commit b562e44f507e863c6792946e4e1b1449fbbac85d Author: Linus Torvalds Date: Sun Mar 13 21:28:54 2016 -0700 Linux 4.5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a26555498849489fb87139a15abe2eeb8a366ae7 Merge: f414ca6 d825c06 Author: Linus Torvalds Date: Sun Mar 13 13:04:46 2016 -0700 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: "Another round of MIPS fixes for 4.5: - Fix JZ4780 build with DEBUG_ZBOOT and MACH_JZ4780 - Fix build with DEBUG_ZBOOT and MACH_JZ4780 - Fix issue with uninitialised temp_foreign_map - Fix awk regex compile failure with certain versions of awk. At this time, the sole user, ld-ifversion, is only used on MIPS" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: smp.c: Fix uninitialised temp_foreign_map MIPS: Fix build error when SMP is used without GIC ld-version: Fix awk regex compile failure MIPS: Fix build with DEBUG_ZBOOT and MACH_JZ4780 commit d825c06bfe8b885b797f917ad47365d0e9c21fbb Author: James Hogan Date: Fri Mar 4 10:10:51 2016 +0000 MIPS: smp.c: Fix uninitialised temp_foreign_map When calculate_cpu_foreign_map() recalculates the cpu_foreign_map cpumask it uses the local variable temp_foreign_map without initialising it to zero. Since the calculation only ever sets bits in this cpumask any existing bits at that memory location will remain set and find their way into cpu_foreign_map too. This could potentially lead to cache operations suboptimally doing smp calls to multiple VPEs in the same core, even though the VPEs share primary caches. Therefore initialise temp_foreign_map using cpumask_clear() before use. Fixes: cccf34e9411c ("MIPS: c-r4k: Fix cache flushing for MT cores") Signed-off-by: James Hogan Cc: Paul Burton Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/12759/ Signed-off-by: Ralf Baechle arch/mips/kernel/smp.c | 1 + 1 file changed, 1 insertion(+) commit 7a50e4688dabb8005df39b2b992d76629b8af8aa Author: Hauke Mehrtens Date: Sun Mar 6 22:28:56 2016 +0100 MIPS: Fix build error when SMP is used without GIC The MIPS_GIC_IPI should only be selected when MIPS_GIC is also selected, otherwise it results in a compile error. smp-gic.c uses some functions from include/linux/irqchip/mips-gic.h like plat_ipi_call_int_xlate() which are only added to the header file when MIPS_GIC is set. The Lantiq SoC does not use the GIC, but supports SMP. The calls top the functions from smp-gic.c are already protected by some #ifdefs The first part of this was introduced in commit 72e20142b2bf ("MIPS: Move GIC IPI functions out of smp-cmp.c") Signed-off-by: Hauke Mehrtens Cc: Paul Burton Cc: stable@vger.kernel.org # v3.15+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/12774/ Signed-off-by: Ralf Baechle arch/mips/Kconfig | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 4b7b1ef2c2f83d702272555e8adb839a50ba0f8e Author: James Hogan Date: Tue Mar 8 16:47:53 2016 +0000 ld-version: Fix awk regex compile failure The ld-version.sh script fails on some versions of awk with the following error, resulting in build failures for MIPS: awk: scripts/ld-version.sh: line 4: regular expression compile failed (missing '(') This is due to the regular expression ".*)", meant to strip off the beginning of the ld version string up to the close bracket, however brackets have a meaning in regular expressions, so lets escape it so that awk doesn't expect a corresponding open bracket. Fixes: ccbef1674a15 ("Kbuild, lto: add ld-version and ld-ifversion ...") Reported-by: Geert Uytterhoeven Signed-off-by: James Hogan Tested-by: Michael S. Tsirkin Acked-by: Michael S. Tsirkin Tested-by: Sudip Mukherjee Cc: Michal Marek Cc: Andi Kleen Cc: Geert Uytterhoeven Cc: linux-mips@linux-mips.org Cc: linux-kbuild@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 4.4.x- Patchwork: https://patchwork.linux-mips.org/patch/12838/ Signed-off-by: Ralf Baechle scripts/ld-version.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ba9e72c2290fcdeeff5f0105590a03e0f341b059 Author: Aaro Koskinen Date: Tue Mar 8 00:06:36 2016 +0200 MIPS: Fix build with DEBUG_ZBOOT and MACH_JZ4780 Ingenic SoC declares ZBOOT support, but debug definitions are missing for MACH_JZ4780 resulting in a build failure when DEBUG_ZBOOT is set. The UART addresses are same as with JZ4740, so fix by covering JZ4780 with those as well. Signed-off-by: Aaro Koskinen Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/12830/ Signed-off-by: Ralf Baechle arch/mips/boot/compressed/uart-16550.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f414ca64be4b36c30deb5b5fa25c5a8ff42ea56b Merge: 2f51c82 90d0f0f Author: Linus Torvalds Date: Sat Mar 12 20:18:54 2016 -0800 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block merge fix from Jens Axboe. This fixes the block segment counting bug and resulting sg overrun reported by Kent Overstreet, introduced with the last block pull. * 'for-linus' of git://git.kernel.dk/linux-block: block: don't optimize for non-cloned bio in bio_get_last_bvec() commit 2f51c8204ab3ea211ac92f3b7b88a38595ed6412 Merge: fda604a 452308d Author: Linus Torvalds Date: Sat Mar 12 20:09:25 2016 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "This fixes 3 FPU handling related bugs, an EFI boot crash and a runtime warning. The EFI fix arrived late but I didn't want to delay it to after v4.5 because the effects are pretty bad for the systems that are affected by it" [ Actually, I don't think the EFI fix really matters yet, because we haven't switched to the separate EFI page tables in mainline yet ] * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Fix boot crash by always mapping boot service regions into new EFI page tables x86/fpu: Fix eager-FPU handling on legacy FPU machines x86/delay: Avoid preemptible context checks in delay_mwaitx() x86/fpu: Revert ("x86/fpu: Disable AVX when eagerfpu is off") x86/fpu: Fix 'no387' regression commit fda604a4daa19ead458ce5471892fa1d4b382d82 Merge: 03c668a 7f54ab5 Author: Linus Torvalds Date: Sat Mar 12 17:14:07 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target bug fix from Nicholas Bellinger: "Here is an outstanding target-core bug-fix for v4.5 code." This patch addresses a recent Task Management (TMR) regression related to larger set of multi-port LUN_RESET bug-fixes in v4.5-rc5. It drops a left-over target_put_sess_cmd() of se_cmd->cmd_kref within ABORT_TASK failure path, once a se_cmd descriptor has already completed posting response to fabric driver logic, and must be skipped during normal ABORT_TASK se_cmd->tag lookup" * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: target: Drop incorrect ABORT_TASK put for completed commands commit 90d0f0f11588ec692c12f9009089b398be395184 Author: Ming Lei Date: Sat Mar 12 22:56:19 2016 +0800 block: don't optimize for non-cloned bio in bio_get_last_bvec() For !BIO_CLONED bio, we can use .bi_vcnt safely, but it doesn't mean we can just simply return .bi_io_vec[.bi_vcnt - 1] because the start postion may have been moved in the middle of the bvec, such as splitting in the middle of bvec. Fixes: 7bcd79ac50d9(block: bio: introduce helpers to get the 1st and last bvec) Cc: stable@vger.kernel.org Reported-by: Kent Overstreet Signed-off-by: Ming Lei Signed-off-by: Jens Axboe include/linux/bio.h | 5 ----- 1 file changed, 5 deletions(-) commit 452308de61056a539352a9306c46716d7af8a1f1 Author: Matt Fleming Date: Fri Mar 11 11:19:23 2016 +0000 x86/efi: Fix boot crash by always mapping boot service regions into new EFI page tables Some machines have EFI regions in page zero (physical address 0x00000000) and historically that region has been added to the e820 map via trim_bios_range(), and ultimately mapped into the kernel page tables. It was not mapped via efi_map_regions() as one would expect. Alexis reports that with the new separate EFI page tables some boot services regions, such as page zero, are not mapped. This triggers an oops during the SetVirtualAddressMap() runtime call. For the EFI boot services quirk on x86 we need to memblock_reserve() boot services regions until after SetVirtualAddressMap(). Doing that while respecting the ownership of regions that may have already been reserved by the kernel was the motivation behind this commit: 7d68dc3f1003 ("x86, efi: Do not reserve boot services regions within reserved areas") That patch was merged at a time when the EFI runtime virtual mappings were inserted into the kernel page tables as described above, and the trick of setting ->numpages (and hence the region size) to zero to track regions that should not be freed in efi_free_boot_services() meant that we never mapped those regions in efi_map_regions(). Instead we were relying solely on the existing kernel mappings. Now that we have separate page tables we need to make sure the EFI boot services regions are mapped correctly, even if someone else has already called memblock_reserve(). Instead of stashing a tag in ->numpages, set the EFI_MEMORY_RUNTIME bit of ->attribute. Since it generally makes no sense to mark a boot services region as required at runtime, it's pretty much guaranteed the firmware will not have already set this bit. For the record, the specific circumstances under which Alexis triggered this bug was that an EFI runtime driver on his machine was responding to the EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event during SetVirtualAddressMap(). The event handler for this driver looks like this, sub rsp,0x28 lea rdx,[rip+0x2445] # 0xaa948720 mov ecx,0x4 call func_aa9447c0 ; call to ConvertPointer(4, & 0xaa948720) mov r11,QWORD PTR [rip+0x2434] # 0xaa948720 xor eax,eax mov BYTE PTR [r11+0x1],0x1 add rsp,0x28 ret Which is pretty typical code for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE handler. The "mov r11, QWORD PTR [rip+0x2424]" was the faulting instruction because ConvertPointer() was being called to convert the address 0x0000000000000000, which when converted is left unchanged and remains 0x0000000000000000. The output of the oops trace gave the impression of a standard NULL pointer dereference bug, but because we're accessing physical addresses during ConvertPointer(), it wasn't. EFI boot services code is stored at that address on Alexis' machine. Reported-by: Alexis Murzeau Signed-off-by: Matt Fleming Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Ben Hutchings Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Maarten Lankhorst Cc: Matthew Garrett Cc: Peter Zijlstra Cc: Raphael Hertzog Cc: Roger Shimizu Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1457695163-29632-2-git-send-email-matt@codeblueprint.co.uk Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815125 Signed-off-by: Ingo Molnar arch/x86/platform/efi/quirks.c | 79 +++++++++++++++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 17 deletions(-) commit 6e6867093de35141f0a76b66ac13f9f2e2c8e77a Author: Borislav Petkov Date: Fri Mar 11 12:32:06 2016 +0100 x86/fpu: Fix eager-FPU handling on legacy FPU machines i486 derived cores like Intel Quark support only the very old, legacy x87 FPU (FSAVE/FRSTOR, CPUID bit FXSR is not set), and our FPU code wasn't handling the saving and restoring there properly in the 'eagerfpu' case. So after we made eagerfpu the default for all CPU types: 58122bf1d856 x86/fpu: Default eagerfpu=on on all CPUs these old FPU designs broke. First, Andy Shevchenko reported a splat: WARNING: CPU: 0 PID: 823 at arch/x86/include/asm/fpu/internal.h:163 fpu__clear+0x8c/0x160 which was us trying to execute FXRSTOR on those machines even though they don't support it. After taking care of that, Bryan O'Donoghue reported that a simple FPU test still failed because we weren't initializing the FPU state properly on those machines. Take care of all that. Reported-and-tested-by: Bryan O'Donoghue Reported-by: Andy Shevchenko Signed-off-by: Borislav Petkov Acked-by: Linus Torvalds Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: Fenghua Yu Cc: H. Peter Anvin Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Quentin Casasnovas Cc: Thomas Gleixner Cc: Yu-cheng Link: http://lkml.kernel.org/r/20160311113206.GD4312@pd.tnic Signed-off-by: Ingo Molnar arch/x86/kernel/fpu/core.c | 4 +++- arch/x86/kernel/fpu/init.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) commit 03c668a93187fe7fba9464f96fbe7c22eebd9897 Merge: 3ab0a0f 9df4f91 Author: Linus Torvalds Date: Fri Mar 11 16:34:18 2016 -0800 Merge tag 'for-linus-20160311' of git://git.infradead.org/linux-mtd Pull MTD fixes from Brian Norris: "Late MTD fix for v4.5: - A simple error code handling fix for the NAND ECC test; this was a regression in v4.5-rc1 - A MAINTAINERS update, which might as well go in ASAP" * tag 'for-linus-20160311' of git://git.infradead.org/linux-mtd: MAINTAINERS: add a maintainer for the NAND subsystem mtd: nand: tests: fix regression introduced in mtd_nandectest commit 3ab0a0f91cca6a9988ef1544176cd7f2106ec722 Merge: 7640131 0bbca27 Author: Linus Torvalds Date: Fri Mar 11 16:19:23 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm/i915 fixes from Dave Airlie: "Just two i915 regression fixes, that should be it from me" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/i915: Actually retry with bit-banging after GMBUS timeout drm/i915: Fix bogus dig_port_map[] assignment for pre-HSW commit 7640131032db9118a78af715ac77ba2debeeb17c Author: Matthew Dawson Date: Fri Mar 11 13:08:07 2016 -0800 mm/mempool: avoid KASAN marking mempool poison checks as use-after-free When removing an element from the mempool, mark it as unpoisoned in KASAN before verifying its contents for SLUB/SLAB debugging. Otherwise KASAN will flag the reads checking the element use-after-free writes as use-after-free reads. Signed-off-by: Matthew Dawson Acked-by: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mempool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2a4fb270daa9c1f1d1b86a53d66ed86cc64ad232 Merge: 95f41fb d7d5a43 Author: Linus Torvalds Date: Fri Mar 11 12:35:54 2016 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Two more fixes for 4.5: - One is a fix for OMAP that is urgently needed to avoid DRA7xx chips from premature aging, by always keeping the Ethernet clock enabled. - The other solves a I/O memory layout issue on Armada, where SROM and PCI memory windows were conflicting in some configurations" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: mvebu: fix overlap of Crypto SRAM with PCIe memory window ARM: dts: dra7: do not gate cpsw clock due to errata i877 ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property commit 95f41fb203b0780b4fb97de64f83cc932abfd33d Merge: 20698c9 b2cd274 Author: Linus Torvalds Date: Fri Mar 11 12:32:02 2016 -0800 Merge tag 'media/v4.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "One last time fix: It adds a code that prevents some media tools like media-ctl to hide some entities that have their IDs out of the range expected by those apps" * tag 'media/v4.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] media-device: map new functions into old types for legacy API commit d7d5a43c0d16760f25d892bf9329848167a8b8a4 Author: Thomas Petazzoni Date: Tue Mar 8 16:59:57 2016 +0100 ARM: mvebu: fix overlap of Crypto SRAM with PCIe memory window When the Crypto SRAM mappings were added to the Device Tree files describing the Armada XP boards in commit c466d997bb16 ("ARM: mvebu: define crypto SRAM ranges for all armada-xp boards"), the fact that those mappings were overlaping with the PCIe memory aperture was overlooked. Due to this, we currently have for all Armada XP platforms a situation that looks like this: Memory mapping on Armada XP boards with internal registers at 0xf1000000: - 0x00000000 -> 0xf0000000 3.75G RAM - 0xf0000000 -> 0xf1000000 16M NOR flashes (AXP GP / AXP DB) - 0xf1000000 -> 0xf1100000 1M internal registers - 0xf8000000 -> 0xffe0000 126M PCIe memory aperture - 0xf8100000 -> 0xf8110000 64KB Crypto SRAM #0 => OVERLAPS WITH PCIE ! - 0xf8110000 -> 0xf8120000 64KB Crypto SRAM #1 => OVERLAPS WITH PCIE ! - 0xffe00000 -> 0xfff00000 1M PCIe I/O aperture - 0xfff0000 -> 0xffffffff 1M BootROM The overlap means that when PCIe devices are added, depending on their memory window needs, they might or might not be mapped into the physical address space. Indeed, they will not be mapped if the area allocated in the PCIe memory aperture by the PCI core overlaps with one of the Crypto SRAM. Typically, a Intel IGB PCIe NIC that needs 8MB of PCIe memory will see its PCIe memory window allocated from 0xf80000000 for 8MB, which overlaps with the Crypto SRAM windows. Due to this, the PCIe window is not created, and any attempt to access the PCIe window makes the kernel explode: [ 3.302213] igb: Copyright (c) 2007-2014 Intel Corporation. [ 3.307841] pci 0000:00:09.0: enabling device (0140 -> 0143) [ 3.313539] mvebu_mbus: cannot add window '4:f8', conflicts with another window [ 3.320870] mvebu-pcie soc:pcie-controller: Could not create MBus window at [mem 0xf8000000-0xf87fffff]: -22 [ 3.330811] Unhandled fault: external abort on non-linefetch (0x1008) at 0xf08c0018 This problem does not occur on Armada 370 boards, because we use the following memory mapping (for boards that have internal registers at 0xf1000000): - 0x00000000 -> 0xf0000000 3.75G RAM - 0xf0000000 -> 0xf1000000 16M NOR flashes (AXP GP / AXP DB) - 0xf1000000 -> 0xf1100000 1M internal registers - 0xf1100000 -> 0xf1110000 64KB Crypto SRAM #0 => OK ! - 0xf8000000 -> 0xffe0000 126M PCIe memory - 0xffe00000 -> 0xfff00000 1M PCIe I/O - 0xfff0000 -> 0xffffffff 1M BootROM Obviously, the solution is to align the location of the Crypto SRAM mappings of Armada XP to be similar with the ones on Armada 370, i.e have them between the "internal registers" area and the beginning of the PCIe aperture. However, we have a special case with the OpenBlocks AX3-4 platform, which has a 128 MB NOR flash. Currently, this NOR flash is mapped from 0xf0000000 to 0xf8000000. This is possible because on OpenBlocks AX3-4, the internal registers are not at 0xf1000000. And this explains why the Crypto SRAM mappings were not configured at the same place on Armada XP. Hence, the solution is two-fold: (1) Move the NOR flash mapping on Armada XP OpenBlocks AX3-4 from 0xe8000000 to 0xf0000000. This frees the 0xf0000000 -> 0xf80000000 space. (2) Move the Crypto SRAM mappings on Armada XP to be similar to Armada 370 (except of course that Armada XP has two Crypto SRAM and not one). After this patch, the memory mapping on Armada XP boards with registers at 0xf1 is: - 0x00000000 -> 0xf0000000 3.75G RAM - 0xf0000000 -> 0xf1000000 16M NOR flashes (AXP GP / AXP DB) - 0xf1000000 -> 0xf1100000 1M internal registers - 0xf1100000 -> 0xf1110000 64KB Crypto SRAM #0 - 0xf1110000 -> 0xf1120000 64KB Crypto SRAM #1 - 0xf8000000 -> 0xffe0000 126M PCIe memory - 0xffe00000 -> 0xfff00000 1M PCIe I/O - 0xfff0000 -> 0xffffffff 1M BootROM And the memory mapping for the special case of the OpenBlocks AX3-4 (internal registers at 0xd0000000, NOR of 128 MB): - 0x00000000 -> 0xc0000000 3G RAM - 0xd0000000 -> 0xd1000000 1M internal registers - 0xe800000 -> 0xf0000000 128M NOR flash - 0xf1100000 -> 0xf1110000 64KB Crypto SRAM #0 - 0xf1110000 -> 0xf1120000 64KB Crypto SRAM #1 - 0xf8000000 -> 0xffe0000 126M PCIe memory - 0xffe00000 -> 0xfff00000 1M PCIe I/O - 0xfff0000 -> 0xffffffff 1M BootROM Fixes: c466d997bb16 ("ARM: mvebu: define crypto SRAM ranges for all armada-xp boards") Reported-by: Phil Sutter Cc: Phil Sutter Cc: Signed-off-by: Thomas Petazzoni Acked-by: Gregory CLEMENT Signed-off-by: Olof Johansson arch/arm/boot/dts/armada-xp-axpwifiap.dts | 4 ++-- arch/arm/boot/dts/armada-xp-db.dts | 4 ++-- arch/arm/boot/dts/armada-xp-gp.dts | 4 ++-- arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts | 4 ++-- arch/arm/boot/dts/armada-xp-linksys-mamba.dts | 4 ++-- arch/arm/boot/dts/armada-xp-matrix.dts | 4 ++-- arch/arm/boot/dts/armada-xp-netgear-rn2120.dts | 4 ++-- arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts | 6 +++--- arch/arm/boot/dts/armada-xp-synology-ds414.dts | 4 ++-- 9 files changed, 19 insertions(+), 19 deletions(-) commit 20698c922f81047c4d45c7793b7ddce8ff58d10e Merge: 7ae9c76 25c5e96 Author: Linus Torvalds Date: Fri Mar 11 10:57:18 2016 -0800 Merge tag 'dmaengine-fix-4.5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Two fixes showed up in last few days, and they should be included in 4.5. Summary: Two more late fixes to drivers, nothing major here: - A memory leak fix in fsdma unmap the dma descriptors on freeup - A fix in xdmac driver for residue calculation of dma descriptor" * tag 'dmaengine-fix-4.5' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: at_xdmac: fix residue computation dmaengine: fsldma: fix memory leak commit 7ae9c768e19ec8ce1b397a5c4abf88f9ee053e09 Merge: 2a62ec0 5b3e7e05 Author: Linus Torvalds Date: Fri Mar 11 10:45:03 2016 -0800 Merge tag 'pm+acpi-4.5-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI fixes from Rafael Wysocki: "Two more fixes for issues introduced recently, one in the generic device properties framework and one in ACPICA. Specifics: - Revert a recent ACPICA commit that has been reverted upstream, because it caused problems to happen on user systems and the problem it attempted to address will not be relevant any more after upcoming ACPI specification changes (Bob Moore). - Fix crash in the generic device properties framework introduced by a recent change that forgot to check pointers against error values in addition to checking them against NULL (Heikki Krogerus)" * tag 'pm+acpi-4.5-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: fwnode->secondary may contain ERR_PTR(-ENODEV) ACPICA: Revert "Parser: Fix for SuperName method invocation" commit 2a62ec0af2ed3758dd4535eb58527f63ba6549ad Merge: 63cf207 7f6aff3 Author: Linus Torvalds Date: Fri Mar 11 10:21:32 2016 -0800 Merge tag 'xfs-for-linus-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs Pull xfs fixes from Dave Chinner: "This is a fix for a regression introduced in 4.5-rc1 by the new torn log write detection code. The regression only affects people moving a clean filesystem between machines/kernels of different architecture (such as changing between 32 bit and 64 bit kernels), but this is the recommended (and only!) safe way to migrate a filesystem between architectures so we really need to ensure it works. The changes are larger than I'd prefer right at the end of the release cycle, but the majority of the change is just factoring code to enable the detection of a clean log at the correct time to avoid this issue. Changes: - Only perform torn log write detection on dirty logs. This prevents failures being detected due to a clean filesystem being moved between machines or kernels of different architectures (e.g. 32 -> 64 bit, BE -> LE, etc). This fixes a regression introduced by the torn log write detection in 4.5-rc1" * tag 'xfs-for-linus-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: xfs: only run torn log write detection on dirty logs xfs: refactor in-core log state update to helper xfs: refactor unmount record detection into helper xfs: separate log head record discovery from verification commit 63cf207e931894b93fe5471131e41fda567611e2 Merge: f2c1242 f938128 Author: Linus Torvalds Date: Fri Mar 11 10:13:49 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A couple of fixes: Fix for my dumb braino in ncpfs and a long-standing breakage on recovery from failed rename() in jffs2" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: jffs2: reduce the breakage on recovery from halfway failed rename() ncpfs: fix a braino in OOM handling in ncp_fill_cache() commit 5b3e7e0536bd6326798ab57d14a49b15ad7e3e3f Merge: f6cede5 7781203 0dda885 Author: Rafael J. Wysocki Date: Fri Mar 11 14:22:54 2016 +0100 Merge branches 'device-properties-fixes' and 'acpica-fixes' * device-properties-fixes: device property: fwnode->secondary may contain ERR_PTR(-ENODEV) * acpica-fixes: ACPICA: Revert "Parser: Fix for SuperName method invocation" commit 0bbca274a31c2366414d8d3f95e03d1c4674d93f Author: Ville Syrjälä Date: Mon Mar 7 17:56:57 2016 +0200 drm/i915: Actually retry with bit-banging after GMBUS timeout After the GMBUS transfer times out, we set force_bit=1 and return -EAGAIN expecting the i2c core to call the .master_xfer hook again so that we will retry the same transfer via bit-banging. This is in case the gmbus hardware is somehow faulty. Unfortunately we left adapter->retries to 0, meaning the i2c core didn't actually do the retry. Let's tell the core we want one retry when we return -EAGAIN. Note that i2c-algo-bit also uses this retry count for some internal retries, so we'll end up increasing those a bit as well. Cc: Jani Nikula Cc: drm-intel-fixes@lists.freedesktop.org Fixes: bffce907d640 ("drm/i915: abstract i2c bit banging fallback in gmbus xfer") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1457366220-29409-2-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 8b1f165a4a8f64c28cf42d10e1f4d3b451dedc51) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_i2c.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 9df4f913eb39046fa57c4217bb3429a63e164000 Author: Boris BREZILLON Date: Wed Mar 9 21:57:24 2016 +0100 MAINTAINERS: add a maintainer for the NAND subsystem Add myself as the maintainer of the NAND subsystem. Signed-off-by: Boris Brezillon Acked-by: Richard Weinberger Acked-by: Brian Norris Acked-by: Artem Bityutskiy Signed-off-by: Brian Norris MAINTAINERS | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f2c1242194c7af9b26f53359ab2b23df36d3a643 Merge: c32c2cb 5f0b819 Author: Linus Torvalds Date: Thu Mar 10 10:42:15 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "A few simple fixes for ARM, x86, PPC and generic code. The x86 MMU fix is a bit larger because the surrounding code needed a cleanup, but nothing worrisome" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo kvm: cap halt polling at exactly halt_poll_ns KVM: s390: correct fprs on SIGP (STOP AND) STORE STATUS KVM: VMX: disable PEBS before a guest entry KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit commit c32c2cb27268f0adad0b6afbebe860ac5250c388 Merge: 2da33f9 ff79258 Author: Linus Torvalds Date: Thu Mar 10 10:39:04 2016 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "I thought we were done for 4.5, but then the 64k-page chaps came crawling out of the woodwork. *sigh* The vmemmap fix I sent for -rc7 caused a regression with 64k pages and sparsemem and at some point during the release cycle the new hugetlb code using contiguous ptes started failing the libhugetlbfs tests with 64k pages enabled. So here are a couple of patches that fix the vmemmap alignment and disable the new hugetlb page sizes whilst a proper fix is being developed: - Temporarily disable huge pages built using contiguous ptes - Ensure vmemmap region is sufficiently aligned for sparsemem sections" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: hugetlb: partial revert of 66b3923a1a0f arm64: account for sparsemem section alignment when choosing vmemmap offset commit 2da33f9f96dabd62d6c7780cbce15818c2a6ce24 Merge: 8e0f93c 3446c13 Author: Linus Torvalds Date: Thu Mar 10 10:36:07 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Three bug fixes: - The fix for the page table corruption (CVE-2016-2143) - The diagnose statistics introduced a regression for the dasd diag driver - Boot crash on systems without the set-program-parameters facility" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: four page table levels vs. fork s390/cpumf: Fix lpp detection s390/dasd: fix diag 0x250 inline assembly commit b2cd27448b33de9069d580d8f229efef434b64e6 Author: Mauro Carvalho Chehab Date: Sat Mar 5 07:13:39 2016 -0300 [media] media-device: map new functions into old types for legacy API The legacy media controller userspace API exposes entity types that carry both type and function information. The new API replaces the type with a function. It preserves backward compatibility by defining legacy functions for the existing types and using them in drivers. This works fine, as long as newer entity functions won't be added. Unfortunately, some tools, like media-ctl with --print-dot argument rely on the now legacy MEDIA_ENT_T_V4L2_SUBDEV and MEDIA_ENT_T_DEVNODE numeric ranges to identify what entities will be shown. Also, if the entity doesn't match those ranges, it will ignore the major/minor information on devnodes, and won't be getting the devnode name via udev or sysfs. As we're now adding devices outside the old range, the legacy ioctl needs to map the new entity functions into a type at the old range, or otherwise we'll have a regression. Detected on all released media-ctl versions (e. g. versions <= 1.10). Fix this by deriving the type from the function to emulate the legacy API if the function isn't in the legacy functions range. Reported-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab drivers/media/media-device.c | 23 +++++++++++++++++++++++ include/uapi/linux/media.h | 6 +++++- 2 files changed, 28 insertions(+), 1 deletion(-) commit 25c5e9626ca4d40928dc9c44f009ce2ed0a739e7 Author: Ludovic Desroches Date: Thu Mar 10 10:17:55 2016 +0100 dmaengine: at_xdmac: fix residue computation When computing the residue we need two pieces of information: the current descriptor and the remaining data of the current descriptor. To get that information, we need to read consecutively two registers but we can't do it in an atomic way. For that reason, we have to check manually that current descriptor has not changed. Signed-off-by: Ludovic Desroches Suggested-by: Cyrille Pitchen Reported-by: David Engraf Tested-by: David Engraf Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Cc: stable@vger.kernel.org #4.1 and later Signed-off-by: Vinod Koul drivers/dma/at_xdmac.c | 42 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 39 insertions(+), 3 deletions(-) commit 84477336ec03f8061ffd6908da341e063e5d6d1f Author: Borislav Petkov Date: Wed Mar 9 21:56:22 2016 +0100 x86/delay: Avoid preemptible context checks in delay_mwaitx() We do use this_cpu_ptr(&cpu_tss) as a cacheline-aligned, seldomly accessed per-cpu var as the MONITORX target in delay_mwaitx(). However, when called in preemptible context, this_cpu_ptr -> smp_processor_id() -> debug_smp_processor_id() fires: BUG: using smp_processor_id() in preemptible [00000000] code: udevd/312 caller is delay_mwaitx+0x40/0xa0 But we don't care about that check - we only need cpu_tss as a MONITORX target and it doesn't really matter which CPU's var we're touching as we're going idle anyway. Fix that. Suggested-by: Andy Lutomirski Signed-off-by: Borislav Petkov Cc: Andy Lutomirski Cc: Huang Rui Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: spg_linux_kernel@amd.com Link: http://lkml.kernel.org/r/20160309205622.GG6564@pd.tnic Signed-off-by: Ingo Molnar arch/x86/lib/delay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f0b819995e172f48fdcd91335a2126ba7d9deae Author: Paolo Bonzini Date: Wed Mar 9 14:28:02 2016 +0100 KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 KVM has special logic to handle pages with pte.u=1 and pte.w=0 when CR0.WP=1. These pages' SPTEs flip continuously between two states: U=1/W=0 (user and supervisor reads allowed, supervisor writes not allowed) and U=0/W=1 (supervisor reads and writes allowed, user writes not allowed). When SMEP is in effect, however, U=0 will enable kernel execution of this page. To avoid this, KVM also sets NX=1 in the shadow PTE together with U=0, making the two states U=1/W=0/NX=gpte.NX and U=0/W=1/NX=1. When guest EFER has the NX bit cleared, the reserved bit check thinks that the latter state is invalid; teach it that the smep_andnot_wp case will also use the NX bit of SPTEs. Cc: stable@vger.kernel.org Reviewed-by: Xiao Guangrong Fixes: c258b62b264fdc469b6d3610a907708068145e3b Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 844a5fe219cf472060315971e15cbf97674a3324 Author: Paolo Bonzini Date: Tue Mar 8 12:13:39 2016 +0100 KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Yes, all of these are needed. :) This is admittedly a bit odd, but kvm-unit-tests access.flat tests this if you run it with "-cpu host" and of course ept=0. KVM runs the guest with CR0.WP=1, so it must handle supervisor writes specially when pte.u=1/pte.w=0/CR0.WP=0. Such writes cause a fault when U=1 and W=0 in the SPTE, but they must succeed because CR0.WP=0. When KVM gets the fault, it sets U=0 and W=1 in the shadow PTE and restarts execution. This will still cause a user write to fault, while supervisor writes will succeed. User reads will fault spuriously now, and KVM will then flip U and W again in the SPTE (U=1, W=0). User reads will be enabled and supervisor writes disabled, going back to the originary situation where supervisor writes fault spuriously. When SMEP is in effect, however, U=0 will enable kernel execution of this page. To avoid this, KVM also sets NX=1 in the shadow PTE together with U=0. If the guest has not enabled NX, the result is a continuous stream of page faults due to the NX bit being reserved. The fix is to force EFER.NX=1 even if the CPU is taking care of the EFER switch. (All machines with SMEP have the CPU_LOAD_IA32_EFER vm-entry control, so they do not use user-return notifiers for EFER---if they did, EFER.NX would be forced to the same value as the host). There is another bug in the reserved bit check, which I've split to a separate patch for easier application to stable kernels. Cc: stable@vger.kernel.org Cc: Andy Lutomirski Reviewed-by: Xiao Guangrong Fixes: f6577a5fa15d82217ca73c74cd2dcbc0f6c781dd Signed-off-by: Paolo Bonzini Documentation/virtual/kvm/mmu.txt | 3 ++- arch/x86/kvm/vmx.c | 36 +++++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-) commit a65050c6f17e52442716138d48d0a47301a8344b Author: Yu-cheng Yu Date: Wed Mar 9 16:28:54 2016 -0800 x86/fpu: Revert ("x86/fpu: Disable AVX when eagerfpu is off") Leonid Shatz noticed that the SDM interpretation of the following recent commit: 394db20ca240741 ("x86/fpu: Disable AVX when eagerfpu is off") ... is incorrect and that the original behavior of the FPU code was correct. Because AVX is not stated in CR0 TS bit description, it was mistakenly believed to be not supported for lazy context switch. This turns out to be false: Intel Software Developer's Manual Vol. 3A, Sec. 2.5 Control Registers: 'TS Task Switched bit (bit 3 of CR0) -- Allows the saving of the x87 FPU/ MMX/SSE/SSE2/SSE3/SSSE3/SSE4 context on a task switch to be delayed until an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction is actually executed by the new task.' Intel Software Developer's Manual Vol. 2A, Sec. 2.4 Instruction Exception Specification: 'AVX instructions refer to exceptions by classes that include #NM "Device Not Available" exception for lazy context switch.' So revert the commit. Reported-by: Leonid Shatz Signed-off-by: Yu-cheng Yu Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Fenghua Yu Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Ravi V. Shankar Cc: Sai Praneeth Prakhya Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1457569734-3785-1-git-send-email-yu-cheng.yu@intel.com Signed-off-by: Ingo Molnar arch/x86/include/asm/fpu/xstate.h | 9 ++++----- arch/x86/kernel/fpu/init.c | 6 ------ 2 files changed, 4 insertions(+), 11 deletions(-) commit 3446c13b268af86391d06611327006b059b8bab1 Author: Martin Schwidefsky Date: Mon Feb 15 14:46:49 2016 +0100 s390/mm: four page table levels vs. fork The fork of a process with four page table levels is broken since git commit 6252d702c5311ce9 "[S390] dynamic page tables." All new mm contexts are created with three page table levels and an asce limit of 4TB. If the parent has four levels dup_mmap will add vmas to the new context which are outside of the asce limit. The subsequent call to copy_page_range will walk the three level page table structure of the new process with non-zero pgd and pud indexes. This leads to memory clobbers as the pgd_index *and* the pud_index is added to the mm->pgd pointer without a pgd_deref in between. The init_new_context() function is selecting the number of page table levels for a new context. The function is used by mm_init() which in turn is called by dup_mm() and mm_alloc(). These two are used by fork() and exec(). The init_new_context() function can distinguish the two cases by looking at mm->context.asce_limit, for fork() the mm struct has been copied and the number of page table levels may not change. For exec() the mm_alloc() function set the new mm structure to zero, in this case a three-level page table is created as the temporary stack space is located at STACK_TOP_MAX = 4TB. This fixes CVE-2016-2143. Reported-by: Marcin Kościelnicki Reviewed-by: Heiko Carstens Cc: stable@vger.kernel.org Signed-off-by: Martin Schwidefsky arch/s390/include/asm/mmu_context.h | 16 +++++++++++----- arch/s390/include/asm/pgalloc.h | 24 +++++++++++++++++++----- 2 files changed, 30 insertions(+), 10 deletions(-) commit 8e0f93cda48ed054e1216bab5c60017e1a5fc1e8 Merge: 718e47a 3ee20ab Author: Linus Torvalds Date: Wed Mar 9 20:24:23 2016 -0800 Merge tag 'spi-fix-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few driver specific fixes for the Rockchip and i.MX SPI controllers, especially for the i.MX they're annoying bugs if you run into them" * tag 'spi-fix-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: imx: fix spi resource leak with dma transfer spi: imx: allow only WML aligned transfers to use DMA spi: rockchip: add missing spi_master_put spi: rockchip: disable runtime pm when in err case commit 3ee20abb063acc57a45ccb2fdab2eb3ce29e85fa Merge: c23663a 844c9f4 Author: Mark Brown Date: Thu Mar 10 10:42:24 2016 +0700 Merge remote-tracking branch 'spi/fix/rockchip' into spi-linus commit c23663ace8adda3bca15e7ad6a99663f6119612d Merge: f6cede5 ba4a355 Author: Mark Brown Date: Thu Mar 10 10:42:22 2016 +0700 Merge remote-tracking branch 'spi/fix/imx' into spi-linus commit 718e47a573a43dba9a1673e0fc29fb36d3ef9769 Merge: a6e434e 6ffe77b Author: Linus Torvalds Date: Wed Mar 9 19:33:05 2016 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fix from Ted Ts'o: "This fixes a regression which crept in v4.5-rc5" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: iterate over buffer heads correctly in move_extent_per_page() commit a6e434e9550807164c5ab7bffde59e9e7a4e717b Merge: 8205ff1 848819c54 Author: Linus Torvalds Date: Wed Mar 9 19:12:37 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A few imx fixes I missed from a couple of weeks ago, they still aren't that big and fix some regression and a fail to boot problem. Other than that, a couple of regression fixes for radeon/amdgpu, one regression fix for vmwgfx and one regression fix for tda998x" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: Revert "drm/radeon/pm: adjust display configuration after powerstate" drm/amdgpu/dp: add back special handling for NUTMEG drm/radeon/dp: add back special handling for NUTMEG drm/i2c: tda998x: Choose between atomic or non atomic dpms helper drm/vmwgfx: Add back ->detect() and ->fill_modes() drm/radeon: Fix error handling in radeon_flip_work_func. drm/amdgpu: Fix error handling in amdgpu_flip_work_func. drm/imx: Add missing DRM_FORMAT_RGB565 to ipu_plane_formats drm/imx: notify DRM core about CRTC vblank state gpu: ipu-v3: Reset IPU before activating IRQ gpu: ipu-v3: Do not bail out on missing optional port nodes commit 8205ff1dc84e0298cd4bc15aa7aeccc35634582c Merge: 380173f dc17147 Author: Linus Torvalds Date: Wed Mar 9 19:01:58 2016 -0800 Merge tag 'trace-fixes-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "I previously sent a fix that prevents all trace events from being called if the current cpu is offline. But I forgot that in 3.18, we added lockdep checks to test RCU usage even when the event is disabled. Although there cannot be any bug when a cpu is going offline, we now get false warnings triggered by the added checks of the event being disabled. I removed the check from the tracepoint code itself, and added it to the condition section (which is "1" for 'no condition'). This way the online cpu check will get checked in all the right locations" * tag 'trace-fixes-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix check for cpu online when event is disabled commit 6ffe77bad545f4a7c8edd2a4ee797ccfcd894ab4 Author: Eryu Guan Date: Sun Feb 21 18:38:44 2016 -0500 ext4: iterate over buffer heads correctly in move_extent_per_page() In commit bcff24887d00 ("ext4: don't read blocks from disk after extents being swapped") bh is not updated correctly in the for loop and wrong data has been written to disk. generic/324 catches this on sub-page block size ext4. Fixes: bcff24887d00 ("ext4: don't read blocks from disk after extentsbeing swapped") Signed-off-by: Eryu Guan Signed-off-by: Theodore Ts'o fs/ext4/move_extent.c | 1 + 1 file changed, 1 insertion(+) commit 380173ff56c7faea02d1278e8d9783093fc776f6 Merge: 2f0d94e d6b7eae Author: Linus Torvalds Date: Wed Mar 9 18:27:52 2016 -0800 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "13 fixes" * emailed patches from Andrew Morton : dma-mapping: avoid oops when parameter cpu_addr is null mm/hugetlb: use EOPNOTSUPP in hugetlb sysctl handlers memremap: check pfn validity before passing to pfn_to_page() mm, thp: fix migration of PTE-mapped transparent huge pages dax: check return value of dax_radix_entry() ocfs2: fix return value from ocfs2_page_mkwrite() arm64: kasan: clear stale stack poison sched/kasan: remove stale KASAN poison after hotplug kasan: add functions to clear stack poison mm: fix mixed zone detection in devm_memremap_pages list: kill list_force_poison() mm: __delete_from_page_cache show Bad page if mapped mm/hugetlb: hugetlb_no_page: rate-limit warning message commit d6b7eaeb03421139e32800324ef04ab50bba886d Author: Zhen Lei Date: Wed Mar 9 14:08:38 2016 -0800 dma-mapping: avoid oops when parameter cpu_addr is null To keep consistent with kfree, which tolerate ptr is NULL. We do this because sometimes we may use goto statement, so that success and failure case can share parts of the code. But unfortunately, dma_free_coherent called with parameter cpu_addr is null will cause oops, such as showed below: Unable to handle kernel paging request at virtual address ffffffc020d3b2b8 pgd = ffffffc083a61000 [ffffffc020d3b2b8] *pgd=0000000000000000, *pud=0000000000000000 CPU: 4 PID: 1489 Comm: malloc_dma_1 Tainted: G O 4.1.12 #1 Hardware name: ARM64 (DT) PC is at __dma_free_coherent.isra.10+0x74/0xc8 LR is at __dma_free+0x9c/0xb0 Process malloc_dma_1 (pid: 1489, stack limit = 0xffffffc0837fc020) [...] Call trace: __dma_free_coherent.isra.10+0x74/0xc8 __dma_free+0x9c/0xb0 malloc_dma+0x104/0x158 [dma_alloc_coherent_mtmalloc] kthread+0xec/0xfc Signed-off-by: Zhen Lei Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/dma-mapping.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86613628b3d367743f71b945c203774c522404f4 Author: Jan Stancek Date: Wed Mar 9 14:08:35 2016 -0800 mm/hugetlb: use EOPNOTSUPP in hugetlb sysctl handlers Replace ENOTSUPP with EOPNOTSUPP. If hugepages are not supported, this value is propagated to userspace. EOPNOTSUPP is part of uapi and is widely supported by libc libraries. It gives nicer message to user, rather than: # cat /proc/sys/vm/nr_hugepages cat: /proc/sys/vm/nr_hugepages: Unknown error 524 And also LTP's proc01 test was failing because this ret code (524) was unexpected: proc01 1 TFAIL : proc01.c:396: read failed: /proc/sys/vm/nr_hugepages: errno=???(524): Unknown error 524 proc01 2 TFAIL : proc01.c:396: read failed: /proc/sys/vm/nr_hugepages_mempolicy: errno=???(524): Unknown error 524 proc01 3 TFAIL : proc01.c:396: read failed: /proc/sys/vm/nr_overcommit_hugepages: errno=???(524): Unknown error 524 Signed-off-by: Jan Stancek Acked-by: Naoya Horiguchi Acked-by: Kirill A. Shutemov Acked-by: David Rientjes Acked-by: Hillf Danton Cc: Mike Kravetz Cc: Dave Hansen Cc: Paul Gortmaker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ac343e882a8377caef5fa75d9093cb77e9d4bf6d Author: Ard Biesheuvel Date: Wed Mar 9 14:08:32 2016 -0800 memremap: check pfn validity before passing to pfn_to_page() In memremap's helper function try_ram_remap(), we dereference a struct page pointer that was derived from a PFN that is known to be covered by a 'System RAM' iomem region, and is thus assumed to be a 'valid' PFN, i.e., a PFN that has a struct page associated with it and is covered by the kernel direct mapping. However, the assumption that there is a 1:1 relation between the System RAM iomem region and the kernel direct mapping is not universally valid on all architectures, and on ARM and arm64, 'System RAM' may include regions for which pfn_valid() returns false. Generally speaking, both __va() and pfn_to_page() should only ever be called on PFNs/physical addresses for which pfn_valid() returns true, so add that check to try_ram_remap(). Signed-off-by: Ard Biesheuvel Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0a2e280b6d8ea4afef07c749070705d6af403b7f Author: Kirill A. Shutemov Date: Wed Mar 9 14:08:30 2016 -0800 mm, thp: fix migration of PTE-mapped transparent huge pages We don't have native support of THP migration, so we have to split huge page into small pages in order to migrate it to different node. This includes PTE-mapped huge pages. I made mistake in refcounting patchset: we don't actually split PTE-mapped huge page in queue_pages_pte_range(), if we step on head page. The result is that the head page is queued for migration, but none of tail pages: putting head page on queue takes pin on the page and any subsequent attempts of split_huge_pages() would fail and we skip queuing tail pages. unmap_and_move_huge_page() will eventually split the huge pages, but only one of 512 pages would get migrated. Let's fix the situation. Fixes: 248db92da13f2507 ("migrate_pages: try to split pages on queuing") Signed-off-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 30f471fd88e0304bee2c17ef1a4651e705870817 Author: Ross Zwisler Date: Wed Mar 9 14:08:27 2016 -0800 dax: check return value of dax_radix_entry() dax_pfn_mkwrite() previously wasn't checking the return value of the call to dax_radix_entry(), which was a mistake. Instead, capture this return value and return the appropriate VM_FAULT_ value. Signed-off-by: Ross Zwisler Cc: Dan Williams Cc: Matthew Wilcox Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 566e8dfd88d9e0d12873ca69c26e82c0af8479d8 Author: Jan Kara Date: Wed Mar 9 14:08:24 2016 -0800 ocfs2: fix return value from ocfs2_page_mkwrite() ocfs2_page_mkwrite() could mistakenly return error code instead of mkwrite status value. Fix it. Signed-off-by: Jan Kara Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/mmap.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0d97e6d8024c71cc838b292c01d5bd951e080eba Author: Mark Rutland Date: Wed Mar 9 14:08:21 2016 -0800 arm64: kasan: clear stale stack poison Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning. In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in __cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel. Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online. Signed-off-by: Mark Rutland Acked-by: Catalin Marinas Reviewed-by: Andrey Ryabinin Reviewed-by: Lorenzo Pieralisi Cc: Alexander Potapenko Cc: Catalin Marinas Cc: Will Deacon Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/kernel/sleep.S | 4 ++++ 1 file changed, 4 insertions(+) commit e1b77c92981a522223bd1ac118fdcade6b7ad086 Author: Mark Rutland Date: Wed Mar 9 14:08:18 2016 -0800 sched/kasan: remove stale KASAN poison after hotplug Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poision prior to returning. In the case of CPU hotplug, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. When a CPU is subsequently brought back into the kernel via a different path, depending on stackframe, layout calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online. Signed-off-by: Mark Rutland Acked-by: Catalin Marinas Reviewed-by: Andrey Ryabinin Reviewed-by: Ingo Molnar Cc: Alexander Potapenko Cc: Lorenzo Pieralisi Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sched/core.c | 3 +++ 1 file changed, 3 insertions(+) commit e3ae116339f9a0c77523abc95e338fa405946e07 Author: Mark Rutland Date: Wed Mar 9 14:08:15 2016 -0800 kasan: add functions to clear stack poison Functions which the compiler has instrumented for ASAN place poison on the stack shadow upon entry and remove this poison prior to returning. In some cases (e.g. hotplug and idle), CPUs may exit the kernel a number of levels deep in C code. If there are any instrumented functions on this critical path, these will leave portions of the idle thread stack shadow poisoned. If a CPU returns to the kernel via a different path (e.g. a cold entry), then depending on stack frame layout subsequent calls to instrumented functions may use regions of the stack with stale poison, resulting in (spurious) KASAN splats to the console. Contemporary GCCs always add stack shadow poisoning when ASAN is enabled, even when asked to not instrument a function [1], so we can't simply annotate functions on the critical path to avoid poisoning. Instead, this series explicitly removes any stale poison before it can be hit. In the common hotplug case we clear the entire stack shadow in common code, before a CPU is brought online. On architectures which perform a cold return as part of cpu idle may retain an architecture-specific amount of stack contents. To retain the poison for this retained context, the arch code must call the core KASAN code, passing a "watermark" stack pointer value beyond which shadow will be cleared. Architectures which don't perform a cold return as part of idle do not need any additional code. This patch (of 3): Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poision prior to returning. In some cases (e.g. hotplug and idle), CPUs may exit the kernel a number of levels deep in C code. If there are any instrumented functions on this critical path, these will leave portions of the stack shadow poisoned. If a CPU returns to the kernel via a different path (e.g. a cold entry), then depending on stack frame layout subsequent calls to instrumented functions may use regions of the stack with stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, we must clear stale poison from the stack prior to instrumented functions being called. This patch adds functions to the KASAN core for removing poison from (portions of) a task's stack. These will be used by subsequent patches to avoid problems with hotplug and idle. Signed-off-by: Mark Rutland Acked-by: Catalin Marinas Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Lorenzo Pieralisi Cc: Will Deacon Cc: Ingo Molnar Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/kasan.h | 6 +++++- mm/kasan/kasan.c | 20 ++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) commit 5f29a77cd95771edebbf41e5800fdd557c69302a Author: Dan Williams Date: Wed Mar 9 14:08:13 2016 -0800 mm: fix mixed zone detection in devm_memremap_pages The check for whether we overlap "System RAM" needs to be done at section granularity. For example a system with the following mapping: 100000000-37bffffff : System RAM 37c000000-837ffffff : Persistent Memory ...is unable to use devm_memremap_pages() as it would result in two zones colliding within a given section. Signed-off-by: Dan Williams Cc: Ross Zwisler Reviewed-by: Toshi Kani Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit d77a117e6871ff78a06def46583d23752593de60 Author: Dan Williams Date: Wed Mar 9 14:08:10 2016 -0800 list: kill list_force_poison() Given we have uninitialized list_heads being passed to list_add() it will always be the case that those uninitialized values randomly trigger the poison value. Especially since a list_add() operation will seed the stack with the poison value for later stack allocations to trip over. For example, see these two false positive reports: list_add attempted on force-poisoned entry WARNING: at lib/list_debug.c:34 [..] NIP [c00000000043c390] __list_add+0xb0/0x150 LR [c00000000043c38c] __list_add+0xac/0x150 Call Trace: __list_add+0xac/0x150 (unreliable) __down+0x4c/0xf8 down+0x68/0x70 xfs_buf_lock+0x4c/0x150 [xfs] list_add attempted on force-poisoned entry(0000000000000500), new->next == d0000000059ecdb0, new->prev == 0000000000000500 WARNING: at lib/list_debug.c:33 [..] NIP [c00000000042db78] __list_add+0xa8/0x140 LR [c00000000042db74] __list_add+0xa4/0x140 Call Trace: __list_add+0xa4/0x140 (unreliable) rwsem_down_read_failed+0x6c/0x1a0 down_read+0x58/0x60 xfs_log_commit_cil+0x7c/0x600 [xfs] Fixes: commit 5c2c2587b132 ("mm, dax, pmem: introduce {get|put}_dev_pagemap() for dax-gup") Signed-off-by: Dan Williams Reported-by: Eryu Guan Tested-by: Eryu Guan Cc: Ross Zwisler Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/list.h | 11 ----------- kernel/memremap.c | 9 +++++++-- lib/list_debug.c | 9 --------- 3 files changed, 7 insertions(+), 22 deletions(-) commit 06b241f32c711d7ca868a0351dd97fe91fd8817b Author: Hugh Dickins Date: Wed Mar 9 14:08:07 2016 -0800 mm: __delete_from_page_cache show Bad page if mapped Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages") changed the famous BUG_ON(page_mapped(page)) in __delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not. Although it has not usually been very helpul, being hit long after the error in question, we do need to know if it actually happens on users' systems; but reinstating a crash there is likely to be opposed :) In the non-debug case, pr_alert("BUG: Bad page cache") plus dump_page(), dump_stack(), add_taint() - I don't really believe LOCKDEP_NOW_UNRELIABLE, but that seems to be the standard procedure now. Move that, or the VM_BUG_ON_PAGE(), up before the deletion from tree: so that the unNULLified page->mapping gives a little more information. If the inode is being evicted (rather than truncated), it won't have any vmas left, so it's safe(ish) to assume that the raised mapcount is erroneous, and we can discount it from page_count to avoid leaking the page (I'm less worried by leaking the occasional 4kB, than losing a potential 2MB page with each 4kB page leaked). Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Joonsoo Kim Cc: Sasha Levin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) commit 910154d520c97cd0095a889e6b878041c91111a6 Author: Geoffrey Thomas Date: Wed Mar 9 14:08:04 2016 -0800 mm/hugetlb: hugetlb_no_page: rate-limit warning message The warning message "killed due to inadequate hugepage pool" simply indicates that SIGBUS was sent, not that the process was forcibly killed. If the process has a signal handler installed does not fix the problem, this message can rapidly spam the kernel log. On my amd64 dev machine that does not have hugepages configured, I can reproduce the repeated warnings easily by setting vm.nr_hugepages=2 (i.e., 4 megabytes of huge pages) and running something that sets a signal handler and forks, like #include #include #include #include sig_atomic_t counter = 10; void handler(int signal) { if (counter-- == 0) exit(0); } int main(void) { int status; char *addr = mmap(NULL, 4 * 1048576, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0); if (addr == MAP_FAILED) {perror("mmap"); return 1;} *addr = 'x'; switch (fork()) { case -1: perror("fork"); return 1; case 0: signal(SIGBUS, handler); *addr = 'x'; break; default: *addr = 'x'; wait(&status); if (WIFSIGNALED(status)) { psignal(WTERMSIG(status), "child"); } break; } } Signed-off-by: Geoffrey Thomas Cc: Naoya Horiguchi Cc: Hillf Danton Cc: "Kirill A. Shutemov" Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1dea581f86f51563d5bf468abc36c74bc88f8aac Merge: f3c87e9 0f514e6 Author: Olof Johansson Date: Wed Mar 9 14:15:31 2016 -0800 Merge tag 'for-v4.5-rc/omap-critical-fixes-a' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending into fixes ARM: OMAP2+: critical DRA7xx fix for v4.5-rc Force the DRA7xx Ethernet internal clock source to stay enabled per TI erratum i877: http://www.ti.com/lit/er/sprz429h/sprz429h.pdf Otherwise, if the Ethernet internal clock source is disabled, the chip will age prematurely, and the RGMII I/O timing will soon fail to meet the delay time and skew specifications for 1000Mbps Ethernet. This fix should go in as soon as possible. Basic build, boot, and PM test results are available here: http://www.pwsan.com/omap/testlogs/omap-critical-fixes-for-v4.5-rc/20160307014209/ * tag 'for-v4.5-rc/omap-critical-fixes-a' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending: ARM: dts: dra7: do not gate cpsw clock due to errata i877 ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Signed-off-by: Olof Johansson commit 2f0d94ea413a0d56629435e4b9f43b52035a3e79 Merge: 7f02bf6 54c6e2d Author: Linus Torvalds Date: Wed Mar 9 13:28:27 2016 -0800 Merge tag 'pci-v4.5-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Here's another fix for v4.5. It fixes an ARM regression in v4.0 that causes many boxes to crash on boot, including cns3xxx, dove, footbridge, iopl13xx, ip32x, iop33x, ixp4xx, ks8695, mv78xx0, orion5x, pxa, sa1100, etc. The change is in code that's only built for ARM and ARM64. Summary: Enumeration: Allow generic PCI domains without bridge "parent" pointer (Krzysztof Hałasa)" * tag 'pci-v4.5-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() commit dc17147de328a74bbdee67c1bf37d2f1992de756 Author: Steven Rostedt (Red Hat) Date: Wed Mar 9 11:58:41 2016 -0500 tracing: Fix check for cpu online when event is disabled Commit f37755490fe9b ("tracepoints: Do not trace when cpu is offline") added a check to make sure that tracepoints only get called when the cpu is online, as it uses rcu_read_lock_sched() for protection. Commit 3a630178fd5f3 ("tracing: generate RCU warnings even when tracepoints are disabled") added lockdep checks (including rcu checks) for events that are not enabled to catch possible RCU issues that would only be triggered if a trace event was enabled. Commit f37755490fe9b only stopped the warnings when the trace event was enabled but did not prevent warnings if the trace event was called when disabled. To fix this, the cpu online check is moved to where the condition is added to the trace event. This will place the cpu online check in all places that it may be used now and in the future. Cc: stable@vger.kernel.org # v3.18+ Fixes: f37755490fe9b ("tracepoints: Do not trace when cpu is offline") Fixes: 3a630178fd5f3 ("tracing: generate RCU warnings even when tracepoints are disabled") Reported-by: Sudeep Holla Tested-by: Sudeep Holla Signed-off-by: Steven Rostedt include/linux/tracepoint.h | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit ff7925848b50050732ac0401e0acf27e8b241d7b Author: Will Deacon Date: Wed Mar 9 15:22:55 2016 +0000 arm64: hugetlb: partial revert of 66b3923a1a0f Commit 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit") introduced support for huge pages using the contiguous bit in the PTE as opposed to block mappings, which may be slightly unwieldy (512M) in 64k page configurations. Unfortunately, this support has resulted in some late regressions when running the libhugetlbfs test suite with 64k pages and CONFIG_DEBUG_VM as a result of a BUG: | readback (2M: 64): ------------[ cut here ]------------ | kernel BUG at fs/hugetlbfs/inode.c:446! | Internal error: Oops - BUG: 0 [#1] SMP | Modules linked in: | CPU: 7 PID: 1448 Comm: readback Not tainted 4.5.0-rc7 #148 | Hardware name: linux,dummy-virt (DT) | task: fffffe0040964b00 ti: fffffe00c2668000 task.ti: fffffe00c2668000 | PC is at remove_inode_hugepages+0x44c/0x480 | LR is at remove_inode_hugepages+0x264/0x480 Rather than revert the entire patch, simply avoid advertising the contiguous huge page sizes for now while people are actively working on a fix. This patch can then be reverted once things have been sorted out. Cc: David Woods Reported-by: Steve Capper Signed-off-by: Will Deacon arch/arm64/mm/hugetlbpage.c | 14 -------------- 1 file changed, 14 deletions(-) commit 36e5cd6b897e17d03008f81e075625d8e43e52d0 Author: Ard Biesheuvel Date: Tue Mar 8 21:09:29 2016 +0700 arm64: account for sparsemem section alignment when choosing vmemmap offset Commit dfd55ad85e4a ("arm64: vmemmap: use virtual projection of linear region") fixed an issue where the struct page array would overflow into the adjacent virtual memory region if system RAM was placed so high up in physical memory that its addresses were not representable in the build time configured virtual address size. However, the fix failed to take into account that the vmemmap region needs to be relatively aligned with respect to the sparsemem section size, so that a sequence of page structs corresponding with a sparsemem section in the linear region appears naturally aligned in the vmemmap region. So round up vmemmap to sparsemem section size. Since this essentially moves the projection of the linear region up in memory, also revert the reduction of the size of the vmemmap region. Cc: Fixes: dfd55ad85e4a ("arm64: vmemmap: use virtual projection of linear region") Tested-by: Mark Langsdorf Tested-by: David Daney Tested-by: Robert Richter Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon arch/arm64/include/asm/pgtable.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f363938c70a04e6bc99023a5e0c44ef7879b903f Author: Andy Lutomirski Date: Thu Jan 21 15:24:31 2016 -0800 x86/fpu: Fix 'no387' regression After fixing FPU option parsing, we now parse the 'no387' boot option too early: no387 clears X86_FEATURE_FPU before it's even probed, so the boot CPU promptly re-enables it. I suspect it gets even more confused on SMP. Fix the probing code to leave X86_FEATURE_FPU off if it's been disabled by setup_clear_cpu_cap(). Signed-off-by: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: Fenghua Yu Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Quentin Casasnovas Cc: Sai Praneeth Prakhya Cc: Thomas Gleixner Cc: yu-cheng yu Fixes: 4f81cbafcce2 ("x86/fpu: Fix early FPU command-line parsing") Signed-off-by: Ingo Molnar arch/x86/kernel/fpu/init.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 313f636d5c490c9741d3f750dc8da33029edbc6b Author: David Matlack Date: Tue Mar 8 16:19:44 2016 -0800 kvm: cap halt polling at exactly halt_poll_ns When growing halt-polling, there is no check that the poll time exceeds the limit. It's possible for vcpu->halt_poll_ns grow once past halt_poll_ns, and stay there until a halt which takes longer than vcpu->halt_poll_ns. For example, booting a Linux guest with halt_poll_ns=11000: ... kvm:kvm_halt_poll_ns: vcpu 0: halt_poll_ns 0 (shrink 10000) ... kvm:kvm_halt_poll_ns: vcpu 0: halt_poll_ns 10000 (grow 0) ... kvm:kvm_halt_poll_ns: vcpu 0: halt_poll_ns 20000 (grow 10000) Signed-off-by: David Matlack Fixes: aca6ff29c4063a8d467cdee241e6b3bf7dc4a171 Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 3 +++ 1 file changed, 3 insertions(+) commit a9af316c83e3d81e26985193ffafdf143b327c07 Author: Xuelin Shi Date: Tue Mar 8 14:02:01 2016 +0800 dmaengine: fsldma: fix memory leak adding unmap of sources and destinations while doing dequeue. Signed-off-by: Xuelin Shi Signed-off-by: Vinod Koul drivers/dma/fsldma.c | 2 ++ 1 file changed, 2 insertions(+) commit 848819c5447eb318a787467e8435a07c733e16c9 Merge: 9138301 33bee52 Author: Dave Airlie Date: Wed Mar 9 14:21:12 2016 +1000 Merge tag 'imx-drm-fixes-2016-02-19' of git://git.pengutronix.de/git/pza/linux into drm-fixes ipu-v3 probe and imx-drm crtc and plane fixes - Fix ipu probe if optional port nodes are not present in the device tree - Reset the ipu before initializing interrupts, not thereafter - Notify DRM core about the state of vblank interrupts - Add missing RGB565 format to the list of plate formats * tag 'imx-drm-fixes-2016-02-19' of git://git.pengutronix.de/git/pza/linux: drm/imx: Add missing DRM_FORMAT_RGB565 to ipu_plane_formats drm/imx: notify DRM core about CRTC vblank state gpu: ipu-v3: Reset IPU before activating IRQ gpu: ipu-v3: Do not bail out on missing optional port nodes commit 913830147ace0a31ac0128726b29153d570c9985 Merge: dad82ea d74e766 Author: Dave Airlie Date: Wed Mar 9 14:19:14 2016 +1000 Merge branch 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux into drm-fixes radeon and amdgpu fixes for 4.5. Three regression fixes and some fixups for the error handling in the vblank regression fixes from earlier. * 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux: Revert "drm/radeon/pm: adjust display configuration after powerstate" drm/amdgpu/dp: add back special handling for NUTMEG drm/radeon/dp: add back special handling for NUTMEG drm/radeon: Fix error handling in radeon_flip_work_func. drm/amdgpu: Fix error handling in amdgpu_flip_work_func. commit 7781203416ffc4e731619f8a8b93a37599a8f502 Author: Heikki Krogerus Date: Tue Mar 8 15:44:36 2016 +0200 device property: fwnode->secondary may contain ERR_PTR(-ENODEV) This fixes BUG triggered when fwnode->secondary is not NULL, but has ERR_PTR(-ENODEV) instead. BUG: unable to handle kernel paging request at ffffffffffffffed IP: [] __fwnode_property_read_string+0x26/0x160 PGD 200e067 PUD 2010067 PMD 0 Oops: 0000 [#1] SMP KASAN Modules linked in: dwc3_pci(+) dwc3 CPU: 0 PID: 1138 Comm: modprobe Not tainted 4.5.0-rc5+ #61 task: ffff88015aaf5b00 ti: ffff88007b958000 task.ti: ffff88007b958000 RIP: 0010:[] [] __fwnode_property_read_string+0x26/0x160 RSP: 0018:ffff88007b95eff8 EFLAGS: 00010246 RAX: fffffbfffffffffd RBX: ffffffffffffffed RCX: ffff88015999cd37 RDX: dffffc0000000000 RSI: ffffffff81e11bc0 RDI: ffffffffffffffed RBP: ffff88007b95f020 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88007b90f7cf R11: 0000000000000000 R12: ffff88007b95f0a0 R13: 00000000fffffffa R14: ffffffff81e11bc0 R15: ffff880159ea37a0 FS: 00007ff35f46c700(0000) GS:ffff88015b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffffffffffed CR3: 000000007b8be000 CR4: 00000000001006f0 Stack: ffff88015999cd20 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b383dd8 ffff880159ea37a0 ffff88007b95f048 ffffffff81677d03 ffff88007b952460 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b95f070 ffffffff81677d40 Call Trace: [] fwnode_property_read_string+0x43/0x50 [] device_property_read_string+0x30/0x40 ... Fixes: 362c0b30249e (device property: Fallback to secondary fwnode if primary misses the property) Signed-off-by: Heikki Krogerus Signed-off-by: Rafael J. Wysocki drivers/base/property.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0dda8851a88d6c9d6389f1caf69627154c39aceb Author: Bob Moore Date: Fri Feb 19 14:17:36 2016 +0800 ACPICA: Revert "Parser: Fix for SuperName method invocation" ACPICA commit eade8f78f2aa21e8eabc3380a5728db47273bcf1 Revert commit ae90fbf562d7 (ACPICA: Parser: Fix for SuperName method invocation). Support for method invocations as part of super_name will be removed from the ACPI specification, since no AML interpreter supports it. Fixes: ae90fbf562d7 (ACPICA: Parser: Fix for SuperName method invocation) Link: https://github.com/acpica/acpica/commit/eade8f78 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/psargs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit d74e766e1916d0e09b86e4b5b9d0f819628fd546 Author: Alex Deucher Date: Tue Mar 8 11:31:00 2016 -0500 Revert "drm/radeon/pm: adjust display configuration after powerstate" This reverts commit 39d4275058baf53e89203407bf3841ff2c74fa32. This caused a regression on some older hardware. bug: https://bugzilla.kernel.org/show_bug.cgi?id=113891 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_pm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 7f02bf6b5f5de90b7a331759b5364e41c0f39bf9 Merge: 1e2a4c7 ad09ef2 Author: Linus Torvalds Date: Tue Mar 8 09:41:20 2016 -0800 Merge tag 'sound-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's always an ambivalent feeling to send a large pull request at the late stage like this, especially when most of patches came from me. Anyway, this is a collection of lots of small fixes that slipped from the previous pull request. All fixes are about ASoC, and the majority of changes are corrections of the wrong access types in ALSA ctl enum items. They are mostly harmless on 32bit architectures, but actually buggy on 64bit. So we addressed all these now in a shot. The rest are various small ASoC driver fixes. Among them, only two changes have been done to ASoC core, and both of them are trivial. The rest are all device-specific. So overall, they should be safe to apply" * tag 'sound-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits) ASoC: wm_adsp: Fix enum ctl accesses in a wrong type ASoC: wm9081: Fix enum ctl accesses in a wrong type ASoC: wm8996: Fix enum ctl accesses in a wrong type ASoC: wm8994: Fix enum ctl accesses in a wrong type ASoC: wm8985: Fix enum ctl accesses in a wrong type ASoC: wm8983: Fix enum ctl accesses in a wrong type ASoC: wm8958: Fix enum ctl accesses in a wrong type ASoC: wm8904: Fix enum ctl accesses in a wrong type ASoC: wm8753: Fix enum ctl accesses in a wrong type ASoC: wl1273: Fix enum ctl accesses in a wrong type ASoC: tlv320dac33: Fix enum ctl accesses in a wrong type ASoC: max98095: Fix enum ctl accesses in a wrong type ASoC: max98088: Fix enum ctl accesses in a wrong type ASoC: ab8500: Fix enum ctl accesses in a wrong type ASoC: da732x: Fix enum ctl accesses in a wrong type ASoC: cs42l51: Fix enum ctl accesses in a wrong type ASoC: intel: mfld: Fix enum ctl accesses in a wrong type ASoC: omap: rx51: Fix enum ctl accesses in a wrong type ASoC: omap: n810: Fix enum ctl accesses in a wrong type ASoC: pxa: tosa: Fix enum ctl accesses in a wrong type ... commit 1e2a4c7a3f916f1caa5e68a9f2f7e6a04a0efa7e Merge: e2857b8 83bdaad Author: Linus Torvalds Date: Tue Mar 8 09:29:00 2016 -0800 Merge tag 'edac_fix_for_4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fix from Borislav Petkov: "Last minute fix for sb_edac which fixes DIMM detection on certain Xeon Phi configurations: A single fix to the Xeon Phi section of sb_edac. The issue was introduced during this merge window" * tag 'edac_fix_for_4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, sb_edac: Fix logic when computing DIMM sizes on Xeon Phi commit 02d27234759dc4fe14a880ec1e1dee108cb0b503 Author: Alex Deucher Date: Thu Mar 3 19:34:28 2016 -0500 drm/amdgpu/dp: add back special handling for NUTMEG When I fixed the dp rate selection in: 3b73b168cffd9c392584d3f665021fa2190f8612 drm/amdgpu: fix dp link rate selection (v2) I accidently dropped the special handling for NUTMEG DP bridge chips. They require a fixed link rate. Reviewed-by: Christian König Reviewed-by: Ken Wang Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/atombios_dp.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit c8213a638f65bf487c10593c216525952cca3690 Author: Alex Deucher Date: Thu Mar 3 19:26:24 2016 -0500 drm/radeon/dp: add back special handling for NUTMEG When I fixed the dp rate selection in: 092c96a8ab9d1bd60ada2ed385cc364ce084180e drm/radeon: fix dp link rate selection (v2) I accidently dropped the special handling for NUTMEG DP bridge chips. They require a fixed link rate. Reviewed-by: Christian König Reviewed-by: Ken Wang Reviewed-by: Harry Wentland Tested-by: Ken Moffat Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/atombios_dp.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 9522b37f5a8c7bfabe46eecadf2e130f1103f337 Author: David Hildenbrand Date: Tue Mar 8 12:24:30 2016 +0100 KVM: s390: correct fprs on SIGP (STOP AND) STORE STATUS With MACHINE_HAS_VX, we convert the floating point registers from the vector registeres when storing the status. For other VCPUs, these are stored to vcpu->run->s.regs.vrs, but we are using current->thread.fpu.vxrs, which resolves to the currently loaded VCPU. So kvm_s390_store_status_unloaded() currently writes the wrong floating point registers (converted from the vector registers) when called from another VCPU on a z13. This is only the case for old user space not handling SIGP STORE STATUS and SIGP STOP AND STORE STATUS, but relying on the kernel implementation. All other calls come from the loaded VCPU via kvm_s390_store_status(). Fixes: 9abc2a08a7d6 (KVM: s390: fix memory overwrites when vx is disabled) Reviewed-by: Christian Borntraeger Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: David Hildenbrand Signed-off-by: Christian Borntraeger Signed-off-by: Paolo Bonzini arch/s390/kvm/kvm-s390.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8bb9b9ccff5b7ce5084b5111244a92fd1d0daf16 Merge: 7099e2e ccec445 Author: Paolo Bonzini Date: Tue Mar 8 12:46:50 2016 +0100 Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD commit 7099e2e1f4d9051f31bbfa5803adf954bb5d76ef Author: Radim Krčmář Date: Fri Mar 4 15:08:42 2016 +0100 KVM: VMX: disable PEBS before a guest entry Linux guests on Haswell (and also SandyBridge and Broadwell, at least) would crash if you decided to run a host command that uses PEBS, like perf record -e 'cpu/mem-stores/pp' -a This happens because KVM is using VMX MSR switching to disable PEBS, but SDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it isn't safe: When software needs to reconfigure PEBS facilities, it should allow a quiescent period between stopping the prior event counting and setting up a new PEBS event. The quiescent period is to allow any latent residual PEBS records to complete its capture at their previously specified buffer address (provided by IA32_DS_AREA). There might not be a quiescent period after the MSR switch, so a CPU ends up using host's MSR_IA32_DS_AREA to access an area in guest's memory. (Or MSR switching is just buggy on some models.) The guest can learn something about the host this way: If the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results in #PF where we leak host's MSR_IA32_DS_AREA through CR2. After that, a malicious guest can map and configure memory where MSR_IA32_DS_AREA is pointing and can therefore get an output from host's tracing. This is not a critical leak as the host must initiate with PEBS tracing and I have not been able to get a record from more than one instruction before vmentry in vmx_vcpu_run() (that place has most registers already overwritten with guest's). We could disable PEBS just few instructions before vmentry, but disabling it earlier shouldn't affect host tracing too much. We also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that optimization isn't worth its code, IMO. (If you are implementing PEBS for guests, be sure to handle the case where both host and guest enable PEBS, because this patch doesn't.) Fixes: 26a4f3c08de4 ("perf/x86: disable PEBS on a guest entry.") Cc: Reported-by: Jiří Olša Signed-off-by: Radim Krčmář Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 7a76aa95f6f6682db5629449d763251d1c9f8c4e Author: Christian Borntraeger Date: Mon Feb 29 15:59:18 2016 +0100 s390/cpumf: Fix lpp detection we have to check bit 40 of the facility list before issuing LPP and not bit 48. Otherwise a guest running on a system with "The decimal-floating-point zoned-conversion facility" and without the "The set-program-parameters facility" might crash on an lpp instruction. Signed-off-by: Christian Borntraeger Cc: stable@vger.kernel.org # v4.4+ Fixes: e22cf8ca6f75 ("s390/cpumf: rework program parameter setting to detect guest samples") Signed-off-by: Martin Schwidefsky arch/s390/kernel/head64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f93812846f31381d35c04c6c577d724254355e7f Author: Al Viro Date: Mon Mar 7 23:07:10 2016 -0500 jffs2: reduce the breakage on recovery from halfway failed rename() d_instantiate(new_dentry, old_inode) is absolutely wrong thing to do - it will oops if new_dentry used to be positive, for starters. What we need is d_invalidate() the target and be done with that. Cc: stable@vger.kernel.org # v3.18+ Signed-off-by: Al Viro fs/jffs2/dir.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 803c00123a8012b3a283c0530910653973ef6d8f Author: Al Viro Date: Mon Mar 7 22:17:07 2016 -0500 ncpfs: fix a braino in OOM handling in ncp_fill_cache() Failing to allocate an inode for child means that cache for *parent* is incompletely populated. So it's parent directory inode ('dir') that needs NCPI_DIR_CACHE flag removed, *not* the child inode ('inode', which is what we'd failed to allocate in the first place). Fucked-up-in: commit 5e993e25 ("ncpfs: get rid of d_validate() nonsense") Fucked-up-by: Al Viro Cc: stable@vger.kernel.org # v3.19 Signed-off-by: Al Viro fs/ncpfs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ccec44563b18a0ce90e2d4f332784b3cb25c8e9c Author: Paul Mackerras Date: Sat Mar 5 19:34:39 2016 +1100 KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit Thomas Huth discovered that a guest could cause a hard hang of a host CPU by setting the Instruction Authority Mask Register (IAMR) to a suitable value. It turns out that this is because when the code was added to context-switch the new special-purpose registers (SPRs) that were added in POWER8, we forgot to add code to ensure that they were restored to a sane value on guest exit. This adds code to set those registers where a bad value could compromise the execution of the host kernel to a suitable neutral value on guest exit. Cc: stable@vger.kernel.org # v3.14+ Fixes: b005255e12a3 Reported-by: Thomas Huth Reviewed-by: David Gibson Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_rmhandlers.S | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit dad82ea3ef4b9dc97ca5ec718abc6b0986f1aaaf Author: Jyri Sarha Date: Sat Jan 16 22:17:54 2016 +0200 drm/i2c: tda998x: Choose between atomic or non atomic dpms helper Choose between atomic or non atomic connector dpms helper. If tda998x is connected to a drm driver that does not support atomic modeset calling drm_atomic_helper_connector_dpms() causes a crash when the connectors atomic state is not initialized. The patch implements a driver specific connector dpms helper that calls drm_atomic_helper_connector_dpms() if driver supports DRIVER_ATOMIC and otherwise it calls the legacy drm_helper_connector_dpms(). Fixes commit 9736e988d328 ("drm/i2c: tda998x: Add support for atomic modesetting"). Signed-off-by: Jyri Sarha Signed-off-by: Dave Airlie drivers/gpu/drm/i2c/tda998x_drv.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit d17e67de6e81394624685f16f174453bd561d48b Author: Thierry Reding Date: Mon Mar 7 18:06:01 2016 +0100 drm/vmwgfx: Add back ->detect() and ->fill_modes() This partially reverts commit d56f57ac969c ("drm/gma500: Move to private save/restore hooks") which removed these lines by mistake. Reported-by: Sebastian Herbszt Acked-by: Daniel Vetter Signed-off-by: Thierry Reding Tested-by: Thomas Hellstrom Tested-by: Sebastian Herbszt Signed-off-by: Dave Airlie drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 2 ++ 1 file changed, 2 insertions(+) commit e2857b8f11a289ed2b61d18d0665e05c1053c446 Merge: 01ffa3d 6faac63 Author: Linus Torvalds Date: Mon Mar 7 15:41:10 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix ordering of WEXT netlink messages so we don't see a newlink after a dellink, from Johannes Berg. 2) Out of bounds access in minstrel_ht_set_best_prob_rage, from Konstantin Khlebnikov. 3) Paging buffer memory leak in iwlwifi, from Matti Gottlieb. 4) Wrong units used to set initial TCP rto from cached metrics, also from Konstantin Khlebnikov. 5) Fix stale IP options data in the SKB control block from leaking through layers of encapsulation, from Bernie Harris. 6) Zero padding len miscalculated in bnxt_en, from Michael Chan. 7) Only CHECKSUM_PARTIAL packets should be passed down through GSO, fix from Hannes Frederic Sowa. 8) Fix suspend/resume with JME networking devices, from Diego Violat and Guo-Fu Tseng. 9) Checksums not validated properly in bridge multicast support due to the placement of the SKB header pointers at the time of the check, fix from Álvaro Fernández Rojas. 10) Fix hang/tiemout with r8169 if a stats fetch is done while the device is runtime suspended. From Chun-Hao Lin. 11) The forwarding database netlink dump facilities don't track the state of the dump properly, resulting in skipped/missed entries. From Minoura Makoto. 12) Fix regression from a recent 3c59x bug fix, from Neil Horman. 13) Fix list corruption in bna driver, from Ivan Vecera. 14) Big endian machines crash on vlan add in bnx2x, fix from Michal Schmidt. 15) Ethtool RSS configuration not propagated properly in mlx5 driver, from Tariq Toukan. 16) Fix regression in PHY probing in stmmac driver, from Gabriel Fernandez. 17) Fix SKB tailroom calculation in igmp/mld code, from Benjamin Poirier. 18) A past change to skip empty routing headers in ipv6 extention header parsing accidently caused fragment headers to not be matched any longer. Fix from Florian Westphal. 19) eTSEC-106 erratum needs to be applied to more gianfar chips, from Atsushi Nemoto. 20) Fix netdev reference after free via workqueues in usb networking drivers, from Oliver Neukum and Bjørn Mork. 21) mdio->irq is now an array rather than a pointer to dynamic memory, but several drivers were still trying to free it :-/ Fixes from Colin Ian King. 22) act_ipt iptables action forgets to set the family field, thus LOG netfilter targets don't work with it. Fix from Phil Sutter. 23) SKB leak in ibmveth when skb_linearize() fails, from Thomas Falcon. 24) pskb_may_pull() cannot be called with interrupts disabled, fix code that tries to do this in vmxnet3 driver, from Neil Horman. 25) be2net driver leaks iomap'd memory on removal, fix from Douglas Miller. 26) Forgotton RTNL mutex unlock in ppp_create_interface() error paths, from Guillaume Nault. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (97 commits) ppp: release rtnl mutex when interface creation fails cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind tcp: fix tcpi_segs_in after connection establishment net: hns: fix the bug about loopback jme: Fix device PM wakeup API usage jme: Do not enable NIC WoL functions on S0 udp6: fix UDP/IPv6 encap resubmit path be2net: Don't leak iomapped memory on removal. vmxnet3: avoid calling pskb_may_pull with interrupts disabled net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEM ibmveth: check return of skb_linearize in ibmveth_start_xmit cdc_ncm: toggle altsetting to force reset before setup usbnet: cleanup after bind() in probe() mlxsw: pci: Correctly determine if descriptor queue is full mlxsw: spectrum: Always decrement bridge's ref count tipc: fix nullptr crash during subscription cancel net: eth: altera: do not free array priv->mdio->irq net/ethoc: do not free array priv->mdio->irq net: sched: fix act_ipt for LOG target asix: do not free array priv->mdio->irq ... commit 01ffa3df223c061435dfaab8daba7c0109a3c6d5 Merge: 256faed b81de06 Author: Linus Torvalds Date: Mon Mar 7 15:23:25 2016 -0800 Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Overlayfs bug fixes. All marked as -stable material" * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: copy new uid/gid into overlayfs runtime inode ovl: ignore lower entries when checking purity of non-directory entries ovl: fix getcwd() failure after unsuccessful rmdir ovl: fix working on distributed fs as lower layer commit 256faedcfd646161477d47a1a78c32a562d2e845 Author: Linus Torvalds Date: Mon Mar 7 13:15:09 2016 -0800 Revert "drm/radeon: call hpd_irq_event on resume" This reverts commit dbb17a21c131eca94eb31136eee9a7fe5aff00d9. It turns out that commit can cause problems for systems with multiple GPUs, and causes X to hang on at least a HP Pavilion dv7 with hybrid graphics. This got noticed originally in 4.4.4, where this patch had already gotten back-ported, but 4.5-rc7 was verified to have the same problem. Alexander Deucher says: "It looks like you have a muxed system so I suspect what's happening is that one of the display is being reported as connected for both the IGP and the dGPU and then the desktop environment gets confused or there some sort problem in the detect functions since the mux is not switched to the dGPU. I don't see an easy fix unless Dave has any ideas. I'd say just revert for now" Reported-by: Jörg-Volker Peetz Acked-by: Alexander Deucher Cc: Dave Airlie Cc: stable@kernel.org # wherever dbb17a21c131 got back-ported Signed-off-by: Linus Torvalds drivers/gpu/drm/radeon/radeon_device.c | 1 - 1 file changed, 1 deletion(-) commit 6faac63a6986f29ef39827f460edd3a5ba64ad5c Author: Guillaume Nault Date: Mon Mar 7 19:36:44 2016 +0100 ppp: release rtnl mutex when interface creation fails Add missing rtnl_unlock() in the error path of ppp_create_interface(). Fixes: 58a89ecaca53 ("ppp: fix lockdep splat in ppp_dev_uninit()") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller drivers/net/ppp/ppp_generic.c | 1 + 1 file changed, 1 insertion(+) commit 4d06dd537f95683aba3651098ae288b7cbff8274 Author: Bjørn Mork Date: Mon Mar 7 21:15:36 2016 +0100 cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind usbnet_link_change will call schedule_work and should be avoided if bind is failing. Otherwise we will end up with scheduled work referring to a netdev which has gone away. Instead of making the call conditional, we can just defer it to usbnet_probe, using the driver_info flag made for this purpose. Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change") Reported-by: Andrey Konovalov Suggested-by: Linus Torvalds Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/cdc_ncm.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) commit a9d99ce28ed359d68cf6f3c1a69038aefedf6d6a Author: Eric Dumazet Date: Sun Mar 6 09:29:21 2016 -0800 tcp: fix tcpi_segs_in after connection establishment If final packet (ACK) of 3WHS is lost, it appears we do not properly account the following incoming segment into tcpi_segs_in While we are at it, starts segs_in with one, to count the SYN packet. We do not yet count number of SYN we received for a request sock, we might add this someday. packetdrill script showing proper behavior after fix : // Tests tcpi_segs_in when 3rd packet (ACK) of 3WHS is lost 0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +0 < S 0:0(0) win 32792 +0 > S. 0:0(0) ack 1 +.020 < P. 1:1001(1000) ack 1 win 32792 +0 accept(3, ..., ...) = 4 +.000 %{ assert tcpi_segs_in == 2, 'tcpi_segs_in=%d' % tcpi_segs_in }% Fixes: 2efd055c53c06 ("tcp: add tcpi_segs_in and tcpi_segs_out to tcp_info") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_minisocks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 68c222a6bc90e4bf03df7ae36a9b196fa869928e Author: yankejian Date: Sat Mar 5 14:10:42 2016 +0800 net: hns: fix the bug about loopback It will always be passed if the soc is tested the loopback cases. This patch will fix this bug. Signed-off-by: Kejian Yan Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 8 +++++ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 37 ++++++++++++++++++++++ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 5 +++ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 15 ++++++++- 5 files changed, 65 insertions(+), 1 deletion(-) commit 81422e672f8181d7ad1ee6c60c723aac649f538f Author: Guo-Fu Tseng Date: Sat Mar 5 08:11:56 2016 +0800 jme: Fix device PM wakeup API usage According to Documentation/power/devices.txt The driver should not use device_set_wakeup_enable() which is the policy for user to decide. Using device_init_wakeup() to initialize dev->power.should_wakeup and dev->power.can_wakeup on driver initialization. And use device_may_wakeup() on suspend to decide if WoL function should be enabled on NIC. Reported-by: Diego Viola Signed-off-by: Guo-Fu Tseng Signed-off-by: David S. Miller drivers/net/ethernet/jme.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 0772a99b818079e628a1da122ac7ee023faed83e Author: Guo-Fu Tseng Date: Sat Mar 5 08:11:55 2016 +0800 jme: Do not enable NIC WoL functions on S0 Otherwise it might be back on resume right after going to suspend in some hardware. Reported-by: Diego Viola Signed-off-by: Guo-Fu Tseng Signed-off-by: David S. Miller drivers/net/ethernet/jme.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 54c6e2dd00c313d0add58e5befe62fe6f286d03b Author: Krzysztof =?utf-8?Q?Ha=C5=82asa?= Date: Tue Mar 1 07:07:18 2016 +0100 PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() pci_create_root_bus() passes a "parent" pointer to pci_bus_assign_domain_nr(). When CONFIG_PCI_DOMAINS_GENERIC is defined, pci_bus_assign_domain_nr() dereferences that pointer. Many callers of pci_create_root_bus() supply a NULL "parent" pointer, which leads to a NULL pointer dereference error. 7c674700098c ("PCI: Move domain assignment from arm64 to generic code") moved the "parent" dereference from arm64 to generic code. Only arm64 used that code (because only arm64 defined CONFIG_PCI_DOMAINS_GENERIC), and it always supplied a valid "parent" pointer. Other arches supplied NULL "parent" pointers but didn't defined CONFIG_PCI_DOMAINS_GENERIC, so they used a no-op version of pci_bus_assign_domain_nr(). 8c7d14746abc ("ARM/PCI: Move to generic PCI domains") defined CONFIG_PCI_DOMAINS_GENERIC on ARM, and many ARM platforms use pci_common_init(), which supplies a NULL "parent" pointer. These platforms (cns3xxx, dove, footbridge, iop13xx, etc.) crash with a NULL pointer dereference like this while probing PCI: Unable to handle kernel NULL pointer dereference at virtual address 000000a4 PC is at pci_bus_assign_domain_nr+0x10/0x84 LR is at pci_create_root_bus+0x48/0x2e4 Kernel panic - not syncing: Attempted to kill init! [bhelgaas: changelog, add "Reported:" and "Fixes:" tags] Reported: http://forum.doozan.com/read.php?2,17868,22070,quote=1 Fixes: 8c7d14746abc ("ARM/PCI: Move to generic PCI domains") Fixes: 7c674700098c ("PCI: Move domain assignment from arm64 to generic code") Signed-off-by: Krzysztof Hałasa Signed-off-by: Bjorn Helgaas Acked-by: Lorenzo Pieralisi CC: stable@vger.kernel.org # v4.0+ drivers/pci/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 59dca1d8a6725a121dae6c452de0b2611d5865dc Author: Bill Sommerfeld Date: Fri Mar 4 14:47:21 2016 -0800 udp6: fix UDP/IPv6 encap resubmit path IPv4 interprets a negative return value from a protocol handler as a request to redispatch to a new protocol. In contrast, IPv6 interprets a negative value as an error, and interprets a positive value as a request for redispatch. UDP for IPv6 was unaware of this difference. Change __udp6_lib_rcv() to return a positive value for redispatch. Note that the socket's encap_rcv hook still needs to return a negative value to request dispatch, and in the case of IPv6 packets, adjust IP6CB(skb)->nhoff to identify the byte containing the next protocol. Signed-off-by: Bill Sommerfeld Signed-off-by: David S. Miller net/ipv6/udp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a69bf3c5b49ef488970c74e26ba0ec12f08491c2 Author: Douglas Miller Date: Fri Mar 4 15:36:56 2016 -0600 be2net: Don't leak iomapped memory on removal. The adapter->pcicfg resource is either mapped via pci_iomap() or derived from adapter->db. During be_remove() this resource was ignored and so could remain mapped after remove. Add a flag to track whether adapter->pcicfg was mapped or not, then use that flag in be_unmap_pci_bars() to unmap if required. Fixes: 25848c901 ("use PCI MMIO read instead of config read for errors") Signed-off-by: Douglas Miller Signed-off-by: David S. Miller drivers/net/ethernet/emulex/benet/be.h | 1 + drivers/net/ethernet/emulex/benet/be_main.c | 4 ++++ 2 files changed, 5 insertions(+) commit cec05562fb1dcdf09ef7b46e1e3eade98e488893 Author: Neil Horman Date: Fri Mar 4 13:40:48 2016 -0500 vmxnet3: avoid calling pskb_may_pull with interrupts disabled vmxnet3 has a function vmxnet3_parse_and_copy_hdr which, among other operations, uses pskb_may_pull to linearize the header portion of an skb. That operation eventually uses local_bh_disable/enable to ensure that it doesn't race with the drivers bottom half handler. Unfortunately, vmxnet3 preforms this parse_and_copy operation with a spinlock held and interrupts disabled. This causes us to run afoul of the WARN_ON_ONCE(irqs_disabled()) warning in local_bh_enable, resulting in this: WARNING: at kernel/softirq.c:159 local_bh_enable+0x59/0x90() (Not tainted) Hardware name: VMware Virtual Platform Modules linked in: ipv6 ppdev parport_pc parport microcode e1000 vmware_balloon vmxnet3 i2c_piix4 sg ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom mptspi mptscsih mptbase scsi_transport_spi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mperf] Pid: 6229, comm: sshd Not tainted 2.6.32-616.el6.i686 #1 Call Trace: [] ? warn_slowpath_common+0x89/0xe0 [] ? local_bh_enable+0x59/0x90 [] ? warn_slowpath_null+0x1b/0x20 [] ? local_bh_enable+0x59/0x90 [] ? skb_copy_bits+0x126/0x210 [] ? ext4_ext_find_extent+0x24e/0x2d0 [ext4] [] ? __pskb_pull_tail+0x6e/0x2b0 [] ? vmxnet3_xmit_frame+0xba4/0xef0 [vmxnet3] [] ? selinux_ip_postroute+0x56/0x320 [] ? cfq_add_rq_rb+0x98/0x110 [] ? packet_rcv+0x48/0x350 [] ? dev_queue_xmit_nit+0xc9/0x140 ... Fix it by splitting vmxnet3_parse_and_copy_hdr into two functions: vmxnet3_parse_hdr, which sets up the internal/on stack ctx datastructure, and pulls the skb (both of which can be done without holding the spinlock with irqs disabled and vmxnet3_copy_header, which just copies the skb to the tx ring under the lock safely. tested and shown to correct the described problem. Applies cleanly to the head of the net tree Signed-off-by: Neil Horman CC: Shrikrishna Khare CC: "VMware, Inc." CC: "David S. Miller" Acked-by: Shrikrishna Khare Signed-off-by: David S. Miller drivers/net/vmxnet3/vmxnet3_drv.c | 73 ++++++++++++++++++++++++--------------- 1 file changed, 46 insertions(+), 27 deletions(-) commit 7024b68ef1310a9dd3b2b40b082588a9826f05f5 Merge: 979d804 10da848 Author: David S. Miller Date: Mon Mar 7 14:58:11 2016 -0500 Merge tag 'wireless-drivers-for-davem-2016-03-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.5 iwlwifi * free firmware paging memory when the module is unloaded or device removed * fix pending frames counter to fix an issue when removing stations ssb * fix a build problem related to ssb_fill_sprom_with_fallback() ==================== Signed-off-by: David S. Miller commit 979d804e5bc926f8f3133715736f26456c910a97 Author: Krzysztof Kozlowski Date: Fri Mar 4 10:04:52 2016 +0900 net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEM The MFD_SYSCON depends on HAS_IOMEM so when selecting it avoid unmet direct dependencies. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 2c42bf4b43170ee83354bb68a12f8fc84c2e27a9 Author: Thomas Falcon Date: Thu Mar 3 15:22:36 2016 -0600 ibmveth: check return of skb_linearize in ibmveth_start_xmit If skb_linearize fails, the driver should drop the packet instead of trying to copy it into the bounce buffer. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmveth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 48906f62c96cc2cd35753e59310cb70eb08cc6a5 Author: Bjørn Mork Date: Thu Mar 3 22:20:53 2016 +0100 cdc_ncm: toggle altsetting to force reset before setup Some devices will silently fail setup unless they are reset first. This is necessary even if the data interface is already in altsetting 0, which it will be when the device is probed for the first time. Briefly toggling the altsetting forces a function reset regardless of the initial state. This fixes a setup problem observed on a number of Huawei devices, appearing to operate in NTB-32 mode even if we explicitly set them to NTB-16 mode. Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/cdc_ncm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 83bdaad4d919722744ef1b726a9913ec36c6a430 Author: Hubert Chrzaniuk Date: Mon Mar 7 15:30:45 2016 +0100 EDAC, sb_edac: Fix logic when computing DIMM sizes on Xeon Phi Correct a typo introduced by d0cdf9003140 ("EDAC, sb_edac: Add Knights Landing (Xeon Phi gen 2) support") As a result under some configurations DIMMs were not correctly recognized. Problem affects only Xeon Phi architecture. Signed-off-by: Hubert Chrzaniuk Acked-by: Aristeu Rozanski Cc: Mauro Carvalho Chehab Cc: linux-edac Cc: lukasz.anaczkowski@intel.com Link: http://lkml.kernel.org/r/1457361045-26221-1-git-send-email-hubert.chrzaniuk@intel.com Signed-off-by: Borislav Petkov drivers/edac/sb_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2f791908a70e95768596f5bb9e6de4f441d7bf13 Author: Takashi Iwai Date: Wed Feb 24 15:35:22 2016 +0100 drm/i915: Fix bogus dig_port_map[] assignment for pre-HSW The recent commit [0bdf5a05647a: drm/i915: Add reverse mapping between port and intel_encoder] introduced a reverse mapping to retrieve intel_dig_port object from the port number. The code assumed that the port vs intel_dig_port are 1:1 mapping. But in reality, this was a too naive assumption. As Martin reported about the missing HDMI audio on his SNB machine, pre-HSW chips may have multiple intel_dig_port objects corresponding to the same port. Since we assign the mapping statically at the init time and the multiple objects override the map, it may not match with the actually enabled output. This patch tries to address the regression above. The reverse mapping is provided basically only for the audio callbacks, so now we set / clear the mapping dynamically at enabling and disabling HDMI/DP audio, so that we can always track the latest and correct object corresponding to the given port. Fixes: 0bdf5a05647a ('drm/i915: Add reverse mapping between port and intel_encoder') Reported-and-tested-by: Martin Kepplinger Cc: drm-intel-fixes@lists.freedesktop.org Signed-off-by: Takashi Iwai Reviewed-by: Ville Syrjälä Tested-by: Martin Kepplinger Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/1456324522-21591-1-git-send-email-tiwai@suse.de (cherry picked from commit 9dfbffcf4ac0707097af9e6c1372192b9d03a357) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_audio.c | 3 +++ drivers/gpu/drm/i915/intel_ddi.c | 1 - drivers/gpu/drm/i915/intel_dp.c | 1 - drivers/gpu/drm/i915/intel_hdmi.c | 2 -- 4 files changed, 3 insertions(+), 4 deletions(-) commit 1666984c8625b3db19a9abc298931d35ab7bc64b Author: Oliver Neukum Date: Mon Mar 7 11:31:10 2016 +0100 usbnet: cleanup after bind() in probe() In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller drivers/net/usb/usbnet.c | 7 +++++++ 1 file changed, 7 insertions(+) commit a383b7f0e0ba9f8610bdf88a58591a9cca96c38e Merge: 4de13d7e 5091730 Author: David S. Miller Date: Mon Mar 7 11:39:16 2016 -0500 Merge branch 'mlxsw-fixes' Jiri Pirko says: ==================== mlxsw: couple of fixes Couple of fixes from Ido. ==================== Signed-off-by: David S. Miller commit 5091730d7795ccb21eb880699b5194730641c70b Author: Ido Schimmel Date: Mon Mar 7 15:15:30 2016 +0100 mlxsw: pci: Correctly determine if descriptor queue is full The descriptor queues for sending (SDQs) and receiving (RDQs) packets are managed by two counters - producer and consumer - which are both 16-bit in size. A queue is considered full when the difference between the two equals the queue's maximum number of descriptors. However, if the producer counter overflows, then it's possible for the full queue check to fail, as it doesn't take the overflow into account. In such a case, descriptors already passed to the device - but for which a completion has yet to be posted - will be overwritten, thereby causing undefined behavior. The above can be achieved under heavy load (~30 netperf instances). Fix that by casting the subtraction result to u16, preventing it from being treated as a signed integer. Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 912b1c89c5043e163f8cfa568512a131976121b2 Author: Ido Schimmel Date: Mon Mar 7 15:15:29 2016 +0100 mlxsw: spectrum: Always decrement bridge's ref count Since we only support one VLAN filtering bridge we need to associate a reference count with it, so that when the last port netdev leaves it, we would know that a different bridge can be offloaded to hardware. When a LAG device is memeber in a bridge and port netdevs are leaving the LAG, we should always decrement the bridge's reference count, as it's incremented for any port in the LAG. Fixes: 4dc236c31733 ("mlxsw: spectrum: Handle port leaving LAG while bridged") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ad09ef2cce91e3a98a32e3bb0a5982a6e8920aa1 Merge: 790b415 02db17f Author: Takashi Iwai Date: Mon Mar 7 11:06:46 2016 +0100 Merge tag 'asoc-fix-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.5 This is far too big a set of fixes for this late in the release cycle but the overwhelming bulk is essentially the same simple fix from Takashi for a cut'n'pasted 64 bit cleanliness issue in the userspace interface where drivers were accessing things using the wrong element in a union which worked OK on 32 bit platforms as the correct element happened to be aligned the same way but with 64 bit platforms ABIs are different and the two members of the union are laid out in different places. They aren't all tagged to stable since some of these chips have vanishingly little chance of being used in 64 bit systems. The other changes are: - A fix for Qualcomm devices to work on big endian systems. The original change is actually correct but triggered a bug in regmap which is too invasive to fix for this cycle and can be worked around by just letting regmap pick the default. - A fix for the Samsung I2S driver locking which wasn't using IRQ safe spinlocks when it needed to. - A fix for the new Intel Sky Lake driver forgetting that C pointer arithmetic takes the type of the pointer into consideration. - A revert of a change to the FSL SSI driver that broke some systems. - A fix for the cleanup path of the wm9713 driver. - A fix for some incorrect register definitions in the ADAU17x1 driver that caused misclocking in some configurations. - A fix for the tracepoints for jack detection to avoid using an internal field of the core jack structure which is no longer present in all configurations. - A fix for another of the new Intel drivers which tried to write to a string literal. commit 0f514e690740e54815441a87708c3326f8aa8709 Author: Mugunthan V N Date: Mon Mar 7 01:41:22 2016 -0700 ARM: dts: dra7: do not gate cpsw clock due to errata i877 Errata id: i877 Description: ------------ The RGMII 1000 Mbps Transmit timing is based on the output clock (rgmiin_txc) being driven relative to the rising edge of an internal clock and the output control/data (rgmiin_txctl/txd) being driven relative to the falling edge of an internal clock source. If the internal clock source is allowed to be static low (i.e., disabled) for an extended period of time then when the clock is actually enabled the timing delta between the rising edge and falling edge can change over the lifetime of the device. This can result in the device switching characteristics degrading over time, and eventually failing to meet the Data Manual Delay Time/Skew specs. To maintain RGMII 1000 Mbps IO Timings, SW should minimize the duration that the Ethernet internal clock source is disabled. Note that the device reset state for the Ethernet clock is "disabled". Other RGMII modes (10 Mbps, 100Mbps) are not affected Workaround: ----------- If the SoC Ethernet interface(s) are used in RGMII mode at 1000 Mbps, SW should minimize the time the Ethernet internal clock source is disabled to a maximum of 200 hours in a device life cycle. This is done by enabling the clock as early as possible in IPL (QNX) or SPL/u-boot (Linux/Android) by setting the register CM_GMAC_CLKSTCTRL[1:0]CLKTRCTRL = 0x2:SW_WKUP. So, do not allow to gate the cpsw clocks using ti,no-idle property in cpsw node assuming 1000 Mbps is being used all the time. If someone does not need 1000 Mbps and wants to gate clocks to cpsw, this property needs to be deleted in their respective board files. Signed-off-by: Mugunthan V N Signed-off-by: Grygorii Strashko Signed-off-by: Lokesh Vutla Cc: Signed-off-by: Paul Walmsley arch/arm/boot/dts/dra7.dtsi | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 2e18f5a1bc18e8af7031b3b26efde25307014837 Author: Lokesh Vutla Date: Mon Mar 7 01:41:21 2016 -0700 ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Introduce a dt property, ti,no-idle, that prevents an IP to idle at any point. This is to handle Errata i877, which tells that GMAC clocks cannot be disabled. Acked-by: Roger Quadros Tested-by: Mugunthan V N Signed-off-by: Lokesh Vutla Signed-off-by: Sekhar Nori Signed-off-by: Dave Gerlach Acked-by: Rob Herring Cc: Signed-off-by: Paul Walmsley Documentation/devicetree/bindings/arm/omap/omap.txt | 1 + arch/arm/mach-omap2/omap_hwmod.c | 9 ++++++++- arch/arm/mach-omap2/omap_hwmod.h | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) commit 4de13d7ed6ffdcbb34317acaa9236f121176f5f8 Author: Parthasarathy Bhuvaragan Date: Thu Mar 3 17:54:54 2016 +0100 tipc: fix nullptr crash during subscription cancel commit 4d5cfcba2f6e ('tipc: fix connection abort during subscription cancel'), removes the check for a valid subscription before calling tipc_nametbl_subscribe(). This will lead to a nullptr exception when we process a subscription cancel request. For a cancel request, a null subscription is passed to tipc_nametbl_subscribe() resulting in exception. In this commit, we call tipc_nametbl_subscribe() only for a valid subscription. Fixes: 4d5cfcba2f6e ('tipc: fix connection abort during subscription cancel') Reported-by: Anders Widell Signed-off-by: Parthasarathy Bhuvaragan Acked-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/subscr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 11f7f79b40ebfbac6a1bcdbc61d5d13d365e744b Author: Colin Ian King Date: Thu Mar 3 13:47:18 2016 +0000 net: eth: altera: do not free array priv->mdio->irq priv->mdio->irq used to be allocated and required freeing, but it is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/altera/altera_tse_main.c | 1 - 1 file changed, 1 deletion(-) commit 57a0f3675489181c31636d204fa5c5daf5fa3c83 Author: Colin Ian King Date: Thu Mar 3 13:43:34 2016 +0000 net/ethoc: do not free array priv->mdio->irq priv->mdio->irq used to be allocated and required freeing, but it is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King Reviewed-by: Tobias Klauser Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/ethoc.c | 1 - 1 file changed, 1 deletion(-) commit 44ef548f4f8bbc739070583f9844ff0cd8fcc6b4 Author: Phil Sutter Date: Thu Mar 3 14:34:14 2016 +0100 net: sched: fix act_ipt for LOG target Before calling the destroy() or target() callbacks, the family parameter field has to be initialized. Otherwise at least the LOG target will refuse to work and upon removal oops the kernel. Cc: Jamal Hadi Salim Signed-off-by: Phil Sutter Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller net/sched/act_ipt.c | 2 ++ 1 file changed, 2 insertions(+) commit eb1f420214adf81fd98d9e8df6b60318ef883102 Author: Colin Ian King Date: Thu Mar 3 13:27:56 2016 +0000 asix: do not free array priv->mdio->irq Used to be allocated and required freeing, but now priv->mdio->irq is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/usb/ax88172a.c | 1 - 1 file changed, 1 deletion(-) commit 7bfc60822d1cd44069f4fdb16f81a66f716bf787 Author: Atsushi Nemoto Date: Thu Mar 3 09:07:51 2016 +0900 gianfar: Enable eTSEC-106 erratum w/a for MPC8548E Rev2 Enable workaround for MPC8548E erratum eTSEC 106, "Excess delays when transmitting TOE=1 large frames". (see commit 53fad77375ce "gianfar: Enable eTSEC-20 erratum w/a for P2020 Rev1") This erratum was fixed in Rev 3.1.x. Signed-off-by: Atsushi Nemoto Acked-by: Claudiu Manoil Signed-off-by: David S. Miller drivers/net/ethernet/freescale/gianfar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f6cede5b49e822ebc41a099fe41ab4989f64e2cb Author: Linus Torvalds Date: Sun Mar 6 14:48:03 2016 -0800 Linux 4.5-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d55e08c8448def74ae4236cd6e1c3714d78f5abd Merge: dd273a8 f3c87e9 Author: Linus Torvalds Date: Sun Mar 6 14:14:54 2016 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fix from Olof Johansson: "Tiny fixes branch this week, in fact only one patch. Turns out the USB support for a Renesas board was developed on a pre-release board that ended up being changed before shipping. To avoid breakage on those boards, and avoid confusion, it's a reasonable idea to patch now instead of later. There are no known users of the pre-release variant any more" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: porter: remove enable prop from HS-USB device node commit dd273a8071124c2235c45d2ca756acc90ca31ed3 Merge: 21b27a7 f474c8c Author: Linus Torvalds Date: Sun Mar 6 13:51:27 2016 -0800 Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Just two ARM fixes this time: one to fix the hyp-stub for older ARM CPUs, and another to fix the set_memory_xx() permission functions to deal with zero sizes correctly" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8544/1: set_memory_xx fixes ARM: 8534/1: virt: fix hyp-stub build for pre-ARMv7 CPUs commit 7f6aff3a29b08fc4234c8136eb1ac31b4897522c Author: Brian Foster Date: Mon Mar 7 08:22:22 2016 +1100 xfs: only run torn log write detection on dirty logs XFS uses CRC verification over a sub-range of the head of the log to detect and handle torn writes. This torn log write detection currently runs unconditionally at mount time, regardless of whether the log is dirty or clean. This is problematic in cases where a filesystem might end up being moved across different, incompatible (i.e., opposite byte-endianness) architectures. The problem lies in the fact that log data is not necessarily written in an architecture independent format. For example, certain bits of data are written in native endian format. Further, the size of certain log data structures differs (i.e., struct xlog_rec_header) depending on the word size of the cpu. This leads to false positive crc verification errors and ultimately failed mounts when a cleanly unmounted filesystem is mounted on a system with an incompatible architecture from data that was written near the head of the log. Update the log head/tail discovery code to run torn write detection only when the log is not clean. This means something other than an unmount record resides at the head of the log and log recovery is imminent. It is a requirement to run log recovery on the same type of host that had written the content of the dirty log and therefore CRC failures are legitimate corruptions in that scenario. Reported-by: Jan Beulich Tested-by: Jan Beulich Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner fs/xfs/xfs_log_recover.c | 42 +++++++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 11 deletions(-) commit 717bc0ebca0bce9cb3edfc31b49b384a1d55db1c Author: Brian Foster Date: Mon Mar 7 08:22:22 2016 +1100 xfs: refactor in-core log state update to helper Once the record at the head of the log is identified and verified, the in-core log state is updated based on the record. This includes information such as the current head block and cycle, the start block of the last record written to the log, the tail lsn, etc. Once torn write detection is conditional, this logic will need to be reused. Factor the code to update the in-core log data structures into a new helper function. This patch does not change behavior. Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner fs/xfs/xfs_log_recover.c | 52 ++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 19 deletions(-) commit 65b99a08b350876e8835fc0e7173598165f64dee Author: Brian Foster Date: Mon Mar 7 08:22:22 2016 +1100 xfs: refactor unmount record detection into helper Once the mount sequence has identified the head and tail blocks of the physical log, the record at the head of the log is located and examined for an unmount record to determine if the log is clean. This currently occurs after torn write verification of the head region of the log. This must ultimately be separated from torn write verification and may need to be called again if the log head is walked back due to a torn write (to determine whether the new head record is an unmount record). Separate this logic into a new helper function. This patch does not change behavior. Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner fs/xfs/xfs_log_recover.c | 153 ++++++++++++++++++++++++++++------------------- 1 file changed, 93 insertions(+), 60 deletions(-) commit 82ff6cc26e98f9bba8e2a10f727e335fa241cc47 Author: Brian Foster Date: Mon Mar 7 08:22:22 2016 +1100 xfs: separate log head record discovery from verification The code that locates the log record at the head of the log is buried in the log head verification function. This is fine when torn write verification occurs unconditionally, but this behavior is problematic for filesystems that might be moved across systems with different architectures. In preparation for separating examination of the log head for unmount records from torn write detection, lift the record location logic out of the log verification function and into the caller. This patch does not change behavior. Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner fs/xfs/xfs_log_recover.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit 21b27a74ec0f4e52e001912c89570a49494705a2 Merge: a58b9ad 5ea5c5e Author: Linus Torvalds Date: Sun Mar 6 11:31:13 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull ceph fix from Sage Weil: "This is a final commit we missed to align the protocol compatibility with the feature bits. It decodes a few extra fields in two different messages and reports EIO when they are used (not yet supported)" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: initial CEPH_FEATURE_FS_FILE_LAYOUT_V2 support commit a58b9adaf9f0913af2e5bf69565266335033b4fd Merge: 1306b04 e4f6daa Author: Linus Torvalds Date: Sun Mar 6 11:24:05 2016 -0800 Merge tag 'upstream-4.5-rc7' of git://git.infradead.org/linux-ubifs Pull UBI fix from Richard Weinberger: "This contains a single bug fix for UBI" * tag 'upstream-4.5-rc7' of git://git.infradead.org/linux-ubifs: ubi: Fix out of bounds write in volume update code commit 1306b0471ff11409e4f18f3cde00215d367e007a Merge: 76d9c6c ad32a1f Author: Linus Torvalds Date: Sun Mar 6 11:19:28 2016 -0800 Merge branch 'for-linus-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML fixes from Richard Weinberger: "This contains three bug/build fixes" * 'for-linus-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: use %lx format specifiers for unsigned longs um: Export pm_power_off Revert "um: Fix get_signal() usage" commit 76d9c6c1c6eb115c2c686d5cbf10a68857511853 Merge: b8155fe e723e3f Author: Linus Torvalds Date: Sun Mar 6 11:14:16 2016 -0800 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: "Another round of fixes for 4.5: - Fix the use of an undocumented syntactial variant of the .type pseudo op which is not supported by the LLVM assembler. - Fix invalid initialization on S-cache-less systems. - Fix possible information leak from the kernel stack for SIGFPE. - Fix handling of copy_{from,to}_user() return value in KVM - Fix the last instance of irq_to_gpio() which now was causing build errors" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' MIPS: kvm: Fix ioctl error handling. MIPS: scache: Fix scache init with invalid line size. MIPS: Avoid variant of .type unsupported by LLVM Assembler MIPS: jz4740: Fix surviving instance of irq_to_gpio() commit b8155fe1b2963ab2c53140929eb2362afcb9ccfe Merge: 7addb7f 37c5e94 Author: Linus Torvalds Date: Sun Mar 6 11:08:06 2016 -0800 Merge tag 'powerpc-4.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - cxl: Fix PSL timebase synchronization detection from Frederic Barrat - Fix oops when destroying hw_breakpoint event from Ravi Bangoria - Avoid lbarx on e5500 from Scott Wood * tag 'powerpc-4.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/fsl-book3e: Avoid lbarx on e5500 powerpc/hw_breakpoint: Fix oops when destroying hw_breakpoint event cxl: Fix PSL timebase synchronization detection commit 7addb7fa1085e29398c2aef43f0b98c3c4b7e749 Merge: 3e09b7e 7314d22 Author: Linus Torvalds Date: Sun Mar 6 11:03:34 2016 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "One I2C bugfix ensuring correct memory allocation in a driver" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: brcmstb: allocate correct amount of memory for regmap commit 3e09b7e93dae6cd9fcabc5dd36fc6973d3049c30 Merge: 6794402 861c384 Author: Linus Torvalds Date: Sun Mar 6 10:50:00 2016 -0800 Merge tag 'usb-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB driver ids for 4.5-rc7, and the removal of a driver we merged in 4.5-rc1 but it turns out it's not needed as the hardware is the same as a driver we already have in the tree. This was only figured out after doing a lot of cleanup on it, gotta love vendor-provided drivers... The new device ids for the devices for this driver will be added later on when testing is completed, but for now, we will remove the driver to keep people from accidentally cleaning it up. All of these have been in linux-next for a while with no reported issues" * tag 'usb-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: qcserial: add Sierra Wireless EM74xx device ID Revert "USB: serial: add Moxa UPORT 11x0 driver" USB: serial: option: add support for Quectel UC20 USB: serial: option: add support for Telit LE922 PID 0x1045 USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) usb: chipidea: otg: change workqueue ci_otg as freezable commit 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d Author: Nicholas Bellinger Date: Sat Mar 5 20:00:12 2016 -0800 target: Drop incorrect ABORT_TASK put for completed commands This patch fixes a recent ABORT_TASK regression associated with commit febe562c, where a left-over target_put_sess_cmd() would still be called when __target_check_io_state() detected a command has already been completed, and explicit ABORT must be avoided. Note commit febe562c dropped the local kref_get_unless_zero() check in core_tmr_abort_task(), but did not drop this extra corresponding target_put_sess_cmd() in the failure path. So go ahead and drop this now bogus target_put_sess_cmd(), and avoid this potential use-after-free. Reported-by: Dan Lane Cc: Quinn Tran Cc: Himanshu Madhani Cc: Sagi Grimberg Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Andy Grover Cc: Mike Christie Cc: stable@vger.kernel.org # 3.14+ Signed-off-by: Nicholas Bellinger drivers/target/target_core_tmr.c | 1 - 1 file changed, 1 deletion(-) commit ad32a1f3c36b046b2e7b0361b88c18e3af61419e Author: Colin Ian King Date: Sat Jan 23 19:17:59 2016 +0000 um: use %lx format specifiers for unsigned longs static analysis from cppcheck detected %x being used for unsigned longs: [arch/x86/um/os-Linux/task_size.c:112]: (warning) %x in format string (no. 1) requires 'unsigned int' but the argument type is 'unsigned long'. Use %lx instead of %x Signed-off-by: Colin Ian King Signed-off-by: Richard Weinberger arch/x86/um/os-Linux/task_size.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0834f9cc9f1c5a104e87000378b9cda290c4f406 Author: Richard Weinberger Date: Mon Jan 25 23:24:21 2016 +0100 um: Export pm_power_off ...modules are using this symbol. Export it like all other archs to. Signed-off-by: Richard Weinberger arch/um/kernel/reboot.c | 1 + 1 file changed, 1 insertion(+) commit 322740efbb7ca26df845161e61cc41484b7e328e Author: Richard Weinberger Date: Mon Jan 25 23:33:30 2016 +0100 Revert "um: Fix get_signal() usage" Commit db2f24dc240856fb1d78005307f1523b7b3c121b was plain wrong. I did not realize the we are allowed to loop here. In fact we have to loop and must not return to userspace before all SIGSEGVs have been delivered. Other archs do this directly in their entry code, UML does it here. Reported-by: Al Viro Signed-off-by: Richard Weinberger arch/um/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e4f6daac20332448529b11f09388f1d55ef2084c Author: Richard Weinberger Date: Sun Feb 21 10:53:03 2016 +0100 ubi: Fix out of bounds write in volume update code ubi_start_leb_change() allocates too few bytes. ubi_more_leb_change_data() will write up to req->upd_bytes + ubi->min_io_size bytes. Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger Reviewed-by: Boris Brezillon drivers/mtd/ubi/upd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67944024c1cdd897e49a09b0d6af3ea38d1388ca Merge: 40fea2e 790b415 Author: Linus Torvalds Date: Sat Mar 5 12:35:48 2016 -0800 Merge tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's our tradition to get a high volume of fixes late at rc7: this time, X32 ABI breakage was found and this resulted in a high number LOCs. The necessary changes to ALSA core codes were fairly straightforward, and more importantly, they are specific to X32, thus should be safe to apply. Other than that, rather a collection of small fixes: - Removal of the code that blocks too long at closing the OSS sequencer client (which was spotted by syzkaller, unsurprisingly) - Fixes races at HD-audio HDMI i915 audio binding - a few HDSP/HDPM zero-division fixes - Quirks for HD-audio and USB-audio as usual" * tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - hdmi defer to register acomp eld notifier ALSA: hda - hdmi add wmb barrier for audio component ALSA: hda - Fix mic issues on Acer Aspire E1-472 ALSA: seq: oss: Don't drain at closing a client ALSA: usb-audio: Add a quirk for Plantronics DA45 ALSA: hdsp: Fix wrong boolean ctl value accesses ALSA: hdspm: Fix zero-division ALSA: hdspm: Fix wrong boolean ctl value accesses ALSA: timer: Fix ioctls for X32 ABI ALSA: timer: Fix broken compat timer user status ioctl ALSA: rawmidi: Fix ioctls X32 ABI ALSA: rawmidi: Use comapt_put_timespec() ALSA: pcm: Fix ioctls for X32 ABI ALSA: ctl: Fix ioctls for X32 ABI commit 40fea2ed0bcedcab6a7c318f4be2df2bcab4f2eb Merge: ee8f395 f169212 Author: Linus Torvalds Date: Sat Mar 5 12:34:29 2016 -0800 Merge tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fix from Vinod Koul: "One minor fix on pxa driver to fix the cyclic dma tranfers" * tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: pxa_dma: fix cyclic transfers commit ee8f3955c0ef4c7a90a5f707c37c4cb3711ff626 Merge: a7c9b60 fbe093a Author: Linus Torvalds Date: Sat Mar 5 12:32:34 2016 -0800 Merge tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - some last time changes before we stablize the new entity function integer numbers at uAPI - probe: fix erroneous return value on i2c/adp1653 driver - fix tx 5v detect regression on adv7604 driver - fix missing unlock on error in vpfe_prepare_pipeline() on davinci_vpfe driver * tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] media: Sanitise the reserved fields of the G_TOPOLOGY IOCTL arguments [media] media.h: postpone connectors entities [media] media.h: use hex values for range offsets, move connectors base up. [media] adv7604: fix tx 5v detect regression [media] media.h: get rid of MEDIA_ENT_F_CONN_TEST [media] [for,v4.5] media.h: increase the spacing between function ranges [media] media: i2c/adp1653: probe: fix erroneous return value [media] media: davinci_vpfe: fix missing unlock on error in vpfe_prepare_pipeline() commit 1e1490a38504419e349caa1b7d55d5c141a9bccb Author: Mario Kleiner Date: Tue Mar 1 21:31:17 2016 +0100 drm/radeon: Fix error handling in radeon_flip_work_func. This is a port of the patch "drm/amdgpu: Fix error handling in amdgpu_flip_work_func." to fix the following problem for radeon as well which was reported against amdgpu: The patch e1d09dc0ccc6: "drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc." from Feb 19, 2016, leads to the following static checker warning, as reported by Dan Carpenter in https://lists.freedesktop.org/archives/dri-devel/2016-February/101987.html drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:127 amdgpu_flip_work_func() warn: should this be 'repcnt == -1' drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:136 amdgpu_flip_work_func() error: double unlock 'spin_lock:&crtc->dev->event_lock' drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:136 amdgpu_flip_work_func() error: double unlock 'irqsave:flags' This patch fixes both reported problems: Change post-decrement of repcnt to pre-decrement, so it can't underflow anymore, but still performs up to three repetitions - three is the maximum one could expect in practice. Move the spin_unlock_irqrestore to where it actually belongs. Reviewed-by: Michel Dänzer Reported-by: Dan Carpenter Signed-off-by: Mario Kleiner Cc: # 4.4+ Cc: Michel Dänzer Cc: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 90e94b160c7f647ddffda707f5e3c0c66c170df8 Author: Mario Kleiner Date: Tue Mar 1 21:31:16 2016 +0100 drm/amdgpu: Fix error handling in amdgpu_flip_work_func. The patch e1d09dc0ccc6: "drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc." from Feb 19, 2016, leads to the following static checker warning, as reported by Dan Carpenter in https://lists.freedesktop.org/archives/dri-devel/2016-February/101987.html drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:127 amdgpu_flip_work_func() warn: should this be 'repcnt == -1' drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:136 amdgpu_flip_work_func() error: double unlock 'spin_lock:&crtc->dev->event_lock' drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:136 amdgpu_flip_work_func() error: double unlock 'irqsave:flags' This patch fixes both reported problems: Change post-decrement of repcnt to pre-decrement, so it can't underflow anymore, but still performs up to three repetitions - three is the maximum one could expect in practice. Move the spin_unlock_irqrestore to where it actually belongs. Reviewed-by: Michel Dänzer Reported-by: Dan Carpenter Signed-off-by: Mario Kleiner Cc: # 4.4+ Cc: Michel Dänzer Cc: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 02db17ff376893f65f45974b0897e70e6695034e Merge: b23229e 251d604 8019c0b 8293004 39a79fe da9b930 Author: Mark Brown Date: Sat Mar 5 21:27:13 2016 +0900 Merge remote-tracking branches 'asoc/fix/wm8985', 'asoc/fix/wm8994', 'asoc/fix/wm8996', 'asoc/fix/wm9081' and 'asoc/fix/wm9713' into asoc-linus commit b23229e4d5d883652160b061c52743482de8f82c Merge: 3b22371 316fa9e 8733f99 154a0fd 0cad105 c41a024 d078482 b5ab265 Author: Mark Brown Date: Sat Mar 5 21:26:58 2016 +0900 Merge remote-tracking branches 'asoc/fix/samsung', 'asoc/fix/tlv320dac33', 'asoc/fix/wl1273', 'asoc/fix/wm8753', 'asoc/fix/wm8904', 'asoc/fix/wm8958' and 'asoc/fix/wm8983' into asoc-linus commit 3b22371e202d2c2f48bb4192879cf611e91a97be Merge: 92e9f77 f4833a5 9af3904 58c0213 f4d438e 419396d a947b72 Author: Mark Brown Date: Sat Mar 5 21:26:45 2016 +0900 Merge remote-tracking branches 'asoc/fix/jack', 'asoc/fix/max98088', 'asoc/fix/max98095', 'asoc/fix/omap', 'asoc/fix/pxa' and 'asoc/fix/qcom-be' into asoc-linus commit 92e9f77306e3dddb707ae744333ea204c9727bac Merge: 6374fda 4b60631 7c139db 15c6657 89300b4 fe9aba1 56e5fd8 Author: Mark Brown Date: Sat Mar 5 21:26:33 2016 +0900 Merge remote-tracking branches 'asoc/fix/ab8500', 'asoc/fix/adau17x1', 'asoc/fix/adsp', 'asoc/fix/cs42l51', 'asoc/fix/da732x' and 'asoc/fix/fsl-ssi' into asoc-linus commit 6374fda1472524deaa492da1ce0adca600343996 Merge: 1c750eb 508ddfb Author: Mark Brown Date: Sat Mar 5 21:26:30 2016 +0900 Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus commit 1c750eb580d332f740af456748de4b206e442c3b Merge: fc77dbd 741338f Author: Mark Brown Date: Sat Mar 5 21:26:28 2016 +0900 Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus commit a7c9b603cf2371edacb054abc35597e810c1e5fd Merge: c12f83c 6e2452d Author: Linus Torvalds Date: Fri Mar 4 18:47:18 2016 -0800 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvcimm fix from Dan Williams: "One straggling fix for NVDIMM support. The KVM/QEMU enabling for NVDIMMs has recently reached the point where it is able to accept some ACPI _DSM requests from a guest VM. However they immediately found that the 4.5-rc kernel is unusable because the kernel's 'nfit' driver fails to load upon seeing a valid "not supported" response from the virtual BIOS for an address range scrub command. It is not mandatory that a platform implement address range scrubbing, so this fix from Vishal properly treats the 'not supported' response as 'skip scrubbing and continue loading the driver'" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nfit: Continue init even if ARS commands are unimplemented commit c12f83c3099c4dd73fe721409d2ce18ca79a753d Merge: fab3e94 21b8171 Author: Linus Torvalds Date: Fri Mar 4 18:41:40 2016 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two fairly simple fixes. One is a regression with ipr firmware loading caused by one of the trivial patches in the last merge window which failed to strip the \n from the file name string, so now the firmware loader no longer works leading to a lot of unhappy ipr users; fix by stripping the \n. The second is a memory leak within SCSI: the BLK_PREP_INVALID state was introduced a recent fix but we forgot to account for it correctly when freeing state, resulting in memory leakage. Add the correct state freeing in scsi_prep_return()" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: ipr: Fix regression when loading firmware SCSI: Free resources when we return BLKPREP_INVALID commit fab3e94a624f6ac6c4d8b8dc027bb03818a6cf1b Merge: e5322c5 dc8b4af Author: Linus Torvalds Date: Fri Mar 4 18:31:36 2016 -0800 Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "Assorted fixes for libata drivers. - Turns out HDIO_GET_32BIT ioctl was subtly broken all along. - Recent update to ahci external port handling was incorrectly marking hotpluggable ports as external making userland handle devices connected to those ports incorrectly. - ahci_xgene needs its own irq handler to work around a hardware erratum. libahci updated to allow irq handler override. - Misc driver specific updates" * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: ata: ahci: don't mark HotPlugCapable Ports as external/removable ahci: Workaround for ThunderX Errata#22536 libata: Align ata_device's id on a cacheline Adding Intel Lewisburg device IDs for SATA pata-rb532-cf: get rid of the irq_to_gpio() call libata: fix HDIO_GET_32BIT ioctl ahci_xgene: Implement the workaround to fix the missing of the edge interrupt for the HOST_IRQ_STAT. ata: Remove the AHCI_HFLAG_EDGE_IRQ support from libahci. libahci: Implement the capability to override the generic ahci interrupt handler. commit e5322c54068162846fdbac0f0891cd95f37d4c4e Merge: bdf9d29 4d6af73 Author: Linus Torvalds Date: Fri Mar 4 18:17:17 2016 -0800 Merge branch 'for-linus2' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Round 2 of this. I cut back to the bare necessities, the patch is still larger than it usually would be at this time, due to the number of NVMe fixes in there. This pull request contains: - The 4 core fixes from Ming, that fix both problems with exceeding the virtual boundary limit in case of merging, and the gap checking for cloned bio's. - NVMe fixes from Keith and Christoph: - Regression on larger user commands, causing problems with reading log pages (for instance). This touches both NVMe, and the block core since that is now generally utilized also for these types of commands. - Hot removal fixes. - User exploitable issue with passthrough IO commands, if !length is given, causing us to fault on writing to the zero page. - Fix for a hang under error conditions - And finally, the current series regression for umount with cgroup writeback, where the final flush would happen async and hence open up window after umount where the device wasn't consistent. fsck right after umount would show this. From Tejun" * 'for-linus2' of git://git.kernel.dk/linux-block: block: support large requests in blk_rq_map_user_iov block: fix blk_rq_get_max_sectors for driver private requests nvme: fix max_segments integer truncation nvme: set queue limits for the admin queue writeback: flush inode cgroup wb switches instead of pinning super_block NVMe: Fix 0-length integrity payload NVMe: Don't allow unsupported flags NVMe: Move error handling to failed reset handler NVMe: Simplify device reset failure NVMe: Fix namespace removal deadlock NVMe: Use IDA for namespace disk naming NVMe: Don't unmap controller registers on reset block: merge: get the 1st and last bvec via helpers block: get the 1st and last bvec via helpers block: check virt boundary in bio_will_gap() block: bio: introduce helpers to get the 1st and last bvec commit bdf9d29799296fd787a9d2b99cb8feff77e2b9db Merge: 638c201 11d8d64 Author: Linus Torvalds Date: Fri Mar 4 18:06:49 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "Additional 4.5-rc6 fixes. I have four patches today. I had previously thought I had submitted two of them last week, but they were accidentally skipped :-(. - One fix to an error path in the core - One fix for RoCE in the core - Two related fixes for the core/mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/core: Use GRH when the path hop-limit > 0 IB/{core, mlx5}: Fix input len in vendor part of create_qp/srq IB/mlx5: Avoid using user-index for SRQs IB/core: Fix missed clean call in registration path commit 638c201e3fffd2699e58305030d58730355ece12 Merge: b80e8e2 26bae5e Author: Linus Torvalds Date: Fri Mar 4 17:56:48 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This contains one i915 patch twice, as I merged it locally for testing, and then pulled some stuff in on top, and then Jani sent to me, I didn't think it was worth redoing all the merges of what I had tested. Summary: - amdgpu/radeon fixes for some more power management and VM races. - Two i915 fixes, one for the a recent regression, one another power management fix for skylake. - Two tegra dma mask fixes for a regression. - One ast fix for a typo I made transcribing the userspace driver, that I'd like to get into stable so I don't forget about it" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: gpu: host1x: Set DMA ops on device creation gpu: host1x: Set DMA mask drm/amdgpu: return from atombios_dp_get_dpcd only when error drm/amdgpu/cz: remove commented out call to enable vce pg drm/amdgpu/powerplay/cz: enable/disable vce dpm independent of vce pg drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled drm/amdgpu/gfx8: specify which engine to wait before vm flush drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well drm/amd/powerplay: send event to notify powerplay all modules are initialized. drm/amd/powerplay: export AMD_PP_EVENT_COMPLETE_INIT task to amdgpu. drm/radeon/pm: update current crtc info after setting the powerstate drm/amdgpu/pm: update current crtc info after setting the powerstate drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) drm/i915/skl: Fix power domain suspend sequence drm/ast: Fix incorrect register check for DRAM width drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) commit b80e8e2811ecb2ace7ff851d887fe8b6db4425bf Merge: ed385c7 bfc6b97 Author: Linus Torvalds Date: Fri Mar 4 17:51:16 2016 -0800 Merge tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI fixes from Rafael Wysocki: "Two build fixes for cpufreq drivers (including one for breakage introduced recently) and a fix for a graph tracer crash when used over suspend-to-RAM on x86. Specifics: - Prevent the graph tracer from crashing when used over suspend-to- RAM on x86 by pausing it before invoking do_suspend_lowlevel() and un-pausing it when that function has returned (Todd Brandt). - Fix build issues in the qoriq and mediatek cpufreq drivers related to broken dependencies on THERMAL (Arnd Bergmann)" * tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / sleep / x86: Fix crash on graph trace through x86 suspend cpufreq: mediatek: allow building as a module cpufreq: qoriq: allow building as module with THERMAL=m commit ed385c7a1752e6a87622e5a2a80808cfb8917305 Merge: c51797d dfd55ad Author: Linus Torvalds Date: Fri Mar 4 17:43:40 2016 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Will Deacon: "Arm64 fix for -rc7. Without it, our struct page array can overflow the vmemmap region on systems with a large PHYS_OFFSET. Nothing else on the radar at the moment, so hopefully that's it for 4.5 from us. Summary: Ensure struct page array fits within vmemmap area" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: vmemmap: use virtual projection of linear region commit c51797d25d84833804e9e6950c8c1abbe6c73808 Merge: 2cdcb2b 44248af Author: Linus Torvalds Date: Fri Mar 4 17:36:46 2016 -0800 Merge tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd Pull jffs2 fixes from David Woodhouse: "This contains two important JFFS2 fixes marked for stable: - a lock ordering problem between the page lock and the internal f->sem mutex, which was causing occasional deadlocks in garbage collection - a scan failure causing moved directories to sometimes end up appearing to have hard links. There are also a couple of trivial MAINTAINERS file updates" * tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd: MAINTAINERS: add maintainer entry for FREESCALE GPMI NAND driver Fix directory hardlinks from deleted directories jffs2: Fix page lock / f->sem deadlock Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" MAINTAINERS: update Han's email commit 2cdcb2b5b5d6d7c1bdefbc1a63187d47fd809408 Merge: 78baab7 909c3a2 Author: Linus Torvalds Date: Fri Mar 4 17:31:32 2016 -0800 Merge branch 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fix from Chris Mason: "Filipe nailed down a problem where tree log replay would do some work that orphan code wasn't expecting to be done yet, leading to BUG_ON" * 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: fix loading of orphan roots leading to BUG_ON commit c57753d4541d5104284abbdceb841e690394e55f Author: Jorge Ramirez-Ortiz Date: Tue Mar 1 16:04:00 2016 -0500 mtd: nand: tests: fix regression introduced in mtd_nandectest Offending Commit: 6e94119 "mtd: nand: return consistent error codes in ecc.correct() implementations" The new error code was not being handled properly in double bit error detection. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Boris Brezillon Tested-by: Franklin S Cooper Jr Signed-off-by: Brian Norris drivers/mtd/tests/mtd_nandecctest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 78baab7aa843ef01644195d341bee118cbe4bf19 Merge: e3c2ef4 e57cbaf Author: Linus Torvalds Date: Fri Mar 4 16:57:04 2016 -0800 Merge tag 'trace-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "A feature was added in 4.3 that allowed users to filter trace points on a tasks "comm" field. But this prevented filtering on a comm field that is within a trace event (like sched_migrate_task). When trying to filter on when a program migrated, this change prevented the filtering of the sched_migrate_task. To fix this, the event fields are examined first, and then the extra fields like "comm" and "cpu" are examined. Also, instead of testing to assign the comm filter function based on the field's name, the generic comm field is given a new filter type (FILTER_COMM). When this field is used to filter the type is checked. The same is done for the cpu filter field. Two new special filter types are added: "COMM" and "CPU". This allows users to still filter the tasks comm for events that have "comm" as one of their fields, in cases that users would like to filter sched_migrate_task on the comm of the task that called the event, and not the comm of the task that is being migrated" * tag 'trace-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Do not have 'comm' filter override event 'comm' field commit 6e2452dff4441e3dc24d415c8b2cda8a3ba52116 Author: Vishal Verma Date: Thu Mar 3 15:39:41 2016 -0700 nfit: Continue init even if ARS commands are unimplemented If firmware doesn't implement any of the ARS commands, take that to mean that ARS is unsupported, and continue to initialize regions without bad block lists. We cannot make the assumption that ARS commands will be unconditionally supported on all NVDIMMs. Reported-by: Haozhong Zhang Signed-off-by: Vishal Verma Acked-by: Xiao Guangrong Tested-by: Haozhong Zhang Signed-off-by: Dan Williams drivers/acpi/nfit.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit f474c8c857d996f34c39f66bbed23faaa739fad6 Author: Mika Penttilä Date: Mon Feb 22 17:56:52 2016 +0100 ARM: 8544/1: set_memory_xx fixes Allow zero size updates. This makes set_memory_xx() consistent with x86, s390 and arm64 and makes apply_to_page_range() not to BUG() when loading modules. Signed-off-by: Mika Penttilä mika.penttila@nextfour.com Signed-off-by: Russell King arch/arm/mm/pageattr.c | 3 +++ 1 file changed, 3 insertions(+) commit 26bae5e04c3570728787f809b13546a8169fdf95 Merge: 0dff973 c95469a Author: Dave Airlie Date: Sat Mar 5 07:53:25 2016 +1000 Merge tag 'drm/tegra/for-4.5-rc7' of git://anongit.freedesktop.org/tegra/linux into drm-fixes drm/tegra: Fixes for v4.5-rc7 Two small fixes that restore PRIME support. * tag 'drm/tegra/for-4.5-rc7' of git://anongit.freedesktop.org/tegra/linux: gpu: host1x: Set DMA ops on device creation gpu: host1x: Set DMA mask commit e723e3f7f9591b79e8c56b3d7c5a204a9c571b55 Author: Maciej W. Rozycki Date: Fri Mar 4 01:42:49 2016 +0000 MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Avoid sending a partially initialised `siginfo_t' structure along SIGFPE signals issued from `do_ov' and `do_trap_or_bp', leading to information leaking from the kernel stack. Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org Signed-off-by: Ralf Baechle arch/mips/kernel/traps.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit bfc6b97d528def357adcbdadf71b21c8e5f7dbc4 Merge: fc77dbd 3c2002a 92f9e17 Author: Rafael J. Wysocki Date: Fri Mar 4 22:41:05 2016 +0100 Merge branches 'pm-cpufreq-fixes' and 'pm-sleep-fixes' * pm-cpufreq-fixes: cpufreq: mediatek: allow building as a module cpufreq: qoriq: allow building as module with THERMAL=m * pm-sleep-fixes: PM / sleep / x86: Fix crash on graph trace through x86 suspend commit 5ea5c5e0a7f70b256417d3b6e36bd9851504babd Author: Yan, Zheng Date: Sun Feb 14 18:06:41 2016 +0800 ceph: initial CEPH_FEATURE_FS_FILE_LAYOUT_V2 support Add support for the format change of MClientReply/MclientCaps. Also add code that denies access to inodes with pool_ns layouts. Signed-off-by: Yan, Zheng Reviewed-by: Sage Weil fs/ceph/addr.c | 4 ++++ fs/ceph/caps.c | 27 ++++++++++++++++++++++++--- fs/ceph/inode.c | 2 ++ fs/ceph/mds_client.c | 16 ++++++++++++++++ fs/ceph/mds_client.h | 1 + fs/ceph/super.h | 1 + include/linux/ceph/ceph_features.h | 1 + 7 files changed, 49 insertions(+), 3 deletions(-) commit 390fd4fa9f1053e282e871af42eb32ba0ea76f88 Merge: c1bb0a5 d694b06 Author: David S. Miller Date: Fri Mar 4 14:32:47 2016 -0500 Merge tag 'linux-can-fixes-for-4.5-20160304' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-03-04 this is a pull request for net/master. There is one patch from Ed Spiridonov, which increases the performance of the mcp251x SPI CAN driver, by avoiding to write to error flag register if it's unnecessary. ==================== Signed-off-by: David S. Miller commit c95469aa5a188384ccf8ac520ece931c66caf8aa Author: Alexandre Courbot Date: Fri Feb 26 18:06:53 2016 +0900 gpu: host1x: Set DMA ops on device creation Currently host1x-instanciated devices have their dma_ops left to NULL, which makes any DMA operation (like buffer import) on ARM64 fallback to the dummy_dma_ops and fail with an error. This patch calls of_dma_configure() with the host1x node when creating such a device, so the proper DMA operations are set. Suggested-by: Thierry Reding Signed-off-by: Alexandre Courbot Signed-off-by: Thierry Reding drivers/gpu/host1x/bus.c | 2 ++ 1 file changed, 2 insertions(+) commit 097452e61366a939a4772332181cea7cdcc74760 Author: Alexandre Courbot Date: Fri Feb 26 18:06:52 2016 +0900 gpu: host1x: Set DMA mask The default DMA mask covers a 32 bits address range, but host1x devices can address a larger range on TK1 and TX1. Set the DMA mask to the range addressable when we use the IOMMU to prevent the use of bounce buffers. Signed-off-by: Alexandre Courbot Signed-off-by: Thierry Reding drivers/gpu/host1x/dev.c | 7 +++++++ drivers/gpu/host1x/dev.h | 1 + 2 files changed, 8 insertions(+) commit e57cbaf0eb006eaa207395f3bfd7ce52c1b5539c Author: Steven Rostedt (Red Hat) Date: Thu Mar 3 17:18:20 2016 -0500 tracing: Do not have 'comm' filter override event 'comm' field Commit 9f61668073a8d "tracing: Allow triggers to filter for CPU ids and process names" added a 'comm' filter that will filter events based on the current tasks struct 'comm'. But this now hides the ability to filter events that have a 'comm' field too. For example, sched_migrate_task trace event. That has a 'comm' field of the task to be migrated. echo 'comm == "bash"' > events/sched_migrate_task/filter will now filter all sched_migrate_task events for tasks named "bash" that migrates other tasks (in interrupt context), instead of seeing when "bash" itself gets migrated. This fix requires a couple of changes. 1) Change the look up order for filter predicates to look at the events fields before looking at the generic filters. 2) Instead of basing the filter function off of the "comm" name, have the generic "comm" filter have its own filter_type (FILTER_COMM). Test against the type instead of the name to assign the filter function. 3) Add a new "COMM" filter that works just like "comm" but will filter based on the current task, even if the trace event contains a "comm" field. Do the same for "cpu" field, adding a FILTER_CPU and a filter "CPU". Cc: stable@vger.kernel.org # v4.3+ Fixes: 9f61668073a8d "tracing: Allow triggers to filter for CPU ids and process names" Reported-by: Matt Fleming Signed-off-by: Steven Rostedt include/linux/trace_events.h | 2 ++ kernel/trace/trace_events.c | 14 ++++++++------ kernel/trace/trace_events_filter.c | 13 +++++++------ 3 files changed, 17 insertions(+), 12 deletions(-) commit d694b06c42a56c9610861ee0474b4d441af8ada6 Author: Ed Spiridonov Date: Fri Mar 4 09:07:27 2016 +0300 can: mcp251x: avoid write to error flag register if it's unnecessary Only two bits (RX0OVR and RX1OVR) are writable in EFLG, write is useless if these bits aren't set. Signed-off-by: Ed Spiridonov Signed-off-by: Marc Kleine-Budde drivers/net/can/spi/mcp251x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 790b415c98de62602810b0eedce26f0f9d6ddd78 Author: Libin Yang Date: Fri Mar 4 14:33:43 2016 +0800 ALSA: hda - hdmi defer to register acomp eld notifier Defer to register acomp eld notifier until hdmi audio driver is fully ready. After registering eld notifier, gfx driver can use this callback function to notify audio driver the monitor connection event. However this action may happen when audio driver is adding the pins or doing other initialization. This is not always safe, however. For example, using per_pin->lock before the lock is initialized. Let's register the eld notifier after the initialization is done. Signed-off-by: Libin Yang Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit ec75a940b1037e877efd9a5a9e94eab1e464f73b Author: Libin Yang Date: Fri Mar 4 14:33:06 2016 +0800 ALSA: hda - hdmi add wmb barrier for audio component To make sure audio_ptr is set before intel_audio_codec_enable() or intel_audio_codec_disable() calling pin_eld_notify(), this patch adds wmb barrier to prevent optimizing. Signed-off-by: Libin Yang Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 5 +++++ 1 file changed, 5 insertions(+) commit 37c5e942bb2eedd98c1cd1fa1f94d79f6b830c38 Author: Scott Wood Date: Wed Mar 2 22:51:04 2016 -0600 powerpc/fsl-book3e: Avoid lbarx on e5500 lbarx/stbcx. are implemented on e6500, but not on e5500. Likewise, SMT is on e6500, but not on e5500. So, avoid executing an unimplemented instruction by only locking when needed (i.e. in the presence of SMT). Signed-off-by: Scott Wood arch/powerpc/mm/hugetlbpage-book3e.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 0dff9738ec6dddf701821a6aa477ced809f17ef0 Merge: f0511e6 eda9089 Author: Dave Airlie Date: Fri Mar 4 13:51:53 2016 +1000 Merge tag 'drm-intel-fixes-2016-03-03' of git://anongit.freedesktop.org/drm-intel into drm-fixes Small conflict as I had the balance in my tree already for testing. * tag 'drm-intel-fixes-2016-03-03' of git://anongit.freedesktop.org/drm-intel: drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) drm/i915/skl: Fix power domain suspend sequence commit 909c3a22da3b8d2cfd3505ca5658f0176859d400 Author: Filipe Manana Date: Wed Mar 2 15:49:38 2016 +0000 Btrfs: fix loading of orphan roots leading to BUG_ON When looking for orphan roots during mount we can end up hitting a BUG_ON() (at root-item.c:btrfs_find_orphan_roots()) if a log tree is replayed and qgroups are enabled. This is because after a log tree is replayed, a transaction commit is made, which triggers qgroup extent accounting which in turn does backref walking which ends up reading and inserting all roots in the radix tree fs_info->fs_root_radix, including orphan roots (deleted snapshots). So after the log tree is replayed, when finding orphan roots we hit the BUG_ON with the following trace: [118209.182438] ------------[ cut here ]------------ [118209.183279] kernel BUG at fs/btrfs/root-tree.c:314! [118209.184074] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [118209.185123] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic ppdev xor raid6_pq evdev sg parport_pc parport acpi_cpufreq tpm_tis tpm psmouse processor i2c_piix4 serio_raw pcspkr i2c_core button loop autofs4 ext4 crc16 mbcache jbd2 sd_mod sr_mod cdrom ata_generic virtio_scsi ata_piix libata virtio_pci virtio_ring virtio scsi_mod e1000 floppy [last unloaded: btrfs] [118209.186318] CPU: 14 PID: 28428 Comm: mount Tainted: G W 4.5.0-rc5-btrfs-next-24+ #1 [118209.186318] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 [118209.186318] task: ffff8801ec131040 ti: ffff8800af34c000 task.ti: ffff8800af34c000 [118209.186318] RIP: 0010:[] [] btrfs_find_orphan_roots+0x1fc/0x244 [btrfs] [118209.186318] RSP: 0018:ffff8800af34faa8 EFLAGS: 00010246 [118209.186318] RAX: 00000000ffffffef RBX: 00000000ffffffef RCX: 0000000000000001 [118209.186318] RDX: 0000000080000000 RSI: 0000000000000001 RDI: 00000000ffffffff [118209.186318] RBP: ffff8800af34fb08 R08: 0000000000000001 R09: 0000000000000000 [118209.186318] R10: ffff8800af34f9f0 R11: 6db6db6db6db6db7 R12: ffff880171b97000 [118209.186318] R13: ffff8801ca9d65e0 R14: ffff8800afa2e000 R15: 0000160000000000 [118209.186318] FS: 00007f5bcb914840(0000) GS:ffff88023edc0000(0000) knlGS:0000000000000000 [118209.186318] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [118209.186318] CR2: 00007f5bcaceb5d9 CR3: 00000000b49b5000 CR4: 00000000000006e0 [118209.186318] Stack: [118209.186318] fffffbffffffffff 010230ffffffffff 0101000000000000 ff84000000000000 [118209.186318] fbffffffffffffff 30ffffffffffffff 0000000000000101 ffff880082348000 [118209.186318] 0000000000000000 ffff8800afa2e000 ffff8800afa2e000 0000000000000000 [118209.186318] Call Trace: [118209.186318] [] open_ctree+0x1e37/0x21b9 [btrfs] [118209.186318] [] btrfs_mount+0x97e/0xaed [btrfs] [118209.186318] [] ? trace_hardirqs_on+0xd/0xf [118209.186318] [] mount_fs+0x67/0x131 [118209.186318] [] vfs_kern_mount+0x6c/0xde [118209.186318] [] btrfs_mount+0x1ac/0xaed [btrfs] [118209.186318] [] ? trace_hardirqs_on+0xd/0xf [118209.186318] [] ? lockdep_init_map+0xb9/0x1b3 [118209.186318] [] mount_fs+0x67/0x131 [118209.186318] [] vfs_kern_mount+0x6c/0xde [118209.186318] [] do_mount+0x8a6/0x9e8 [118209.186318] [] SyS_mount+0x77/0x9f [118209.186318] [] entry_SYSCALL_64_fastpath+0x12/0x6b [118209.186318] Code: 64 00 00 85 c0 89 c3 75 24 f0 41 80 4c 24 20 20 49 8b bc 24 f0 01 00 00 4c 89 e6 e8 e8 65 00 00 85 c0 89 c3 74 11 83 f8 ef 75 02 <0f> 0b 4c 89 e7 e8 da 72 00 00 eb 1c 41 83 bc 24 00 01 00 00 00 [118209.186318] RIP [] btrfs_find_orphan_roots+0x1fc/0x244 [btrfs] [118209.186318] RSP [118209.230735] ---[ end trace 83938f987d85d477 ]--- So fix this by not treating the error -EEXIST, returned when attempting to insert a root already inserted by the backref walking code, as an error. The following test case for xfstests reproduces the bug: seq=`basename $0` seqres=$RESULT_DIR/$seq echo "QA output created by $seq" tmp=/tmp/$$ status=1 # failure is the default! trap "_cleanup; exit \$status" 0 1 2 3 15 _cleanup() { _cleanup_flakey cd / rm -f $tmp.* } # get standard environment, filters and checks . ./common/rc . ./common/filter . ./common/dmflakey # real QA test starts here _supported_fs btrfs _supported_os Linux _require_scratch _require_dm_target flakey _require_metadata_journaling $SCRATCH_DEV rm -f $seqres.full _scratch_mkfs >>$seqres.full 2>&1 _init_flakey _mount_flakey _run_btrfs_util_prog quota enable $SCRATCH_MNT # Create 2 directories with one file in one of them. # We use these just to trigger a transaction commit later, moving the file from # directory a to directory b and doing an fsync against directory a. mkdir $SCRATCH_MNT/a mkdir $SCRATCH_MNT/b touch $SCRATCH_MNT/a/f sync # Create our test file with 2 4K extents. $XFS_IO_PROG -f -s -c "pwrite -S 0xaa 0 8K" $SCRATCH_MNT/foobar | _filter_xfs_io # Create a snapshot and delete it. This doesn't really delete the snapshot # immediately, just makes it inaccessible and invisible to user space, the # snapshot is deleted later by a dedicated kernel thread (cleaner kthread) # which is woke up at the next transaction commit. # A root orphan item is inserted into the tree of tree roots, so that if a # power failure happens before the dedicated kernel thread does the snapshot # deletion, the next time the filesystem is mounted it resumes the snapshot # deletion. _run_btrfs_util_prog subvolume snapshot $SCRATCH_MNT $SCRATCH_MNT/snap _run_btrfs_util_prog subvolume delete $SCRATCH_MNT/snap # Now overwrite half of the extents we wrote before. Because we made a snapshpot # before, which isn't really deleted yet (since no transaction commit happened # after we did the snapshot delete request), the non overwritten extents get # referenced twice, once by the default subvolume and once by the snapshot. $XFS_IO_PROG -c "pwrite -S 0xbb 4K 8K" $SCRATCH_MNT/foobar | _filter_xfs_io # Now move file f from directory a to directory b and fsync directory a. # The fsync on the directory a triggers a transaction commit (because a file # was moved from it to another directory) and the file fsync leaves a log tree # with file extent items to replay. mv $SCRATCH_MNT/a/f $SCRATCH_MNT/a/b $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/a $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/foobar echo "File digest before power failure:" md5sum $SCRATCH_MNT/foobar | _filter_scratch # Now simulate a power failure and mount the filesystem to replay the log tree. # After the log tree was replayed, we used to hit a BUG_ON() when processing # the root orphan item for the deleted snapshot. This is because when processing # an orphan root the code expected to be the first code inserting the root into # the fs_info->fs_root_radix radix tree, while in reallity it was the second # caller attempting to do it - the first caller was the transaction commit that # took place after replaying the log tree, when updating the qgroup counters. _flakey_drop_and_remount echo "File digest before after failure:" # Must match what he got before the power failure. md5sum $SCRATCH_MNT/foobar | _filter_scratch _unmount_flakey status=0 exit Fixes: 2d9e97761087 ("Btrfs: use btrfs_get_fs_root in resolve_indirect_ref") Cc: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Reviewed-by: Qu Wenruo Signed-off-by: Chris Mason fs/btrfs/root-tree.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit c1bb0a5588816ec26abc08aa9adcf90e32656781 Author: Venkat Duvvuru Date: Wed Mar 2 06:00:28 2016 -0500 be2net: don't enable multicast flag in be_enable_if_filters() routine When the interface is opened (in be_open()) the routine be_enable_if_filters() must be called to switch on the basic filtering capabilities of an interface that are not changed at run-time. These include the flags UNTAGGED, BROADCAST and PASS_L3L4_ERRORS. Other flags such as MULTICAST and PROMISC must be enabled later by be_set_rx_mode() based on the state in the netdev/adapter struct. be_enable_if_filters() routine is wrongly trying to enable MULTICAST flag without checking the current adapter state. This can cause the RX_FILTER cmds to the FW to fail. This patch fixes this problem by only enabling the basic filtering flags in be_enable_if_filters(). The VF must be able to issue RX_FILTER cmd with any filter flag, as long as the PF allowed those flags (if_cap_flags) in the iface it provisioned for the VF. This rule is applicable even when the VF doesn't have the FILTMGMT privilege. There is a bug in BE3 FW that wrongly fails RX_FILTER multicast programming cmds on VFs that don't have FILTMGMT privilege. This patch also helps in insulating the VF driver from be_open failures due to the FW bug. A fix for the BE3 FW issue will be available in versions >= 11.0.283.0 and 10.6.334.0 Reported-by: Ivan Vecera Signed-off-by: Venkat Duvvuru Signed-off-by: Sathya Perla Signed-off-by: David S. Miller drivers/net/ethernet/emulex/benet/be_cmds.h | 9 ++++++--- drivers/net/ethernet/emulex/benet/be_main.c | 16 +++++++++------- 2 files changed, 15 insertions(+), 10 deletions(-) commit 1d3cd1773fddfdc9ffb0c2dec9a954c7a54bc207 Author: Dan Carpenter Date: Wed Mar 2 13:11:10 2016 +0300 net: moxa: fix an error code We accidentally return IS_ERR(priv->base) which is 1 instead of PTR_ERR(priv->base) which is the error code. Fixes: 6c821bd9edc9 ('net: Add MOXA ART SoCs ethernet driver') Signed-off-by: Dan Carpenter Acked-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/moxa/moxart_ether.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 63a0a00b90b5193173bcf76ef24afdda8eb05d3a Author: Nimrod Andy Date: Wed Mar 2 17:24:53 2016 +0800 MAINTAINERS: add maintainer entry for FREESCALE FEC ethernet driver Add a maintainer entry for FREESCALE FEC ethernet driver and add myself as a maintainer. Signed-off-by: Fugang Duan Acked-by: Frank Li Signed-off-by: David S. Miller MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit 4024fcf70556311521e7b6cf79fa50e16f31013a Author: Daniel Borkmann Date: Wed Mar 2 02:32:08 2016 +0100 vxlan: fix missing options_len update on RX with collect metadata When signalling to metadata consumers that the metadata_dst entry carries additional GBP extension data for vxlan (TUNNEL_VXLAN_OPT), the dst's vxlan_metadata information is populated, but options_len is left to zero. F.e. in ovs, ovs_flow_key_extract() checks for options_len before extracting the data through ip_tunnel_info_opts_get(). Geneve uses ip_tunnel_info_opts_set() helper in receive path, which sets options_len internally, vxlan however uses ip_tunnel_info_opts(), so when filling vxlan_metadata, we do need to update options_len. Fixes: 4c22279848c5 ("ip-tunnel: Use API to access tunnel metadata options.") Signed-off-by: Daniel Borkmann Acked-by: Thomas Graf Signed-off-by: David S. Miller drivers/net/vxlan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4d6af73d9e43f78651a43ee4c5ad221107ac8365 Author: Christoph Hellwig Date: Wed Mar 2 18:07:14 2016 +0100 block: support large requests in blk_rq_map_user_iov This patch adds support for larger requests in blk_rq_map_user_iov by allowing it to build multiple bios for a request. This functionality used to exist for the non-vectored blk_rq_map_user in the past, and this patch reuses the existing functionality for it on the unmap side, which stuck around. Thanks to the iov_iter API supporting multiple bios is fairly trivial, as we can just iterate the iov until we've consumed the whole iov_iter. Signed-off-by: Christoph Hellwig Reported-by: Jeff Lien Tested-by: Jeff Lien Reviewed-by: Keith Busch Signed-off-by: Jens Axboe block/blk-map.c | 91 ++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 61 insertions(+), 30 deletions(-) commit f21018427cb007a0894c36ad702990ab639cbbb4 Author: Christoph Hellwig Date: Thu Mar 3 14:43:45 2016 -0700 block: fix blk_rq_get_max_sectors for driver private requests Driver private request types should not get the artifical cap for the FS requests. This is important to use the full device capabilities for internal command or NVMe pass through commands. Signed-off-by: Christoph Hellwig Reported-by: Jeff Lien Tested-by: Jeff Lien Reviewed-by: Keith Busch Updated by me to use an explicit check for the one command type that does support extended checking, instead of relying on the ordering of the enum command values - as suggested by Keith. Signed-off-by: Jens Axboe include/linux/blkdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 45686b6198bd824f083ff5293f191d78db9d708a Author: Christoph Hellwig Date: Wed Mar 2 18:07:12 2016 +0100 nvme: fix max_segments integer truncation The block layer uses an unsigned short for max_segments. The way we calculate the value for NVMe tends to generate very large 32-bit values, which after integer truncation may lead to a zero value instead of the desired outcome. Signed-off-by: Christoph Hellwig Reported-by: Jeff Lien Tested-by: Jeff Lien Reviewed-by: Keith Busch Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit da35825d9a091a7a1d5824c8468168e2658333ff Author: Christoph Hellwig Date: Wed Mar 2 18:07:11 2016 +0100 nvme: set queue limits for the admin queue Factor out a helper to set all the device specific queue limits and apply them to the admin queue in addition to the I/O queues. Without this the command size on the admin queue is arbitrarily low, and the missing other limitations are just minefields waiting for victims. Signed-off-by: Christoph Hellwig Reported-by: Jeff Lien Tested-by: Jeff Lien Reviewed-by: Keith Busch Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) commit a1a0e23e49037c23ea84bc8cc146a03584d13577 Author: Tejun Heo Date: Mon Feb 29 18:28:53 2016 -0500 writeback: flush inode cgroup wb switches instead of pinning super_block If cgroup writeback is in use, inodes can be scheduled for asynchronous wb switching. Before 5ff8eaac1636 ("writeback: keep superblock pinned during cgroup writeback association switches"), this could race with umount leading to super_block being destroyed while inodes are pinned for wb switching. 5ff8eaac1636 fixed it by bumping s_active while wb switches are in flight; however, this allowed in-flight wb switches to make umounts asynchronous when the userland expected synchronosity - e.g. fsck immediately following umount may fail because the device is still busy. This patch removes the problematic super_block pinning and instead makes generic_shutdown_super() flush in-flight wb switches. wb switches are now executed on a dedicated isw_wq so that they can be flushed and isw_nr_in_flight keeps track of the number of in-flight wb switches so that flushing can be avoided in most cases. v2: Move cgroup_writeback_umount() further below and add MS_ACTIVE check in inode_switch_wbs() as Jan an Al suggested. Signed-off-by: Tejun Heo Reported-by: Tahsin Erdogan Cc: Jan Kara Cc: Al Viro Link: http://lkml.kernel.org/g/CAAeU0aNCq7LGODvVGRU-oU_o-6enii5ey0p1c26D1ZzYwkDc5A@mail.gmail.com Fixes: 5ff8eaac1636 ("writeback: keep superblock pinned during cgroup writeback association switches") Cc: stable@vger.kernel.org #v4.5 Reviewed-by: Jan Kara Tested-by: Tahsin Erdogan Signed-off-by: Jens Axboe fs/fs-writeback.c | 54 +++++++++++++++++++++++++++++++++++------------ fs/super.c | 1 + include/linux/writeback.h | 5 +++++ 3 files changed, 47 insertions(+), 13 deletions(-) commit e9fc63d682dbbef17921aeb00d03fd52d6735ffd Author: Keith Busch Date: Wed Feb 24 09:15:58 2016 -0700 NVMe: Fix 0-length integrity payload A user could send a passthrough IO command with a metadata pointer to a namespace without metadata. With metadata length of 0, kmalloc returns ZERO_SIZE_PTR. Since that is not NULL, the driver would have set this as the bio's integrity payload, which causes an access fault on completion. This patch ignores the users metadata buffer if the namespace format does not support separate metadata. Reported-by: Stephen Bates Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63088ec7c8eadfe08b96127a41b385ec9742dace Author: Keith Busch Date: Wed Feb 24 09:15:57 2016 -0700 NVMe: Don't allow unsupported flags The command flags can change the meaning of other fields in the command that the driver is not prepared to handle. Specifically, the user could passthrough an SGL flag, causing the controller to misinterpret the PRP list the driver created, potentially corrupting memory or data. Signed-off-by: Keith Busch Reviewed-by: Jon Derrick Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 4 ++++ 1 file changed, 4 insertions(+) commit 69d9a99c258eb1d6478fd9608a2070890797eed7 Author: Keith Busch Date: Wed Feb 24 09:15:56 2016 -0700 NVMe: Move error handling to failed reset handler This moves failed queue handling out of the namespace removal path and into the reset failure path, fixing a hanging condition if the controller fails or link down during del_gendisk. Previously the driver had to see the controller as degraded prior to calling del_gendisk to setup the queues to fail. But, if the controller happened to fail after this, there was no task to end outstanding requests. On failure, all namespace states are set to dead. This has capacity revalidate to 0, and ends all new requests with error status. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 53 ++++++++++++++++++++++++++++++++---------------- drivers/nvme/host/nvme.h | 2 ++ drivers/nvme/host/pci.c | 13 +++++++++++- 3 files changed, 50 insertions(+), 18 deletions(-) commit f58944e265d4ebe47216a5d7488aee3928823d30 Author: Keith Busch Date: Wed Feb 24 09:15:55 2016 -0700 NVMe: Simplify device reset failure A reset failure schedules the device to unbind from the driver through the pci driver's remove. This cleans up all intialization, so there is no need to duplicate the potentially racy cleanup. To help understand why a reset failed, the status is logged with the existing warning message. Signed-off-by: Keith Busch Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 48 +++++++++++++++++++++--------------------------- 1 file changed, 21 insertions(+), 27 deletions(-) commit 646017a612e72f19bd9f991fe25287a149c5f627 Author: Keith Busch Date: Wed Feb 24 09:15:54 2016 -0700 NVMe: Fix namespace removal deadlock This patch makes nvme namespace removal lockless. It is up to the caller to ensure no active namespace scanning is occuring. To ensure no scan work occurs, the nvme pci driver adds a removing state to the controller device to avoid queueing scan work during removal. The work is flushed after setting the state, so no new scan work can be queued. The lockless removal allows the driver to cleanup a namespace request_queue if the controller fails during removal. Previously this could deadlock trying to acquire the namespace mutex in order to handle such events. Signed-off-by: Keith Busch Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 12 +++++++----- drivers/nvme/host/nvme.h | 4 ++++ drivers/nvme/host/pci.c | 17 +++++++++++++++-- 3 files changed, 26 insertions(+), 7 deletions(-) commit 075790ebba4a1eb297f9875e581b55c0382b1f3d Author: Keith Busch Date: Wed Feb 24 09:15:53 2016 -0700 NVMe: Use IDA for namespace disk naming A namespace may be detached from a controller, but a user may be holding a reference to it. Attaching a new namespace with the same NSID will create duplicate names when using the NSID to name the disk. This patch uses an IDA that is released only when the last reference is released instead of using the namespace ID. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 15 ++++++++++++--- drivers/nvme/host/nvme.h | 2 ++ 2 files changed, 14 insertions(+), 3 deletions(-) commit b00a726a9fd82ddd4c10344e46f0d371e1674303 Author: Keith Busch Date: Wed Feb 24 09:15:52 2016 -0700 NVMe: Don't unmap controller registers on reset Unmapping the registers on reset or shutdown is not necessary. Keeping the mapping simplifies reset handling. Signed-off-by: Keith Busch Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 71 +++++++++++++++++++++++++++++-------------------- 1 file changed, 42 insertions(+), 29 deletions(-) commit e827091cb1bcd8e718ac3657845fb809c0b93324 Author: Ming Lei Date: Fri Feb 26 23:40:53 2016 +0800 block: merge: get the 1st and last bvec via helpers This patch applies the two introduced helpers to figure out the 1st and last bvec. Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe block/blk-merge.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 25e71a99f10e444cd00bb2ebccb11e1c9fb672b1 Author: Ming Lei Date: Fri Feb 26 23:40:52 2016 +0800 block: get the 1st and last bvec via helpers This patch applies the two introduced helpers to figure out the 1st and last bvec, and fixes the original way after bio splitting. Cc: stable@vger.kernel.org Reported-by: Sagi Grimberg Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe include/linux/blkdev.h | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit e0af29171aa8912e1ca95023b75ef336cd70d661 Author: Ming Lei Date: Fri Feb 26 23:40:51 2016 +0800 block: check virt boundary in bio_will_gap() In the following patch, the way for figuring out the last bvec will be changed with a bit cost introduced, so return immediately if the queue doesn't have virt boundary limit. Actually most of devices have not this limit. Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe include/linux/blkdev.h | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 7bcd79ac50d9d83350a835bdb91c04ac9e098412 Author: Ming Lei Date: Fri Feb 26 23:40:50 2016 +0800 block: bio: introduce helpers to get the 1st and last bvec The bio passed to bio_will_gap() may be fast cloned from upper layer(dm, md, bcache, fs, ...), or from bio splitting in block core. Unfortunately bio_will_gap() just figures out the last bvec via 'bi_io_vec[prev->bi_vcnt - 1]' directly, and this way is obviously wrong. This patch introduces two helpers for getting the first and last bvec of one bio for fixing the issue. Cc: stable@vger.kernel.org Reported-by: Sagi Grimberg Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe include/linux/bio.h | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) commit 42a67c9b0c0853f6a1159bd54ed0ba50df9f9ad8 Author: Wolfram Sang Date: Tue Mar 1 17:37:59 2016 +0100 net: ethernet: renesas: sh_eth: don't open code of_device_get_match_data() This change will also make Coverity happy by avoiding a theoretical NULL pointer dereference; yet another reason is to use the above helper function to tighten the code and make it more readable. Signed-off-by: Wolfram Sang Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/renesas/sh_eth.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) commit e866863066a4e6c42117434dd5cd35c9842f5b82 Author: Wolfram Sang Date: Tue Mar 1 17:37:58 2016 +0100 net: ethernet: renesas: ravb_main: don't open code of_device_get_match_data() This change will also make Coverity happy by avoiding a theoretical NULL pointer dereference; yet another reason is to use the above helper function to tighten the code and make it more readable. Signed-off-by: Wolfram Sang Reviewed-by: Simon Horman Acked-by: Geert Uytterhoeven Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit de89e854bcc71ebaf30d415a0c015d1cb6c68856 Author: Thomas Falcon Date: Tue Mar 1 10:20:09 2016 -0600 ibmvnic: Fix ibmvnic_capability struct The ibmvnic_capability struct was defined incorrectly. The last two elements of the struct are in the wrong order. In addition, the number element should be 64-bit. Byteswapping functions are updated as well. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 62 +++++++++++++++++++------------------- drivers/net/ethernet/ibm/ibmvnic.h | 4 +-- 2 files changed, 32 insertions(+), 34 deletions(-) commit 5d150a985520bbe3cb2aa1ceef24a7e32f20c15f Author: Florian Westphal Date: Tue Mar 1 16:15:16 2016 +0100 ipv6: re-enable fragment header matching in ipv6_find_hdr When ipv6_find_hdr is used to find a fragment header (caller specifies target NEXTHDR_FRAGMENT) we erronously return -ENOENT for all fragments with nonzero offset. Before commit 9195bb8e381d, when target was specified, we did not enter the exthdr walk loop as nexthdr == target so this used to work. Now we do (so we can skip empty route headers). When we then stumble upon a frag with nonzero frag_off we must return -ENOENT ("header not found") only if the caller did not specifically request NEXTHDR_FRAGMENT. This allows nfables exthdr expression to match ipv6 fragments, e.g. via nft add rule ip6 filter input frag frag-off gt 0 Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing headers") Signed-off-by: Florian Westphal Signed-off-by: David S. Miller net/ipv6/exthdrs_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit bf13c94ccb33c3182efc92ce4989506a0f541243 Author: Bjørn Mork Date: Tue Mar 1 14:31:02 2016 +0100 qmi_wwan: add Sierra Wireless EM74xx device ID The MC74xx and EM74xx modules use different IDs by default, according to the Lenovo EM7455 driver for Windows. Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit f214fc402967e1bc94ad7f39faa03db5813d6849 Author: Parthasarathy Bhuvaragan Date: Tue Mar 1 11:07:09 2016 +0100 tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain" reverts commit 94153e36e709e ("tipc: use existing sk_write_queue for outgoing packet chain") In Commit 94153e36e709e, we assume that we fill & empty the socket's sk_write_queue within the same lock_sock() session. This is not true if the link is congested. During congestion, the socket lock is released while we wait for the congestion to cease. This implementation causes a nullptr exception, if the user space program has several threads accessing the same socket descriptor. Consider two threads of the same program performing the following: Thread1 Thread2 -------------------- ---------------------- Enter tipc_sendmsg() Enter tipc_sendmsg() lock_sock() lock_sock() Enter tipc_link_xmit(), ret=ELINKCONG spin on socket lock.. sk_wait_event() : release_sock() grab socket lock : Enter tipc_link_xmit(), ret=0 : release_sock() Wakeup after congestion lock_sock() skb = skb_peek(pktchain); !! TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong; In this case, the second thread transmits the buffers belonging to both thread1 and thread2 successfully. When the first thread wakeup after the congestion it assumes that the pktchain is intact and operates on the skb's in it, which leads to the following exception: [2102.439969] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0 [2102.440074] IP: [] __tipc_link_xmit+0x2b0/0x4d0 [tipc] [2102.440074] PGD 3fa3f067 PUD 3fa6b067 PMD 0 [2102.440074] Oops: 0000 [#1] SMP [2102.440074] CPU: 2 PID: 244 Comm: sender Not tainted 3.12.28 #1 [2102.440074] RIP: 0010:[] [] __tipc_link_xmit+0x2b0/0x4d0 [tipc] [...] [2102.440074] Call Trace: [2102.440074] [] ? schedule+0x29/0x70 [2102.440074] [] ? tipc_node_unlock+0x46/0x170 [tipc] [2102.440074] [] tipc_link_xmit+0x51/0xf0 [tipc] [2102.440074] [] tipc_send_stream+0x11e/0x4f0 [tipc] [2102.440074] [] ? __wake_up_sync+0x20/0x20 [2102.440074] [] tipc_send_packet+0x1c/0x20 [tipc] [2102.440074] [] sock_sendmsg+0xa8/0xd0 [2102.440074] [] ? release_sock+0x145/0x170 [2102.440074] [] ___sys_sendmsg+0x3d8/0x3e0 [2102.440074] [] ? _raw_spin_unlock+0xe/0x10 [2102.440074] [] ? handle_mm_fault+0x6ca/0x9d0 [2102.440074] [] ? set_next_entity+0x85/0xa0 [2102.440074] [] ? _raw_spin_unlock_irq+0xe/0x20 [2102.440074] [] ? finish_task_switch+0x5c/0xc0 [2102.440074] [] ? __schedule+0x34c/0x950 [2102.440074] [] __sys_sendmsg+0x42/0x80 [2102.440074] [] SyS_sendmsg+0x12/0x20 [2102.440074] [] system_call_fastpath+0x16/0x1b In this commit, we maintain the skb list always in the stack. Signed-off-by: Parthasarathy Bhuvaragan Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/socket.c | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) commit fbe093ac9f0201939279cdfe8b0fce20ce5ef7a9 Author: Sakari Ailus Date: Thu Mar 3 14:20:14 2016 -0300 [media] media: Sanitise the reserved fields of the G_TOPOLOGY IOCTL arguments The argument structs are used in arrays for G_TOPOLOGY IOCTL. The arguments themselves do not need to be aligned to a power of two, but aligning them up to the largest basic type alignment (u64) on common ABIs is a good thing to do. The patch changes the size of the reserved fields to 5 or 6 u32's and aligns the size of the struct to 8 bytes so we do no longer depend on the compiler to perform the alignment. While at it, add __attribute__ ((packed)) to these structs as well. Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab include/uapi/linux/media.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit e3c2ef41f88e50c8557270868600d3132028af3b Merge: c2687cf 1195c10 Author: Linus Torvalds Date: Thu Mar 3 12:54:39 2016 -0800 Merge tag 'pci-v4.5-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "Freescale Layerscape host bridge driver: Fix MSG TLP drop setting (Minghuan Lian) TI Keystone host bridge driver: Fix MSI code that retrieves struct pcie_port pointer (Murali Karicheri)" * tag 'pci-v4.5-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: layerscape: Fix MSG TLP drop setting PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer commit 1837b2e2bcd23137766555a63867e649c0b637f0 Author: Benjamin Poirier Date: Mon Feb 29 15:03:33 2016 -0800 mld, igmp: Fix reserved tailroom calculation The current reserved_tailroom calculation fails to take hlen and tlen into account. skb: [__hlen__|__data____________|__tlen___|__extra__] ^ ^ head skb_end_offset In this representation, hlen + data + tlen is the size passed to alloc_skb. "extra" is the extra space made available in __alloc_skb because of rounding up by kmalloc. We can reorder the representation like so: [__hlen__|__data____________|__extra__|__tlen___] ^ ^ head skb_end_offset The maximum space available for ip headers and payload without fragmentation is min(mtu, data + extra). Therefore, reserved_tailroom = data + extra + tlen - min(mtu, data + extra) = skb_end_offset - hlen - min(mtu, skb_end_offset - hlen - tlen) = skb_tailroom - min(mtu, skb_tailroom - tlen) ; after skb_reserve(hlen) Compare the second line to the current expression: reserved_tailroom = skb_end_offset - min(mtu, skb_end_offset) and we can see that hlen and tlen are not taken into account. The min() in the third line can be expanded into: if mtu < skb_tailroom - tlen: reserved_tailroom = skb_tailroom - mtu else: reserved_tailroom = tlen Depending on hlen, tlen, mtu and the number of multicast address records, the current code may output skbs that have less tailroom than dev->needed_tailroom or it may output more skbs than needed because not all space available is used. Fixes: 4c672e4b ("ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs") Signed-off-by: Benjamin Poirier Acked-by: Hannes Frederic Sowa Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/linux/skbuff.h | 24 ++++++++++++++++++++++++ net/ipv4/igmp.c | 3 +-- net/ipv6/mcast.c | 3 +-- 3 files changed, 26 insertions(+), 4 deletions(-) commit 861c3849222b7cadfd0da63f9c7573c2f15ba535 Merge: f4f41c5 04fdbc8 Author: Greg Kroah-Hartman Date: Thu Mar 3 12:37:21 2016 -0800 Merge tag 'usb-serial-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Jonan writes: USB-serial fixes for v4.5-rc7 Here are some new device ids and a patch removing the mxu11x0 driver, which turned out not to be needed. Signed-off-by: Johan Hovold commit 878e3c1be2dc8a759c18bb280a7390f9ed0bd544 Author: Igal Liberman Date: Sun Feb 28 23:59:53 2016 +0200 fsl/fman: Initialize fman->dev earlier Currently, in a case of error, dev_err is using fman->dev before its initialization and "(NULL device *)" is printed. This patch fixes this issue. Signed-off-by: Igal Liberman Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fman/fman.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 88f8b1bb41c6208f81b6a480244533ded7b59493 Author: Gabriel Fernandez Date: Mon Feb 29 17:18:22 2016 +0100 stmmac: Fix 'eth0: No PHY found' regression This patch manages the case when you have an Ethernet MAC with a "fixed link", and not connected to a normal MDIO-managed PHY device. The test of phy_bus_name was not helpful because it was never affected and replaced by the mdio test node. Signed-off-by: Gabriel Fernandez Acked-by: Giuseppe Cavallaro Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 11 +---------- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 9 ++++++++- include/linux/stmmac.h | 1 + 3 files changed, 10 insertions(+), 11 deletions(-) commit c2687cf9502a4b69abc0f3a7b1618ffef47a40db Merge: 4237b2e 2680d6d Author: Linus Torvalds Date: Thu Mar 3 11:54:56 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: - ARM/MIPS: Fixes for ioctls when copy_from_user returns nonzero - x86: Small fix for Skylake TSC scaling - x86: Improved fix for last week's missed hardware breakpoint bug * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: x86: Update tsc multiplier on change. mips/kvm: fix ioctl error handling arm/arm64: KVM: Fix ioctl error handling KVM: x86: fix root cause for missed hardware breakpoints commit 4237b2e6c6ca77b72f0b45ffad29e284e776ede3 Merge: 19eab22 b26a719 Author: Linus Torvalds Date: Thu Mar 3 11:39:11 2016 -0800 Merge tag 'gpio-v4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull late GPIO fix from Linus Walleij: "Regressions never arrive when you want them to, so here is a late fix for the Renesas RCAR GPIO driver. It only affects that driver on the very specific Renesas platforms: - Fix a runtime PM suspend/resume bug in the RCAR driver" * tag 'gpio-v4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: rcar: Add Runtime PM handling for interrupts commit 19eab220e7a00bbb36543b4daf5e3c464ec474cb Merge: f4bd982 e6a8c9b Author: Linus Torvalds Date: Thu Mar 3 11:32:13 2016 -0800 Merge tag 'iommu-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "One fix for Intel VT-d: - Use BUS_NOTIFY_REMOVED_DEVICE notifier to unbind a device from its domain _after_ it has been unbound from its driver. This fixes a BUG_ON being triggered in the PCI hotplug path. And three for AMD IOMMU: - Add a workaround for a hardware issue with ATS in use - Fix ATS enable/disable balance when a device is removed - Fix a boot warning being triggered when the system has IOMMU performance counters and PCI device 00:00.0 is not covered by the IOMMU" * tag 'iommu-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path iommu/amd: Detach device from domain before removal iommu/amd: Apply workaround for ATS write permission check iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered commit f4bd9822080ece335663245c8520b146d9e1bdad Merge: 52ad129 e1f33be Author: Linus Torvalds Date: Thu Mar 3 11:07:32 2016 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull minor virtio/vhost fixes from Michael Tsirkin: "This fixes two minor bugs: error handling in vhost, and capability processing in virtio" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: fix error path in vhost_init_used() virtio-pci: read the right virtio_pci_notify_cap field commit 52ad12966b0217a6dcf782cc2516061343911c0d Merge: 215b031 8160c4e Author: Linus Torvalds Date: Thu Mar 3 10:56:17 2016 -0800 Merge tag 'vfio-v4.5-rc7' of git://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: "Use -EFAULT for copy_to_user error in ioctl (Michael Tsirkin)" * tag 'vfio-v4.5-rc7' of git://github.com/awilliam/linux-vfio: vfio: fix ioctl error handling commit 215b031b970a6cec729dcfaa94537074256ba2e8 Merge: f983cd3 a1e533e Author: Linus Torvalds Date: Thu Mar 3 10:46:18 2016 -0800 Merge tag 'fbdev-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fix from Tomi Valkeinen: "Fix hang caused by fbconsole blink timer" * tag 'fbdev-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: fbcon: set a default value to blink interval commit 93125094c07d8c9ec25dff5869f191b33eb9dd6e Author: Mauro Carvalho Chehab Date: Thu Mar 3 14:52:51 2016 -0300 [media] media.h: postpone connectors entities The representation of external connections got some heated discussions recently. As we're too close to the merge window, let's not set those entities into a stone. Signed-off-by: Mauro Carvalho Chehab include/uapi/linux/media.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit b81de061fa59f17d2730aabb1b84419ef3913810 Author: Konstantin Khlebnikov Date: Sun Jan 31 16:21:29 2016 +0300 ovl: copy new uid/gid into overlayfs runtime inode Overlayfs must update uid/gid after chown, otherwise functions like inode_owner_or_capable() will check user against stale uid. Catched by xfstests generic/087, it chowns file and calls utimes. Signed-off-by: Konstantin Khlebnikov Signed-off-by: Miklos Szeredi Cc: fs/overlayfs/inode.c | 2 ++ 1 file changed, 2 insertions(+) commit 45d11738969633ec07ca35d75d486bf2d8918df6 Author: Konstantin Khlebnikov Date: Sun Jan 31 16:17:53 2016 +0300 ovl: ignore lower entries when checking purity of non-directory entries After rename file dentry still holds reference to lower dentry from previous location. This doesn't matter for data access because data comes from upper dentry. But this stale lower dentry taints dentry at new location and turns it into non-pure upper. Such file leaves visible whiteout entry after remove in directory which shouldn't have whiteouts at all. Overlayfs already tracks pureness of file location in oe->opaque. This patch just uses that for detecting actual path type. Comment from Vivek Goyal's patch: Here are the details of the problem. Do following. $ mkdir upper lower work merged upper/dir/ $ touch lower/test $ sudo mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir= work merged $ mv merged/test merged/dir/ $ rm merged/dir/test $ ls -l merged/dir/ /usr/bin/ls: cannot access merged/dir/test: No such file or directory total 0 c????????? ? ? ? ? ? test Basic problem seems to be that once a file has been unlinked, a whiteout has been left behind which was not needed and hence it becomes visible. Whiteout is visible because parent dir is of not type MERGE, hence od->is_real is set during ovl_dir_open(). And that means ovl_iterate() passes on iterate handling directly to underlying fs. Underlying fs does not know/filter whiteouts so it becomes visible to user. Why did we leave a whiteout to begin with when we should not have. ovl_do_remove() checks for OVL_TYPE_PURE_UPPER() and does not leave whiteout if file is pure upper. In this case file is not found to be pure upper hence whiteout is left. So why file was not PURE_UPPER in this case? I think because dentry is still carrying some leftover state which was valid before rename. For example, od->numlower was set to 1 as it was a lower file. After rename, this state is not valid anymore as there is no such file in lower. Signed-off-by: Konstantin Khlebnikov Reported-by: Viktor Stanchev Suggested-by: Vivek Goyal Link: https://bugzilla.kernel.org/show_bug.cgi?id=109611 Acked-by: Vivek Goyal Signed-off-by: Miklos Szeredi Cc: fs/overlayfs/dir.c | 7 +++++++ fs/overlayfs/super.c | 12 +++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) commit ce9113bbcbf45a57c082d6603b9a9f342be3ef74 Author: Rui Wang Date: Fri Jan 8 23:09:59 2016 +0800 ovl: fix getcwd() failure after unsuccessful rmdir ovl_remove_upper() should do d_drop() only after it successfully removes the dir, otherwise a subsequent getcwd() system call will fail, breaking userspace programs. This is to fix: https://bugzilla.kernel.org/show_bug.cgi?id=110491 Signed-off-by: Rui Wang Reviewed-by: Konstantin Khlebnikov Signed-off-by: Miklos Szeredi Cc: fs/overlayfs/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b5891cfab08fe3144a616e8e734df7749fb3b7d0 Author: Konstantin Khlebnikov Date: Sun Jan 31 16:22:16 2016 +0300 ovl: fix working on distributed fs as lower layer This adds missing .d_select_inode into alternative dentry_operations. Signed-off-by: Konstantin Khlebnikov Fixes: 7c03b5d45b8e ("ovl: allow distributed fs as lower layer") Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay") Reviewed-by: Nikolay Borisov Tested-by: Nikolay Borisov Signed-off-by: Miklos Szeredi Cc: # 4.2+ fs/overlayfs/super.c | 1 + 1 file changed, 1 insertion(+) commit 11d8d645343efba0c975aefe7c2cf3b33c836c75 Author: Or Gerlitz Date: Tue Mar 1 18:52:23 2016 +0200 IB/core: Use GRH when the path hop-limit > 0 According to IBTA spec v1.3 section 12.7.19, QPs should use GRH when the path returned by the SA has hop-limit > 0. Currently, we do that only for the > 1 case, fix that. Fixes: 6d969a471ba1 ('IB/sa: Add ib_init_ah_from_path()') Signed-off-by: Or Gerlitz Reviewed-by: Jason Gunthorpe Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f16921275cc3c2442d0b95225785a601603b990f Author: Robert Jarzmik Date: Tue Feb 16 22:54:02 2016 +0100 dmaengine: pxa_dma: fix cyclic transfers While testing audio with pxa2xx-ac97, underrun were happening while the user application was correctly feeding the music. Debug proved that the cyclic transfer is not cyclic, ie. the last descriptor did not loop on the first. Another issue is that the descriptor length was always set to 8192, because of an trivial operator issue. This was tested on a pxa27x platform. Fixes: a57e16cf0333 ("dmaengine: pxa: add pxa dmaengine driver") Reported-by: Vasily Khoruzhick Tested-by: Vasily Khoruzhick Signed-off-by: Robert Jarzmik Signed-off-by: Vinod Koul drivers/dma/pxa_dma.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 3d943c9d1cc5ad1825e46291ef5ce627e1b6b660 Author: Majd Dibbiny Date: Sun Feb 14 18:35:52 2016 +0200 IB/{core, mlx5}: Fix input len in vendor part of create_qp/srq Currently, the inlen field of the vendor's part of the command doesn't match the command buffer. This happens because the inlen accommodates ib_uverbs_cmd_hdr which is deducted from the in buffer. This is problematic since the vendor function could be called either from the legacy verb (where the input length mismatches the actual length) or by the extended verb (where the length matches). The vendor has no idea which function calls it and therefore has no way to know how the length variable should be treated. Fixing this by aligning the inlen to the correct length. All vendor drivers either assumed that inlen >= sizeof(vendor_uhw_cmd) or just failed wrongly (mlx5) and fixed in this patch. Fixes: cfb5e088e26a ('IB/mlx5: Add CQE version 1 support to user QPs and SRQs') Signed-off-by: Majd Dibbiny Reviewed-by: Matan Barak Reviewed-by: Haggai Eran Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_cmd.c | 9 ++++++--- drivers/infiniband/hw/mlx5/srq.c | 11 +++-------- 2 files changed, 9 insertions(+), 11 deletions(-) commit 85d9691ccc96d95629939a877fd6c1f8c4724f56 Author: Majd Dibbiny Date: Sun Feb 14 18:35:51 2016 +0200 IB/mlx5: Avoid using user-index for SRQs Normal SRQs, unlike XRC SRQs, don't have user-index, therefore avoid verifying it and using it. Fixes: cfb5e088e26a ('IB/mlx5: Add CQE version 1 support to user QPs and SRQs') Signed-off-by: Majd Dibbiny Reviewed-by: Matan Barak Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/srq.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) commit fb822e6076d972691c5dd33431c10f82dda94ae9 Author: Ravi Bangoria Date: Wed Mar 2 15:25:17 2016 +0530 powerpc/hw_breakpoint: Fix oops when destroying hw_breakpoint event When destroying a hw_breakpoint event, the kernel oopses as follows: Unable to handle kernel paging request for data at address 0x00000c07 NIP [c0000000000291d0] arch_unregister_hw_breakpoint+0x40/0x60 LR [c00000000020b6b4] release_bp_slot+0x44/0x80 Call chain: hw_breakpoint_event_init() bp->destroy = bp_perf_event_destroy; do_exit() perf_event_exit_task() perf_event_exit_task_context() WRITE_ONCE(child_ctx->task, TASK_TOMBSTONE); perf_event_exit_event() free_event() _free_event() bp_perf_event_destroy() // event->destroy(event); release_bp_slot() arch_unregister_hw_breakpoint() perf_event_exit_task_context() sets child_ctx->task as TASK_TOMBSTONE which is (void *)-1. arch_unregister_hw_breakpoint() tries to fetch 'thread' attribute of 'task' resulting in oops. Peterz points out that the code shouldn't be using bp->ctx anyway, but fixing that will require a decent amount of rework. So for now to fix the oops, check if bp->ctx->task has been set to (void *)-1, before dereferencing it. We don't use TASK_TOMBSTONE, because that would require exporting it and it's supposed to be an internal detail. Fixes: 63b6da39bb38 ("perf: Fix perf_event_exit_task() race") Signed-off-by: Ravi Bangoria Acked-by: Peter Zijlstra (Intel) Signed-off-by: Michael Ellerman arch/powerpc/kernel/hw_breakpoint.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 02322ac9dee9aff8d8862e8d6660ebe102f492ea Author: Simon South Date: Wed Mar 2 23:10:44 2016 -0500 ALSA: hda - Fix mic issues on Acer Aspire E1-472 This patch applies the microphone-related fix created for the Acer Aspire E1-572 to the E1-472 as well, as it uses the same Realtek ALC282 CODEC and demonstrates the same issues. This patch allows an external, headset microphone to be used and limits the gain on the (quite noisy) internal microphone. Signed-off-by: Simon South Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 58402b6e98f9059420e64b296db6c4cb6f6c1117 Author: Hans Verkuil Date: Mon Feb 29 09:02:47 2016 +0100 [media] media.h: use hex values for range offsets, move connectors base up. Make the base offset hexadecimal to simplify debugging since the base addresses are hex too. The offsets for connectors is also changed to start after the 'reserved' range 0x10000-0x2ffff. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab include/uapi/linux/media.h | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit f0511e66114a6414cfca92d7b94118913a0c11ff Merge: 2d02b8b 0b39c53 Author: Dave Airlie Date: Thu Mar 3 11:37:07 2016 +1000 Merge branch 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for radeon and amdgpu: - Fix GPUVM flushing on CI and VI - Misc DPM and Powerplay fixes - VCE DPM fixes for CZ/ST - DP hotplug fix * 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: return from atombios_dp_get_dpcd only when error drm/amdgpu/cz: remove commented out call to enable vce pg drm/amdgpu/powerplay/cz: enable/disable vce dpm independent of vce pg drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled drm/amdgpu/gfx8: specify which engine to wait before vm flush drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well drm/amd/powerplay: send event to notify powerplay all modules are initialized. drm/amd/powerplay: export AMD_PP_EVENT_COMPLETE_INIT task to amdgpu. drm/radeon/pm: update current crtc info after setting the powerstate drm/amdgpu/pm: update current crtc info after setting the powerstate commit 92f9e179a702a6adbc11e2fedc76ecd6ffc9e3f7 Author: Todd E Brandt Date: Wed Mar 2 16:05:29 2016 -0800 PM / sleep / x86: Fix crash on graph trace through x86 suspend Pause/unpause graph tracing around do_suspend_lowlevel as it has inconsistent call/return info after it jumps to the wakeup vector. The graph trace buffer will otherwise become misaligned and may eventually crash and hang on suspend. To reproduce the issue and test the fix: Run a function_graph trace over suspend/resume and set the graph function to suspend_devices_and_enter. This consistently hangs the system without this fix. Signed-off-by: Todd Brandt Cc: All applicable Signed-off-by: Rafael J. Wysocki arch/x86/kernel/acpi/sleep.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f3c87e99f401a0ff0ef941346ec6e790f0fd526e Merge: fc77dbd 949024d Author: Arnd Bergmann Date: Wed Mar 2 23:24:33 2016 +0100 Merge tag 'renesas-dt-fixes2-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Merge "Second Round of Renesas ARM Based SoC DT Fixes for v4.5" from Simon Horman: * remove enable prop from HS-USB device node on porter board * tag 'renesas-dt-fixes2-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: dts: porter: remove enable prop from HS-USB device node commit ebc9780c93077a1c1129879de783f7fa8551d399 Merge: 11351bf cd5e412 Author: David S. Miller Date: Wed Mar 2 14:57:16 2016 -0500 Merge branch 'dwc_eth_qos' Lars Persson says: ==================== dwc_eth_qos: stability fixes and support for CMA This series has bug fixes for the dwc_eth_qos ethernet driver. Mainly two stability fixes for problems found by Rabin Vincent: - Successive starts and stops of the interface would trigger a DMA reset timeout. - A race condition in the TX DMA handling could trigger a netdev watchdog timeout. The memory allocation was improved to support use of the CMA as DMA allocator backend. ==================== Signed-off-by: David S. Miller commit cd5e41234729966153595fd3c2a7912cc4f95bc2 Author: Lars Persson Date: Mon Feb 29 16:22:34 2016 +0100 dwc_eth_qos: do phy_start before resetting hardware This reverts the changed init order from commit 3647bc35bd42 ("dwc_eth_qos: Reset hardware before PHY start") and makes another fix for the race. It turned out that the reset state machine of the dwceqos hardware requires PHY clocks to be present in order to complete the reset cycle. To plug the race with the phy state machine we defer link speed setting until the hardware init has finished. Signed-off-by: Lars Persson Signed-off-by: David S. Miller drivers/net/ethernet/synopsys/dwc_eth_qos.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) commit 016a91c64de6621e5917b2ddfe2afc0abb0a884c Author: Rabin Vincent Date: Mon Feb 29 16:22:33 2016 +0100 dwc_eth_qos: use DWCEQOS_MSG_DEFAULT Since debug is hardcoded to 3, the defaults in the DWCEQOS_MSG_DEFAULT macro are never used, which does not seem to be the intended behaviour here. Set debug to -1 like other drivers so that DWCEQOS_MSG_DEFAULT is actually used by default. Signed-off-by: Rabin Vincent Signed-off-by: Lars Persson Signed-off-by: David S. Miller drivers/net/ethernet/synopsys/dwc_eth_qos.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8b0c32eae319e287d0329b4148c9a1a51525053 Author: Rabin Vincent Date: Mon Feb 29 16:22:32 2016 +0100 dwc_eth_qos: use GFP_KERNEL in dma_alloc_coherent() Since we are in non-atomic context here we can pass GFP_KERNEL to dma_alloc_coherent(). This enables use of the CMA. Signed-off-by: Rabin Vincent Signed-off-by: Lars Persson Signed-off-by: David S. Miller drivers/net/ethernet/synopsys/dwc_eth_qos.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d4dc35f26e1017e2a632339ecae43706cbc06986 Author: Lars Persson Date: Mon Feb 29 16:22:31 2016 +0100 dwc_eth_qos: release descriptors outside netif_tx_lock To prepare for using the CMA, we can not be in atomic context when de-allocating DMA buffers. The tx lock was needed only to protect the hw reset against the xmit handler. Now we briefly grab the tx lock while stopping the queue to make sure no thread is inside or will enter the xmit handler. Signed-off-by: Lars Persson Signed-off-by: David S. Miller drivers/net/ethernet/synopsys/dwc_eth_qos.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 8afb6c474b0dd8f9cf7e122a19c71924566fdb97 Author: Rabin Vincent Date: Mon Feb 29 16:22:30 2016 +0100 dwc_eth_qos: fix race condition in dwceqos_start_xmit The xmit handler and the tx_reclaim tasklet had a race on the tx_free variable which could lead to a tx timeout if tx_free was updated after the tx complete interrupt. Signed-off-by: Rabin Vincent Signed-off-by: Lars Persson Signed-off-by: David S. Miller drivers/net/ethernet/synopsys/dwc_eth_qos.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 11351bf762d27116dd9fb362b198bebdfd427d53 Merge: ebc363f 6e52242 Author: David S. Miller Date: Wed Mar 2 14:42:46 2016 -0500 Merge branch 'mlx4-fixes' Or Gerlitz says: ==================== Mellanox 10/40G mlx4 driver fixes for 4.5-rc6 This series contains two fixes for the SRIOV HW LAG that was introduced in 4.5-rc1 and one fix that allows to revoke the administrative MAC that was assigned to VF through the PF. The VF mac fix needs to go for stable too. ==================== Signed-off-by: David S. Miller commit 6e5224224faa50ec4c8949dcefadf895e565f0d1 Author: Jack Morgenstein Date: Wed Mar 2 17:47:46 2016 +0200 net/mlx4_core: Allow resetting VF admin mac to zero The VF administrative mac addresses (stored in the PF driver) are initialized to zero when the PF driver starts up. These addresses may be modified in the PF driver through ndo calls initiated by iproute2 or libvirt. While we allow the PF/host to change the VF admin mac address from zero to a valid unicast mac, we do not allow restoring the VF admin mac to zero. We currently only allow changing this mac to a different unicast mac. This leads to problems when libvirt scripts are used to deal with VF mac addresses, and libvirt attempts to revoke the mac so this host will not use it anymore. Fix this by allowing resetting a VF administrative MAC back to zero. Fixes: 8f7ba3ca12f6 ('net/mlx4: Add set VF mac address support') Signed-off-by: Jack Morgenstein Reported-by: Moshe Levi Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 00ada91039fc03100cb4fab41d04f9b30f27340f Author: Moni Shoua Date: Wed Mar 2 17:47:45 2016 +0200 net/mlx4_core: Check the correct limitation on VFs for HA mode The limit of 63 is only for virtual functions while the actual enforcement was for VFs plus physical functions, fix that. Fixes: e57968a10bc1 ('net/mlx4_core: Support the HA mode for SRIOV VFs too') Signed-off-by: Moni Shoua Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/main.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 03a79f31ef5fb7a2298258432f3dc0f558f24d48 Author: Jack Morgenstein Date: Wed Mar 2 17:47:44 2016 +0200 net/mlx4_core: Fix lockdep warning in handling of mac/vlan tables In the mac and vlan register/unregister/replace functions, the driver locks the mac table mutex (or vlan table mutex) on both ports. We move to use mutex_lock_nested() to prevent warnings, such as the one below. [ 101.828445] ============================================= [ 101.834820] [ INFO: possible recursive locking detected ] [ 101.841199] 4.5.0-rc2+ #49 Not tainted [ 101.850251] --------------------------------------------- [ 101.856621] modprobe/3054 is trying to acquire lock: [ 101.862514] (&table->mutex#2){+.+.+.}, at: [] __mlx4_register_mac+0x87e/0xa90 [mlx4_core] [ 101.874598] [ 101.874598] but task is already holding lock: [ 101.881703] (&table->mutex#2){+.+.+.}, at: [] __mlx4_register_mac+0x860/0xa90 [mlx4_core] [ 101.893776] [ 101.893776] other info that might help us debug this: [ 101.901658] Possible unsafe locking scenario: [ 101.901658] [ 101.908859] CPU0 [ 101.911923] ---- [ 101.914985] lock(&table->mutex#2); [ 101.919595] lock(&table->mutex#2); [ 101.924199] [ 101.924199] * DEADLOCK * [ 101.924199] [ 101.931643] May be due to missing lock nesting notation Fixes: 5f61385d2ebc ('net/mlx4_core: Keep VLAN/MAC tables mirrored in multifunc HA mode') Signed-off-by: Jack Morgenstein Suggested-by: Doron Tsur Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/port.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit ebc363f577df2d33ce75aaa9d473782b1cfb873f Merge: 607e681 faf4478 Author: David S. Miller Date: Wed Mar 2 14:37:27 2016 -0500 Merge branch 'mlx5-fixes' Saeed Mahameed says: ==================== Mellanox 100G mlx5 driver fixes This series has few bug fixes for the mlx5 Ethernet driver. Eran fixed a locking issue with time-stamping that could cause a soft-lockup when time-stamping is enabled. Gal fixed the rx/tx packets/bytes counters returned by the driver to actually went through the network stack. Tariq removed a poll CQ optimization which could lead the driver to stop getting interrupts for some of the rings, and a did also fix to HW LRO which is currently broken. He also provided RSS and RX hash fixes for the case of changing the number of rx rings the RX hash/RSS configuration will be out of sync. The time stamping fix from Eran is not for -stable as the feature was only introduced in 4.5 but all of the others are. Changes fro V0: - Eran addressed the irqsave/restore comments from "Dave" and fixed them. This series is generated against net commit 4c0b6eaf373a 'net: thunderx: Fix for Qset error due to CQ full' ==================== Signed-off-by: David S. Miller commit faf4478bf8b7b5e6c94cb07a52a00e4d1cd647c6 Author: Gal Pressman Date: Mon Feb 29 21:17:15 2016 +0200 net/mlx5e: Provide correct packet/bytes statistics Using the HW VPort counters for traffic (rx/tx packets/bytes) statistics is wrong. This is because frames dropped due to steering or out of buffer will be counted as received. To fix that, we move to use the packet/bytes accounting done by the driver for what the netdev reports out. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support [...]') Signed-off-by: Gal Pressman Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 25 ++++++++--------------- 1 file changed, 8 insertions(+), 17 deletions(-) commit b081da5ee1860d1874381a413a1b71d8f9f67e83 Author: Gal Pressman Date: Mon Feb 29 21:17:14 2016 +0200 net/mlx5e: Add rx/tx bytes software counters Sum up rx/tx bytes in software as we do for rx/tx packets, to be reported in upcoming statistics fix. Signed-off-by: Gal Pressman Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 8 ++++++-- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 9 ++++++--- 3 files changed, 13 insertions(+), 5 deletions(-) commit 85082dba0a5059c538cfa786d07f5ec5370d22fe Author: Tariq Toukan Date: Mon Feb 29 21:17:13 2016 +0200 net/mlx5e: Correctly handle RSS indirection table when changing number of channels Upon changing num_channels, reset the RSS indirection table to match the new value. Fixes: 2d75b2bc8a8c ('net/mlx5e: Add ethtool RSS configuration options') Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++---- 3 files changed, 15 insertions(+), 4 deletions(-) commit bdfc028de1b3cd59490d5413a5c87b0fa50040c2 Author: Tariq Toukan Date: Mon Feb 29 21:17:12 2016 +0200 net/mlx5e: Fix ethtool RX hash func configuration change We should modify TIRs explicitly to apply the new RSS configuration. The light ndo close/open calls do not "refresh" them. Fixes: 2d75b2bc8a8c ('net/mlx5e: Add ethtool RSS configuration options') Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 3 ++ .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 34 +++++++++++++++------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++++++++++------- include/linux/mlx5/mlx5_ifc.h | 4 ++- 4 files changed, 46 insertions(+), 22 deletions(-) commit 0ad9b20415a461332611666301e7812900a15ad4 Author: Eran Ben Elisha Date: Mon Feb 29 21:17:11 2016 +0200 net/mlx5e: Fix soft lockup when HW Timestamping is enabled Readers/Writers lock for SW timecounter was acquired without disabling interrupts on local CPU. The problematic scenario: * HW timestamping is enabled * Timestamp overflow periodic service task is running on local CPU and holding write_lock for SW timecounter * Completion arrives, triggers interrupt for local CPU. Interrupt routine calls napi_schedule(), which triggers rx/tx skb process. An attempt to read SW timecounter using read_lock is done, which is already locked by a writer on the same CPU and cause soft lockup. Add irqsave/irqrestore for when using the readers/writers lock for writing. Fixes: ef9814deafd0 ('net/mlx5e: Add HW timestamping (TS) support') Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_clock.c | 25 +++++++++++++--------- 1 file changed, 15 insertions(+), 10 deletions(-) commit ab0394fe2c258fdb5086c51a251b28f8ee7ab35c Author: Tariq Toukan Date: Mon Feb 29 21:17:10 2016 +0200 net/mlx5e: Fix LRO modify Ethtool LRO enable/disable is broken, as of today we only modify TCP TIRs in order to apply the requested configuration. Hardware requires that all TIRs pointing to the same RQ should share the same LRO configuration. For that all other TIRs' LRO fields must be modified as well. Fixes: 5c50368f3831 ('net/mlx5e: Light-weight netdev open/stop') Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 59a7c2fd336eaafb030aac9c91ac21d136a99f33 Author: Tariq Toukan Date: Mon Feb 29 21:17:09 2016 +0200 net/mlx5e: Remove wrong poll CQ optimization With the MLX5E_CQ_HAS_CQES optimization flag, the following buggy flow might occur: - Suppose RX is always busy, TX has a single packet every second. - We poll a single TX cqe and clear its flag. - We never arm it again as RX is always busy. - TX CQ flag is never changed, and new TX cqes are not polled. We revert this optimization. Fixes: e586b3b0baee ('net/mlx5: Ethernet Datapath files') Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 5 ----- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 ------- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 10 +--------- drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 1 - 4 files changed, 1 insertion(+), 22 deletions(-) commit 607e681111800f9bbfcd823a385a45dd0295dfb8 Author: Chunhao Lin Date: Thu Mar 3 00:59:15 2016 +0800 r8169: Enable RX_MULTI_EN for RTL_GIGA_MAC_VER_41~48 For RTL8168G/RTL8168H/RTL8411B/RTL8107E, enable this flag to eliminate message "AMD-Vi: Event logged [IO_PAGE_FAULT device=01:00.0 domain=0x0002 address=0x0000000000003000 flags=0x0050] in dmesg. Signed-off-by: Chunhao Lin Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 4 ---- 1 file changed, 4 deletions(-) commit 68df7247f43b925f3e091a55318f76569e0f3187 Merge: 768c83a 2af8c4d Author: David S. Miller Date: Wed Mar 2 13:35:31 2016 -0500 Merge tag 'mac80211-for-davem-2016-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Here are a few more fixes for the current cycle: * check GCMP encryption vs. fragmentation properly; we'd found this problem quite a while ago but waited for the 802.11 spec to be updated * fix RTS/CTS logic in minstrel_ht * fix RX of certain public action frames in AP mode * add mac80211_hwsim to MAC80211 in MAINTAINERS, this helps the kbuild robot pick up the right tree for it ==================== Signed-off-by: David S. Miller commit 768c83a4bc2f709f6f05a1fa89dcaf508f353d0f Merge: 735c1e2 7e88009 Author: David S. Miller Date: Wed Mar 2 13:31:58 2016 -0500 Merge branch 'bnx2x-fixes' Michal Schmidt says: ==================== bnx2x: endianness fixes this fixes a VLAN crash and some SRIOV bugs in bnx2x observed on ppc64. ==================== Signed-off-by: David S. Miller commit 7e88009b9b2a22a20064abdb2a6536eeb3bcf432 Author: Michal Schmidt Date: Wed Mar 2 13:47:11 2016 +0100 bnx2x: fix indentation in bnx2x_sp_task() Fix a case of misleading code indentation. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d1c6bcb0f7f6e9f1481bcd3a1c52e75cc1f7fa4 Author: Michal Schmidt Date: Wed Mar 2 13:47:10 2016 +0100 bnx2x: define event data reserved fields as little-endian For consistency with other event data structs and to lessen the chance of a mistake should one of the reserved fields become used in the future, define the reserved fields as little-endian. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit da472731d8d0a50c451f5116477ffd9b3165f309 Author: Michal Schmidt Date: Wed Mar 2 13:47:09 2016 +0100 bnx2x: define fields of struct cfc_del_event_data as little-endian There were no missing endianness conversions in this case, but the fields of struct cfc_del_event_data should be defined as little-endian to get rid of the ugly (__force __le32) casts. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h | 6 +++--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +-- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 3 +-- 3 files changed, 5 insertions(+), 7 deletions(-) commit ca4f2d5036be809b0f82ce38a7663d237efa3986 Author: Michal Schmidt Date: Wed Mar 2 13:47:08 2016 +0100 bnx2x: access cfc_del_event only if the opcode is CFC_DEL It's not really a bug, but it was odd that bnx2x_eq_int() read the message data as if it were a cfc_del_event regardless of the event type. It's cleaner to access only the appropriate member of union event_data after checking the event opcode. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit a524ef77d54d7e12045841f4fcc430c1850f71f2 Author: Michal Schmidt Date: Wed Mar 2 13:47:07 2016 +0100 bnx2x: fix receive of VF->PF mailbox messages by the PF on big-endian On ppc64 the PF did not receive messages from VFs correctly. Fields of struct vf_pf_event_data are little-endian. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h | 6 +++--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) commit 5cc5c2d2e5a46c7395a0453f9ea1a446ac4c1b97 Author: Michal Schmidt Date: Wed Mar 2 13:47:06 2016 +0100 bnx2x: fix sending VF->PF messages on big-endian When a VF is sending a message to the PF, it needs to trigger the PF to tell it the message is ready. The trigger did not work on ppc64. No interrupt appeared in the PF. The bug is due to confusion about the layout of struct trigger_vf_zone. In bnx2x_send_msg2pf() the trigger is written using writeb(), not writel(), so the attempt to define the struct with a reversed layout on big-endian is counter-productive. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h | 6 ------ 1 file changed, 6 deletions(-) commit 9cd753a1f449b9af49a4c994ffab8c4f99d91f14 Author: Michal Schmidt Date: Wed Mar 2 13:47:05 2016 +0100 bnx2x: fix crash on big-endian when adding VLAN bnx2x crashes during the initialization of the 8021q module on ppc64. The bug is a missing conversion from le32 in bnx2x_handle_classification_eqe() when obtaining the cid value from struct eth_event_data. The fields in struct eth_event_data should all be declared as little-endian and conversions added where missing. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h | 6 +++--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 13 +++++-------- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 9 ++++----- 3 files changed, 12 insertions(+), 16 deletions(-) commit f983cd32cd5d2ec47ac8868f387bad15e8f11f85 Merge: 12f1d7e b4f09ae Author: Linus Torvalds Date: Wed Mar 2 09:46:19 2016 -0800 Merge branch 'parisc-4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "We wire up the copy_file_range syscall, fix two bugs in the parisc ptrace code and have a trivial fix for floppy.h to clarify an expression with parentheses" * 'parisc-4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Wire up copy_file_range syscall parisc: Fix ptrace syscall number and return value modification parisc: Use parentheses around expression in floppy.h commit 12f1d7e4932a40100177be5681f1a26f46265217 Merge: 39680f5 9589995 Author: Linus Torvalds Date: Wed Mar 2 09:15:21 2016 -0800 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Various small CIFS/SMB3 fixes for stable: Fixes address oops that can occur when accessing Macs with SMB3, and another problem found to Samba when read responses queued (e.g. with gluster under Samba)" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Fix duplicate line introduced by clone_file_range patch Fix cifs_uniqueid_to_ino_t() function for s390x CIFS: Fix SMB2+ interim response processing for read requests cifs: fix out-of-bounds access in lease parsing commit 39680f50ae54cbbb6e72ac38b8329dd3eb9105f4 Author: Linus Torvalds Date: Tue Mar 1 11:56:22 2016 -0800 userfaultfd: don't block on the last VM updates at exit time The exit path will do some final updates to the VM of an exiting process to inform others of the fact that the process is going away. That happens, for example, for robust futex state cleanup, but also if the parent has asked for a TID update when the process exits (we clear the child tid field in user space). However, at the time we do those final VM accesses, we've already stopped accepting signals, so the usual "stop waiting for userfaults on signal" code in fs/userfaultfd.c no longer works, and the process can become an unkillable zombie waiting for something that will never happen. To solve this, just make handle_userfault() abort any user fault handling if we're already in the exit path past the signal handling state being dead (marked by PF_EXITING). This VM special case is pretty ugly, and it is possible that we should look at finalizing signals later (or move the VM final accesses earlier). But in the meantime this is a fairly minimally intrusive fix. Reported-and-tested-by: Dmitry Vyukov Acked-by: Andrea Arcangeli Signed-off-by: Linus Torvalds fs/userfaultfd.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0b39c531cfa12dad54eac238c2e303b994df1ef7 Author: Arindam Nath Date: Wed Mar 2 17:19:01 2016 +0530 drm/amdgpu: return from atombios_dp_get_dpcd only when error In amdgpu_connector_hotplug(), we need to start DP link training only after we have received DPCD. The function amdgpu_atombios_dp_get_dpcd() returns non-zero value only when an error condition is met, otherwise returns zero. So in case the function encounters an error, we need to skip rest of the code and return from amdgpu_connector_hotplug() immediately. Only when we are successfull in reading DPCD pin, we should carry on with turning-on the monitor. Signed-off-by: Arindam Nath Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89913ea615754163ae9a066c9c1b95aa2a2f51b4 Author: Alex Deucher Date: Mon Feb 29 16:11:07 2016 -0500 drm/amdgpu/cz: remove commented out call to enable vce pg This code path is not currently enabled now that we properly respect the vce pg flags, so uncomment the actual pg calls so the code is as it should be we are eventually able to enable vce pg. Reviewed-by: Christian König Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/cz_dpm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 370afa7ac5dc6c65cebeaee841ae700eb2387a55 Author: Alex Deucher Date: Mon Feb 29 15:29:48 2016 -0500 drm/amdgpu/powerplay/cz: enable/disable vce dpm independent of vce pg If we don't disable it when vce is not in use, we use extra power if vce pg is disabled. Reviewed-by: Christian König Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b3dae7828399ef316e3fabf7e82c6415cb03a02e Author: Alex Deucher Date: Thu Feb 25 11:24:52 2016 -0500 drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled I missed this when cleaning up the vce pg handling. Reviewed-by: Christian König Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/cz_dpm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 9cac537332f5502c103415b25609548c276a09f8 Author: Chunming Zhou Date: Mon Feb 29 14:12:38 2016 +0800 drm/amdgpu/gfx8: specify which engine to wait before vm flush Select between me and pfp properly. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit feebe91aa9a9d99d9ec157612a614fadb79beb99 Author: Christian König Date: Fri Feb 26 16:18:15 2016 +0100 drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well We never ported that back to CIK, so we could run into VM faults here. Signed-off-by: Christian König Reviewed-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 4ea2efae0d117c5b5f44081bab941542d892e758 Author: Rex Zhu Date: Thu Feb 25 17:32:45 2016 +0800 drm/amd/powerplay: send event to notify powerplay all modules are initialized. with this event, powerplay can adjust current power state if needed. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit dc26a2a2b3f037c2727f514b64e8a865721ec74b Author: Rex Zhu Date: Thu Feb 25 17:16:52 2016 +0800 drm/amd/powerplay: export AMD_PP_EVENT_COMPLETE_INIT task to amdgpu. This is needed to init the dynamic states without a display. To be used in the next commit. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher drivers/gpu/drm/amd/powerplay/amd_powerplay.c | 5 ++++- drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) commit 5e031d9fe8b0741f11d49667dfc3ebf5454121fd Author: Alex Deucher Date: Wed Feb 24 17:38:38 2016 -0500 drm/radeon/pm: update current crtc info after setting the powerstate On CI, we need to see if the number of crtcs changes to determine whether or not we need to upload the mclk table again. In practice we don't currently upload the mclk table again after the initial load. The only reason you would would be to add new states, e.g., for arbitrary mclk setting which is not currently supported. Acked-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit eda1d1cf8d18383f19cd2b752f786120efa4768f Author: Alex Deucher Date: Wed Feb 24 17:18:25 2016 -0500 drm/amdgpu/pm: update current crtc info after setting the powerstate On CI, we need to see if the number of crtcs changes to determine whether or not we need to upload the mclk table again. In practice we don't currently upload the mclk table again after the initial load. The only reason you would would be to add new states, e.g., for arbitrary mclk setting which is not currently supported. Acked-by: Jordan Lazare Acked-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e1f33be9186363da7955bcb5f0b03e6685544c50 Author: Greg Kurz Date: Tue Feb 16 15:54:28 2016 +0100 vhost: fix error path in vhost_init_used() We don't want side effects. If something fails, we rollback vq->is_le to its previous value. Signed-off-by: Greg Kurz Signed-off-by: Michael S. Tsirkin drivers/vhost/vhost.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 4e94ebdd06d5dc72b7a40fc12fc496d601fb7bbc Author: Ladi Prosek Date: Mon Feb 1 19:36:31 2016 +0100 virtio-pci: read the right virtio_pci_notify_cap field Looks like a copy-paste bug. The value is used as an optimization and a wrong value probably isn't causing any serious damage. Found when porting this code to Windows. Signed-off-by: Ladi Prosek Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2af8c4dc2e9c7038aefe9a822aa1df62e2b106b7 Author: Johannes Berg Date: Fri Feb 26 10:50:34 2016 +0100 mac80211_hwsim: treat as part of mac80211 for MAINTAINERS Since I maintain this driver as part of mac80211, add it to the file list for mac80211; this helps submitters send it to me instead of Kalle and also makes the build robot apply the patches for it on the right tree for build attempts. Acked-by: Kalle Valo Signed-off-by: Johannes Berg MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit ce0c12b633846a47e103842149a5bac2e5d261ec Author: Heiko Carstens Date: Tue Mar 1 12:58:06 2016 +0100 s390/dasd: fix diag 0x250 inline assembly git commit 1ec2772e0c3c ("s390/diag: add a statistic for diagnose calls") added function calls to gather diagnose statistics. In case of the dasd diag driver the function call was added between a register asm statement which initialized register r2 and the inline assembly itself. The function call clobbers the contents of register r2 and therefore the diag 0x250 call behaves in a more or less random way. Fix this by extracting the function call into a separate function like we do everywhere else. Fixes: 1ec2772e0c3c ("s390/diag: add a statistic for diagnose calls") Cc: # 4.4+ Reported-and-tested-by: Stefan Haberland Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky drivers/s390/block/dasd_diag.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit eda908967feecf7575a8ab74f1695b0445cf324e Author: Chris Wilson Date: Thu Feb 25 21:10:28 2016 +0000 drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) commit 09731280028ce03e6a27e1998137f1775a2839f3 Author: Imre Deak Date: Wed Feb 17 14:17:42 2016 +0200 drm/i915: Add helper to get a display power ref if it was already enabled left the rpm wakelock assertions unbalanced if CONFIG_PM was disabled as intel_runtime_pm_get_if_in_use() would return true without incrementing the local bookkeeping required for the assertions. Fixes: 09731280028c ("drm/i915: Add helper to get a display power ref if it was already enabled") Signed-off-by: Chris Wilson CC: Mika Kuoppala CC: Joonas Lahtinen CC: Ville Syrjälä Cc: Imre Deak Link: http://patchwork.freedesktop.org/patch/msgid/1456434628-22574-1-git-send-email-chris@chris-wilson.co.uk Reviewed-by: Imre Deak (cherry picked from commit 135dc79efbc119ea5fb34475996983159e6ca31c) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_runtime_pm.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) commit bd90123c4973821775d7ffae9891ad36017702a9 Author: Imre Deak Date: Mon Feb 29 22:49:02 2016 +0200 drm/i915/skl: Fix power domain suspend sequence During system suspend we need to first disable power wells then unitialize the display core. In case power well support is disabled we did this in the wrong order, so fix this up. Fixes: d314cd43 ("drm/i915: fix handling of the disable_power_well module option") CC: stable@vger.kernel.org CC: Patrik Jakobsson Signed-off-by: Imre Deak Reviewed-by: Patrik Jakobsson Link: http://patchwork.freedesktop.org/patch/msgid/1456778945-5411-1-git-send-email-imre.deak@intel.com (cherry picked from commit 2622d79bd9d18fd04b650234e6a218c5f95cf308) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_runtime_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2680d6da455b636dd006636780c0f235c6561d70 Author: Owen Hofmann Date: Tue Mar 1 13:36:13 2016 -0800 kvm: x86: Update tsc multiplier on change. vmx.c writes the TSC_MULTIPLIER field in vmx_vcpu_load, but only when a vcpu has migrated physical cpus. Record the last value written and update in vmx_vcpu_load on any change, otherwise a cpu migration must occur for TSC frequency scaling to take effect. Cc: stable@vger.kernel.org Fixes: ff2c3a1803775cc72dc6f624b59554956396b0ee Signed-off-by: Owen Hofmann Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 0178fd7dcc4451fcb90bec5e91226586962478d2 Author: Michael S. Tsirkin Date: Sun Feb 28 17:35:59 2016 +0200 mips/kvm: fix ioctl error handling Returning directly whatever copy_to_user(...) or copy_from_user(...) returns may not do the right thing if there's a pagefault: copy_to_user/copy_from_user return the number of bytes not copied in this case, but ioctls need to return -EFAULT instead. Fix up kvm on mips to do return copy_to_user(...)) ? -EFAULT : 0; and return copy_from_user(...)) ? -EFAULT : 0; everywhere. Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Paolo Bonzini arch/mips/kvm/mips.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2b097e9bc3742d4ffc63fe64b8fd44242d662392 Merge: 70e4da7 4cad67f Author: Paolo Bonzini Date: Wed Mar 2 10:31:30 2016 +0100 Merge tag 'kvm-arm-for-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/ARM fixes for 4.5-rc7 - Fix ioctl error handling on the timer path commit 04fdbc825ffc02fb098964b92de802fff44e73fd Author: Bjørn Mork Date: Tue Mar 1 14:36:32 2016 +0100 USB: qcserial: add Sierra Wireless EM74xx device ID The MC74xx and EM74xx modules use different IDs by default, according to the Lenovo EM7455 driver for Windows. Cc: Signed-off-by: Bjørn Mork Signed-off-by: Johan Hovold drivers/usb/serial/qcserial.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2d02b8bdba322b527c5f5168ce1ca10c2d982a78 Author: Timothy Pearson Date: Fri Feb 26 15:29:32 2016 -0600 drm/ast: Fix incorrect register check for DRAM width During DRAM initialization on certain ASpeed devices, an incorrect bit (bit 10) was checked in the "SDRAM Bus Width Status" register to determine DRAM width. Query bit 6 instead in accordance with the Aspeed AST2050 datasheet v1.05. Signed-off-by: Timothy Pearson Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie drivers/gpu/drm/ast/ast_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 949024d6702d1da8a266f42226d8402f0df078dc Author: Sergei Shtylyov Date: Sun Feb 14 01:26:34 2016 +0300 ARM: dts: porter: remove enable prop from HS-USB device node In the final versions of the Porter board (called "PORTER_C") Renesas decided to get rid of the Maxim Integrated MAX3355 OTG chip and didn't add any other provision to differ the host/gadget mode, so we'll have to remove no longer valid "renesas,enable-gpio" property from the HS-USB device node. Hopefully, the earlier revisions of the board were never seen in the wild... Fixes: c794f6a09a25 ("ARM: shmobile: porter: add HS-USB DT support") Reported-by: Yoshihiro Shimoda Signed-off-by: Sergei Shtylyov Signed-off-by: Simon Horman arch/arm/boot/dts/r8a7791-porter.dts | 1 - 1 file changed, 1 deletion(-) commit f4f41c5abcf9acc61939367dc80fd62d19b16edb Merge: fc77dbd d144dfe Author: Greg Kroah-Hartman Date: Tue Mar 1 16:40:10 2016 -0800 Merge tag 'usb-ci-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus Peter writes: One bug-fix using ID wakeup, this bug is existed once this driver has written. commit f691b77b1fc491dae601631c8531a0a13e915466 Merge: 7d46af2 a528aca Author: Linus Torvalds Date: Tue Mar 1 15:30:45 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull d_inode/d_flags race fix from Al Viro. I love this fix. Not only does it fix the race in the dentry type handling, it entirely gets rid of the nasty and subtle memory ordering rules for d_type and d_inode, and replaces them with the basic dentry locking rules (sequence numbers under RCU, d_lock elsewhere). * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: use ->d_seq to get coherency between ->d_inode and ->d_flags commit 735c1e2511a5c4e6c451c8b3d29916c4b0fa39ae Author: Sergei Shtylyov Date: Sun Feb 28 22:50:59 2016 +0300 of_mdio: fix kernel-doc for of_phy_connect() The 'flags' parameter of the of_phy_connect() function wasn't described in the kernel-doc comment... Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/of/of_mdio.c | 1 + 1 file changed, 1 insertion(+) commit 3d73e8fac8f84942f15307d6d9cb1dba843d3fb2 Author: Xin Long Date: Sun Feb 28 10:33:11 2016 +0800 sctp: sctp_remaddr_seq_show use the wrong variable to dump transport info Now in sctp_remaddr_seq_show(), we use variable *tsp to get the param *v. but *tsp is also used to traversal transport_addr_list, which will cover the previous value, and make sctp_transport_put work on the wrong transport. So fix it by adding a new variable to get the param *v. Fixes: fba4c330c5b9 ("sctp: hold transport before we access t->asoc in sctp proc") Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/proc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 40b4f0fd74e46c017814618d67ec9127ff20f157 Author: Xin Long Date: Sun Feb 28 10:03:51 2016 +0800 sctp: lack the check for ports in sctp_v6_cmp_addr As the member .cmp_addr of sctp_af_inet6, sctp_v6_cmp_addr should also check the port of addresses, just like sctp_v4_cmp_addr, cause it's invoked by sctp_cmp_addr_exact(). Now sctp_v6_cmp_addr just check the port when two addresses have different family, and lack the port check for two ipv6 addresses. that will make sctp_hash_cmp() cannot work well. so fix it by adding ports comparison in sctp_v6_cmp_addr(). Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+) commit b4f09ae6db2a98ff7817c3371aaab39ca22daf80 Author: Helge Deller Date: Tue Mar 1 23:18:43 2016 +0100 parisc: Wire up copy_file_range syscall Signed-off-by: Helge Deller arch/parisc/include/uapi/asm/unistd.h | 3 ++- arch/parisc/kernel/syscall_table.S | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 Author: Helge Deller Date: Tue Jan 19 16:08:49 2016 +0100 parisc: Fix ptrace syscall number and return value modification Mike Frysinger reported that his ptrace testcase showed strange behaviour on parisc: It was not possible to avoid a syscall and the return value of a syscall couldn't be changed. To modify a syscall number, we were missing to save the new syscall number to gr20 which is then picked up later in assembly again. The effect that the return value couldn't be changed is a side-effect of another bug in the assembly code. When a process is ptraced, userspace expects each syscall to report entrance and exit of a syscall. If a syscall number was given which doesn't exist, we jumped to the normal syscall exit code instead of informing userspace that the (non-existant) syscall exits. This unexpected behaviour confuses userspace and thus the bug was misinterpreted as if we can't change the return value. This patch fixes both problems and was tested on 64bit kernel with 32bit userspace. Signed-off-by: Helge Deller Cc: Mike Frysinger Cc: stable@vger.kernel.org # v4.0+ Tested-by: Mike Frysinger arch/parisc/kernel/ptrace.c | 16 +++++++++++----- arch/parisc/kernel/syscall.S | 5 ++++- 2 files changed, 15 insertions(+), 6 deletions(-) commit f0da74bc8140001c6afd2a176e397c3c3aaca37a Merge: edffc21 99f81af Author: David S. Miller Date: Tue Mar 1 16:52:09 2016 -0500 Merge branch 'phy-micrel-fixes' Alexandre Belloni says: ==================== phy: micrel: fix issues with interrupt on atmel boards Since the phy is not polled anymore, there were issues getting a link on the sama5d* xplained boards. I'm not too sure about were those fixes should go and I'm wondering whether the first one shoud be made generic. For the second one, I found the PHY_HAS_MAGICANEG flag that is not used and I wondering whether this is related to that kind of issue. I had a quick look at the history and could'nt find its use. ==================== Signed-off-by: David S. Miller commit 99f81afc139c6edd14d77a91ee91685a414a1c66 Author: Alexandre Belloni Date: Fri Feb 26 19:18:23 2016 +0100 phy: micrel: Disable auto negotiation on startup Disable auto negotiation on init to properly detect an already plugged cable at boot. At boot, when the phy is started, it is in the PHY_UP state. However, if a cable is plugged at boot, because auto negociation is already enabled at the time we get the first interrupt, the phy is already running. But the state machine then switches from PHY_UP to PHY_AN and calls phy_start_aneg(). phy_start_aneg() will not do anything because aneg is already enabled on the phy. It will then wait for a interrupt before going further. This interrupt will never happen unless the cable is unplugged and then replugged. It was working properly before 321beec5047a (net: phy: Use interrupts when available in NOLINK state) because switching to NOLINK meant starting polling the phy, even if IRQ were enabled. Fixes: 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Signed-off-by: Alexandre Belloni Signed-off-by: David S. Miller drivers/net/phy/micrel.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f5aba91d7f186cba84af966a741a0346de603cd4 Author: Alexandre Belloni Date: Fri Feb 26 19:18:22 2016 +0100 phy: micrel: Ensure interrupts are reenabled on resume At least on ksz8081, when getting back from power down, interrupts are disabled. ensure they are reenabled if they were previously enabled. This fixes resuming which is failing on the xplained boards from atmel since 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Fixes: 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Signed-off-by: Alexandre Belloni Signed-off-by: David S. Miller drivers/net/phy/micrel.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 9a334d39daad92e2c46539b0bb3bd32b68df2af2 Author: Helge Deller Date: Wed Feb 3 20:54:56 2016 +0100 parisc: Use parentheses around expression in floppy.h David Binderman reported a style issue in the floppy.h header file: arch/parisc/include/asm/floppy.h:221: (style) Boolean result is used in bitwise operation. Clarify expression with parentheses. Reported-by: David Binderman Cc: David Binderman Signed-off-by: Helge Deller arch/parisc/include/asm/floppy.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit edffc2178d4ba10a61e150b42ef5e7d797714eb3 Author: Guillaume Nault Date: Fri Feb 26 18:45:34 2016 +0100 ppp: lock ppp->flags in ppp_read() and ppp_poll() ppp_read() and ppp_poll() can be called concurrently with ppp_ioctl(). In this case, ppp_ioctl() might call ppp_ccp_closed(), which may update ppp->flags while ppp_read() or ppp_poll() is reading it. The update done by ppp_ccp_closed() isn't atomic due to the bit mask operation ('ppp->flags &= ~(SC_CCP_OPEN | SC_CCP_UP)'), so concurrent readers might get transient values. Reading incorrect ppp->flags may disturb the 'ppp->flags & SC_LOOP_TRAFFIC' test in ppp_read() and ppp_poll(), which in turn can lead to improper decision on whether the PPP unit file is ready for reading or not. Since ppp_ccp_closed() is protected by the Rx and Tx locks (with ppp_lock()), taking the Rx lock is enough for ppp_read() and ppp_poll() to guarantee that ppp_ccp_closed() won't update ppp->flags concurrently. The same reasoning applies to ppp->n_channels. The 'n_channels' field can also be written to concurrently by ppp_ioctl() (through ppp_connect_channel() or ppp_disconnect_channel()). These writes aren't atomic (simple increment/decrement), but are protected by both the Rx and Tx locks (like in the ppp->flags case). So holding the Rx lock before reading ppp->n_channels also prevents concurrent writes. Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller drivers/net/ppp/ppp_generic.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit a7f4b98896f6aede26431a3017d32d722fcec5cb Author: Ivan Vecera Date: Fri Feb 26 09:15:50 2016 +0100 bna: fix list corruption Use list_move_tail() to move MAC address entry from list of pending to list of active entries. Simple list_add_tail() leaves the entry also in the first list, this leads to list corruption. Cc: Rasesh Mody Signed-off-by: Ivan Vecera Acked-by: Rasesh Mody Signed-off-by: David S. Miller drivers/net/ethernet/brocade/bna/bna_tx_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c44a72a5e8c16751af456cd711720c3aabd40cdd Merge: a6522c0 e9a2d81 Author: David S. Miller Date: Tue Mar 1 15:10:38 2016 -0500 Merge tag 'linux-can-fixes-for-4.5-20160226' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-02-26 this is a pull request of one patch for net. The patch by Maximilain Schneider fixes a kfree() problem during disconnect in the gs_usb driver. ==================== Signed-off-by: David S. Miller commit 197b958c1e76a575d77038cc98b4bebc2134279f Author: Takashi Iwai Date: Tue Mar 1 18:30:18 2016 +0100 ALSA: seq: oss: Don't drain at closing a client The OSS sequencer client tries to drain the pending events at releasing. Unfortunately, as spotted by syzkaller fuzzer, this may lead to an unkillable process state when the event has been queued at the far future. Since the process being released can't be signaled any longer, it remains and waits for the echo-back event in that far future. Back to history, the draining feature was implemented at the time we misinterpreted POSIX definition for blocking file operation. Actually, such a behavior is superfluous at release, and we should just release the device as is instead of keeping it up forever. This patch just removes the draining call that may block the release for too long time unexpectedly. BugLink: http://lkml.kernel.org/r/CACT4Y+Y4kD-aBGj37rf-xBw9bH3GMU6P+MYg4W1e-s-paVD2pg@mail.gmail.com Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/oss/seq_oss.c | 2 -- sound/core/seq/oss/seq_oss_device.h | 1 - sound/core/seq/oss/seq_oss_init.c | 16 ---------------- 3 files changed, 19 deletions(-) commit 7314d22a2f5bd40468d57768be368c3d9b4bd726 Author: Wolfram Sang Date: Sun Feb 21 15:16:48 2016 +0100 i2c: brcmstb: allocate correct amount of memory for regmap We want the size of the struct, not of a pointer to it. To be future proof, just dereference the pointer to get the desired type. Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver") Acked-by: Gregory Fong Acked-by: Florian Fainelli Reviewed-by: Kamal Dasu Signed-off-by: Wolfram Sang Cc: stable@kernel.org drivers/i2c/busses/i2c-brcmstb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 7d46af2084eabe73ce4dbf06072fded34b58b0c7 Merge: fc77dbd 397d153 Author: Linus Torvalds Date: Tue Mar 1 08:57:34 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: 1) System call tracing doesn't handle register contents properly across the trace. From Mike Frysinger. 2) Hook up copy_file_range 3) Build fix for 32-bit with newer tools. 4) New sun4v watchdog driver, from Wim Coekaerts. 5) Set context system call has to allow for servicable faults when we flush the register windows to memory * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Fix sparc64_set_context stack handling. sparc32: Add -Wa,-Av8 to KBUILD_CFLAGS. Add sun4v_wdt watchdog driver sparc: Fix system call tracing register handling. sparc: Hook up copy_file_range syscall. commit 9589995e46d89c70c6fa4723c5f3e5ec04c3c3e3 Author: Steve French Date: Mon Feb 29 01:02:11 2016 -0600 CIFS: Fix duplicate line introduced by clone_file_range patch Commit 04b38d601239b4 ("vfs: pull btrfs clone API to vfs layer") added a duplicated line (in cifsfs.c) which causes a sparse compile warning. Signed-off-by: Steve French Reviewed-by: Christoph Hellwig fs/cifs/cifsfs.c | 1 - 1 file changed, 1 deletion(-) commit c36dd3eaf1a674a45b58b922258d6eaa8932e292 Author: Felix Fietkau Date: Wed Feb 24 12:07:17 2016 +0100 mac80211: minstrel_ht: fix a logic error in RTS/CTS handling RTS/CTS needs to be enabled if the rate is a fallback rate *or* if it's a dual-stream rate and the sta is in dynamic SMPS mode. Cc: stable@vger.kernel.org Fixes: a3ebb4e1b763 ("mac80211: minstrel_ht: handle peers in dynamic SMPS") Reported-by: Matías Richart Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg net/mac80211/rc80211_minstrel_ht.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ec7bae8bec9b72e347e01330c745ab5cdd66f0e Author: Jouni Malinen Date: Tue Mar 1 00:29:00 2016 +0200 mac80211: Fix Public Action frame RX in AP mode Public Action frames use special rules for how the BSSID field (Address 3) is set. A wildcard BSSID is used in cases where the transmitter and recipient are not members of the same BSS. As such, we need to accept Public Action frames with wildcard BSSID. Commit db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP") added a rule that drops Action frames to TDLS-peers based on an Action frame having different DA (Address 1) and BSSID (Address 3) values. This is not correct since it misses the possibility of BSSID being a wildcard BSSID in which case the Address 1 would not necessarily match. Fix this by allowing mac80211 to accept wildcard BSSID in an Action frame when in AP mode. Fixes: db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP") Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen Signed-off-by: Johannes Berg net/mac80211/rx.c | 1 + 1 file changed, 1 insertion(+) commit 9acc54beb474c81148e2946603d141cf8716b19f Author: Johannes Berg Date: Fri Feb 26 22:13:40 2016 +0100 mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Just like for CCMP we need to check that for GCMP the fragments have PNs that increment by one; the spec was updated to fix this security issue and now has the following text: The receiver shall discard MSDUs and MMPDUs whose constituent MPDU PN values are not incrementing in steps of 1. Adapt the code for CCMP to work for GCMP as well, luckily the relevant fields already alias each other so no code duplication is needed (just check the aliasing with BUILD_BUG_ON.) Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg net/mac80211/ieee80211_i.h | 2 +- net/mac80211/rx.c | 36 +++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 10 deletions(-) commit 17e2df4613be57d0fab68df749f6b8114e453152 Author: Dennis Kadioglu Date: Tue Mar 1 14:23:29 2016 +0100 ALSA: usb-audio: Add a quirk for Plantronics DA45 Plantronics DA45 does not support reading the sample rate which leads to many lines of "cannot get freq at ep 0x4" and "cannot get freq at ep 0x84". This patch adds the USB ID of the DA45 to quirks.c and avoids those error messages. Signed-off-by: Dennis Kadioglu Cc: Signed-off-by: Takashi Iwai sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+) commit 537b8a8695ea0fbc857fe68f99cd5294f8fca5e3 Author: Johan Hovold Date: Mon Feb 29 18:56:02 2016 +0100 Revert "USB: serial: add Moxa UPORT 11x0 driver" This reverts commit 0b2b093ad405b56a9e6f4f20a25da77ebfa9549c. Turns out the MOXA vendor driver was basically just a copy of the ti_usb_3410_5052 driver. We don't want two drivers for the same chip even if mxu11x0 had gotten some much needed clean up before merge. So let's remove the mxu11x0 driver, add support for these Moxa devices to the TI driver, and then clean that driver up instead. Signed-off-by: Johan Hovold Acked-by: Greg Kroah-Hartman drivers/usb/serial/Kconfig | 16 - drivers/usb/serial/Makefile | 1 - drivers/usb/serial/mxu11x0.c | 1006 ------------------------------------------ 3 files changed, 1023 deletions(-) commit c0992d0f54847d0d1d85c60fcaa054f175ab1ccd Author: Yegor Yefremov Date: Mon Feb 29 16:39:57 2016 +0100 USB: serial: option: add support for Quectel UC20 Add support for Quectel UC20 and blacklist the QMI interface. Signed-off-by: Yegor Yefremov Cc: stable [johan: amend commit message ] Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) commit 5deef5551c77e488922cc4bf4bc76df63be650d0 Author: Daniele Palmas Date: Mon Feb 29 15:36:11 2016 +0100 USB: serial: option: add support for Telit LE922 PID 0x1045 This patch adds support for 0x1045 PID of Telit LE922. Signed-off-by: Daniele Palmas Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) commit 397d1533b6cce0ccb5379542e2e6d079f6936c46 Author: David S. Miller Date: Tue Mar 1 00:25:32 2016 -0500 sparc64: Fix sparc64_set_context stack handling. Like a signal return, we should use synchronize_user_stack() rather than flush_user_windows(). Reported-by: Ilya Malakhov Signed-off-by: David S. Miller arch/sparc/kernel/signal_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 22be3b105597002ad3499bdb9c0aba49c9ab05f7 Author: David S. Miller Date: Sun Jan 17 11:47:29 2016 -0500 sparc32: Add -Wa,-Av8 to KBUILD_CFLAGS. Binutils used to be (erroneously) extremely permissive about instruction usage. But that got fixed and if you don't properly tell it to accept classes of instructions it will fail. This uncovered a specs bug on sparc in gcc where it wouldn't pass the proper options to binutils options. Deal with this in the kernel build by adding -Wa,-Av8 to KBUILD_CFLAGS. Reported-by: Al Viro Signed-off-by: David S. Miller arch/sparc/Makefile | 6 ++++++ 1 file changed, 6 insertions(+) commit 15c665700bf6f4543f003ac0fbb1e9ec692e93f2 Author: Takashi Iwai Date: Mon Feb 29 18:01:18 2016 +0100 ASoC: wm_adsp: Fix enum ctl accesses in a wrong type The firmware ctls like "DSP1 Firmware" in wm_adsp codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/codecs/wm_adsp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 39a79fe10482572ce76fd724b7915b3ee4cbd81e Author: Takashi Iwai Date: Mon Feb 29 18:01:17 2016 +0100 ASoC: wm9081: Fix enum ctl accesses in a wrong type "Speaker Mode "ctl in wm9081 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm9081.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8293004c81dd33e6e91afe2f9a773fe6796893cc Author: Takashi Iwai Date: Mon Feb 29 18:01:16 2016 +0100 ASoC: wm8996: Fix enum ctl accesses in a wrong type "DSP1 EQ Mode" and "DSP2 EQ Mode" ctls in wm8996 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm8996.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8019c0b37cd5a87107808300a496388b777225bf Author: Takashi Iwai Date: Mon Feb 29 18:01:15 2016 +0100 ASoC: wm8994: Fix enum ctl accesses in a wrong type The DRC Mode like "AIF1DRC1 Mode" and EQ Mode like "AIF1.1 EQ Mode" in wm8994 codec driver are enum ctls, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/codecs/wm8994.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 251d604778f1f7bbf29672a79cccc4663a7efd62 Author: Takashi Iwai Date: Mon Feb 29 18:01:14 2016 +0100 ASoC: wm8985: Fix enum ctl accesses in a wrong type "Equalizer Function" ctl in wm8985 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm8985.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit b5ab265905b3e07ad9dc7d553a074404b25e9200 Author: Takashi Iwai Date: Mon Feb 29 18:01:13 2016 +0100 ASoC: wm8983: Fix enum ctl accesses in a wrong type "Equalizer Function" ctl in wm8983 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm8983.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit d0784829ae3b0beeb69b476f017d5c8a2eb95198 Author: Takashi Iwai Date: Mon Feb 29 18:01:12 2016 +0100 ASoC: wm8958: Fix enum ctl accesses in a wrong type "MBC Mode", "VSS Mode", "VSS HPF Mode" and "Enhanced EQ Mode" ctls in wm8958 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/codecs/wm8958-dsp2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c41a024c4e770fff999f4164cc4d1696e5f17437 Author: Takashi Iwai Date: Mon Feb 29 18:01:11 2016 +0100 ASoC: wm8904: Fix enum ctl accesses in a wrong type "DRC Mode" and "EQ Mode" ctls in wm8904 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm8904.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0cad10539b281e88335afd765afaf9885dcfc3ef Author: Takashi Iwai Date: Mon Feb 29 18:01:10 2016 +0100 ASoC: wm8753: Fix enum ctl accesses in a wrong type "DAI Mode" ctl in wm8753 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wm8753.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 154a0fddd4275aa93f4683705579a7d8ec3d177b Author: Takashi Iwai Date: Mon Feb 29 18:08:04 2016 +0100 ASoC: wl1273: Fix enum ctl accesses in a wrong type "Codec Mode" and "Audio Switch" ctls in wl1273 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/wl1273.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 8733f99c23726532918034f4ae599d9e6d27bd1e Author: Takashi Iwai Date: Mon Feb 29 18:08:03 2016 +0100 ASoC: tlv320dac33: Fix enum ctl accesses in a wrong type "FIFO Mode" ctl in tlv320dac33 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/tlv320dac33.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 58c0213872816bf24d14364989c82dc4acd58103 Author: Takashi Iwai Date: Mon Feb 29 18:08:02 2016 +0100 ASoC: max98095: Fix enum ctl accesses in a wrong type "Biquad1 Mode" and "Biquad2 Mode" ctls in max98095 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/max98095.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9af39044753d7280fa795528598636fe9c58a54e Author: Takashi Iwai Date: Mon Feb 29 18:08:01 2016 +0100 ASoC: max98088: Fix enum ctl accesses in a wrong type "EQ1 Mode" and "EQ2 Mode" ctls in max98088 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/max98088.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4b606316129571c46381430852c149855ac50477 Author: Takashi Iwai Date: Mon Feb 29 18:08:00 2016 +0100 ASoC: ab8500: Fix enum ctl accesses in a wrong type "Sidetone Status" and "ANC Status" ctls in ab8500 codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/ab8500-codec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit fe9aba13108ee8e15ae59009a26db02460dbb04f Author: Takashi Iwai Date: Mon Feb 29 18:04:42 2016 +0100 ASoC: da732x: Fix enum ctl accesses in a wrong type "DAC1 High Pass Filter Mode" & co in da732x codec driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/da732x.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 89300b4e5a5b5b5c145318f3b257291239522da6 Author: Takashi Iwai Date: Mon Feb 29 18:02:59 2016 +0100 ASoC: cs42l51: Fix enum ctl accesses in a wrong type "PCM channel mixer" ctl in cs42l51 codec driver is enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/codecs/cs42l51.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 508ddfba37cad76d774da8f8d8e2387f0eca5fa4 Author: Takashi Iwai Date: Mon Feb 29 17:29:25 2016 +0100 ASoC: intel: mfld: Fix enum ctl accesses in a wrong type "Playback Switch" and "Lineout Mux" ctls in medfld machine driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/intel/boards/mfld_machine.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit f4d438eec7fe56d55998195e08dfaa5aa3e08f0c Author: Takashi Iwai Date: Mon Feb 29 17:26:22 2016 +0100 ASoC: omap: rx51: Fix enum ctl accesses in a wrong type "Speaker Function", "Input Select" and "Jack Function" ctls in rx51 driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Acked-by: Jarkko Nikula Signed-off-by: Mark Brown sound/soc/omap/rx51.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit dd90533cd6bbfe075a72ab789b6e9d6f280ba476 Author: Takashi Iwai Date: Mon Feb 29 17:26:21 2016 +0100 ASoC: omap: n810: Fix enum ctl accesses in a wrong type "Jack Function", "Speaker Function" and "Input Select" ctls in n810 driver are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Acked-by: Jarkko Nikula Signed-off-by: Mark Brown sound/soc/omap/n810.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 419396d5a1d12003a18a58785687697800d2f02a Author: Takashi Iwai Date: Mon Feb 29 17:23:53 2016 +0100 ASoC: pxa: tosa: Fix enum ctl accesses in a wrong type "Jack Function" and "Speaker Function" ctls in tosa are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/pxa/tosa.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 49a1ba16ab15b9a572c188fe0d9d79017d2fef99 Author: Takashi Iwai Date: Mon Feb 29 17:23:52 2016 +0100 ASoC: pxa: spitz: Fix enum ctl accesses in a wrong type "Jack Function" and "Speaker Function" ctls in spitz are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/pxa/spitz.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7a3f4b488ce366de6ab2cf19d95353da9814bdd9 Author: Takashi Iwai Date: Mon Feb 29 17:23:51 2016 +0100 ASoC: pxa: poodle: Fix enum ctl accesses in a wrong type "Jack Function" and "Speaker Function" ctls in poodle are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/pxa/poodle.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 127ee199d5d232f29ad64bace3b441127fce6cd3 Author: Takashi Iwai Date: Mon Feb 29 17:23:50 2016 +0100 ASoC: pxa: magician: Fix enum ctl accesses in a wrong type "Input Select" ctl in magician driver is an enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. (Meanwhile "Headphone Switch" and "Speaker Switch" are boolean, so they should stay to access via value.integer.value[] as is.) Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/pxa/magician.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1457ad0e99dc5b1fe3fe3123d5135c95c00ed74b Author: Takashi Iwai Date: Mon Feb 29 17:23:49 2016 +0100 ASoC: pxa: corgi: Fix enum ctl accesses in a wrong type "Jack Function" and "Speaker Function" ctls in corgi are enum, while the current driver accesses wrongly via value.integer.value[]. They have to be via value.enumerated.item[] instead. Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/pxa/corgi.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 741338f99f16dc24d2d01ac777b0798ae9d10a90 Author: Takashi Iwai Date: Mon Feb 29 17:20:48 2016 +0100 ASoC: dapm: Fix ctl value accesses in a wrong type snd_soc_dapm_dai_link_get() and _put() access the associated ctl values as value.integer.value[]. However, this is an enum ctl, and it has to be accessed via value.enumerated.item[]. The former is long while the latter is unsigned int, so they don't align. Fixes: c66150824b8a ('ASoC: dapm: add code to configure dai link parameters') Cc: Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/soc-dapm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ead8f34c701ec7bf3234118b8c746227f30dfd1a Author: Chris Wilson Date: Thu Feb 25 21:10:28 2016 +0000 drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) commit 09731280028ce03e6a27e1998137f1775a2839f3 Author: Imre Deak Date: Wed Feb 17 14:17:42 2016 +0200 drm/i915: Add helper to get a display power ref if it was already enabled left the rpm wakelock assertions unbalanced if CONFIG_PM was disabled as intel_runtime_pm_get_if_in_use() would return true without incrementing the local bookkeeping required for the assertions. Signed-off-by: Chris Wilson CC: Mika Kuoppala CC: Joonas Lahtinen CC: Ville Syrjälä Reviewed-by: Imre Deak Signed-off-by: Dave Airlie drivers/gpu/drm/i915/intel_runtime_pm.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) commit 3c2002aec3ee3a9fc86ff8f8618f1253c94ec919 Author: Arnd Bergmann Date: Mon Feb 29 17:04:21 2016 +0100 cpufreq: mediatek: allow building as a module The MT8173 cpufreq driver can currently only be built-in, but it has a Kconfig dependency on the thermal core. THERMAL can be a loadable module, which in turn makes this driver impossible to build. It is nicer to make the cpufreq driver a module as well, so this patch turns the option in to a 'tristate' and adapts the dependency accordingly. The driver has no module_exit() function, so it will continue to not support unloading, but it can be built as a module and loaded at runtime now. Signed-off-by: Arnd Bergmann Fixes: 5269e7067cd6 (cpufreq: Add ARM_MT8173_CPUFREQ dependency on THERMAL) Signed-off-by: Rafael J. Wysocki drivers/cpufreq/Kconfig.arm | 4 ++-- drivers/cpufreq/mt8173-cpufreq.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) commit ddd30ef4741c30945e43a2956bfbc3afe74a73b5 Author: Arnd Bergmann Date: Mon Feb 29 17:04:20 2016 +0100 cpufreq: qoriq: allow building as module with THERMAL=m My previous patch to avoid link errors with the qoriq cpufreq driver disallowed all of the broken cases, but also prevented the driver from being built when CONFIG_THERMAL is a module. This changes the dependency to allow the cpufreq driver to also be a module in this case, just not built-in. Signed-off-by: Arnd Bergmann Fixes: 8ae1702a0df5 (cpufreq: qoriq: Register cooling device based on device tree) Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki drivers/cpufreq/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5adebafb75bdfbbe4ec69f14c3613e70f6ed7f6f Author: Leon Romanovsky Date: Sun Feb 21 18:12:26 2016 +0200 IB/core: Fix missed clean call in registration path In case of failure returned from query function in IB device registration, we need to clean IB cache which was missed. This change fixes it. Fixes: 3e153a93a1c1 ('IB/core: Save the device attributes on the device structure') Signed-off-by: Leon Romanovsky Reviewed-by: Ira Weiny Reviewed-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/core/device.c | 1 + 1 file changed, 1 insertion(+) commit 1195c103f6c98d9ff381cac3a8760d4f8a133627 Author: Minghuan Lian Date: Mon Feb 29 17:24:15 2016 -0600 PCI: layerscape: Fix MSG TLP drop setting Some kinds of Layerscape PCIe controllers will forward the received message TLPs to system application address space, which could corrupt system memory or lead to a system hang. Enable MSG_DROP to fix this issue. Signed-off-by: Minghuan Lian Signed-off-by: Bjorn Helgaas drivers/pci/host/pci-layerscape.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 79e3f4a853ed161cd4c06d84b50beebf961a47c6 Author: Murali Karicheri Date: Mon Feb 29 17:18:22 2016 -0600 PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer Commit cbce7900598c ("PCI: designware: Make driver arch-agnostic") changed the host bridge sysdata pointer from the ARM pci_sys_data to the DesignWare pcie_port structure, and changed pcie-designware.c to reflect that. But it did not change the corresponding code in pci-keystone-dw.c, so it caused crashes on Keystone: Unable to handle kernel NULL pointer dereference at virtual address 00000030 pgd = c0003000 [00000030] *pgd=80000800004003, *pmd=00000000 Internal error: Oops: 206 [#1] PREEMPT SMP ARM CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.2-00139-gb74f926 #2 Hardware name: Keystone PC is at ks_dw_pcie_msi_irq_unmask+0x24/0x58 Change pci-keystone-dw.c to expect sysdata to be the struct pcie_port pointer. [bhelgaas: changelog] Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic") Signed-off-by: Murali Karicheri Signed-off-by: Bjorn Helgaas CC: stable@vger.kernel.org # v4.4+ CC: Zhou Wang drivers/pci/host/pci-keystone-dw.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit e6a8c9b337eed56eb481e1b4dd2180c25a1e5310 Author: Joerg Roedel Date: Mon Feb 29 23:49:47 2016 +0100 iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path In the PCI hotplug path of the Intel IOMMU driver, replace the usage of the BUS_NOTIFY_DEL_DEVICE notifier, which is executed before the driver is unbound from the device, with BUS_NOTIFY_REMOVED_DEVICE, which runs after that. This fixes a kernel BUG being triggered in the VT-d code when the device driver tries to unmap DMA buffers and the VT-d driver already destroyed all mappings. Reported-by: Stefani Seibold Cc: stable@vger.kernel.org # v4.3+ Signed-off-by: Joerg Roedel drivers/iommu/dmar.c | 5 +++-- drivers/iommu/intel-iommu.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) commit a6522c08987daa6f9ac25a9c08870041a43db6b0 Author: Neil Horman Date: Thu Feb 25 13:02:50 2016 -0500 3c59x: mask LAST_FRAG bit from length field in ring Recently, I fixed a bug in 3c59x: commit 6e144419e4da11a9a4977c8d899d7247d94ca338 Author: Neil Horman Date: Wed Jan 13 12:43:54 2016 -0500 3c59x: fix another page map/single unmap imbalance Which correctly rebalanced dma mapping and unmapping types. Unfortunately it introduced a new bug which causes oopses on older systems. When mapping dma regions, the last entry for a packet in the 3c59x tx ring encodes a LAST_FRAG bit, which is encoded as the high order bit of the buffers length field. When it is unmapped the LAST_FRAG bit is cleared prior to being passed to the unmap function. Unfortunately the commit above fails to do that masking. It was missed in testing because the system on which I tested it had an intel iommu, the driver for which ignores the size field, using only the DMA address as the token to identify the mapping to be released. However, on older systems that rely on swiotlb (or other dma drivers that key off that length field), not masking off that LAST_FRAG high order bit results in parsing a huge size to be release, leading to all sorts of odd corruptions and the like. Fix is easy, just mask the length with 0xFFF. It should really be &(LAST_FRAG-1), but 0xFFF is the style of the file, and I'd like to make this fix minimal and correct before making it prettier. Appies to the net tree cleanly. All testing on both iommu and swiommu based systems produce good results Signed-off-by: Neil Horman CC: Steffen Klassert CC: "David S. Miller" Signed-off-by: David S. Miller drivers/net/ethernet/3com/3c59x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dc8b4afc4a04fac8ee55a19b59f2356a25e7e778 Author: Manuel Lauss Date: Sat Feb 27 16:10:05 2016 +0100 ata: ahci: don't mark HotPlugCapable Ports as external/removable The HPCP bit is set by bioses for on-board sata ports either because they think sata is hotplug capable in general or to allow Windows to display a "device eject" icon on ports which are routed to an external connector bracket. However in Redhat Bugzilla #1310682, users report that with kernel 4.4, where this bit test first appeared, a lot of partitions on sata drives are now mounted automatically. This patch should fix redhat and a lot of other distros which unconditionally automount all devices which have the "removable" bit set. Signed-off-by: Manuel Lauss Signed-off-by: Tejun Heo Fixes: 8a3e33cf92c7 ("ata: ahci: find eSATA ports and flag them as removable" changes userspace behavior) Link: http://lkml.kernel.org/g/56CF35FA.1070500@redhat.com Cc: stable@vger.kernel.org #v4.4+ drivers/ata/libahci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d243bed32f5042582896237f88fa1798aee55ff9 Author: Tirumalesh Chalamarla Date: Tue Feb 16 12:08:49 2016 -0800 ahci: Workaround for ThunderX Errata#22536 Due to Errata in ThunderX, HOST_IRQ_STAT should be cleared before leaving the interrupt handler. The patch attempts to satisfy the need. Changes from V2: - removed newfile - code is now under CONFIG_ARM64 Changes from V1: - Rebased on top of libata/for-4.6 - Moved ThunderX intr handler to new file tj: Minor adjustments to comments. Signed-off-by: Tirumalesh Chalamarla Signed-off-by: Tejun Heo drivers/ata/ahci.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit 3c4c615d70c8cbdc8ba8c79ed702640930652a79 Author: Vittorio Alfieri Date: Sun Feb 28 14:40:24 2016 +0100 USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder The Parrot NMEA GPS Flight Recorder is a USB composite device consisting of hub, flash storage, and cp210x usb to serial chip. It is an accessory to the mass-produced Parrot AR Drone 2. The device emits standard NMEA messages which make the it compatible with NMEA compatible software. It was tested using gpsd version 3.11-3 as an NMEA interpreter and using the official Parrot Flight Recorder. Signed-off-by: Vittorio Alfieri Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+) commit 013dd239d6220a4e0dfdf0d45a82c34f1fd73deb Author: Patrik Halfar Date: Sat Feb 20 18:49:56 2016 +0100 USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) New revision of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new idProduct. Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x413c Dell Computer Corp. idProduct 0x81b3 bcdDevice 0.06 iManufacturer 1 Sierra Wireless, Incorporated iProduct 2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband Card iSerial 3 bNumConfigurations 2 Signed-off-by: Patrik Halfar Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+) commit a528aca7f359f4b0b1d72ae406097e491a5ba9ea Author: Al Viro Date: Mon Feb 29 12:12:46 2016 -0500 use ->d_seq to get coherency between ->d_inode and ->d_flags Games with ordering and barriers are way too brittle. Just bump ->d_seq before and after updating ->d_inode and ->d_flags type bits, so that verifying ->d_seq would guarantee they are coherent. Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Al Viro fs/dcache.c | 20 +++++--------------- include/linux/dcache.h | 4 +--- 2 files changed, 6 insertions(+), 18 deletions(-) commit eab3c4db193f5fcccf70e884de9a922ca2c63d80 Author: Takashi Iwai Date: Mon Feb 29 14:26:43 2016 +0100 ALSA: hdsp: Fix wrong boolean ctl value accesses snd-hdsp driver accesses enum item values (int) instead of boolean values (long) wrongly for some ctl elements. This patch fixes them. Cc: Signed-off-by: Takashi Iwai sound/pci/rme9652/hdsp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c1099c3294c2344110085a38c50e478a5992b368 Author: Takashi Iwai Date: Mon Feb 29 14:32:42 2016 +0100 ALSA: hdspm: Fix zero-division HDSPM driver contains a code issuing zero-division potentially in system sample rate ctl code. This patch fixes it by not processing a zero or invalid rate value as a divisor, as well as excluding the invalid value to be passed via the given ctl element. Cc: Signed-off-by: Takashi Iwai sound/pci/rme9652/hdspm.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 537e48136295c5860a92138c5ea3959b9542868b Author: Takashi Iwai Date: Mon Feb 29 14:25:16 2016 +0100 ALSA: hdspm: Fix wrong boolean ctl value accesses snd-hdspm driver accesses enum item values (int) instead of boolean values (long) wrongly for some ctl elements. This patch fixes them. Cc: Signed-off-by: Takashi Iwai sound/pci/rme9652/hdspm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit b6809ee573cc2f8de97f7c8f45eacc5db1129060 Author: Joerg Roedel Date: Fri Feb 26 16:48:59 2016 +0100 iommu/amd: Detach device from domain before removal Detach the device that is about to be removed from its domain (if it has one) to clear any related state like DTE entry and device's ATS state. Reported-by: Kelly Zytaruk Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 4 ++++ 1 file changed, 4 insertions(+) commit 887349f69f37e71e2a8bfbd743831625a0b2ff51 Author: Michael S. Tsirkin Date: Sun Feb 28 17:35:59 2016 +0200 MIPS: kvm: Fix ioctl error handling. Calling return copy_to_user(...) or return copy_from_user in an ioctl will not do the right thing if there's a pagefault: copy_to_user/copy_from_user return the number of bytes not copied in this case. Fix up kvm on mips to do return copy_to_user(...)) ? -EFAULT : 0; and return copy_from_user(...)) ? -EFAULT : 0; everywhere. Signed-off-by: Michael S. Tsirkin Cc: Paolo Bonzini Cc: James Hogan Cc: linux-kernel@vger.kernel.org Cc: linux-mips@linux-mips.org Cc: stable@vger.kernel.org Cc: kvm@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/12709/ Signed-off-by: Ralf Baechle arch/mips/kvm/mips.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 56fa81fc9a5445938f3aa2e63d15ab63dc938ad6 Author: Govindraj Raja Date: Mon Feb 29 11:41:20 2016 +0000 MIPS: scache: Fix scache init with invalid line size. In current scache init cache line_size is determined from cpu config register, however if there there no scache then mips_sc_probe_cm3 function populates a invalid line_size of 2. The invalid line_size can cause a NULL pointer deference during r4k_dma_cache_inv as r4k_blast_scache is populated based on line_size. Scache line_size of 2 is invalid option in r4k_blast_scache_setup. This issue was faced during a MIPS I6400 based virtual platform bring up where scache was not available in virtual platform model. Signed-off-by: Govindraj Raja Fixes: 7d53e9c4cd21("MIPS: CM3: Add support for CM3 L2 cache.") Cc: Paul Burton Cc: James Hogan Cc: Ralf Baechle Cc: James Hartley Cc: linux-mips@linux-mips.org Cc: stable@vger.kernel.org # v4.2+ Patchwork: https://patchwork.linux-mips.org/patch/12710/ Signed-off-by: Ralf Baechle arch/mips/mm/sc-mips.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 923adb1646d5ba739d2a1e63ee20d60574d9da8e Author: Frederic Barrat Date: Wed Feb 24 18:27:51 2016 +0100 cxl: Fix PSL timebase synchronization detection The PSL timebase synchronization is seemingly failing for configuration not including VIRT_CPU_ACCOUNTING_NATIVE. The driver shows the following trace in dmesg: PSL: Timebase sync: giving up! The PSL timebase register is actually syncing correctly, but the cxl driver is not detecting it. Fix is to use the proper timebase-to-time conversion. Signed-off-by: Frederic Barrat Cc: # 4.3+ Acked-by: Michael Neuling Reviewed-by: Matthew R. Ochs Acked-by: Ian Munsie Reviewed-by: Andrew Donnellan Reviewed-by: Vaibhav Jain Signed-off-by: Michael Ellerman drivers/misc/cxl/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 51ff5d7767eae285969da75c209e9425d84b012d Author: Daniel Sanders Date: Tue Feb 23 10:29:20 2016 +0000 MIPS: Avoid variant of .type unsupported by LLVM Assembler The target independent parts of the LLVM Lexer considers 'fault@function' to be a single token representing the 'fault' symbol with a 'function' modifier. However, this is not the case in the .type directive where 'function' refers to STT_FUNC from the ELF standard. Although GAS accepts it, '.type symbol@function' is an undocumented form of this directive. The documentation specifies a comma between the symbol and '@function'. Signed-off-by: Scott Egerton Signed-off-by: Daniel Sanders Reviewed-by: Maciej W. Rozycki Cc: Paul Burton Cc: Leonid Yegoshin Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/12587/ Signed-off-by: Ralf Baechle arch/mips/kernel/r2300_fpu.S | 2 +- arch/mips/kernel/r4k_fpu.S | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 71e60073ca7b5f931b16f29add16c68b2e06949a Author: Ralf Baechle Date: Tue Feb 16 12:29:46 2016 +0100 MIPS: jz4740: Fix surviving instance of irq_to_gpio() This is fallout from commit 832f5dacfa0b ("MIPS: Remove all the uses of custom gpio.h"). Signed-off-by: Ralf Baechle Suggested-by: Lars-Peter Clausen arch/mips/jz4740/gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4cad67fca3fc952d6f2ed9e799621f07666a560f Author: Michael S. Tsirkin Date: Sun Feb 28 17:32:07 2016 +0200 arm/arm64: KVM: Fix ioctl error handling Calling return copy_to_user(...) in an ioctl will not do the right thing if there's a pagefault: copy_to_user returns the number of bytes not copied in this case. Fix up kvm to do return copy_to_user(...)) ? -EFAULT : 0; everywhere. Cc: stable@vger.kernel.org Acked-by: Christoffer Dall Signed-off-by: Michael S. Tsirkin Signed-off-by: Marc Zyngier arch/arm/kvm/guest.c | 2 +- arch/arm64/kvm/guest.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 Author: Yadan Fan Date: Mon Feb 29 14:44:57 2016 +0800 Fix cifs_uniqueid_to_ino_t() function for s390x This issue is caused by commit 02323db17e3a7 ("cifs: fix cifs_uniqueid_to_ino_t not to ever return 0"), when BITS_PER_LONG is 64 on s390x, the corresponding cifs_uniqueid_to_ino_t() function will cast 64-bit fileid to 32-bit by using (ino_t)fileid, because ino_t (typdefed __kernel_ino_t) is int type. It's defined in arch/s390/include/uapi/asm/posix_types.h #ifndef __s390x__ typedef unsigned long __kernel_ino_t; ... #else /* __s390x__ */ typedef unsigned int __kernel_ino_t; So the #ifdef condition is wrong for s390x, we can just still use one cifs_uniqueid_to_ino_t() function with comparing sizeof(ino_t) and sizeof(u64) to choose the correct execution accordingly. Signed-off-by: Yadan Fan CC: stable Signed-off-by: Steve French fs/cifs/cifsfs.h | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 6cc3b24235929b54acd5ecc987ef11a425bd209e Author: Pavel Shilovsky Date: Sat Feb 27 11:58:18 2016 +0300 CIFS: Fix SMB2+ interim response processing for read requests For interim responses we only need to parse a header and update a number credits. Now it is done for all SMB2+ command except SMB2_READ which is wrong. Fix this by adding such processing. Signed-off-by: Pavel Shilovsky Tested-by: Shirish Pargaonkar CC: Stable Signed-off-by: Steve French fs/cifs/cifssmb.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) commit deb7deff2f00bdbbcb3d560dad2a89ef37df837d Author: Justin Maggard Date: Tue Feb 9 15:52:08 2016 -0800 cifs: fix out-of-bounds access in lease parsing When opening a file, SMB2_open() attempts to parse the lease state from the SMB2 CREATE Response. However, the parsing code was not careful to ensure that the create contexts are not empty or invalid, which can lead to out- of-bounds memory access. This can be seen easily by trying to read a file from a OSX 10.11 SMB3 server. Here is sample crash output: BUG: unable to handle kernel paging request at ffff8800a1a77cc6 IP: [] SMB2_open+0x804/0x960 PGD 8f77067 PUD 0 Oops: 0000 [#1] SMP Modules linked in: CPU: 3 PID: 2876 Comm: cp Not tainted 4.5.0-rc3.x86_64.1+ #14 Hardware name: NETGEAR ReadyNAS 314 /ReadyNAS 314 , BIOS 4.6.5 10/11/2012 task: ffff880073cdc080 ti: ffff88005b31c000 task.ti: ffff88005b31c000 RIP: 0010:[] [] SMB2_open+0x804/0x960 RSP: 0018:ffff88005b31fa08 EFLAGS: 00010282 RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000006 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff88007eb8c8b0 RBP: ffff88005b31fad8 R08: 666666203d206363 R09: 6131613030383866 R10: 3030383866666666 R11: 00000000000002b0 R12: ffff8800660fd800 R13: ffff8800a1a77cc2 R14: 00000000424d53fe R15: ffff88005f5a28c0 FS: 00007f7c8a2897c0(0000) GS:ffff88007eb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffff8800a1a77cc6 CR3: 000000005b281000 CR4: 00000000000006e0 Stack: ffff88005b31fa70 ffffffff88278789 00000000000001d3 ffff88005f5a2a80 ffffffff00000003 ffff88005d029d00 ffff88006fde05a0 0000000000000000 ffff88005b31fc78 ffff88006fde0780 ffff88005b31fb2f 0000000100000fe0 Call Trace: [] ? cifsConvertToUTF16+0x159/0x2d0 [] smb2_open_file+0x98/0x210 [] ? __kmalloc+0x1c/0xe0 [] cifs_open+0x2a4/0x720 [] do_dentry_open+0x1ff/0x310 [] ? cifsFileInfo_get+0x30/0x30 [] vfs_open+0x52/0x60 [] path_openat+0x170/0xf70 [] ? remove_wait_queue+0x48/0x50 [] do_filp_open+0x79/0xd0 [] ? __alloc_fd+0x3a/0x170 [] do_sys_open+0x114/0x1e0 [] SyS_open+0x19/0x20 [] entry_SYSCALL_64_fastpath+0x12/0x6a Code: 4d 8d 6c 07 04 31 c0 4c 89 ee e8 47 6f e5 ff 31 c9 41 89 ce 44 89 f1 48 c7 c7 28 b1 bd 88 31 c0 49 01 cd 4c 89 ee e8 2b 6f e5 ff <45> 0f b7 75 04 48 c7 c7 31 b1 bd 88 31 c0 4d 01 ee 4c 89 f6 e8 RIP [] SMB2_open+0x804/0x960 RSP CR2: ffff8800a1a77cc6 ---[ end trace d9f69ba64feee469 ]--- Signed-off-by: Justin Maggard Signed-off-by: Steve French CC: Stable fs/cifs/smb2pdu.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) commit b24e7ad1fdc22177eb3e51584e1cfcb45d818488 Author: Takashi Iwai Date: Sun Feb 28 11:41:47 2016 +0100 ALSA: timer: Fix ioctls for X32 ABI X32 ABI takes the 64bit timespec, thus the timer user status ioctl becomes incompatible with IA32. This results in NOTTY error when the ioctl is issued. Meanwhile, this struct in X32 is essentially identical with the one in X86-64, so we can just bypassing to the existing code for this specific compat ioctl. Cc: # v3.4+ Signed-off-by: Takashi Iwai sound/core/timer_compat.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 3a72494ac2a3bd229db941d51e7efe2f6ccd947b Author: Takashi Iwai Date: Sun Feb 28 11:36:14 2016 +0100 ALSA: timer: Fix broken compat timer user status ioctl The timer user status compat ioctl returned the bogus struct used for 64bit architectures instead of the 32bit one. This patch addresses it to return the proper struct. Cc: Signed-off-by: Takashi Iwai sound/core/timer_compat.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 2251fbbc1539f05b0b206b37a602d5776be37252 Author: Takashi Iwai Date: Sun Feb 28 11:28:08 2016 +0100 ALSA: rawmidi: Fix ioctls X32 ABI Like the previous fixes for ctl and PCM, we need a fix for incompatible X32 ABI regarding the rawmidi: namely, struct snd_rawmidi_status has the timespec, and the size and the alignment on X32 differ from IA32. This patch fixes the incompatible ioctl for X32. Cc: # v3.4+ Signed-off-by: Takashi Iwai sound/core/rawmidi_compat.c | 53 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) commit dd7e3f805231cf83317c39bd346d5e4839f5cbb0 Author: Takashi Iwai Date: Sun Feb 28 11:30:53 2016 +0100 ALSA: rawmidi: Use comapt_put_timespec() Instead of open-coding, use the existing helper to copy a 32bit timespec from/to 64bit. Signed-off-by: Takashi Iwai sound/core/rawmidi_compat.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 513ace79b657e2022a592e77f24074e088681ecc Author: Takashi Iwai Date: Sun Feb 28 11:23:09 2016 +0100 ALSA: pcm: Fix ioctls for X32 ABI X32 ABI uses the 64bit timespec in addition to 64bit alignment of 64bit values. This leads to incompatibilities in some PCM ioctls involved with snd_pcm_channel_info, snd_pcm_status and snd_pcm_sync_ptr structs. Fix the PCM compat ABI for these ioctls like the previous commit for ctl API. Reported-by: Steven Newbury Cc: # v3.4+ Signed-off-by: Takashi Iwai sound/core/pcm_compat.c | 177 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 176 insertions(+), 1 deletion(-) commit 6236d8bb2afcfe71b88ecea554e0dc638090a45f Author: Takashi Iwai Date: Sat Feb 27 17:52:42 2016 +0100 ALSA: ctl: Fix ioctls for X32 ABI The X32 ABI takes the same alignment like x86-64, and this may result in the incompatible struct size from ia32. Unfortunately, we hit this in some control ABI: struct snd_ctl_elem_value differs between them due to the position of 64bit variable array. This ends up with the unknown ioctl (ENOTTY) error. The fix is to add the compat entries for the new aligned struct. Reported-and-tested-by: Steven Newbury Cc: # v3.4+ Signed-off-by: Takashi Iwai sound/core/control_compat.c | 90 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 74 insertions(+), 16 deletions(-) commit fc77dbd34c5c99bce46d40a2491937c3bcbd10af Author: Linus Torvalds Date: Sun Feb 28 08:41:20 2016 -0800 Linux 4.5-rc6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b9540ce033ad15802e36ad1cd1c36bdad98eeea Merge: 4b696dc 0da4cf3 Author: Linus Torvalds Date: Sun Feb 28 07:52:00 2016 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A rather largish series of 12 patches addressing a maze of race conditions in the perf core code from Peter Zijlstra" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Robustify task_function_call() perf: Fix scaling vs. perf_install_in_context() perf: Fix scaling vs. perf_event_enable() perf: Fix scaling vs. perf_event_enable_on_exec() perf: Fix ctx time tracking by introducing EVENT_TIME perf: Cure event->pending_disable race perf: Fix race between event install and jump_labels perf: Fix cloning perf: Only update context time when active perf: Allow perf_release() with !event->ctx perf: Do not double free perf: Close install vs. exit race commit 4b696dcb1a55e40648ad0eec4af991c72f945a85 Merge: 76c03f0 9bf148cb Author: Linus Torvalds Date: Sun Feb 28 07:49:23 2016 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "This update contains: - Hopefully the last ASM CLAC fixups - A fix for the Quark family related to the IMR lock which makes kexec work again - A off-by-one fix in the MPX code. Ironic, isn't it? - A fix for X86_PAE which addresses once more an unsigned long vs phys_addr_t hickup" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mpx: Fix off-by-one comparison with nr_registers x86/mm: Fix slow_virt_to_phys() for X86_PAE again x86/entry/compat: Add missing CLAC to entry_INT80_32 x86/entry/32: Add an ASM_CLAC to entry_SYSENTER_32 x86/platform/intel/quark: Change the kernel's IMR lock bit to false commit 76c03f0f5d496be6a6b81df5f6e16551c07b3c0a Merge: f055ae0 c219b7d Author: Linus Torvalds Date: Sun Feb 28 07:48:01 2016 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixlet from Thomas Gleixner: "A trivial printk typo fix" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix trivial typo in printk() message commit f055ae04aeb0fd1d4373916c43b08481fcd9e5bc Merge: 8da5143 253baff Author: Linus Torvalds Date: Sun Feb 28 07:45:58 2016 -0800 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "Four small fixes for irqchip drivers: - Add missing low level irq handler initialization on mxs, so interrupts can acutally be delivered - Add a missing barrier to the GIC driver - Two fixes for the GIC-V3-ITS driver, addressing a double EOI write and a cache flush beyond the actual region" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3: Add missing barrier to 32bit version of gic_read_iar() irqchip/mxs: Add missing set_handle_irq() irqchip/gicv3-its: Avoid cache flush beyond ITS_BASERn memory size irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1 commit 8da51430ff28d2f2daa570f060b1c9fbba81c81a Merge: 62718e3 7a64cd8 Author: Linus Torvalds Date: Sun Feb 28 07:39:15 2016 -0800 Merge tag 'staging-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/android fix from Greg KH: "Here is one patch, for the android binder driver, to resolve a reported problem. Turns out it has been around for a while (since 3.15), so it is good to finally get it resolved. It has been in linux-next for a while with no reported issues" * tag 'staging-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE commit 62718e304aa603b1fcea9f965c604fc652ac87ba Merge: 12b9fa6 428b315 Author: Linus Torvalds Date: Sun Feb 28 07:37:30 2016 -0800 Merge tag 'usb-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a few USB fixes for 4.5-rc6 They fix a reported bug for some USB 3 devices by reverting the recent patch, a MAINTAINERS change for some drivers, some new device ids, and of course, the usual bunch of USB gadget driver fixes. All have been in linux-next for a while with no reported issues" * tag 'usb-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: MAINTAINERS: drop OMAP USB and MUSB maintainership usb: musb: fix DMA for host mode usb: phy: msm: Trigger USB state detection work in DRD mode usb: gadget: net2280: fix endpoint max packet for super speed connections usb: gadget: gadgetfs: unregister gadget only if it got successfully registered usb: gadget: remove driver from pending list on probe error Revert "usb: hub: do not clear BOS field during reset device" usb: chipidea: fix return value check in ci_hdrc_pci_probe() usb: chipidea: error on overflow for port_test_write USB: option: add "4G LTE usb-modem U901" USB: cp210x: add IDs for GE B650V3 and B850V3 boards USB: option: add support for SIM7100E usb: musb: Fix DMA desired mode for Mentor DMA engine usb: gadget: fsl_qe_udc: fix IS_ERR_VALUE usage usb: dwc2: USB_DWC2 should depend on HAS_DMA usb: dwc2: host: fix the data toggle error in full speed descriptor dma usb: dwc2: host: fix logical omissions in dwc2_process_non_isoc_desc usb: dwc3: Fix assignment of EP transfer resources usb: dwc2: Add extra delay when forcing dr_mode commit 8160c4e455820d5008a1116d2dca35f0363bb062 Author: Michael S. Tsirkin Date: Sun Feb 28 16:31:39 2016 +0200 vfio: fix ioctl error handling Calling return copy_to_user(...) in an ioctl will not do the right thing if there's a pagefault: copy_to_user returns the number of bytes not copied in this case. Fix up vfio to do return copy_to_user(...)) ? -EFAULT : 0; everywhere. Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Alex Williamson drivers/vfio/pci/vfio_pci.c | 9 ++++++--- drivers/vfio/platform/vfio_platform_common.c | 9 ++++++--- drivers/vfio/vfio_iommu_type1.c | 6 ++++-- 3 files changed, 16 insertions(+), 8 deletions(-) commit 12b9fa6a97b3150477ab182e321be512b59fa899 Merge: 340b3a5 5129fa4 Author: Linus Torvalds Date: Sat Feb 27 17:10:32 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_last(): ELOOP failure exit should be done after leaving RCU mode should_follow_link(): validate ->d_seq after having decided to follow namei: ->d_inode of a pinned dentry is stable only for positives do_last(): don't let a bogus return value from ->open() et.al. to confuse us fs: return -EOPNOTSUPP if clone is not supported hpfs: don't truncate the file when delete fails commit 340b3a5b35c0919e1535b355a9eafe1f81c4cae3 Merge: 691429e d877a21 Author: Linus Torvalds Date: Sat Feb 27 16:58:32 2016 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "We didn't have a batch last week, so this one is slightly larger. None of them are scary though, a handful of fixes for small DT pieces, replacing properties with newer conventions. Highlights: - N900 fix for setting system revision - onenand init fix to avoid filesystem corruption - Clock fix for audio on Beaglebone-x15 - Fixes on shmobile to deal with CONFIG_DEBUG_RODATA (default y in 4.6) + misc smaller stuff" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: MAINTAINERS: Extend info, add wiki and ml for meson arch MAINTAINERS: alpine: add a new maintainer and update the entry ARM: at91/dt: fix typo in sama5d2 pinmux descriptions ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption Revert "regulator: tps65217: remove tps65217.dtsi file" ARM: shmobile: Remove shmobile_boot_arg ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss ARM: shmobile: r8a7779: Remove remainings of removed SCU boot setup code ARM: shmobile: Move shmobile_scu_base from .text to .bss ARM: OMAP2+: Fix omap_device for module reload on PM runtime forbid ARM: OMAP2+: Improve omap_device error for driver writers ARM: DTS: am57xx-beagle-x15: Select SYS_CLK2 for audio clocks ARM: dts: am335x/am57xx: replace gpio-key,wakeup with wakeup-source property ARM: OMAP2+: Set system_rev from ATAGS for n900 ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl ARM: dts: kirkwood: use unique machine name for ds112 ARM: dts: imx6: remove bogus interrupt-parent from CAAM node commit 5129fa482b16615fd4464d2f5d23acb1b7056c66 Author: Al Viro Date: Sat Feb 27 19:37:37 2016 -0500 do_last(): ELOOP failure exit should be done after leaving RCU mode ... or we risk seeing a bogus value of d_is_symlink() there. Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Al Viro fs/namei.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit a7f775428b8f5808815c0e3004020cedb94cbe3b Author: Al Viro Date: Sat Feb 27 19:31:01 2016 -0500 should_follow_link(): validate ->d_seq after having decided to follow ... otherwise d_is_symlink() above might have nothing to do with the inode value we've got. Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Al Viro fs/namei.c | 5 +++++ 1 file changed, 5 insertions(+) commit d4565649b6d6923369112758212b851adc407f0c Author: Al Viro Date: Sat Feb 27 19:23:16 2016 -0500 namei: ->d_inode of a pinned dentry is stable only for positives both do_last() and walk_component() risk picking a NULL inode out of dentry about to become positive, *then* checking its flags and seeing that it's not negative anymore and using (already stale by then) value they'd fetched earlier. Usually ends up oopsing soon after that... Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Al Viro fs/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c80567c82ae4814a41287618e315a60ecf513be6 Author: Al Viro Date: Sat Feb 27 19:17:33 2016 -0500 do_last(): don't let a bogus return value from ->open() et.al. to confuse us ... into returning a positive to path_openat(), which would interpret that as "symlink had been encountered" and proceed to corrupt memory, etc. It can only happen due to a bug in some ->open() instance or in some LSM hook, etc., so we report any such event *and* make sure it doesn't trick us into further unpleasantness. Cc: stable@vger.kernel.org # v3.6+, at least Signed-off-by: Al Viro fs/namei.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0fcbf996d848d03573113d83f4e3fb3bcfa5ab5e Author: Christoph Hellwig Date: Fri Feb 26 18:53:12 2016 +0100 fs: return -EOPNOTSUPP if clone is not supported -EBADF is a rather confusing error if an operations is not supported, and nfsd gets rather upset about it. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro fs/read_write.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b6853f78e763d42c7a158d8de3549c9827c604ab Author: Mikulas Patocka Date: Thu Feb 25 18:17:38 2016 +0100 hpfs: don't truncate the file when delete fails The delete opration can allocate additional space on the HPFS filesystem due to btree split. The HPFS driver checks in advance if there is available space, so that it won't corrupt the btree if we run out of space during splitting. If there is not enough available space, the HPFS driver attempted to truncate the file, but this results in a deadlock since the commit 7dd29d8d865efdb00c0542a5d2c87af8c52ea6c7 ("HPFS: Introduce a global mutex and lock it on every callback from VFS"). This patch removes the code that tries to truncate the file and -ENOSPC is returned instead. If the user hits -ENOSPC on delete, he should try to delete other files (that are stored in a leaf btree node), so that the delete operation will make some space for deleting the file stored in non-leaf btree node. Reported-by: Al Viro Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org # 2.6.39+ Signed-off-by: Al Viro fs/hpfs/namei.c | 31 +++---------------------------- 1 file changed, 3 insertions(+), 28 deletions(-) commit 691429e13dfaf5b0994b07cc166db41bd608ee3d Merge: 1c27147 7f6d5b5 Author: Linus Torvalds Date: Sat Feb 27 12:46:16 2016 -0800 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "10 fixes" * emailed patches from Andrew Morton : dax: move writeback calls into the filesystems dax: give DAX clearing code correct bdev ext4: online defrag not supported with DAX ext2, ext4: only set S_DAX for regular inodes block: disable block device DAX by default ocfs2: unlock inode if deleting inode from orphan fails mm: ASLR: use get_random_long() drivers: char: random: add get_random_long() mm: numa: quickly fail allocations for NUMA balancing on full nodes mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED commit 1c271479b56da4a8caf5f56a88432d4260e120fe Merge: a9f8094a 1e9d180 Author: Linus Torvalds Date: Sat Feb 27 12:40:49 2016 -0800 Merge tag 'tags/ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext2/4 DAX fix from Ted Ts'o: "This fixes a file system corruption bug with DAX" * tag 'tags/ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext2, ext4: fix issue with missing journal entry in ext4_dax_mkwrite() commit a9f8094aaedc7bc21e9232ea5120eaf2e0c824fd Merge: b9ea44b 61d9e85 Author: Linus Torvalds Date: Sat Feb 27 12:33:42 2016 -0800 Merge tag 'pci-v4.5-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "Enumeration: Revert x86 pcibios_alloc_irq() to fix regression (Bjorn Helgaas) Marvell MVEBU host bridge driver: Restrict build to 32-bit ARM (Thierry Reding)" * tag 'pci-v4.5-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: mvebu: Restrict build to 32-bit ARM Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()" Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed" Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled" commit 1e9d180ba39f42e8ca4a808baef3a3ef034b1c2c Author: Ross Zwisler Date: Sat Feb 27 14:01:13 2016 -0500 ext2, ext4: fix issue with missing journal entry in ext4_dax_mkwrite() As it is currently written ext4_dax_mkwrite() assumes that the call into __dax_mkwrite() will not have to do a block allocation so it doesn't create a journal entry. For a read that creates a zero page to cover a hole followed by a write that actually allocates storage this is incorrect. The ext4_dax_mkwrite() -> __dax_mkwrite() -> __dax_fault() path calls get_blocks() to allocate storage. Fix this by having the ->page_mkwrite fault handler call ext4_dax_fault() as this function already has all the logic needed to allocate a journal entry and call __dax_fault(). Also update the ext2 fault handlers in this same way to remove duplicate code and keep the logic between ext2 and ext4 the same. Reviewed-by: Jan Kara Signed-off-by: Ross Zwisler Signed-off-by: Theodore Ts'o fs/ext2/file.c | 19 +------------------ fs/ext4/file.c | 19 ++----------------- 2 files changed, 3 insertions(+), 35 deletions(-) commit b9ea44bf2c70b08b9ab3f3d71c2d16d6a134d35e Merge: 29a9faa a0d54c3 Author: Linus Torvalds Date: Sat Feb 27 10:30:14 2016 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One small fix to keep OMAP platforms working across a suspend/resume cycle" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: ti: omap3+: dpll: use non-locking version of clk_get_rate commit 7f6d5b529b7dfe2fca30cbf4bc81e16575090025 Author: Ross Zwisler Date: Fri Feb 26 15:19:55 2016 -0800 dax: move writeback calls into the filesystems Previously calls to dax_writeback_mapping_range() for all DAX filesystems (ext2, ext4 & xfs) were centralized in filemap_write_and_wait_range(). dax_writeback_mapping_range() needs a struct block_device, and it used to get that from inode->i_sb->s_bdev. This is correct for normal inodes mounted on ext2, ext4 and XFS filesystems, but is incorrect for DAX raw block devices and for XFS real-time files. Instead, call dax_writeback_mapping_range() directly from the filesystem ->writepages function so that it can supply us with a valid block device. This also fixes DAX code to properly flush caches in response to sync(2). Signed-off-by: Ross Zwisler Signed-off-by: Jan Kara Cc: Al Viro Cc: Dan Williams Cc: Dave Chinner Cc: Jens Axboe Cc: Matthew Wilcox Cc: Theodore Ts'o Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/block_dev.c | 13 ++++++++++++- fs/dax.c | 12 +++++++----- fs/ext2/inode.c | 8 ++++++++ fs/ext4/inode.c | 4 ++++ fs/xfs/xfs_aops.c | 4 ++++ include/linux/dax.h | 6 ++++-- mm/filemap.c | 12 ++++-------- 7 files changed, 43 insertions(+), 16 deletions(-) commit 20a90f58997245749c2bdfaea9e51f785ec90d0b Author: Ross Zwisler Date: Fri Feb 26 15:19:52 2016 -0800 dax: give DAX clearing code correct bdev dax_clear_blocks() needs a valid struct block_device and previously it was using inode->i_sb->s_bdev in all cases. This is correct for normal inodes on mounted ext2, ext4 and XFS filesystems, but is incorrect for DAX raw block devices and for XFS real-time devices. Instead, rename dax_clear_blocks() to dax_clear_sectors(), and change its arguments to take a bdev and a sector instead of an inode and a block. This better reflects what the function does, and it allows the filesystem and raw block device code to pass in an appropriate struct block_device. Signed-off-by: Ross Zwisler Suggested-by: Dan Williams Reviewed-by: Jan Kara Cc: Theodore Ts'o Cc: Al Viro Cc: Dave Chinner Cc: Jens Axboe Cc: Matthew Wilcox Cc: Ross Zwisler Cc: Theodore Ts'o Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 9 ++++----- fs/ext2/inode.c | 6 ++++-- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_aops.h | 1 + fs/xfs/xfs_bmap_util.c | 3 ++- include/linux/dax.h | 2 +- 6 files changed, 13 insertions(+), 10 deletions(-) commit 73f34a5e2ceddfca27c999c170620e6354aaf6d7 Author: Ross Zwisler Date: Fri Feb 26 15:19:49 2016 -0800 ext4: online defrag not supported with DAX Online defrag operations for ext4 are hard coded to use the page cache. See ext4_ioctl() -> ext4_move_extents() -> move_extent_per_page() When combined with DAX I/O, which circumvents the page cache, this can result in data corruption. This was observed with xfstests ext4/307 and ext4/308. Fix this by only allowing online defrag for non-DAX files. Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Theodore Ts'o Cc: Al Viro Cc: Dan Williams Cc: Dave Chinner Cc: Jens Axboe Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ext4/ioctl.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0a6cf9137ded4856b41910a4336677ee0ffa6736 Author: Ross Zwisler Date: Fri Feb 26 15:19:46 2016 -0800 ext2, ext4: only set S_DAX for regular inodes When S_DAX is set on an inode we assume that if there are pages attached to the mapping (mapping->nrpages != 0), those pages are clean zero pages that were used to service reads from holes. Any dirty data associated with the inode should be in the form of DAX exceptional entries (mapping->nrexceptional) that is written back via dax_writeback_mapping_range(). With the current code, though, this isn't always true. For example, ext2 and ext4 directory inodes can have S_DAX set, but have their dirty data stored as dirty page cache entries. For these types of inodes, having S_DAX set doesn't really make sense since their I/O doesn't actually happen through the DAX code path. Instead, only allow S_DAX to be set for regular inodes for ext2 and ext4. This allows us to have strict DAX vs non-DAX paths in the writeback code. Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Theodore Ts'o Cc: Al Viro Cc: Dan Williams Cc: Dave Chinner Cc: Jens Axboe Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ext2/inode.c | 2 +- fs/ext4/inode.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 03cdadb04077b9311bbc67d98cc5401aff76482d Author: Dan Williams Date: Fri Feb 26 15:19:43 2016 -0800 block: disable block device DAX by default The recent *sync enabling discovered that we are inserting into the block_device pagecache counter to the expectations of the dirty data tracking for dax mappings. This can lead to data corruption. We want to support DAX for block devices eventually, but it requires wider changes to properly manage the pagecache. dump_stack+0x85/0xc2 dax_writeback_mapping_range+0x60/0xe0 blkdev_writepages+0x3f/0x50 do_writepages+0x21/0x30 __filemap_fdatawrite_range+0xc6/0x100 filemap_write_and_wait+0x4a/0xa0 set_blocksize+0x70/0xd0 sb_set_blocksize+0x1d/0x50 ext4_fill_super+0x75b/0x3360 mount_bdev+0x180/0x1b0 ext4_mount+0x15/0x20 mount_fs+0x38/0x170 Mark the support broken so its disabled by default, but otherwise still available for testing. Signed-off-by: Dan Williams Signed-off-by: Ross Zwisler Reported-by: Ross Zwisler Suggested-by: Dave Chinner Reviewed-by: Jan Kara Cc: Jens Axboe Cc: Matthew Wilcox Cc: Al Viro Cc: Theodore Ts'o Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds block/Kconfig | 13 +++++++++++++ fs/block_dev.c | 6 +++++- 2 files changed, 18 insertions(+), 1 deletion(-) commit a4a8481ff68a8a324a878e281bc37f18665224f7 Author: Guozhonghua Date: Fri Feb 26 15:19:40 2016 -0800 ocfs2: unlock inode if deleting inode from orphan fails When doing append direct io cleanup, if deleting inode fails, it goes out without unlocking inode, which will cause the inode deadlock. This issue was introduced by commit cf1776a9e834 ("ocfs2: fix a tiny race when truncate dio orohaned entry"). Signed-off-by: Guozhonghua Signed-off-by: Joseph Qi Reviewed-by: Gang He Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: [4.2+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/aops.c | 1 + 1 file changed, 1 insertion(+) commit 5ef11c35ce86b94bfb878b684de4cdaf96f54b2f Author: Daniel Cashman Date: Fri Feb 26 15:19:37 2016 -0800 mm: ASLR: use get_random_long() Replace calls to get_random_int() followed by a cast to (unsigned long) with calls to get_random_long(). Also address shifting bug which, in case of x86 removed entropy mask for mmap_rnd_bits values > 31 bits. Signed-off-by: Daniel Cashman Acked-by: Kees Cook Cc: "Theodore Ts'o" Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Catalin Marinas Cc: Will Deacon Cc: Ralf Baechle Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: David S. Miller Cc: Thomas Gleixner Cc: Ingo Molnar Cc: H. Peter Anvin Cc: Al Viro Cc: Nick Kralevich Cc: Jeff Vander Stoep Cc: Mark Salyzyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/mm/mmap.c | 2 +- arch/arm64/mm/mmap.c | 4 ++-- arch/mips/mm/mmap.c | 4 ++-- arch/powerpc/kernel/process.c | 4 ++-- arch/powerpc/mm/mmap.c | 4 ++-- arch/sparc/kernel/sys_sparc_64.c | 2 +- arch/x86/mm/mmap.c | 6 +++--- fs/binfmt_elf.c | 2 +- 8 files changed, 14 insertions(+), 14 deletions(-) commit ec9ee4acd97c0039a61c0ae4f12705767ae62153 Author: Daniel Cashman Date: Fri Feb 26 15:19:34 2016 -0800 drivers: char: random: add get_random_long() Commit d07e22597d1d ("mm: mmap: add new /proc tunable for mmap_base ASLR") added the ability to choose from a range of values to use for entropy count in generating the random offset to the mmap_base address. The maximum value on this range was set to 32 bits for 64-bit x86 systems, but this value could be increased further, requiring more than the 32 bits of randomness provided by get_random_int(), as is already possible for arm64. Add a new function: get_random_long() which more naturally fits with the mmap usage of get_random_int() but operates exactly the same as get_random_int(). Also, fix the shifting constant in mmap_rnd() to be an unsigned long so that values greater than 31 bits generate an appropriate mask without overflow. This is especially important on x86, as its shift instruction uses a 5-bit mask for the shift operand, which meant that any value for mmap_rnd_bits over 31 acts as a no-op and effectively disables mmap_base randomization. Finally, replace calls to get_random_int() with get_random_long() where appropriate. This patch (of 2): Add get_random_long(). Signed-off-by: Daniel Cashman Acked-by: Kees Cook Cc: "Theodore Ts'o" Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Catalin Marinas Cc: Will Deacon Cc: Ralf Baechle Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: David S. Miller Cc: Thomas Gleixner Cc: Ingo Molnar Cc: H. Peter Anvin Cc: Al Viro Cc: Nick Kralevich Cc: Jeff Vander Stoep Cc: Mark Salyzyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/char/random.c | 22 ++++++++++++++++++++++ include/linux/random.h | 1 + 2 files changed, 23 insertions(+) commit 8479eba7781fa9ffb28268840de6facfc12c35a7 Author: Mel Gorman Date: Fri Feb 26 15:19:31 2016 -0800 mm: numa: quickly fail allocations for NUMA balancing on full nodes Commit 4167e9b2cf10 ("mm: remove GFP_THISNODE") removed the GFP_THISNODE flag combination due to confusing semantics. It noted that alloc_misplaced_dst_page() was one such user after changes made by commit e97ca8e5b864 ("mm: fix GFP_THISNODE callers and clarify"). Unfortunately when GFP_THISNODE was removed, users of alloc_misplaced_dst_page() started waking kswapd and entering direct reclaim because the wrong GFP flags are cleared. The consequence is that workloads that used to fit into memory now get reclaimed which is addressed by this patch. The problem can be demonstrated with "mutilate" that exercises memcached which is software dedicated to memory object caching. The configuration uses 80% of memory and is run 3 times for varying numbers of clients. The results on a 4-socket NUMA box are mutilate 4.4.0 4.4.0 vanilla numaswap-v1 Hmean 1 8394.71 ( 0.00%) 8395.32 ( 0.01%) Hmean 4 30024.62 ( 0.00%) 34513.54 ( 14.95%) Hmean 7 32821.08 ( 0.00%) 70542.96 (114.93%) Hmean 12 55229.67 ( 0.00%) 93866.34 ( 69.96%) Hmean 21 39438.96 ( 0.00%) 85749.21 (117.42%) Hmean 30 37796.10 ( 0.00%) 50231.49 ( 32.90%) Hmean 47 18070.91 ( 0.00%) 38530.13 (113.22%) The metric is queries/second with the more the better. The results are way outside of the noise and the reason for the improvement is obvious from some of the vmstats 4.4.0 4.4.0 vanillanumaswap-v1r1 Minor Faults 1929399272 2146148218 Major Faults 19746529 3567 Swap Ins 57307366 9913 Swap Outs 50623229 17094 Allocation stalls 35909 443 DMA allocs 0 0 DMA32 allocs 72976349 170567396 Normal allocs 5306640898 5310651252 Movable allocs 0 0 Direct pages scanned 404130893 799577 Kswapd pages scanned 160230174 0 Kswapd pages reclaimed 55928786 0 Direct pages reclaimed 1843936 41921 Page writes file 2391 0 Page writes anon 50623229 17094 The vanilla kernel is swapping like crazy with large amounts of direct reclaim and kswapd activity. The figures are aggregate but it's known that the bad activity is throughout the entire test. Note that simple streaming anon/file memory consumers also see this problem but it's not as obvious. In those cases, kswapd is awake when it should not be. As there are at least two reclaim-related bugs out there, it's worth spelling out the user-visible impact. This patch only addresses bugs related to excessive reclaim on NUMA hardware when the working set is larger than a NUMA node. There is a bug related to high kswapd CPU usage but the reports are against laptops and other UMA hardware and is not addressed by this patch. Signed-off-by: Mel Gorman Cc: Vlastimil Babka Cc: Johannes Weiner Cc: David Rientjes Cc: [4.1+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 Author: Andrea Arcangeli Date: Fri Feb 26 15:19:28 2016 -0800 mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED pmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were introduced to locklessy (but atomically) detect when a pmd is a regular (stable) pmd or when the pmd is unstable and can infinitely transition from pmd_none() and pmd_trans_huge() from under us, while only holding the mmap_sem for reading (for writing not). While holding the mmap_sem only for reading, MADV_DONTNEED can run from under us and so before we can assume the pmd to be a regular stable pmd we need to compare it against pmd_none() and pmd_trans_huge() in an atomic way, with pmd_trans_unstable(). The old pmd_trans_huge() left a tiny window for a race. Useful applications are unlikely to notice the difference as doing MADV_DONTNEED concurrently with a page fault would lead to undefined behavior. [akpm@linux-foundation.org: tidy up comment grammar/layout] Signed-off-by: Andrea Arcangeli Reported-by: Kirill A. Shutemov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 61d9e854dfb91b46b99ffd3d31fc7d45d2b95f31 Author: Thierry Reding Date: Thu Feb 18 14:32:10 2016 +0100 PCI: mvebu: Restrict build to 32-bit ARM This driver uses PCI glue that is only available on 32-bit ARM. This used to work fine as long as ARCH_MVEBU and ARCH_DOVE were exclusively 32-bit, but there's a patch in the pipe to make ARCH_MVEBU also available on 64-bit ARM. [bhelgaas: changelog; patch is coming but not merged yet] Signed-off-by: Thierry Reding Signed-off-by: Bjorn Helgaas Acked-by: Thomas Petazzoni drivers/pci/host/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 6c777e8799a93e3bdb67bec622429e1b48dc90fb Author: Bjorn Helgaas Date: Wed Feb 17 12:26:42 2016 -0600 Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()" 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") appeared in v4.3 and helps support IOAPIC hotplug. Олег reported that the Elcus-1553 TA1-PCI driver worked in v4.2 but not v4.3 and bisected it to 991de2e59090. Sunjin reported that the RocketRAID 272x driver worked in v4.2 but not v4.3. In both cases booting with "pci=routirq" is a workaround. I think the problem is that after 991de2e59090, we no longer call pcibios_enable_irq() for upstream bridges. Prior to 991de2e59090, when a driver called pci_enable_device(), we recursively called pcibios_enable_irq() for upstream bridges via pci_enable_bridge(). After 991de2e59090, we call pcibios_enable_irq() from pci_device_probe() instead of the pci_enable_device() path, which does *not* call pcibios_enable_irq() for upstream bridges. Revert 991de2e59090 to fix these driver regressions. Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") Reported-and-tested-by: Олег Мороз Reported-by: Sunjin Yang Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki CC: Jiang Liu arch/x86/include/asm/pci_x86.h | 2 ++ arch/x86/pci/common.c | 20 +++++++++++--------- arch/x86/pci/intel_mid_pci.c | 7 ++----- arch/x86/pci/irq.c | 15 ++++++++++++++- drivers/acpi/pci_irq.c | 9 ++++++++- 5 files changed, 37 insertions(+), 16 deletions(-) commit 21b81716c6bff24cda52dc75588455f879ddbfe9 Author: Gabriel Krisman Bertazi Date: Thu Feb 25 13:54:20 2016 -0300 ipr: Fix regression when loading firmware Commit d63c7dd5bcb9 ("ipr: Fix out-of-bounds null overwrite") removed the end of line handling when storing the update_fw sysfs attribute. This changed the userpace API because it started refusing writes terminated by a line feed, which broke the update tools we already have. This patch re-adds that handling, so both a write terminated by a line feed or not can make it through with the update. Fixes: d63c7dd5bcb9 ("ipr: Fix out-of-bounds null overwrite") Signed-off-by: Gabriel Krisman Bertazi Cc: Insu Yun Acked-by: Brian King Signed-off-by: Martin K. Petersen drivers/scsi/ipr.c | 5 +++++ 1 file changed, 5 insertions(+) commit e1cd3911170eda37fd9501e81ee1c2eb63803fd0 Author: jiangyiwen Date: Tue Feb 16 20:14:13 2016 +0800 SCSI: Free resources when we return BLKPREP_INVALID When called scsi_prep_fn return BLKPREP_INVALID, we should use the same code with BLKPREP_KILL in scsi_prep_return. Signed-off-by: Yiwen Jiang Signed-off-by: Martin K. Petersen drivers/scsi/scsi_lib.c | 1 + 1 file changed, 1 insertion(+) commit 9bf148cb0812595bfdf5100bd2c07e9bec9c6ef5 Author: Colin Ian King Date: Fri Feb 26 18:55:31 2016 +0000 x86/mpx: Fix off-by-one comparison with nr_registers In the unlikely event that regno == nr_registers then we get an array overrun on regoff because the invalid register check is currently off-by-one. Fix this with a check that regno is >= nr_registers instead. Detected with static analysis using CoverityScan. Fixes: fcc7ffd67991 "x86, mpx: Decode MPX instruction to get bound violation information" Signed-off-by: Colin Ian King Acked-by: Dave Hansen Cc: Borislav Petkov Cc: "Kirill A . Shutemov" Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1456512931-3388-1-git-send-email-colin.king@canonical.com Signed-off-by: Thomas Gleixner arch/x86/mm/mpx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 472681d57a5dde7c6d16b05469be57f1c4ed9d99 Author: MINOURA Makoto / 箕浦 真 Date: Thu Feb 25 14:20:48 2016 +0900 net: ndo_fdb_dump should report -EMSGSIZE to rtnl_fdb_dump. When the send skbuff reaches the end, nlmsg_put and friends returns -EMSGSIZE but it is silently thrown away in ndo_fdb_dump. It is called within a for_each_netdev loop and the first fdb entry of a following netdev could fit in the remaining skbuff. This breaks the mechanism of cb->args[0] and idx to keep track of the entries that are already dumped, which results missing entries in bridge fdb show command. Signed-off-by: Minoura Makoto Signed-off-by: David S. Miller drivers/net/vxlan.c | 4 +++- net/bridge/br_fdb.c | 15 ++++++++++----- net/core/rtnetlink.c | 6 ++++++ net/switchdev/switchdev.c | 5 ++++- 4 files changed, 23 insertions(+), 7 deletions(-) commit dfd55ad85e4a7fbaa82df12467515ac3c81e8a3e Author: Ard Biesheuvel Date: Fri Feb 26 17:57:13 2016 +0100 arm64: vmemmap: use virtual projection of linear region Commit dd006da21646 ("arm64: mm: increase VA range of identity map") made some changes to the memory mapping code to allow physical memory to reside at an offset that exceeds the size of the virtual mapping. However, since the size of the vmemmap area is proportional to the size of the VA area, but it is populated relative to the physical space, we may end up with the struct page array being mapped outside of the vmemmap region. For instance, on my Seattle A0 box, I can see the following output in the dmesg log. vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum) 0xffffffbfc0000000 - 0xffffffbfd0000000 ( 256 MB actual) We can fix this by deciding that the vmemmap region is not a projection of the physical space, but of the virtual space above PAGE_OFFSET, i.e., the linear region. This way, we are guaranteed that the vmemmap region is of sufficient size, and we can even reduce the size by half. Cc: Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon arch/arm64/include/asm/pgtable.h | 7 ++++--- arch/arm64/mm/init.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) commit 29a9faa641857425af76e44f2fab22db53032401 Merge: c213341 cd8140c Author: Linus Torvalds Date: Fri Feb 26 09:35:03 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "There are two small messenger bug fixes and a log spam regression fix" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: libceph: don't spam dmesg with stray reply warnings libceph: use the right footer size when skipping a message libceph: don't bail early from try_read() when skipping a message commit c213341e4962c798274e024e89dd4b14d4826872 Merge: bb134ff 473f414 Author: Linus Torvalds Date: Fri Feb 26 09:27:21 2016 -0800 Merge tag 'sound-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Things got calmed down for rc6, as it seems, and we have only a few HD-audio fixes at this time: a fix for Skylake codec probe errors, a fix for missing interrupt handling, and a few Dell and HP quirks" * tag 'sound-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Loop interrupt handling until really cleared ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 ALSA: hda - Fixing background noise on Dell Inspiron 3162 ALSA: hda - Apply clock gate workaround to Skylake, too commit bb134ff50709fda187027c2263036ccb41024ca5 Merge: 34d47a7 1711fd9c Author: Linus Torvalds Date: Fri Feb 26 09:21:48 2016 -0800 Merge tag 'pm+acpi-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI fixes from Rafael Wysocki: "These are two reverts of recent PCI-related ACPI core changes (one of which caused some systems to crash on boot and the other was a cleanup on top of it) and a devfreq fix for Tegra. Specifics: - Revert an ACPI core change related to IRQ management in PCI that introduced code relying on the use of kmalloc() which turned out to also run during early init when that's not available yet and caused some systems to crash on boot for this reason along with a cleanup on top of it (Rafael Wysocki). - Prevent devfreq from flooding the kernel log with useless messages on Tegra (which started to happen after some recent changes in the devfreq core) by fixing the driver to follow the documentation and the core's expectations in its ->target callback (Tomeu Vizoso)" * tag 'pm+acpi-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI, PCI, irq: remove interrupt count restriction" Revert "ACPI / PCI: Simplify acpi_penalize_isa_irq()" PM / devfreq: tegra: Set freq in rate callback commit 1711fd9cf92f366d42da29b108746accd807789a Merge: 351228e e249714 Author: Rafael J. Wysocki Date: Fri Feb 26 13:50:55 2016 +0100 Merge branches 'pm-devfreq' and 'acpi-pci' * pm-devfreq: PM / devfreq: tegra: Set freq in rate callback * acpi-pci: Revert "ACPI, PCI, irq: remove interrupt count restriction" Revert "ACPI / PCI: Simplify acpi_penalize_isa_irq()" commit 70e4da7a8ff62f2775337b705f45c804bb450454 Author: Paolo Bonzini Date: Fri Feb 26 12:28:40 2016 +0100 KVM: x86: fix root cause for missed hardware breakpoints Commit 172b2386ed16 ("KVM: x86: fix missed hardware breakpoints", 2016-02-10) worked around a case where the debug registers are not loaded correctly on preemption and on the first entry to KVM_RUN. However, Xiao Guangrong pointed out that the root cause must be that KVM_DEBUGREG_BP_ENABLED is not being set correctly. This can indeed happen due to the lazy debug exit mechanism, which does not call kvm_update_dr7. Fix it by replacing the existing loop (more or less equivalent to kvm_update_dr0123) with calls to all the kvm_update_dr* functions. Cc: stable@vger.kernel.org # 4.1+ Fixes: 172b2386ed16a9143d9a456aae5ec87275c61489 Reviewed-by: Xiao Guangrong Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit a1e533ec07d583d01349ef13c0c965b8633e1b91 Author: Jean-Philippe Brucker Date: Mon Feb 15 18:41:33 2016 +0000 fbcon: set a default value to blink interval Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459 fbcon: use the cursor blink interval provided by vt two attempts have been made at fixing a possible hang caused by cursor_timer_handler. That function registers a timer to be triggered at "jiffies + fbcon_ops.cur_blink_jiffies". A new case had been encountered during initialisation of clcd-pl11x: fbcon_fb_registered do_fbcon_takeover -> do_register_con_driver fbcon_startup (A) add_cursor_timer (with cur_blink_jiffies = 0) -> do_bind_con_driver visual_init fbcon_init (B) cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms); If we take an softirq anywhere between A and B (and we do), cursor_timer_handler executes indefinitely. Instead of patching all possible paths that lead to this case one at a time, fix the issue at the source and initialise cur_blink_jiffies to 200ms when allocating fbcon_ops. This was its default value before aforesaid commit. fbcon_cursor or fbcon_init will refine this value downstream. Signed-off-by: Jean-Philippe Brucker Cc: # v4.2 Tested-by: Scot Doyle Signed-off-by: Tomi Valkeinen drivers/video/console/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) commit 10da848f67a7e7152bf7cbe332e4c92d71a990d2 Author: Arnd Bergmann Date: Thu Feb 25 21:57:43 2016 +0100 ssb: host_soc depends on sprom Drivers that use the SSB sprom functionality typically 'select SSB_SPROM' from Kconfig, but CONFIG_SSB_HOST_SOC misses this, which results in a build failure unless at least one of the other drivers that selects it is enabled: drivers/built-in.o: In function `ssb_host_soc_get_invariants': (.text+0x459494): undefined reference to `ssb_fill_sprom_with_fallback' This adds the same select statement that is used elsewhere. Signed-off-by: Arnd Bergmann Fixes: 541c9a84cd85 ("ssb: pick SoC invariants code from MIPS BCM47xx arch") Signed-off-by: Kalle Valo drivers/ssb/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 1a4f6557dd7c7f0eba18aadbc72e3cf09dae496d Merge: c699404d 905e36a Author: Kalle Valo Date: Fri Feb 26 12:43:40 2016 +0200 Merge tag 'iwlwifi-for-kalle-2016-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Two fixes for 4.5: * We forgot to free the paging memory (Matti) * Fix the frames in flight accounting (Liad) commit 34d47a77591f2fe7988beeca86d8ee281aee827f Merge: 5bb9871 e817c2f Author: James Morris Date: Fri Feb 26 19:32:16 2016 +1100 Merge branch 'stable-4.5' of git://git.infradead.org/users/pcmoore/selinux into for-linus commit 473f414564528a819f0c2bb6b4bf26366b64c9ab Author: Takashi Iwai Date: Tue Feb 23 15:54:47 2016 +0100 ALSA: hda - Loop interrupt handling until really cleared Currently the interrupt handler of HD-audio driver assumes that no irq update is needed while processing the irq. But in reality, it has been confirmed that the HW irq is issued even during the irq handling. Since we clear the irq status at the beginning, process the interrupt, then exits from the handler, the lately issued interrupt is left untouched without being properly processed. This patch changes the interrupt handler code to loop over the check-and-process. The handler tries repeatedly as long as the IRQ status are turned on, and either stream or CORB/RIRB is handled. For checking the stream handling, snd_hdac_bus_handle_stream_irq() returns a value indicating the stream indices bits. Other than that, the change is only in the irq handler itself. Reported-by: Libin Yang Cc: Signed-off-by: Takashi Iwai include/sound/hdaudio.h | 2 +- sound/hda/hdac_controller.c | 7 ++++++- sound/pci/hda/hda_controller.c | 47 +++++++++++++++++++++++------------------- 3 files changed, 33 insertions(+), 23 deletions(-) commit e9a2d81b1761093386a0bb8a4f51642ac785ef63 Author: Maximilain Schneider Date: Tue Feb 23 01:17:28 2016 +0000 can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() gs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is allocated through alloc_candev() and should instead be freed using free_candev() alone. The inappropriate use of kfree() causes the kernel to hang when gs_destroy_candev() is called. Only the struct gs_usb * which is allocated through kzalloc() should be freed using kfree() when the device is disconnected. Signed-off-by: Maximilian Schneider Cc: linux-stable Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/gs_usb.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) commit 5bb9871eb8daa2e6a07caf7aeafbe2d0b3faad8f Merge: 73056bb d045437 Author: Linus Torvalds Date: Thu Feb 25 20:12:09 2016 -0800 Merge tag 'trace-fixes-v4.5-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Another small bug reported to me by Chunyu Hu. When perf added a "reg" function to the function tracing event (not a tracepoint), it caused that event to be displayed as a tracepoint and could cause errors in tracepoint handling. That was solved by adding a flag to ignore ftrace non-tracepoint events. But that flag was missed when displaying events in available_events, which should only contain tracepoint events. This broke a documented way to enable all events with: cat available_events > set_event As the function non-tracepoint event would cause that to error out. The commit here fixes that by having the available_events file not list events that have the ignore flag set" * tag 'trace-fixes-v4.5-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix showing function event in available_events commit 73056bbc683f16672b948968a92fc3aa6aefbfbd Merge: 5882c16 0fb00d3 Author: Linus Torvalds Date: Thu Feb 25 19:53:54 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "KVM/ARM fixes: - Fix per-vcpu vgic bitmap allocation - Do not give copy random memory on MMIO read - Fix GICv3 APR register restore order KVM/x86 fixes: - Fix ubsan warning - Fix hardware breakpoints in a guest vs. preempt notifiers - Fix Hurd Generic: - use __GFP_NOWARN together with GFP_NOWAIT" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: MMU: fix ubsan index-out-of-range warning arm64: KVM: vgic-v3: Restore ICH_APR0Rn_EL2 before ICH_APR1Rn_EL2 KVM: async_pf: do not warn on page allocation failures KVM: x86: fix conversion of addresses to linear in 32-bit protected mode KVM: x86: fix missed hardware breakpoints arm/arm64: KVM: Feed initialized memory to MMIO accesses KVM: arm/arm64: vgic: Ensure bitmaps are long enough commit 5882c169be18e42b855443574f8e95215f7ba461 Merge: 9aca90a 0378ba4 Author: Linus Torvalds Date: Thu Feb 25 19:47:01 2016 -0800 Merge tag 'renesas-sh-drivers-fixes-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas Pull SuperH driver fix from Simon Horman: "Restore legacy clock domain on SuperH platforms" * tag 'renesas-sh-drivers-fixes-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: drivers: sh: Restore legacy clock domain on SuperH platforms commit 9aca90a7ca911af4da5d77fad11f54f040dc027d Merge: 70d070f 9ab3ac2 Author: Linus Torvalds Date: Thu Feb 25 19:41:53 2016 -0800 Merge tag 'powerpc-4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - eeh: Fix partial hotplug criterion from Gavin Shan - mm: Clear the invalid slot information correctly from Aneesh Kumar K.V * tag 'powerpc-4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm/hash: Clear the invalid slot information correctly powerpc/eeh: Fix partial hotplug criterion commit 70d070f56a24b0d966aee547b6c51d09e9185b63 Merge: 81904db 1b17cb7 Author: Linus Torvalds Date: Thu Feb 25 19:36:33 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 bugfixes from Martin Schwidefsky: "Two critical bug fixes for the signal handling" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/fpu: signals vs. floating point control register s390/compat: correct restore of high gprs on signal return commit 81904dbbb45490642d16fb1343f95dc0d0eec93f Merge: 3acdb84 b7052cd Author: Linus Torvalds Date: Thu Feb 25 19:31:01 2016 -0800 Merge tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux Pull nfsd bugfix from Bruce Fields: "One fix for a bug that could cause a NULL write past the end of a buffer in case of unusually long writes to some system interfaces used by mountd and other nfs support utilities" * tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux: sunrpc/cache: fix off-by-one in qword_get() commit 3acdb84c22fc5fcd8384ff0238b62cceba8ed549 Merge: 3d7b365 3772e72 Author: Linus Torvalds Date: Thu Feb 25 19:01:42 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This is a bit larger than Id like, but I asked the Intel guys to pull in some Skylake fixes in the possibly vain hope that Skylake might be more functional now that I'm seeing production hardware shipping. For i915, it's mostly the same patch in a few places, making sure the hw doesn't turn off when we are programming it. Apart from that are two nouveau fixes, one for a module defer bug, and one for using nouveau on new Lenovo P50 models. Then there are a bunch of AMDGPU fixes, one is a fix for v4.4 vblank regressions, and some PM fixes" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (26 commits) drm/nouveau/disp/dp: ensure sink is powered up before attempting link training drm/nouveau: platform: Fix deferred probe drm/amdgpu: disable direct VM updates when vm_debug is set amdgpu: fix NULL pointer dereference at tonga_check_states_equal drm/i915/gen9: Verify and enforce dc6 state writes drm/i915/gen9: Check for DC state mismatch drm/radeon/pm: adjust display configuration after powerstate drm/amdgpu/pm: adjust display configuration after powerstate drm/amdgpu/pm: add some checks for PX drm/amdgpu: fix locking in force performance level drm/amdgpu/gfx8: fix priv reg interrupt enable drm/i915/skl: Ensure HW is powered during DDB HW state readout drm/i915/lvds: Ensure the HW is powered during HW state readout drm/i915/hdmi: Ensure the HW is powered during HW state readout drm/i915/dsi: Ensure the HW is powered during HW state readout drm/i915/dp: Ensure the HW is powered during HW state readout drm/i915: Ensure the HW is powered when accessing the CRC HW block drm/i915/ddi: Ensure the HW is powered during HW state readout drm/i915/crt: Ensure the HW is powered during HW state readout drm/i915: Ensure the HW is powered during HW access in assert_pipe ... commit 3d7b365490d5f2f8ac1aaaf6cce775e6a8b7f570 Merge: 1ebe383 c454420 Author: Linus Torvalds Date: Thu Feb 25 18:54:53 2016 -0800 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: - Two fixes for compatibility with the ACPI 6.1 specification. Without these fixes multi-interface DIMMs will fail to be probed, and address range scrub commands to find memory errors will give results that the kernel will mis-interpret. For multi-interface DIMMs Linux will accept either the original 6.0 implementation or 6.1. For address range scrub we'll only support 6.1 since ACPI formalized this DSM differently than the original example [1] implemented in v4.2. The expectation is that production systems will only ever ship the ACPI 6.1 address range scrub command definition. - The wider async address range scrub work targeting 4.6 discovered that the original synchronous implementation in 4.5 is not sizing its return buffer correctly. - Arnd caught that my recent fix to the size of the pfn_t flags missed updating the flags variable used in the pmem driver. - Toshi found that we mishandle the memremap() return value in devm_memremap(). * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: use 'u64' for pfn flags devm_memremap: Fix error value when memremap failed nfit: update address range scrub commands to the acpi 6.1 format libnvdimm, tools/testing/nvdimm: fix 'ars_status' output buffer sizing nfit: fix multi-interface dimm handling, acpi6.1 compatibility commit 1ebe3839e66ae85e065157ba9d6f7923ad8d8fbf Merge: 6dc390a 9aafabc Author: Linus Torvalds Date: Thu Feb 25 18:42:08 2016 -0800 Merge tag 'for-v4.5-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: "Add a regression fix for changed sysfs path of bq27xxx_battery and update MAINTAINERS file" * tag 'for-v4.5-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: bq27xxx_battery: Restore device name MAINTAINERS: update bq27xxx driver commit c8560b7c917f8738f5d80dd516930edc1d05e4e4 Author: Carlo Caione Date: Tue Feb 23 09:50:20 2016 +0100 ASoC: cht_bsw_rt5645: Fix writing to string literal We cannot use strcpy() to write to a const char * location. This is causing a 'BUG: unable to handle kernel paging request' error at boot when using the cht-bsw-rt5645 driver. With this patch we also fix a wrong indexing in the driver where the codec_name of the wrong dai_link is being overwritten. Signed-off-by: Carlo Caione Signed-off-by: Mark Brown sound/soc/intel/boards/cht_bsw_rt5645.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f4833a519aec793cf8349bf479589d37473ef6a7 Author: Arnd Bergmann Date: Wed Feb 24 17:38:14 2016 +0100 ASoC: trace: fix printing jack name After a change to the snd_jack structure, the 'name' member is no longer available in all configurations, which results in a build failure in the tracing code: include/trace/events/asoc.h: In function 'trace_event_raw_event_snd_soc_jack_report': include/trace/events/asoc.h:240:32: error: 'struct snd_jack' has no member named 'name' The name field is normally initialized from the card shortname and the jack "id" field: snprintf(jack->name, sizeof(jack->name), "%s %s", card->shortname, jack->id); This changes the tracing output to just contain the 'id' by itself, which slightly changes the output format but avoids the link error and is hopefully still enough to see what is going on. Signed-off-by: Arnd Bergmann Fixes: fe0d128c57bf ("ALSA: jack: Allow building the jack layer without input device") Signed-off-by: Mark Brown include/trace/events/asoc.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 4ee34ea3a12396f35b26d90a094c75db95080baa Author: Harvey Hunt Date: Wed Feb 24 15:16:43 2016 +0000 libata: Align ata_device's id on a cacheline The id buffer in ata_device is a DMA target, but it isn't explicitly cacheline aligned. Due to this, adjacent fields can be overwritten with stale data from memory on non coherent architectures. As a result, the kernel is sometimes unable to communicate with an ATA device. Fix this by ensuring that the id buffer is cacheline aligned. This issue is similar to that fixed by Commit 84bda12af31f ("libata: align ap->sector_buf"). Signed-off-by: Harvey Hunt Cc: linux-kernel@vger.kernel.org Cc: # 2.6.18 Signed-off-by: Tejun Heo include/linux/libata.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4c0b6eaf373a5323f03a3a20c42fc435715b073d Author: Sunil Goutham Date: Wed Feb 24 16:40:50 2016 +0530 net: thunderx: Fix for Qset error due to CQ full On Thunderx pass 1.x and pass2 due to a HW errata default CQ DROP_LEVEL of 0x80 is not sufficient to avoid CQ_WR_FULL Qset error when packets are being received at >20Mpps resulting in complete stall of packet reception. This patch will configure it to 0x100 which is what is expected by HW on Thunderx. On future passes of thunderx and other chips HW default/reset value will be 0x100 or higher hence not overwritten. Signed-off-by: Jerin Jacob Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 9 +++++++++ drivers/net/ethernet/cavium/thunder/nic_main.c | 6 ++++++ drivers/net/ethernet/cavium/thunder/nic_reg.h | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) commit f09cf4b7832d029fb22d8f476eac12fc27dde61f Author: Chun-Hao Lin Date: Wed Feb 24 14:18:42 2016 +0800 r8169:fix "rtl_counters_cond == 1 (loop: 1000, delay: 10)" log spam. There will be a log spam when there is no cable plugged. Please refer to following links. https://bugzilla.kernel.org/show_bug.cgi?id=104351 https://bugzilla.kernel.org/show_bug.cgi?id=107421 This issue is caused by runtime power management. When there is no cable plugged, the driver will be suspend (runtime suspend) by OS and NIC will be put into the D3 state. During this time, if OS call rtl8169_get_stats64() to dump tally counter, because NIC is in D3 state, the register value read by driver will return all 0xff. This will let driver think tally counter flag is not toggled and then sends the warning message "rtl_counters_cond == 1 (loop: 1000, delay: 10)" to kernel log. For fixing this issue, 1.add checking driver's pm runtime status in rtl8169_get_stats64(). 2.dump tally counter before going runtime suspend for counter accuracy in runtime suspend. Signed-off-by: Chunhao Lin Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 9b368814b336b0a1a479135eb2815edbc00efd3c Author: Linus Lüssing Date: Wed Feb 24 04:21:42 2016 +0100 net: fix bridge multicast packet checksum validation We need to update the skb->csum after pulling the skb, otherwise an unnecessary checksum (re)computation can ocure for IGMP/MLD packets in the bridge code. Additionally this fixes the following splats for network devices / bridge ports with support for and enabled RX checksum offloading: [...] [ 43.986968] eth0: hw csum failure [ 43.990344] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.4.0 #2 [ 43.996193] Hardware name: BCM2709 [ 43.999647] [<800204e0>] (unwind_backtrace) from [<8001cf14>] (show_stack+0x10/0x14) [ 44.007432] [<8001cf14>] (show_stack) from [<801ab614>] (dump_stack+0x80/0x90) [ 44.014695] [<801ab614>] (dump_stack) from [<802e4548>] (__skb_checksum_complete+0x6c/0xac) [ 44.023090] [<802e4548>] (__skb_checksum_complete) from [<803a055c>] (ipv6_mc_validate_checksum+0x104/0x178) [ 44.032959] [<803a055c>] (ipv6_mc_validate_checksum) from [<802e111c>] (skb_checksum_trimmed+0x130/0x188) [ 44.042565] [<802e111c>] (skb_checksum_trimmed) from [<803a06e8>] (ipv6_mc_check_mld+0x118/0x338) [ 44.051501] [<803a06e8>] (ipv6_mc_check_mld) from [<803b2c98>] (br_multicast_rcv+0x5dc/0xd00) [ 44.060077] [<803b2c98>] (br_multicast_rcv) from [<803aa510>] (br_handle_frame_finish+0xac/0x51c) [...] Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") Reported-by: Álvaro Fernández Rojas Signed-off-by: Linus Lüssing Signed-off-by: David S. Miller net/core/skbuff.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit a4690afeb0d2d7ba4d60dfa98a89f3bb1ce60ecd Author: Stefan Wahren Date: Tue Feb 23 19:23:24 2016 +0000 net: qca_spi: clear IFF_TX_SKB_SHARING ether_setup sets IFF_TX_SKB_SHARING but this is not supported by qca_spi as it modifies the skb on xmit. Signed-off-by: Stefan Wahren Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000) Signed-off-by: David S. Miller drivers/net/ethernet/qualcomm/qca_spi.c | 1 + 1 file changed, 1 insertion(+) commit 2b70bad23c89b121a3e4a00f8968d14ebb78887d Author: Stefan Wahren Date: Tue Feb 23 19:23:23 2016 +0000 net: qca_spi: Don't clear IFF_BROADCAST Currently qcaspi_netdev_setup accidentally clears IFF_BROADCAST. So fix this by keeping the flags from ether_setup. Reported-by: Michael Heimpold Signed-off-by: Stefan Wahren Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000) Signed-off-by: David S. Miller drivers/net/ethernet/qualcomm/qca_spi.c | 1 - 1 file changed, 1 deletion(-) commit 65c38aa653c14df49e19faad74bd375f36e61c57 Author: David Ahern Date: Tue Feb 23 10:10:26 2016 -0800 net: vrf: Remove direct access to skb->data Nik pointed that the VRF driver should be using skb_header_pointer instead of accessing skb->data and bits beyond directly which can be garbage. Fixes: 35402e313663 ("net: Add IPv6 support to VRF device") Cc: Nikolay Aleksandrov Signed-off-by: David Ahern Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller drivers/net/vrf.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 44248affb5d82d32cdb58a92a94ce191d4ddee60 Author: Han Xu Date: Thu Feb 18 03:55:15 2016 +0000 MAINTAINERS: add maintainer entry for FREESCALE GPMI NAND driver Add a maintainer entry for FREESCALE GPMI NAND driver and add myself as a maintainer. Signed-off-by: Han Xu Acked-by: Huang Shijie Signed-off-by: Brian Norris MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) commit bf70e5513dfea29c3682e7eb3dbb45f0723bac09 Author: Dexuan Cui Date: Thu Feb 25 01:58:12 2016 -0800 x86/mm: Fix slow_virt_to_phys() for X86_PAE again "d1cd12108346: x86, pageattr: Prevent overflow in slow_virt_to_phys() for X86_PAE" was unintentionally removed by the recent "34437e67a672: x86/mm: Fix slow_virt_to_phys() to handle large PAT bit". And, the variable 'phys_addr' was defined as "unsigned long" by mistake -- it should be "phys_addr_t". As a result, Hyper-V network driver in 32-PAE Linux guest can't work again. Fixes: commit 34437e67a672: "x86/mm: Fix slow_virt_to_phys() to handle large PAT bit" Signed-off-by: Dexuan Cui Reviewed-by: Toshi Kani Cc: olaf@aepfle.de Cc: gregkh@linuxfoundation.org Cc: jasowang@redhat.com Cc: driverdev-devel@linuxdriverproject.org Cc: linux-mm@kvack.org Cc: apw@canonical.com Cc: Andrew Morton Cc: K. Y. Srinivasan Cc: Haiyang Zhang Link: http://lkml.kernel.org/r/1456394292-9030-1-git-send-email-decui@microsoft.com Signed-off-by: Thomas Gleixner arch/x86/mm/pageattr.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 358875fd52ab8f00f66328cbf1a1d2486f265829 Author: Jay Cornwall Date: Wed Feb 10 15:48:01 2016 -0600 iommu/amd: Apply workaround for ATS write permission check The AMD Family 15h Models 30h-3Fh (Kaveri) BIOS and Kernel Developer's Guide omitted part of the BIOS IOMMU L2 register setup specification. Without this setup the IOMMU L2 does not fully respect write permissions when handling an ATS translation request. The IOMMU L2 will set PTE dirty bit when handling an ATS translation with write permission request, even when PTE RW bit is clear. This may occur by direct translation (which would cause a PPR) or by prefetch request from the ATC. This is observed in practice when the IOMMU L2 modifies a PTE which maps a pagecache page. The ext4 filesystem driver BUGs when asked to writeback these (non-modified) pages. Enable ATS write permission check in the Kaveri IOMMU L2 if BIOS has not. Signed-off-by: Jay Cornwall Cc: # v3.19+ Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu_init.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 38e45d02ea9f194b89d6bf41e52ccafc8e2c2b47 Author: Suravee Suthikulpanit Date: Tue Feb 23 13:03:30 2016 +0100 iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered The setup code for the performance counters in the AMD IOMMU driver tests whether the counters can be written. It tests to setup a counter for device 00:00.0, which fails on systems where this particular device is not covered by the IOMMU. Fix this by not relying on device 00:00.0 but only on the IOMMU being present. Cc: stable@vger.kernel.org Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu_init.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) commit b26a719bdba9aa926ceaadecc66e07623d2b8a53 Author: Geert Uytterhoeven Date: Thu Feb 18 17:06:30 2016 +0100 gpio: rcar: Add Runtime PM handling for interrupts The R-Car GPIO driver handles Runtime PM for requested GPIOs only. When using a GPIO purely as an interrupt source, no Runtime PM handling is done, and the GPIO module's clock may not be enabled. To fix this: - Add .irq_request_resources() and .irq_release_resources() callbacks to handle Runtime PM when an interrupt is requested, - Add irq_bus_lock() and sync_unlock() callbacks to handle Runtime PM when e.g. disabling/enabling an interrupt, or configuring the interrupt type. Fixes: d5c3d84657db57bd "net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS" Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Walleij drivers/gpio/gpio-rcar.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) commit f883982dc1b117f04579f0896821cd9f2e397f94 Author: Takashi Iwai Date: Thu Feb 25 14:31:59 2016 +0100 ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 HP EliteBook 755 G2 with ALC3228 (ALC280) codec [103c:221c] requires the known fixup (ALC269_FIXUP_HEADSET_MIC) for making the headset mic working. Also, it suffers from the loopback noise problem, so we should disable aamix path as well. Reported-by: Derick Eddington Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit be629c62a603e5935f8177fd8a19e014100a259e Author: David Woodhouse Date: Mon Feb 1 14:04:46 2016 +0000 Fix directory hardlinks from deleted directories When a directory is deleted, we don't take too much care about killing off all the dirents that belong to it — on the basis that on remount, the scan will conclude that the directory is dead anyway. This doesn't work though, when the deleted directory contained a child directory which was moved *out*. In the early stages of the fs build we can then end up with an apparent hard link, with the child directory appearing both in its true location, and as a child of the original directory which are this stage of the mount process we don't *yet* know is defunct. To resolve this, take out the early special-casing of the "directories shall not have hard links" rule in jffs2_build_inode_pass1(), and let the normal nlink processing happen for directories as well as other inodes. Then later in the build process we can set ic->pino_nlink to the parent inode#, as is required for directories during normal operaton, instead of the nlink. And complain only *then* about hard links which are still in evidence even after killing off all the unreachable paths. Reported-by: Liu Song Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org fs/jffs2/build.c | 75 ++++++++++++++++++++++++++++++++++++++++------------- fs/jffs2/nodelist.h | 6 ++++- 2 files changed, 62 insertions(+), 19 deletions(-) commit 49e91e7079febe59a20ca885a87dd1c54240d0f1 Author: David Woodhouse Date: Mon Feb 1 12:37:20 2016 +0000 jffs2: Fix page lock / f->sem deadlock With this fix, all code paths should now be obtaining the page lock before f->sem. Reported-by: Szabó Tamás Tested-by: Thomas Betker Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org fs/jffs2/README.Locking | 5 +---- fs/jffs2/gc.c | 17 ++++++++++------- 2 files changed, 11 insertions(+), 11 deletions(-) commit 157078f64b8a9cd7011b6b900b2f2498df850748 Author: Thomas Betker Date: Tue Nov 10 22:18:15 2015 +0100 Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" This reverts commit 5ffd3412ae55 ("jffs2: Fix lock acquisition order bug in jffs2_write_begin"). The commit modified jffs2_write_begin() to remove a deadlock with jffs2_garbage_collect_live(), but this introduced new deadlocks found by multiple users. page_lock() actually has to be called before mutex_lock(&c->alloc_sem) or mutex_lock(&f->sem) because jffs2_write_end() and jffs2_readpage() are called with the page locked, and they acquire c->alloc_sem and f->sem, resp. In other words, the lock order in jffs2_write_begin() was correct, and it is the jffs2_garbage_collect_live() path that has to be changed. Revert the commit to get rid of the new deadlocks, and to clear the way for a better fix of the original deadlock. Reported-by: Deng Chao Reported-by: Ming Liu Reported-by: wangzaiwei Signed-off-by: Thomas Betker Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org fs/jffs2/file.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) commit 2ae955774f29bbd7d16149cb0ae8d0319bf2ecc4 Author: David Henningsson Date: Thu Feb 25 09:37:05 2016 +0100 ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 On one of the machines we enable, we found that the actual speaker volume did not always correspond to the volume set in alsamixer. This patch fixes that problem. This patch was orginally written by Kailang @ Realtek, I've rebased it to fit sound git master. Cc: stable@vger.kernel.org BugLink: https://bugs.launchpad.net/bugs/1549660 Co-Authored-By: Kailang Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) commit 0fb00d326ffc36844fac0bfefd8644585a86d4a6 Merge: 17e4bce fd451b9 Author: Paolo Bonzini Date: Thu Feb 25 09:53:55 2016 +0100 Merge tag 'kvm-arm-for-4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/ARM fixes for 4.5-rc6 - Fix per-vcpu vgic bitmap allocation - Do not give copy random memory on MMIO read - Fix GICv3 APR register restore order commit 17e4bce0ae63c7e03f3c7fa8d80890e7af3d4971 Author: Mike Krinkin Date: Wed Feb 24 21:02:31 2016 +0300 KVM: x86: MMU: fix ubsan index-out-of-range warning Ubsan reports the following warning due to a typo in update_accessed_dirty_bits template, the patch fixes the typo: [ 168.791851] ================================================================================ [ 168.791862] UBSAN: Undefined behaviour in arch/x86/kvm/paging_tmpl.h:252:15 [ 168.791866] index 4 is out of range for type 'u64 [4]' [ 168.791871] CPU: 0 PID: 2950 Comm: qemu-system-x86 Tainted: G O L 4.5.0-rc5-next-20160222 #7 [ 168.791873] Hardware name: LENOVO 23205NG/23205NG, BIOS G2ET95WW (2.55 ) 07/09/2013 [ 168.791876] 0000000000000000 ffff8801cfcaf208 ffffffff81c9f780 0000000041b58ab3 [ 168.791882] ffffffff82eb2cc1 ffffffff81c9f6b4 ffff8801cfcaf230 ffff8801cfcaf1e0 [ 168.791886] 0000000000000004 0000000000000001 0000000000000000 ffffffffa1981600 [ 168.791891] Call Trace: [ 168.791899] [] dump_stack+0xcc/0x12c [ 168.791904] [] ? _atomic_dec_and_lock+0xc4/0xc4 [ 168.791910] [] ubsan_epilogue+0xd/0x8a [ 168.791914] [] __ubsan_handle_out_of_bounds+0x15c/0x1a3 [ 168.791918] [] ? __ubsan_handle_shift_out_of_bounds+0x2bd/0x2bd [ 168.791922] [] ? get_user_pages_fast+0x2bf/0x360 [ 168.791954] [] ? kvm_largepages_enabled+0x30/0x30 [kvm] [ 168.791958] [] ? __get_user_pages_fast+0x360/0x360 [ 168.791987] [] paging64_walk_addr_generic+0x1b28/0x2600 [kvm] [ 168.792014] [] ? init_kvm_mmu+0x1100/0x1100 [kvm] [ 168.792019] [] ? debug_check_no_locks_freed+0x350/0x350 [ 168.792044] [] ? init_kvm_mmu+0x1100/0x1100 [kvm] [ 168.792076] [] paging64_gva_to_gpa+0x7d/0x110 [kvm] [ 168.792121] [] ? paging64_walk_addr_generic+0x2600/0x2600 [kvm] [ 168.792130] [] ? debug_lockdep_rcu_enabled+0x7b/0x90 [ 168.792178] [] emulator_read_write_onepage+0x27a/0x1150 [kvm] [ 168.792208] [] ? __kvm_read_guest_page+0x54/0x70 [kvm] [ 168.792234] [] ? kvm_task_switch+0x160/0x160 [kvm] [ 168.792238] [] ? debug_lockdep_rcu_enabled+0x7b/0x90 [ 168.792263] [] emulator_read_write+0xe7/0x6d0 [kvm] [ 168.792290] [] ? em_cr_write+0x230/0x230 [kvm] [ 168.792314] [] emulator_write_emulated+0x15/0x20 [kvm] [ 168.792340] [] segmented_write+0xf8/0x130 [kvm] [ 168.792367] [] ? em_lgdt+0x20/0x20 [kvm] [ 168.792374] [] ? vmx_read_guest_seg_ar+0x42/0x1e0 [kvm_intel] [ 168.792400] [] writeback+0x3f2/0x700 [kvm] [ 168.792424] [] ? em_sidt+0xa0/0xa0 [kvm] [ 168.792449] [] ? x86_decode_insn+0x1b3d/0x4f70 [kvm] [ 168.792474] [] x86_emulate_insn+0x572/0x3010 [kvm] [ 168.792499] [] x86_emulate_instruction+0x3bd/0x2110 [kvm] [ 168.792524] [] ? reexecute_instruction.part.110+0x2e0/0x2e0 [kvm] [ 168.792532] [] handle_ept_misconfig+0x61/0x460 [kvm_intel] [ 168.792539] [] ? handle_pause+0x450/0x450 [kvm_intel] [ 168.792546] [] vmx_handle_exit+0xd6a/0x1ad0 [kvm_intel] [ 168.792572] [] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm] [ 168.792597] [] kvm_arch_vcpu_ioctl_run+0xd3d/0x6090 [kvm] [ 168.792621] [] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm] [ 168.792627] [] ? __ww_mutex_lock_interruptible+0x1630/0x1630 [ 168.792651] [] ? kvm_arch_vcpu_runnable+0x4f0/0x4f0 [kvm] [ 168.792656] [] ? preempt_notifier_unregister+0x190/0x190 [ 168.792681] [] ? kvm_arch_vcpu_load+0x127/0x650 [kvm] [ 168.792704] [] kvm_vcpu_ioctl+0x553/0xda0 [kvm] [ 168.792727] [] ? vcpu_put+0x40/0x40 [kvm] [ 168.792732] [] ? debug_check_no_locks_freed+0x350/0x350 [ 168.792735] [] ? _raw_spin_unlock+0x27/0x40 [ 168.792740] [] ? handle_mm_fault+0x1673/0x2e40 [ 168.792744] [] ? trace_hardirqs_on_caller+0x478/0x6c0 [ 168.792747] [] ? trace_hardirqs_on+0xd/0x10 [ 168.792751] [] ? debug_lockdep_rcu_enabled+0x7b/0x90 [ 168.792756] [] do_vfs_ioctl+0x1b0/0x12b0 [ 168.792759] [] ? ioctl_preallocate+0x210/0x210 [ 168.792763] [] ? __fget+0x273/0x4a0 [ 168.792766] [] ? __fget+0x50/0x4a0 [ 168.792770] [] ? __fget_light+0x96/0x2b0 [ 168.792773] [] SyS_ioctl+0x79/0x90 [ 168.792777] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 168.792780] ================================================================================ Signed-off-by: Mike Krinkin Reviewed-by: Xiao Guangrong Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/kvm/paging_tmpl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3b43b71f05d3ecd01c4116254666d9492301697d Author: Kai-Heng Feng Date: Thu Feb 25 15:19:38 2016 +0800 ALSA: hda - Fixing background noise on Dell Inspiron 3162 After login to the desktop on Dell Inspiron 3162, there's a very loud background noise comes from the builtin speaker. The noise does not go away even if the speaker is muted. The noise disappears after using the aamix fixup. Codec: Realtek ALC3234 Address: 0 AFG Function Id: 0x1 (unsol 1) Vendor Id: 0x10ec0255 Subsystem Id: 0x10280725 Revision Id: 0x100002 No Modem Function Group found BugLink: http://bugs.launchpad.net/bugs/1549620 Signed-off-by: Kai-Heng Feng Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 0da4cf3e0a68c97ef811569804616a811f786729 Author: Peter Zijlstra Date: Wed Feb 24 18:45:51 2016 +0100 perf: Robustify task_function_call() Since there is no serialization between task_function_call() doing task_curr() and the other CPU doing context switches, we could end up not sending an IPI even if we had to. And I'm not sure I still buy my own argument we're OK. Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174948.340031200@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit a096309bc4677f60caa8e93fcc613a55073c51d4 Author: Peter Zijlstra Date: Wed Feb 24 18:45:50 2016 +0100 perf: Fix scaling vs. perf_install_in_context() Completely reworks perf_install_in_context() (again!) in order to ensure that there will be no ctx time hole between add_event_to_ctx() and any potential ctx_sched_in(). Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174948.279399438@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 115 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 70 insertions(+), 45 deletions(-) commit bd2afa49d194c6412c333e9fdd48bc5d06bb465d Author: Peter Zijlstra Date: Wed Feb 24 18:45:49 2016 +0100 perf: Fix scaling vs. perf_event_enable() Similar to the perf_enable_on_exec(), ensure that event timings are consistent across perf_event_enable(). Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174948.218288698@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-) commit 7fce250915efca0f8f51dddee3ae89bf30d86ca5 Author: Peter Zijlstra Date: Wed Feb 24 18:45:48 2016 +0100 perf: Fix scaling vs. perf_event_enable_on_exec() The recent commit 3e349507d12d ("perf: Fix perf_enable_on_exec() event scheduling") caused this by moving task_ctx_sched_out() from before __perf_event_mask_enable() to after it. The overlooked consequence of that change is that task_ctx_sched_out() would update the ctx time fields, and now __perf_event_mask_enable() uses stale time. In order to fix this, explicitly stop our context's time before enabling the event(s). Reported-by: Oleg Nesterov Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Fixes: 3e349507d12d ("perf: Fix perf_enable_on_exec() event scheduling") Link: http://lkml.kernel.org/r/20160224174948.159242158@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 1 + 1 file changed, 1 insertion(+) commit 3cbaa59069677920186dcf502632ca1df4329f80 Author: Peter Zijlstra Date: Wed Feb 24 18:45:47 2016 +0100 perf: Fix ctx time tracking by introducing EVENT_TIME Currently any ctx_sched_in() call will re-start the ctx time tracking, this means that calls like: ctx_sched_in(.event_type = EVENT_PINNED); ctx_sched_in(.event_type = EVENT_FLEXIBLE); will have a hole in their ctx time tracking. This is likely harmless but can confuse things a little. By adding EVENT_TIME, we can have the first ctx_sched_in() (is_active: 0 -> !0) start the time and any further ctx_sched_in() will leave the timestamps alone. Secondly, this allows for an early disable like: ctx_sched_out(.event_type = EVENT_TIME); which would update the ctx time (if the ctx is active) and any further calls to ctx_sched_out() would not further modify the ctx time. For ctx_sched_in() any 0 -> !0 transition will automatically include EVENT_TIME. For ctx_sched_out(), any transition that clears EVENT_ALL will automatically clear EVENT_TIME. These two rules ensure that under normal circumstances we need not bother with EVENT_TIME and get natural ctx time behaviour. Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174948.100446561@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) commit 28a967c3a2f99fa3b5f762f25cb2a319d933571b Author: Peter Zijlstra Date: Wed Feb 24 18:45:46 2016 +0100 perf: Cure event->pending_disable race Because event_sched_out() checks event->pending_disable _before_ actually disabling the event, it can happen that the event fires after it checks but before it gets disabled. This would leave event->pending_disable set and the queued irq_work will try and process it. However, if the event trigger was during schedule(), the event might have been de-scheduled by the time the irq_work runs, and perf_event_disable_local() will fail. Fix this by checking event->pending_disable _after_ we call event->pmu->del(). This depends on the latter being a compiler barrier, such that the compiler does not lift the load and re-creates the problem. Tested-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174948.040469884@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9107c89e269d2738019861bb518e3d59bef01781 Author: Peter Zijlstra Date: Wed Feb 24 18:45:45 2016 +0100 perf: Fix race between event install and jump_labels perf_install_in_context() relies upon the context switch hooks to have scheduled in events when the IPI misses its target -- after all, if the task has moved from the CPU (or wasn't running at all), it will have to context switch to run elsewhere. This however doesn't appear to be happening. It is possible for the IPI to not happen (task wasn't running) only to later observe the task running with an inactive context. The only possible explanation is that the context switch hooks are not called. Therefore put in a sync_sched() after toggling the jump_label to guarantee all CPUs will have them enabled before we install an event. A simple if (0->1) sync_sched() will not in fact work, because any further increment can race and complete before the sync_sched(). Therefore we must jump through some hoops. Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.980211985@infradead.org Signed-off-by: Ingo Molnar include/linux/perf_event.h | 6 +++--- kernel/events/core.c | 49 ++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 44 insertions(+), 11 deletions(-) commit a69b0ca4ac3bf5427b571f11cbf33f0a32b728d5 Author: Peter Zijlstra Date: Wed Feb 24 18:45:44 2016 +0100 perf: Fix cloning Alexander reported that when the 'original' context gets destroyed, no new clones happen. This can happen irrespective of the ctx switch optimization, any task can die, even the parent, and we want to continue monitoring the task hierarchy until we either close the event or no tasks are left in the hierarchy. perf_event_init_context() will attempt to pin the 'parent' context during clone(). At that point current is the parent, and since current cannot have exited while executing clone(), its context cannot have passed through perf_event_exit_task_context(). Therefore perf_pin_task_context() cannot observe ctx->task == TASK_TOMBSTONE. However, since inherit_event() does: if (parent_event->parent) parent_event = parent_event->parent; it looks at the 'original' event when it does: is_orphaned_event(). This can return true if the context that contains the this event has passed through perf_event_exit_task_context(). And thus we'll fail to clone the perf context. Fix this by adding a new state: STATE_DEAD, which is set by perf_release() to indicate that the filedesc (or kernel reference) is dead and there are no observers for our data left. Only for STATE_DEAD will is_orphaned_event() be true and inhibit cloning. STATE_EXIT is otherwise preserved such that is_event_hup() remains functional and will report when the observed task hierarchy becomes empty. Reported-by: Alexander Shishkin Tested-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Fixes: c6e5b73242d2 ("perf: Synchronously clean up child events") Link: http://lkml.kernel.org/r/20160224174947.919845295@infradead.org Signed-off-by: Ingo Molnar include/linux/perf_event.h | 1 + kernel/events/core.c | 29 ++++++++++++++--------------- 2 files changed, 15 insertions(+), 15 deletions(-) commit 6f932e5be1503ab0783699e843db325d44c2fabb Author: Peter Zijlstra Date: Wed Feb 24 18:45:43 2016 +0100 perf: Only update context time when active Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.860690919@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit a4f4bb6d0c69d0bb573f1d9e6f1b806f9b038b19 Author: Peter Zijlstra Date: Wed Feb 24 18:45:42 2016 +0100 perf: Allow perf_release() with !event->ctx In the err_file: fput(event_file) case, the event will not yet have been attached to a context. However perf_release() does assume it has been. Cure this. Tested-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.793996260@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 130056275ade730e7a79c110212c8815202773ee Author: Peter Zijlstra Date: Wed Feb 24 18:45:41 2016 +0100 perf: Do not double free In case of: err_file: fput(event_file), we'll end up calling perf_release() which in turn will free the event. Do not then free the event _again_. Tested-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.697350349@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 84c4e620d35f49f486a900af214ad12276afb386 Author: Peter Zijlstra Date: Wed Feb 24 18:45:40 2016 +0100 perf: Close install vs. exit race Consider the following scenario: CPU0 CPU1 ctx = find_get_ctx(); perf_event_exit_task_context() mutex_lock(&ctx->mutex); perf_install_in_context(ctx, ...); /* NO-OP */ mutex_unlock(&ctx->mutex); ... perf_release() WARN_ON_ONCE(event->state != STATE_EXIT); Since the event doesn't pass through perf_remove_from_context() because perf_install_in_context() NO-OPs because the ctx is dead, and perf_event_exit_task_context() will not observe the event because its not attached yet, the event->state will not be set. Solve this by revalidating ctx->task after we acquire ctx->mutex and failing the event creation as a whole. Tested-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.626853419@infradead.org Signed-off-by: Ingo Molnar kernel/events/core.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) commit 3d44d51bd339766f0178f0cf2e8d048b4a4872aa Author: Andy Lutomirski Date: Wed Feb 24 12:18:49 2016 -0800 x86/entry/compat: Add missing CLAC to entry_INT80_32 This doesn't seem to fix a regression -- I don't think the CLAC was ever there. I double-checked in a debugger: entries through the int80 gate do not automatically clear AC. Stable maintainers: I can provide a backport to 4.3 and earlier if needed. This needs to be backported all the way to 3.10. Reported-by: Brian Gerst Signed-off-by: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: # v3.10 and later Fixes: 63bcff2a307b ("x86, smap: Add STAC and CLAC instructions to control user space access") Link: http://lkml.kernel.org/r/b02b7e71ae54074be01fc171cbd4b72517055c0e.1456345086.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/entry/entry_64_compat.S | 1 + 1 file changed, 1 insertion(+) commit ee50c130c82175eaa0820c96b6d3763928af2241 Author: Diego Viola Date: Tue Feb 23 12:04:04 2016 -0300 net: jme: fix suspend/resume on JMC260 The JMC260 network card fails to suspend/resume because the call to jme_start_irq() was too early, moving the call to jme_start_irq() after the call to jme_reset_link() makes it work. Prior this change suspend/resume would fail unless /sys/power/pm_async=0 was explicitly specified. Relevant bug report: https://bugzilla.kernel.org/show_bug.cgi?id=112351 Signed-off-by: Diego Viola Signed-off-by: David S. Miller drivers/net/ethernet/jme.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3772e72720c6bfe1c1fc592ac3d6270559b4ce09 Merge: 870571a5 95664e6 Author: Dave Airlie Date: Thu Feb 25 13:17:50 2016 +1000 Merge branch 'linux-4.5' of git://github.com/skeggsb/linux into drm-fixes single for for eDP panel issues on Lenovo P50 * 'linux-4.5' of git://github.com/skeggsb/linux: drm/nouveau/disp/dp: ensure sink is powered up before attempting link training commit 95664e66fad964c3dd7945d6edfb1d0931844664 Author: Ben Skeggs Date: Thu Feb 18 08:14:19 2016 +1000 drm/nouveau/disp/dp: ensure sink is powered up before attempting link training This can happen under some annoying circumstances, and is a quick fix until more substantial changes can be made. Fixed eDP mode changes on (at least) the Lenovo P50. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.c | 10 ++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.h | 6 ++++++ 2 files changed, 16 insertions(+) commit 870571a5698b2e9d0f4d2e5c6245967b582aab45 Author: Thierry Reding Date: Wed Feb 24 18:34:43 2016 +0100 drm/nouveau: platform: Fix deferred probe The error cleanup paths aren't quite correct and will crash upon deferred probe. Cc: stable@vger.kernel.org # v4.3+ Reviewed-by: Ben Skeggs Reviewed-by: Alexandre Courbot Signed-off-by: Thierry Reding Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nouveau_platform.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 40 ++++++++++++++++------ 2 files changed, 30 insertions(+), 12 deletions(-) commit d144dfea8af7108f613139623e63952ed7e69c0c Author: Peter Chen Date: Wed Feb 24 11:05:25 2016 +0800 usb: chipidea: otg: change workqueue ci_otg as freezable If we use USB ID pin as wakeup source, and there is a USB block device on this USB OTG (ID) cable, the system will be deadlock after system resume. The root cause for this problem is: the workqueue ci_otg may try to remove hcd before the driver resume has finished, and hcd will disconnect the device on it, then, it will call device_release_driver, and holds the device lock "dev->mutex", but it is never unlocked since it waits workqueue writeback to run to flush the block information, but the workqueue writeback is freezable, it is not thawed before driver resume has finished. When the driver (device: sd 0:0:0:0:) resume goes to dpm_complete, it tries to get its device lock "dev->mutex", but it can't get it forever, then the deadlock occurs. Below call stacks show the situation. So, in order to fix this problem, we need to change workqueue ci_otg as freezable, then the work item in this workqueue will be run after driver's resume, this workqueue will not be blocked forever like above case since the workqueue writeback has been thawed too. Tested at: i.mx6qdl-sabresd and i.mx6sx-sdb. [ 555.178869] kworker/u2:13 D c07de74c 0 826 2 0x00000000 [ 555.185310] Workqueue: ci_otg ci_otg_work [ 555.189353] Backtrace: [ 555.191849] [] (__schedule) from [] (schedule+0x48/0xa0) [ 555.198912] r10:ee471ba0 r9:00000000 r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4 [ 555.206867] r4:ee470000 [ 555.209453] [] (schedule) from [] (schedule_timeout+0x15c/0x1e0) [ 555.217212] r4:7fffffff r3:edc2b000 [ 555.220862] [] (schedule_timeout) from [] (wait_for_common+0x94/0x144) [ 555.229140] r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4 r4:7fffffff [ 555.235980] [] (wait_for_common) from [] (wait_for_completion+0x18/0x1c) [ 555.244430] r10:00000001 r9:c0b5563c r8:c0042e48 r7:ef086000 r6:eea4372c r5:ef131b00 [ 555.252383] r4:00000000 [ 555.254970] [] (wait_for_completion) from [] (flush_work+0x19c/0x234) [ 555.263177] [] (flush_work) from [] (flush_delayed_work+0x48/0x4c) [ 555.271106] r8:ed5b5000 r7:c0b38a3c r6:eea439cc r5:eea4372c r4:eea4372c [ 555.277958] [] (flush_delayed_work) from [] (bdi_unregister+0x84/0xec) [ 555.286236] r4:eea43520 r3:20000153 [ 555.289885] [] (bdi_unregister) from [] (blk_cleanup_queue+0x180/0x29c) [ 555.298250] r5:eea43808 r4:eea43400 [ 555.301909] [] (blk_cleanup_queue) from [] (__scsi_remove_device+0x48/0xb8) [ 555.310623] r7:00000000 r6:20000153 r5:ededa950 r4:ededa800 [ 555.316403] [] (__scsi_remove_device) from [] (scsi_forget_host+0x64/0x68) [ 555.325028] r5:ededa800 r4:ed5b5000 [ 555.328689] [] (scsi_forget_host) from [] (scsi_remove_host+0x78/0x104) [ 555.337054] r5:ed5b5068 r4:ed5b5000 [ 555.340709] [] (scsi_remove_host) from [] (usb_stor_disconnect+0x50/0xb4) [ 555.349247] r6:ed5b56e4 r5:ed5b5818 r4:ed5b5690 r3:00000008 [ 555.355025] [] (usb_stor_disconnect) from [] (usb_unbind_interface+0x78/0x25c) [ 555.363997] r8:c13919b4 r7:edd3c000 r6:edd3c020 r5:ee551c68 r4:ee551c00 r3:c04cdf7c [ 555.371892] [] (usb_unbind_interface) from [] (__device_release_driver+0x8c/0x118) [ 555.381213] r10:00000001 r9:edd90c00 r8:c13919b4 r7:ee551c68 r6:c0b546e0 r5:c0b5563c [ 555.389167] r4:edd3c020 [ 555.391752] [] (__device_release_driver) from [] (device_release_driver+0x28/0x34) [ 555.401071] r5:edd3c020 r4:edd3c054 [ 555.404721] [] (device_release_driver) from [] (bus_remove_device+0xe0/0x110) [ 555.413607] r5:edd3c020 r4:ef17f04c [ 555.417253] [] (bus_remove_device) from [] (device_del+0x114/0x21c) [ 555.425270] r6:edd3c028 r5:edd3c020 r4:ee551c00 r3:00000000 [ 555.431045] [] (device_del) from [] (usb_disable_device+0xa4/0x1e8) [ 555.439061] r8:edd3c000 r7:eded8000 r6:00000000 r5:00000001 r4:ee551c00 [ 555.445906] [] (usb_disable_device) from [] (usb_disconnect+0x74/0x224) [ 555.454271] r9:edd90c00 r8:ee551000 r7:ee551c68 r6:ee551c9c r5:ee551c00 r4:00000001 [ 555.462156] [] (usb_disconnect) from [] (usb_disconnect+0x1d8/0x224) [ 555.470259] r10:00000001 r9:edd90000 r8:ee471e2c r7:ee551468 r6:ee55149c r5:ee551400 [ 555.478213] r4:00000001 [ 555.480797] [] (usb_disconnect) from [] (usb_remove_hcd+0xa0/0x1ac) [ 555.488813] r10:00000001 r9:ee471eb0 r8:00000000 r7:ef3d9500 r6:eded810c r5:eded80b0 [ 555.496765] r4:eded8000 [ 555.499351] [] (usb_remove_hcd) from [] (host_stop+0x28/0x64) [ 555.506847] r6:eeb50010 r5:eded8000 r4:eeb51010 [ 555.511563] [] (host_stop) from [] (ci_otg_work+0xc4/0x124) [ 555.518885] r6:00000001 r5:eeb50010 r4:eeb502a0 r3:c04d4130 [ 555.524665] [] (ci_otg_work) from [] (process_one_work+0x194/0x420) [ 555.532682] r6:ef086000 r5:eeb502a0 r4:edc44480 [ 555.537393] [] (process_one_work) from [] (worker_thread+0x34/0x514) [ 555.545496] r10:edc44480 r9:ef086000 r8:c0b1a100 r7:ef086034 r6:00000088 r5:edc44498 [ 555.553450] r4:ef086000 [ 555.556032] [] (worker_thread) from [] (kthread+0xdc/0xf8) [ 555.563268] r10:00000000 r9:00000000 r8:00000000 r7:c004577c r6:edc44480 r5:eddc15c0 [ 555.571221] r4:00000000 [ 555.573804] [] (kthread) from [] (ret_from_fork+0x14/0x24) [ 555.581040] r7:00000000 r6:00000000 r5:c004b9d8 r4:eddc15c0 [ 553.429383] sh D c07de74c 0 694 691 0x00000000 [ 553.435801] Backtrace: [ 553.438295] [] (__schedule) from [] (schedule+0x48/0xa0) [ 553.445358] r10:edd3c054 r9:edd3c078 r8:edddbd50 r7:edcbbc00 r6:c1377c34 r5:60000153 [ 553.453313] r4:eddda000 [ 553.455896] [] (schedule) from [] (schedule_preempt_disabled+0x10/0x14) [ 553.464261] r4:edd3c058 r3:0000000a [ 553.467910] [] (schedule_preempt_disabled) from [] (mutex_lock_nested+0x1a0/0x3e8) [ 553.477254] [] (mutex_lock_nested) from [] (dpm_complete+0xc0/0x1b0) [ 553.485358] r10:00561408 r9:edd3c054 r8:c0b4863c r7:edddbd90 r6:c0b485d8 r5:edd3c020 [ 553.493313] r4:edd3c0d0 [ 553.495896] [] (dpm_complete) from [] (dpm_resume_end+0x1c/0x20) [ 553.503652] r9:00000000 r8:c0b1a9d0 r7:c1334ec0 r6:c1334edc r5:00000003 r4:00000010 [ 553.511544] [] (dpm_resume_end) from [] (suspend_devices_and_enter+0x158/0x504) [ 553.520604] r4:00000000 r3:c1334efc [ 553.524250] [] (suspend_devices_and_enter) from [] (pm_suspend+0x234/0x2cc) [ 553.532961] r10:00561408 r9:ed6b7300 r8:00000004 r7:c1334eec r6:00000000 r5:c1334ee8 [ 553.540914] r4:00000003 [ 553.543493] [] (pm_suspend) from [] (state_store+0x6c/0xc0) [ 555.703684] 7 locks held by kworker/u2:13/826: [ 555.708140] #0: ("%s""ci_otg"){++++.+}, at: [] process_one_work+0x128/0x420 [ 555.716277] #1: ((&ci->work)){+.+.+.}, at: [] process_one_work+0x128/0x420 [ 555.724317] #2: (usb_bus_list_lock){+.+.+.}, at: [] usb_remove_hcd+0x98/0x1ac [ 555.732626] #3: (&dev->mutex){......}, at: [] usb_disconnect+0x48/0x224 [ 555.740403] #4: (&dev->mutex){......}, at: [] usb_disconnect+0x48/0x224 [ 555.748179] #5: (&dev->mutex){......}, at: [] device_release_driver+0x20/0x34 [ 555.756487] #6: (&shost->scan_mutex){+.+.+.}, at: [] scsi_remove_host+0x20/0x104 Cc: #v3.14+ Cc: Jun Li Signed-off-by: Peter Chen drivers/usb/chipidea/otg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0378ba4899d5fbd8494ed6580cbc81d7b44dbac6 Author: Geert Uytterhoeven Date: Wed Feb 24 09:43:23 2016 +0100 drivers: sh: Restore legacy clock domain on SuperH platforms CONFIG_ARCH_SHMOBILE is not only enabled for Renesas ARM platforms (which are DT based and multi-platform), but also on a select set of Renesas SuperH platforms (SH7722/SH7723/SH7724/SH7343/SH7366). Hence since commit 0ba58de231066e47 ("drivers: sh: Get rid of CONFIG_ARCH_SHMOBILE_MULTI"), the legacy clock domain is no longer installed on these SuperH platforms, and module clocks may not be enabled when needed, leading to driver failures. To fix this, add an additional check for CONFIG_OF. Fixes: 0ba58de231066e47 ("drivers: sh: Get rid of CONFIG_ARCH_SHMOBILE_MULTI"). Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman drivers/sh/pm_runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 398cb0c93b18b625703db30d874351e6d4cc645a Merge: ad00a57 9b18572 Author: Dave Airlie Date: Thu Feb 25 08:22:43 2016 +1000 Merge tag 'drm-intel-fixes-2016-02-22' of git://anongit.freedesktop.org/drm-intel into drm-fixes This is a bit large, but it really helps Skylake bugs we are seeing on a number of laptops. Most of the commits are quite similar, ensuring the display power doesn't vanish under us during hardware access. Also do note that it's not just Skylake that's affected. * tag 'drm-intel-fixes-2016-02-22' of git://anongit.freedesktop.org/drm-intel: drm/i915/gen9: Verify and enforce dc6 state writes drm/i915/gen9: Check for DC state mismatch drm/i915/skl: Ensure HW is powered during DDB HW state readout drm/i915/lvds: Ensure the HW is powered during HW state readout drm/i915/hdmi: Ensure the HW is powered during HW state readout drm/i915/dsi: Ensure the HW is powered during HW state readout drm/i915/dp: Ensure the HW is powered during HW state readout drm/i915: Ensure the HW is powered when accessing the CRC HW block drm/i915/ddi: Ensure the HW is powered during HW state readout drm/i915/crt: Ensure the HW is powered during HW state readout drm/i915: Ensure the HW is powered during HW access in assert_pipe drm/i915: Ensure the HW is powered when disabling VGA drm/i915/ibx: Ensure the HW is powered during PLL HW readout drm/i915: Ensure the HW is powered during display pipe HW readout drm/i915: Add helper to get a display power ref if it was already enabled commit ad00a57ad78f33590b392eabcacb0e1d57b640a1 Merge: 84e54c4 6378076 Author: Dave Airlie Date: Thu Feb 25 08:21:33 2016 +1000 Merge branch 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few radeon and amdgpu fixes for 4.5. A few further fixes for the vblank regressions in 4.4 and a couple of other minor fixes. * 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: disable direct VM updates when vm_debug is set amdgpu: fix NULL pointer dereference at tonga_check_states_equal drm/radeon/pm: adjust display configuration after powerstate drm/amdgpu/pm: adjust display configuration after powerstate drm/amdgpu/pm: add some checks for PX drm/amdgpu: fix locking in force performance level drm/amdgpu/gfx8: fix priv reg interrupt enable drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc. drm/radeon: Don't hang in radeon_flip_work_func on disabled crtc. (v2) commit 6dc390ad61ac8dfca5fa9b0823981fb6f7ec17a0 Merge: aa263c4 9ef2d8b Author: Linus Torvalds Date: Wed Feb 24 14:06:17 2016 -0800 Merge tag 'arc-4.5-rc6-fixes-upd' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - Fix for csd deadlock due to missing self IPI - Accompanying IPI cleanups / optimization - Brown paper bag bug in one of the cleanups above - Boot reporting updates for new hardware features - Don't force DEVTMPFS if INITRAMFS * tag 'arc-4.5-rc6-fixes-upd' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: arc: SMP: CONFIG_ARC_IPI_DBG cleanup ARC: SMP: No need for CONFIG_ARC_IPI_DBG ARCv2: Elide sending new cross core intr if receiver didn't ack prev ARCv2: SMP: Push IPI_IRQ into IPI provider ARC: [intc-compact] Remove IPI setup from ARCompact port ARCv2: SMP: Emulate IPI to self using software triggered interrupt arc: get rid of DEVTMPFS dependency on INITRAMFS_SOURCE ARCv2: boot report CCMs (Closely Coupled Memories) ARCv2: boot print Low Latency Memory ARC: Assume multiplier is always present commit aa263c43fee300af018aec437dbd64570ec65825 Merge: 2ac015e 7ae8fd0 Author: Linus Torvalds Date: Wed Feb 24 14:00:26 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Assorted fixes - xattr one from this cycle, the rest - stable fodder" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/pnode.c: treat zero mnt_group_id-s as unequal affs_do_readpage_ofs(): just use kmap_atomic() around memcpy() xattr handlers: plug a lock leak in simple_xattr_list fs: allow no_seek_end_llseek to actually seek commit 25ac3417b79b0aafd2401c96503716901be4533b Merge: 2da897e b860715 Author: David S. Miller Date: Wed Feb 24 16:58:12 2016 -0500 Merge tag 'mac80211-for-davem-2016-02-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Another small set of fixes: * stop critical protocol session on disconnect to avoid it getting stuck * wext: fix two RTNL message ordering issues * fix an uninitialized value (found by KASAN) * fix an out-of-bounds access (also found by KASAN) * clear connection keys when freeing them in all cases (IBSS, all other places already did so) * fix expected throughput unit to get consistent values * set default TX aggregation timeout to 0 in minstrel to avoid (really just hide) issues and perform better ==================== Signed-off-by: David S. Miller commit 2da897e51d7f23f872224218b9a4314503b0d360 Author: Daniel Borkmann Date: Tue Feb 23 02:05:26 2016 +0100 bpf: fix csum setting for bpf_set_tunnel_key The fix in 35e2d1152b22 ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.") changed behavior for bpf_set_tunnel_key() when in use with IPv6 and thus uncovered a bug that TUNNEL_CSUM needed to be set but wasn't. As a result, the stack dropped ingress vxlan IPv6 packets, that have been sent via eBPF through collect meta data mode due to checksum now being zero. Since after LCO, we enable IPv4 checksum by default, so make that analogous and only provide a flag BPF_F_ZERO_CSUM_TX for the user to turn it off in IPv4 case. Fixes: 35e2d1152b22 ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.") Fixes: c6c33454072f ("bpf: support ipv6 for bpf_skb_{set,get}_tunnel_key") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/uapi/linux/bpf.h | 3 +++ net/core/filter.c | 6 ++++-- 2 files changed, 7 insertions(+), 2 deletions(-) commit cd8140c673d9ba9be3591220e1b2226d9e1e40d3 Author: Ilya Dryomov Date: Fri Feb 19 11:38:57 2016 +0100 libceph: don't spam dmesg with stray reply warnings Commit d15f9d694b77 ("libceph: check data_len in ->alloc_msg()") mistakenly bumped the log level on the "tid %llu unknown, skipping" message. Turn it back into a dout() - stray replies are perfectly normal when OSDs flap, crash, get killed for testing purposes, etc. Cc: stable@vger.kernel.org # 4.3+ Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/osd_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dbc0d3caff5b7591e0cf8e34ca686ca6f4479ee1 Author: Ilya Dryomov Date: Fri Feb 19 11:38:57 2016 +0100 libceph: use the right footer size when skipping a message ceph_msg_footer is 21 bytes long, while ceph_msg_footer_old is only 13. Don't skip too much when CEPH_FEATURE_MSG_AUTH isn't negotiated. Cc: stable@vger.kernel.org # 3.19+ Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/messenger.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit e7a88e82fe380459b864e05b372638aeacb0f52d Author: Ilya Dryomov Date: Wed Feb 17 20:04:08 2016 +0100 libceph: don't bail early from try_read() when skipping a message The contract between try_read() and try_write() is that when called each processes as much data as possible. When instructed by osd_client to skip a message, try_read() is violating this contract by returning after receiving and discarding a single message instead of checking for more. try_write() then gets a chance to write out more requests, generating more replies/skips for try_read() to handle, forcing the messenger into a starvation loop. Cc: stable@vger.kernel.org # 3.10+ Reported-by: Varada Kari Signed-off-by: Ilya Dryomov Tested-by: Varada Kari Reviewed-by: Alex Elder net/ceph/messenger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a8c4a2522a0808c5c2143612909717d1115c40cf Author: Hannes Frederic Sowa Date: Mon Feb 22 18:43:25 2016 +0100 ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL Otherwise we break the contract with GSO to only pass CHECKSUM_PARTIAL skbs down. This can easily happen with UDP+IPv4 sockets with the first MSG_MORE write smaller than the MTU, second write is a sendfile. Returning -EOPNOTSUPP lets the callers fall back into normal sendmsg path, were we calculate the checksum manually during copying. Commit d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets") started to exposes this bug. Fixes: d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets") Reported-by: Jiri Benc Cc: Jiri Benc Reported-by: Wakko Warner Cc: Wakko Warner Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/ipv4/ip_output.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 2ac015e293bbe3858533009612eac58842daf325 Author: Kirill A. Shutemov Date: Wed Feb 24 18:58:03 2016 +0300 thp: call pmdp_invalidate() with correct virtual address Sebastian Ott and Gerald Schaefer reported random crashes on s390. It was bisected to my THP refcounting patchset. The problem is that pmdp_invalidated() called with wrong virtual address. It got offset up by HPAGE_PMD_SIZE by loop over ptes. The solution is to introduce new variable to be used in loop and don't touch 'haddr'. Signed-off-by: Kirill A. Shutemov Reported-and-tested-by: Gerald Schaefer Reported-and-tested-by Sebastian Ott Reviewed-by: Will Deacon Cc: Christian Borntraeger Cc: Martin Schwidefsky Cc: Aneesh Kumar K.V Cc: Andrea Arcangeli Cc: Sasha Levin Cc: Jerome Marchand Cc: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 6378076bcfdcd1d4f8d726d08d3fa044736873eb Author: Christian König Date: Fri Feb 19 10:03:03 2016 +0100 drm/amdgpu: disable direct VM updates when vm_debug is set That should make user space bugs more obvious. Signed-off-by: Christian König Reviewed-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 827108d08070c7515c14eb47e5fa03f59cfe38cf Author: Bradley Pankow Date: Mon Feb 22 20:11:47 2016 -0500 amdgpu: fix NULL pointer dereference at tonga_check_states_equal The event_data passed from pem_fini was not cleared upon initialization. This caused NULL checks to pass and cast_const_phw_tonga_power_state to attempt to dereference an invalid pointer. Clear the event_data in pem_init and pem_fini before calling pem_handle_event. Reviewed-by: Rex Zhu Signed-off-by: Bradley Pankow Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fd451b90e78c4178bcfc5072f2b2b637500c109a Author: Marc Zyngier Date: Wed Feb 17 10:25:05 2016 +0000 arm64: KVM: vgic-v3: Restore ICH_APR0Rn_EL2 before ICH_APR1Rn_EL2 The GICv3 architecture spec says: Writing to the active priority registers in any order other than the following order will result in UNPREDICTABLE behavior: - ICH_AP0R_EL2. - ICH_AP1R_EL2. So let's not pointlessly go against the rule... Acked-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm64/kvm/hyp/vgic-v3-sr.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 428b315a2475d614d6efbdbeaa13f3977416b21a Merge: e5bdfd5 3b24351 Author: Greg Kroah-Hartman Date: Wed Feb 24 09:04:21 2016 -0800 Merge tag 'fixes-for-v4.5-rc6' of http://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.5-rc6 The most important fixes here are: a) yet another fix to dwc3's EP transfer resource assignment logic. This time around we will be pre-allocating transfer resources to avoid any future issues; b) two DMA fixes for the old MUSB driver. c) dwc2's data toggle fix for FS Other than these, we have a few other minor fixes elsewhere. commit d877a214d54619762ae86114fbd04932002ffecd Merge: 7931845 901c5ff Author: Olof Johansson Date: Wed Feb 24 08:48:22 2016 -0800 Merge tag 'renesas-soc-fixes-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Renesas ARM Based SoC Fixes for v4.5 * Avoid writing to .text * tag 'renesas-soc-fixes-for-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: shmobile: Remove shmobile_boot_arg ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss ARM: shmobile: r8a7779: Remove remainings of removed SCU boot setup code ARM: shmobile: Move shmobile_scu_base from .text to .bss Signed-off-by: Olof Johansson commit c7dfe3abf40ec9a298884a4c0775062eac27afc9 Author: Sebastian Frias Date: Mon Feb 22 13:33:14 2016 +0100 net: ethernet: nb8800: support fixed-link DT node Under some circumstances, e.g. when connecting to a switch, the ethernet port will not be connected to a PHY. In that case a "fixed-link" DT node can be used to replace it. https://stackoverflow.com/questions/31046172/device-tree-for-phy-less-connection-to-a-dsa-switch This patch adds support for the "fixed-link" node to the nb8800 driver. Signed-off-by: Sebastian Frias Acked-by: Mans Rullgard Cc: Mason Signed-off-by: David S. Miller drivers/net/ethernet/aurora/nb8800.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit d045437a169f899dfb0f6f7ede24cc042543ced9 Author: Steven Rostedt (Red Hat) Date: Wed Feb 24 09:04:24 2016 -0500 tracing: Fix showing function event in available_events The ftrace:function event is only displayed for parsing the function tracer data. It is not used to enable function tracing, and does not include an "enable" file in its event directory. Originally, this event was kept separate from other events because it did not have a ->reg parameter. But perf added a "reg" parameter for its use which caused issues, because it made the event available to functions where it was not compatible for. Commit 9b63776fa3ca9 "tracing: Do not enable function event with enable" added a TRACE_EVENT_FL_IGNORE_ENABLE flag that prevented the function event from being enabled by normal trace events. But this commit missed keeping the function event from being displayed by the "available_events" directory, which is used to show what events can be enabled by set_event. One documented way to enable all events is to: cat available_events > set_event But because the function event is displayed in the available_events, this now causes an INVALID error: cat: write error: Invalid argument Reported-by: Chunyu Hu Fixes: 9b63776fa3ca9 "tracing: Do not enable function event with enable" Cc: stable@vger.kernel.org # 3.4+ Signed-off-by: Steven Rostedt kernel/trace/trace_events.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d7444794a02ff655eda87e3cc54e86b940e7736f Author: Christian Borntraeger Date: Fri Feb 19 13:11:46 2016 +0100 KVM: async_pf: do not warn on page allocation failures In async_pf we try to allocate with NOWAIT to get an element quickly or fail. This code also handle failures gracefully. Lets silence potential page allocation failures under load. qemu-system-s39: page allocation failure: order:0,mode:0x2200000 [...] Call Trace: ([<00000000001146b8>] show_trace+0xf8/0x148) [<000000000011476a>] show_stack+0x62/0xe8 [<00000000004a36b8>] dump_stack+0x70/0x98 [<0000000000272c3a>] warn_alloc_failed+0xd2/0x148 [<000000000027709e>] __alloc_pages_nodemask+0x94e/0xb38 [<00000000002cd36a>] new_slab+0x382/0x400 [<00000000002cf7ac>] ___slab_alloc.constprop.30+0x2dc/0x378 [<00000000002d03d0>] kmem_cache_alloc+0x160/0x1d0 [<0000000000133db4>] kvm_setup_async_pf+0x6c/0x198 [<000000000013dee8>] kvm_arch_vcpu_ioctl_run+0xd48/0xd58 [<000000000012fcaa>] kvm_vcpu_ioctl+0x372/0x690 [<00000000002f66f6>] do_vfs_ioctl+0x3be/0x510 [<00000000002f68ec>] SyS_ioctl+0xa4/0xb8 [<0000000000781c5e>] system_call+0xd6/0x264 [<000003ffa24fa06a>] 0x3ffa24fa06a Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger Reviewed-by: Dominik Dingel Signed-off-by: Paolo Bonzini virt/kvm/async_pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 Author: Paolo Bonzini Date: Fri Feb 19 18:07:21 2016 +0100 KVM: x86: fix conversion of addresses to linear in 32-bit protected mode Commit e8dd2d2d641c ("Silence compiler warning in arch/x86/kvm/emulate.c", 2015-09-06) broke boot of the Hurd. The bug is that the "default:" case actually could modify "la", but after the patch this change is not reflected in *linear. The bug is visible whenever a non-zero segment base causes the linear address to wrap around the 4GB mark. Fixes: e8dd2d2d641cb2724ee10e76c0ad02e04289c017 Cc: stable@vger.kernel.org Reported-by: Aurelien Jarno Tested-by: Aurelien Jarno Signed-off-by: Paolo Bonzini arch/x86/kvm/emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 172b2386ed16a9143d9a456aae5ec87275c61489 Author: Paolo Bonzini Date: Wed Feb 10 17:50:23 2016 +0100 KVM: x86: fix missed hardware breakpoints Sometimes when setting a breakpoint a process doesn't stop on it. This is because the debug registers are not loaded correctly on VCPU load. The following simple reproducer from Oleg Nesterov tries using debug registers in two threads. To see the bug, run a 2-VCPU guest with "taskset -c 0" and run "./bp 0 1" inside the guest. #include #include #include #include #include #include #include #include #include #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER) unsigned long encode_dr7(int drnum, int enable, unsigned int type, unsigned int len) { unsigned long dr7; dr7 = ((len | type) & 0xf) << (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE); if (enable) dr7 |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE)); return dr7; } int write_dr(int pid, int dr, unsigned long val) { return ptrace(PTRACE_POKEUSER, pid, offsetof (struct user, u_debugreg[dr]), val); } void set_bp(pid_t pid, void *addr) { unsigned long dr7; assert(write_dr(pid, 0, (long)addr) == 0); dr7 = encode_dr7(0, 1, DR_RW_EXECUTE, DR_LEN_1); assert(write_dr(pid, 7, dr7) == 0); } void *get_rip(int pid) { return (void*)ptrace(PTRACE_PEEKUSER, pid, offsetof(struct user, regs.rip), 0); } void test(int nr) { void *bp_addr = &&label + nr, *bp_hit; int pid; printf("test bp %d\n", nr); assert(nr < 16); // see 16 asm nops below pid = fork(); if (!pid) { assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0); kill(getpid(), SIGSTOP); for (;;) { label: asm ( "nop; nop; nop; nop;" "nop; nop; nop; nop;" "nop; nop; nop; nop;" "nop; nop; nop; nop;" ); } } assert(pid == wait(NULL)); set_bp(pid, bp_addr); for (;;) { assert(ptrace(PTRACE_CONT, pid, 0, 0) == 0); assert(pid == wait(NULL)); bp_hit = get_rip(pid); if (bp_hit != bp_addr) fprintf(stderr, "ERR!! hit wrong bp %ld != %d\n", bp_hit - &&label, nr); } } int main(int argc, const char *argv[]) { while (--argc) { int nr = atoi(*++argv); if (!fork()) test(nr); } while (wait(NULL) > 0) ; return 0; } Cc: stable@vger.kernel.org Suggested-by: Nadav Amit Reported-by: Andrey Wagin Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 1 + 1 file changed, 1 insertion(+) commit e249714571db26cdb1ae8df7ed39971bafa041a7 Author: Rafael J. Wysocki Date: Wed Feb 24 13:55:38 2016 +0100 Revert "ACPI, PCI, irq: remove interrupt count restriction" Revert commit b5bd02695471 (ACPI, PCI, irq: remove interrupt count restriction) that introduced a boot regression on some systems where it caused kmalloc() to be used too early. Link: http://marc.info/?l=linux-acpi&m=145580159209240&w=2 Reported-by: Nalla, Ravikanth Signed-off-by: Rafael J. Wysocki drivers/acpi/pci_link.c | 136 ++++++++++++------------------------------------ 1 file changed, 34 insertions(+), 102 deletions(-) commit 5ec5d10682745d3280a37e8ffee1ddcd37ecfa94 Author: Rafael J. Wysocki Date: Wed Feb 24 13:53:46 2016 +0100 Revert "ACPI / PCI: Simplify acpi_penalize_isa_irq()" Revert commit 0971686954f9 "ACPI / PCI: Simplify acpi_penalize_isa_irq()" that depends on commit b5bd02695471 (ACPI, PCI, irq: remove interrupt count restriction) which introduced a regression and needs to be reverted for this reason. Signed-off-by: Rafael J. Wysocki drivers/acpi/pci_link.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 1d6a821277aaa0cdd666278aaff93298df313d41 Author: Marc Zyngier Date: Mon Feb 15 17:04:04 2016 +0000 arm/arm64: KVM: Feed initialized memory to MMIO accesses On an MMIO access, we always copy the on-stack buffer info the shared "run" structure, even if this is a read access. This ends up leaking up to 8 bytes of uninitialized memory into userspace, depending on the size of the access. An obvious fix for this one is to only perform the copy if this is an actual write. Reviewed-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm/kvm/mmio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9ef2d8be55652804205a34dcbfec78b933c0ea30 Author: Valentin Rothberg Date: Wed Feb 24 09:40:22 2016 +0100 arc: SMP: CONFIG_ARC_IPI_DBG cleanup Previous Commit ("ARC: SMP: No need for CONFIG_ARC_IPI_DBG") removed the Kconfig option ARC_IPI_DBG. Remove the last reference on this option. Signed-off-by: Valentin Rothberg Signed-off-by: Vineet Gupta arch/arc/kernel/mcip.c | 5 ----- 1 file changed, 5 deletions(-) commit 79318452cb36678bde20d384dc3eab537d930d3e Author: Carlo Caione Date: Tue Feb 23 10:43:11 2016 +0100 MAINTAINERS: Extend info, add wiki and ml for meson arch Update the maintainers info with wiki and mailing list for the meson platform. Fix a wrong file attribution and add maintainership for the generic meson platforms. Signed-off-by: Carlo Caione Signed-off-by: Olof Johansson MAINTAINERS | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 9fa6c2b1aa7f6b05cd96a0d6bec499c9aef45479 Merge: a9e5547 3f315c5 Author: Olof Johansson Date: Wed Feb 24 00:10:11 2016 -0800 Merge tag 'omap-for-v4.5/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Two omap fixes for omaps against v4.5-rc5: - Yet another fix for n900 onenand to avoid corruption. This time to fix the issue of mounting onenand back and forth between the original maemo kernel and mainline Linux kernel. And it also seems there will be two more fixes coming via the MTD tree as issues were discovered also in the onenand driver during testing. - Revert tps65217 regulator clean up as it breaks MMC for am335x variants. The proper way to clean this up is just to rename the tps65217.dtsi file into tps65217-am335x.dtsi as a similar setup is used on many am335x boards. * tag 'omap-for-v4.5/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption Revert "regulator: tps65217: remove tps65217.dtsi file" Signed-off-by: Olof Johansson commit a9e5547b1908ee282b875470a08c96acf17656d6 Author: Antoine Tenart Date: Mon Feb 22 14:22:30 2016 +0100 MAINTAINERS: alpine: add a new maintainer and update the entry Add myself as a co-maintainer for the Alpine support. Also update the entry to take in account Alpine ARM64 boards, Alpine ARM device trees and Alpine-specific drivers. Signed-off-by: Antoine Tenart Acked-by: Tsahee Zidenberg Signed-off-by: Olof Johansson MAINTAINERS | 4 ++++ 1 file changed, 4 insertions(+) commit 5e45a2589d24573c564630990c88ac93659f8fe4 Author: Ludovic Desroches Date: Fri Feb 19 20:21:17 2016 +0100 ARM: at91/dt: fix typo in sama5d2 pinmux descriptions PIN_PA15 macro has the same value as PIN_PA14 so we were overriding PA14 mux/configuration. Signed-off-by: Ludovic Desroches Reported-by: Cyrille Pitchen Fixes: 7f16cb676c00 ("ARM: at91/dt: add sama5d2 pinmux") Cc: # v4.4+ Signed-off-by: Alexandre Belloni Signed-off-by: Olof Johansson arch/arm/boot/dts/sama5d2-pinfunc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b223c9f59389a7802c47ea4c6889dccb2f1a1a60 Merge: e3acd74 f5d0ca2 Author: Olof Johansson Date: Wed Feb 24 00:05:58 2016 -0800 Merge tag 'imx-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes The i.MX fixes for v4.5: - Drop the bogus interrupt-parent from i.MX6 CAAM node, which leads to the CAAM IRQs not getting unmasked at the GPC level. * tag 'imx-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx6: remove bogus interrupt-parent from CAAM node Signed-off-by: Olof Johansson commit e3acd74f9268a713b08d5461567cd8bfe47054f7 Merge: 74a46ec cf26f11 Author: Olof Johansson Date: Wed Feb 24 00:05:11 2016 -0800 Merge tag 'omap-for-v4.5/fixes-rc3-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Few fixes for omaps against v4.5-rc3: - Improve omap_device error message to tell driver writers what is wrong after commit 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind"). There will be also a handful of driver related fixes also queued separately. But adding this error message makes it easy to fix any omap_device using drivers suffering from this issue so I think it's important to have. - Also related to commit 5de85b9d57ab discussion, let's fix a bug where disabling PM runtime via sysfs will also cause the hardware state to be different from PM runtime state. - Fix audio clocks for beagle-x15. - Use wakeup-source instead of gpio-key,wakeup for the new entries that sneaked in during the merge window. - Fix a legacy booting vs device tree based booting regression for n900 where the legacy user space expects to have the device revision available in /proc/atags also when booted with device tree. * tag 'omap-for-v4.5/fixes-rc3-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Fix omap_device for module reload on PM runtime forbid ARM: OMAP2+: Improve omap_device error for driver writers ARM: DTS: am57xx-beagle-x15: Select SYS_CLK2 for audio clocks ARM: dts: am335x/am57xx: replace gpio-key,wakeup with wakeup-source property ARM: OMAP2+: Set system_rev from ATAGS for n900 Signed-off-by: Olof Johansson commit 74a46ec6fbc1b410f3cbf897d3802c0bf554ea5a Merge: 81f70ba 44361a2 Author: Olof Johansson Date: Tue Feb 23 23:59:29 2016 -0800 Merge tag 'mvebu-fixes-4.5-2' of git://git.infradead.org/linux-mvebu into fixes mvebu fixes for 4.5 (part 2) - Fix the missing mtd flash on linkstation lswtgl - Use unique machine name for the kirkwood ds112 (for Debian flash-kernel tool) * tag 'mvebu-fixes-4.5-2' of git://git.infradead.org/linux-mvebu: ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl ARM: dts: kirkwood: use unique machine name for ds112 Signed-off-by: Olof Johansson commit 04d1d281dcfe683a53cddfab8371fc8bb302b069 Author: Andy Lutomirski Date: Tue Feb 23 13:19:29 2016 -0800 x86/entry/32: Add an ASM_CLAC to entry_SYSENTER_32 Both before and after 5f310f739b4c ("x86/entry/32: Re-implement SYSENTER using the new C path"), we relied on a uaccess very early in the SYSENTER path to clear AC. After that change, though, we can potentially make it all the way into C code with AC set, which enlarges the attack surface for SMAP bypass by doing SYSENTER with AC set. Strengthen the SMAP protection by addding the missing ASM_CLAC right at the beginning. Signed-off-by: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/3e36be110724896e32a4a1fe73bacb349d3cba94.1456262295.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/entry/entry_32.S | 1 + 1 file changed, 1 insertion(+) commit d73b73f5626ac0b131b31b7b9457e19201bc570b Author: Vineet Gupta Date: Fri Feb 19 08:18:11 2016 +0530 ARC: SMP: No need for CONFIG_ARC_IPI_DBG This was more relevant during SMP bringup. The warning for bogus msg better be visible always. Signed-off-by: Vineet Gupta arch/arc/Kconfig | 8 -------- arch/arc/kernel/mcip.c | 9 +-------- arch/arc/kernel/smp.c | 3 --- 3 files changed, 1 insertion(+), 19 deletions(-) commit 3dea30ca5bef0e013abe857057a952a9d6757fe5 Author: Vineet Gupta Date: Fri Feb 19 07:57:41 2016 +0530 ARCv2: Elide sending new cross core intr if receiver didn't ack prev ARConnect/MCIP IPI sending has a retry-wait loop in case caller had not seen a previous such interrupt. Turns out that it is not needed at all. Linux cross core calling allows coalescing multiple IPIs to same receiver - it is fine as long as there is one. This logic is built into upper layer already, at a higher level of abstraction. ipi_send_msg_one() sets the actual msg payload, but it only calls MCIP IPI sending if msg holder was empty (using atomic-set-new-and-get-old construct). Thus it is unlikely that the retry-wait looping was ever getting exercised at all. Cc: Chuck Jordan Cc: Peter Zijlstra Signed-off-by: Vineet Gupta arch/arc/kernel/mcip.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) commit 9681787930cec7cee77db0a93c747153ef962b8a Author: Vineet Gupta Date: Tue Feb 23 13:35:12 2016 +0530 ARCv2: SMP: Push IPI_IRQ into IPI provider Signed-off-by: Vineet Gupta arch/arc/include/asm/irq.h | 1 - arch/arc/kernel/mcip.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) commit dbcbc7e7cee15058fdb9696b2b38c692680fc413 Author: Vineet Gupta Date: Thu Jan 28 12:48:05 2016 +0530 ARC: [intc-compact] Remove IPI setup from ARCompact port There is no real ARC700 based SMP SoC so remove IPI definition. EZChip's SMP ARC700 is going to use a different intc and IPI provider anyways. Signed-off-by: Vineet Gupta arch/arc/include/asm/irq.h | 1 - arch/arc/kernel/intc-compact.c | 3 --- 2 files changed, 4 deletions(-) commit bb143f814ea488769ca2e79e0b376139cb5f134b Author: Vineet Gupta Date: Tue Feb 23 11:55:16 2016 +0530 ARCv2: SMP: Emulate IPI to self using software triggered interrupt ARConnect/MCIP Inter-Core-Interrupt module can't send interrupt to local core. So use core intc capability to trigger software interrupt to self, using an unsued IRQ #21. This showed up as csd deadlock with LTP trace_sched on a dual core system. This test acts as scheduler fuzzer, triggering all sorts of schedulting activity. Trouble starts with IPI to self, which doesn't get delivered (effectively lost due to H/w capability), but the msg intended to be sent remain enqueued in per-cpu @ipi_data. All subsequent IPIs to this core from other cores get elided due to the IPI coalescing optimization in ipi_send_msg_one() where a pending msg implies an IPI already sent and assumes other core is yet to ack it. After the elided IPI, other core simply goes into csd_lock_wait() but never comes out as this core never sees the interrupt. Fixes STAR 9001008624 Cc: Peter Zijlstra Cc: [4.2] Signed-off-by: Vineet Gupta arch/arc/include/asm/irqflags-arcv2.h | 11 +++++++++++ arch/arc/kernel/entry-arcv2.S | 11 ++++++----- arch/arc/kernel/mcip.c | 15 +++++++++++++++ 3 files changed, 32 insertions(+), 5 deletions(-) commit 7c139db2e579669c3313f92d2dd2256b255fcc07 Author: Andreas Irestål Date: Tue Feb 16 13:56:41 2016 +0100 ASoC: adau17x1: Fix incorrect BCLK ratio definitions Signed-off-by: Andreas Irestål Signed-off-by: Mark Brown sound/soc/codecs/adau17x1.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit da9b9303ed8d1673a89a4bdd85464e33614775e3 Author: Robert Jarzmik Date: Mon Feb 22 23:35:44 2016 +0100 ASoC: wm9713: fix regmap free path In the conversion to regmap, I assumed that the devm_() variant could be used in the soc probe function. As a mater of fact with the current code the regmap is freed twice because of the devm_() call: (mutex_lock) from [] (debugfs_remove_recursive+0x50/0x1d0) (debugfs_remove_recursive) from [] (regmap_debugfs_exit+0x1c/0xd4) (regmap_debugfs_exit) from [] (regmap_exit+0x28/0xc8) (regmap_exit) from [] (release_nodes+0x18c/0x204) (release_nodes) from [] (device_release+0x18/0x90) (device_release) from [] (kobject_release+0x90/0x1bc) (kobject_release) from [] (wm9713_soc_remove+0x1c/0x24) (wm9713_soc_remove) from [] (soc_remove_component+0x50/0x7c) (soc_remove_component) from [] (soc_remove_dai_links+0x118/0x228) (soc_remove_dai_links) from [] (snd_soc_register_card+0x4e4/0xdd4) (snd_soc_register_card) from [] (devm_snd_soc_register_card+0x34/0x70) Fix this by replacing the devm_regmap initialization code with the non devm_() variant. Fixes: 700dadfefc3d ASoC: wm9713: convert to regmap Signed-off-by: Robert Jarzmik Acked-by: Charles Keepax Signed-off-by: Mark Brown sound/soc/codecs/wm9713.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84e54c46b2f440a365a5224f1e5f173a462b7cca Merge: 0ecdcd3 4328daa Author: Linus Torvalds Date: Tue Feb 23 19:03:43 2016 -0800 Merge tag 'dm-4.5-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mike Snitzer: "Fix a 112 byte leak for each IO request that is requeued while DM multipath is handling faults due to path failures. This leak does not happen if blk-mq DM multipath is used. It only occurs if .request_fn DM multipath is stacked ontop of blk-mq paths (e.g. scsi-mq devices)" * tag 'dm-4.5-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths commit 0ecdcd3a520b99287d0573df4feb43bdceb44b87 Merge: 420eb6d 814a3c0 Author: Linus Torvalds Date: Tue Feb 23 18:54:58 2016 -0800 Merge tag 'mmc-v4.5-rc4' of git://git.linaro.org/people/ulf.hansson/mmc Pull MMC fix from Ulf Hansson: "Here's an mmc fix intended for v4.5 rc6. MMC host: - omap_hsmmc: Fix PM regression for deferred probe" * tag 'mmc-v4.5-rc4' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: omap_hsmmc: Fix PM regression with deferred probe for pm_runtime_reinit commit c45442055dfdeb265cc20c9eeaa9fd11a75fbf51 Author: Arnd Bergmann Date: Mon Feb 22 22:58:34 2016 +0100 nvdimm: use 'u64' for pfn flags A recent bugfix changed pfn_t to always be 64-bit wide, but did not change the code in pmem.c, which is now broken on 32-bit architectures as reported by gcc: In file included from ../drivers/nvdimm/pmem.c:28:0: drivers/nvdimm/pmem.c: In function 'pmem_alloc': include/linux/pfn_t.h:15:17: error: large integer implicitly truncated to unsigned type [-Werror=overflow] #define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3)) This changes the intermediate pfn_flags in struct pmem_device to be 64 bit wide as well, so they can store the flags correctly. Signed-off-by: Arnd Bergmann Fixes: db78c22230d0 ("mm: fix pfn_t vs highmem") Signed-off-by: Dan Williams drivers/nvdimm/pmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 93f834df9c2d4e362dfdc4b05daa0a4e18814836 Author: Toshi Kani Date: Sat Feb 20 14:32:24 2016 -0800 devm_memremap: Fix error value when memremap failed devm_memremap() returns an ERR_PTR() value in case of error. However, it returns NULL when memremap() failed. This causes the caller, such as the pmem driver, to proceed and oops later. Change devm_memremap() to return ERR_PTR(-ENXIO) when memremap() failed. Signed-off-by: Toshi Kani Cc: Andrew Morton Cc: Reviewed-by: Ross Zwisler Signed-off-by: Dan Williams kernel/memremap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4577b0665515e0abc7bc72562d6328d179598815 Author: Dan Williams Date: Wed Feb 17 13:08:58 2016 -0800 nfit: update address range scrub commands to the acpi 6.1 format The original format of these commands from the "NVDIMM DSM Interface Example" [1] are superseded by the ACPI 6.1 definition of the "NVDIMM Root Device _DSMs" [2]. [1]: http://pmem.io/documents/NVDIMM_DSM_Interface_Example.pdf [2]: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf "9.20.7 NVDIMM Root Device _DSMs" Changes include: 1/ New 'restart' fields in ars_status, unfortunately these are implemented in the middle of the existing definition so this change is not backwards compatible. The expectation is that shipping platforms will only ever support the ACPI 6.1 definition. 2/ New status values for ars_start ('busy') and ars_status ('overflow'). Cc: Vishal Verma Cc: Linda Knippers Cc: Signed-off-by: Dan Williams drivers/acpi/nfit.c | 6 +++--- drivers/nvdimm/bus.c | 12 ++++++------ include/linux/libnvdimm.h | 2 +- include/uapi/linux/ndctl.h | 11 +++++++++-- 4 files changed, 19 insertions(+), 12 deletions(-) commit 351228eaa2aa32e5b3f22747246199807488f5f2 Merge: 81f70ba dbb0c7c Author: Rafael J. Wysocki Date: Wed Feb 24 02:13:43 2016 +0100 Merge branch 'for-rafael' of https://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq into pm-devfreq Pull a devfreq fix for v4.5 from MyungJoo Ham. * 'for-rafael' of https://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq: PM / devfreq: tegra: Set freq in rate callback commit 420eb6d7efc4591ef1968106cdaa980ea06fe00e Merge: de9e478 9fd4b9f Author: Linus Torvalds Date: Tue Feb 23 16:39:21 2016 -0800 Merge tag 'nfs-for-4.5-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Stable bugfixes: - Fix nfs_size_to_loff_t - NFSv4: Fix a dentry leak on alias use Other bugfixes: - Don't schedule a layoutreturn if the layout segment can be freed immediately. - Always set NFS_LAYOUT_RETURN_REQUESTED with lo->plh_return_iomode - rpcrdma_bc_receive_call() should init rq_private_buf.len - fix stateid handling for the NFS v4.2 operations - pnfs/blocklayout: fix a memeory leak when using,vmalloc_to_page - fix panic in gss_pipe_downcall() in fips mode - Fix a race between layoutget and pnfs_destroy_layout - Fix a race between layoutget and bulk recalls" * tag 'nfs-for-4.5-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv4.x/pnfs: Fix a race between layoutget and bulk recalls NFSv4.x/pnfs: Fix a race between layoutget and pnfs_destroy_layout auth_gss: fix panic in gss_pipe_downcall() in fips mode pnfs/blocklayout: fix a memeory leak when using,vmalloc_to_page nfs4: fix stateid handling for the NFS v4.2 operations NFSv4: Fix a dentry leak on alias use xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len pNFS: Always set NFS_LAYOUT_RETURN_REQUESTED with lo->plh_return_iomode pNFS: Fix pnfs_mark_matching_lsegs_return() nfs: fix nfs_size_to_loff_t commit de9e478b9d49f3a0214310d921450cf5bb4a21e6 Author: Linus Torvalds Date: Tue Feb 23 14:58:52 2016 -0800 x86: fix SMAP in 32-bit environments In commit 11f1a4b9755f ("x86: reorganize SMAP handling in user space accesses") I changed how the stac/clac instructions were generated around the user space accesses, which then made it possible to do batched accesses efficiently for user string copies etc. However, in doing so, I completely spaced out, and didn't even think about the 32-bit case. And nobody really even seemed to notice, because SMAP doesn't even exist until modern Skylake processors, and you'd have to be crazy to run 32-bit kernels on a modern CPU. Which brings us to Andy Lutomirski. He actually tested the 32-bit kernel on new hardware, and noticed that it doesn't work. My bad. The trivial fix is to add the required uaccess begin/end markers around the raw accesses in . I feel a bit bad about this patch, just because that header file really should be cleaned up to avoid all the duplicated code in it, and this commit just expands on the problem. But this just fixes the bug without any bigger cleanup surgery. Reported-and-tested-by: Andy Lutomirski Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess_32.h | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit fbb0fa8b48892a3db8f5b89fb591c741fbd2fe7a Author: Michael Chan Date: Mon Feb 22 02:10:26 2016 -0500 bnxt_en: Fix zero padding of tx push data. The arithmetic to zero pad the last 64-bit word in the push buffer is not correct. 1. It should be pdata + length to get to the end. 2. 'pdata' is void pointer and passing it to PTR_ALIGN() will cast the aligned pointer to void. Pass 'end' which is u64 pointer to PTR_ALIGN() instead so that the aligned pointer - 1 is the last 64-bit pointer to data. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5146d1f151122e868e594c7b45115d64825aee5f Author: Bernie Harris Date: Mon Feb 22 12:58:05 2016 +1300 tunnel: Clear IPCB(skb)->opt before dst_link_failure called IPCB may contain data from previous layers (in the observed case the qdisc layer). In the observed scenario, the data was misinterpreted as ip header options, which later caused the ihl to be set to an invalid value (<5). This resulted in an infinite loop in the mips implementation of ip_fast_csum. This patch clears IPCB(skb)->opt before dst_link_failure can be called for various types of tunnels. This change only applies to encapsulated ipv4 packets. The code introduced in 11c21a30 which clears all of IPCB has been removed to be consistent with these changes, and instead the opt field is cleared unconditionally in ip_tunnel_xmit. The change in ip_tunnel_xmit applies to SIT, GRE, and IPIP tunnels. The relevant vti, l2tp, and pptp functions already contain similar code for clearing the IPCB. Signed-off-by: Bernie Harris Signed-off-by: David S. Miller net/ipv4/ip_tunnel.c | 3 ++- net/ipv4/udp_tunnel.c | 2 ++ net/ipv6/ip6_gre.c | 2 ++ net/ipv6/ip6_tunnel.c | 2 ++ 4 files changed, 8 insertions(+), 1 deletion(-) commit 9bdfb3b79e61c60e1a3e2dc05ad164528afa6b8a Author: Konstantin Khlebnikov Date: Sun Feb 21 10:12:39 2016 +0300 tcp: convert cached rtt from usec to jiffies when feeding initial rto Currently it's converted into msecs, thus HZ=1000 intact. Signed-off-by: Konstantin Khlebnikov Fixes: 740b0f1841f6 ("tcp: switch rtt estimations to usec resolution") Signed-off-by: David S. Miller net/ipv4/tcp_metrics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fb5eb24cdd5cdb83be77d3e4b2f16e92e06bd9e9 Author: Patrik Halfar Date: Sat Feb 20 18:49:40 2016 +0100 Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card (rev3) to qmi_wwan New revison of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new idProduct Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x413c Dell Computer Corp. idProduct 0x81b3 bcdDevice 0.06 iManufacturer 1 Sierra Wireless, Incorporated iProduct 2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband Card iSerial 3 bNumConfigurations 2 Signed-off-by: Patrik Halfar Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 905e36ae172c83a30894a3adefab7d4f850fcf54 Author: Matti Gottlieb Date: Sun Feb 14 17:05:39 2016 +0200 iwlwifi: mvm: Fix paging memory leak If the opmode is stopped and started again we did not free the paging buffers. Fix that. In addition when freeing the firmware's paging download buffer, set the pointer to NULL. Signed-off-by: Matti Gottlieb Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 +++ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) commit 236cf17c2502007a9d2dda3c39fb0d9a6bd03cc2 Author: Mark Rutland Date: Tue Feb 16 14:47:31 2016 +0000 KVM: arm/arm64: vgic: Ensure bitmaps are long enough When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of bits we need by 8 to figure out how many bytes to allocate. However, bitmap elements are always accessed as unsigned longs, and if we didn't happen to allocate a size such that size % sizeof(unsigned long) == 0, bitmap accesses may go past the end of the allocation. When using KASAN (which does byte-granular access checks), this results in a continuous stream of BUGs whenever these bitmaps are accessed: ============================================================================= BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730 INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080 INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null) Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17 Hardware name: ARM Juno development board (r1) (DT) Call trace: [] dump_backtrace+0x0/0x280 [] show_stack+0x14/0x20 [] dump_stack+0x100/0x188 [] print_trailer+0xfc/0x168 [] object_err+0x3c/0x50 [] kasan_report_error+0x244/0x558 [] __asan_report_load8_noabort+0x48/0x50 [] __bitmap_or+0xc0/0xc8 [] kvm_vgic_flush_hwstate+0x1bc/0x650 [] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60 [] kvm_vcpu_ioctl+0x474/0xa68 [] do_vfs_ioctl+0x5b8/0xcb0 [] SyS_ioctl+0x8c/0xa0 [] el0_svc_naked+0x24/0x28 Memory state around the buggy address: ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Fix the issue by always allocating a multiple of sizeof(unsigned long), as we do elsewhere in the vgic code. Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation") Cc: stable@vger.kernel.org Acked-by: Marc Zyngier Acked-by: Christoffer Dall Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier virt/kvm/arm/vgic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b7052cd7bcf3c1478796e93e3dff2b44c9e82943 Author: Stefan Hajnoczi Date: Thu Feb 18 18:55:54 2016 +0000 sunrpc/cache: fix off-by-one in qword_get() The qword_get() function NUL-terminates its output buffer. If the input string is in hex format \xXXXX... and the same length as the output buffer, there is an off-by-one: int qword_get(char **bpp, char *dest, int bufsize) { ... while (len < bufsize) { ... *dest++ = (h << 4) | l; len++; } ... *dest = '\0'; return len; } This patch ensures the NUL terminator doesn't fall outside the output buffer. Signed-off-by: Stefan Hajnoczi Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields net/sunrpc/cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b86071528f3261ab592fad5b9b1a02aea3dcabf3 Author: Arend van Spriel Date: Mon Feb 15 14:35:53 2016 +0100 cfg80211: stop critical protocol session upon disconnect event When user-space has started a critical protocol session and a disconnect event occurs, the rdev::crit_prot_nlportid remains set. This caused a subsequent NL80211_CMD_CRIT_PROTO_START to fail (-EBUSY). Fix this by clearing the rdev attribute and call .crit_proto_stop() callback upon disconnect event. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Arend van Spriel Signed-off-by: Johannes Berg net/wireless/sme.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 5e950a78bf5b18ded277a27aed0bcdbe7c1b868a Author: Ola Olsson Date: Thu Feb 11 01:00:22 2016 +0100 nl80211: Zero out the connection keys memory when freeing them. The connection keys are zeroed out in all other cases except this one. Let's fix the last one as well. Signed-off-by: Ola Olsson Reviewed-by: Julian Calaby Signed-off-by: Johannes Berg net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a36b930e6ed4702c866dc74a5ad07318a57c688 Author: Felix Fietkau Date: Thu Feb 18 19:49:18 2016 +0100 mac80211: minstrel_ht: set default tx aggregation timeout to 0 The value 5000 was put here with the addition of the timeout field to ieee80211_start_tx_ba_session. It was originally added in mac80211 to save resources for drivers like iwlwifi, which only supports a limited number of concurrent aggregation sessions. Since iwlwifi does not use minstrel_ht and other drivers don't need this, 0 is a better default - especially since there have been recent reports of aggregation setup related issues reproduced with ath9k. This should improve stability without causing any adverse effects. Cc: stable@vger.kernel.org Acked-by: Avery Pennarun Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg net/mac80211/rc80211_minstrel_ht.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e5177c1919bdc7651b5056f35409d0b4d728841 Author: Alexey Brodkin Date: Sat Feb 20 16:04:26 2016 +0300 arc: get rid of DEVTMPFS dependency on INITRAMFS_SOURCE Even though DEVTMPFS is required when our pre-built initramfs is used it is not the case in general. It is perfectly possible to use initramfs with device nodes already populated or there could be other usages, see discussion below for more detials: http://thread.gmane.org/gmane.comp.embedded.openwrt.devel/37819/focus=37821 This change removes mentioned dependency from arch/arc/Kconfig updating instead those defconfigs that are usually used with this kind of pre-build initramfs. And while at it all touched defconfigs were regenerated via savedefconfig and some options were removed: * USB is selected by other options implicitly * VGA_CONSOLE is disableb for ARC since 031e29b5877f31676739dc2f847d04c2c0732034 * EXT3_FS automatically selects EXT4_FS * MTDxxx and JFFS2_FS make no sense for AXS because AXS NAND controller is not upstreamed * NET_OSCI_LAN is not in upstream as well * ARCPGU_xxx options make no sense because ARC PGU is not yet in upstream and when it gets there all config options would be taken from devicetree Signed-off-by: Alexey Brodkin Signed-off-by: Vineet Gupta arch/arc/Kconfig | 2 -- arch/arc/configs/axs101_defconfig | 4 +--- arch/arc/configs/axs103_defconfig | 10 +--------- arch/arc/configs/axs103_smp_defconfig | 10 +--------- arch/arc/configs/nsim_700_defconfig | 5 ++--- arch/arc/configs/nsim_hs_defconfig | 3 +-- arch/arc/configs/nsim_hs_smp_defconfig | 6 ++---- arch/arc/configs/nsimosci_defconfig | 2 +- arch/arc/configs/nsimosci_hs_defconfig | 3 +-- arch/arc/configs/nsimosci_hs_smp_defconfig | 12 ++---------- arch/arc/configs/tb10x_defconfig | 18 ++++++------------ 11 files changed, 18 insertions(+), 57 deletions(-) commit 3b2435192fe917a826c91c8b34032428d6efdfc7 Author: Felipe Balbi Date: Fri Feb 19 11:04:55 2016 +0200 MAINTAINERS: drop OMAP USB and MUSB maintainership Now that I have switched to another company, I won't be able to help by maintaining OMAP USB Support and/or the MUSB driver. OMAP USB Support is left Orphaned. MUSB's new maintainer will be Bin Liu from Texas Instruments who has accepted to take over starting with v4.6. Cc: Bin Liu Acked-by: Greg Kroah-Hartman Signed-off-by: Felipe Balbi MAINTAINERS | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 4c2ba0c67394514f3f75c660c9f5d02e66a7efd4 Author: Cristian Birsan Date: Fri Feb 19 10:11:56 2016 +0200 usb: musb: fix DMA for host mode Commit ac33cdb16681 ("usb: musb: Remove ifdefs for musb_host_rx in musb_host.c part5") introduces a problem setting DMA host mode. The musb_advance_schedule() is called immediately after receiving an endpoint RX interrupt without waiting for the DMA transfer to complete. As a consequence when the dma complete interrupt arrives the in_qh member of hw_ep is already null an the musb_host_rx() exits on !urb error case. Fix the done condition that advances the musb schedule. Signed-off-by: Cristian Birsan Signed-off-by: Joshua Henderson Tested-by: Ladislav Michl Signed-off-by: Felipe Balbi drivers/usb/musb/musb_host.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 8de4b3a3fcbc18e0aa62e9defe5c08821351be12 Author: Ivan T. Ivanov Date: Fri Feb 5 19:17:09 2016 +0000 usb: phy: msm: Trigger USB state detection work in DRD mode When working in Dual Role Device mode, USB state machine is not kicked, when host or gadget drivers are loaded. Fix this be explicitly triggering state detection on client driver load. Issue is that if the board is booted without micro usb cable and usb device attached, kernel fails to populate the usb host and device. The reason for this is that the state machine worker logic only checks for USB_DR_MODE_PERIPHERAL and USB_DR_MODE_HOST modes to run worker thread. However if the phy is configured in OTG mode it would fail to run the state machine, resulting in failure to detect for very first time. This patch fixes the issue by removing the explicit checks. Issue is noticed on Qualcomm Dragon board DB410C. [srinivas.kandagatla@linaro.org: Added more details to log] Signed-off-by: Ivan T. Ivanov Signed-off-by: Srinivas Kandagatla Signed-off-by: Felipe Balbi drivers/usb/phy/phy-msm-usb.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) commit ca1c11894274c1687417945c034d6b8aee49f625 Author: Simon Appleby Date: Tue Feb 9 09:19:46 2016 +0000 usb: gadget: net2280: fix endpoint max packet for super speed connections This patch fixes the register offset used for super-speed connection's max packet size. Without it using the 338x series of devices in enhanced mode will only allow full or high speed operation to function correctly. Signed-off-by: Simon Appleby Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/net2280.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 7b0a271d5cadf5fbb5a9c7cb868776af2a2c248c Author: Marek Szyprowski Date: Thu Feb 18 08:59:26 2016 +0100 usb: gadget: gadgetfs: unregister gadget only if it got successfully registered Gadgetfs driver called usb_gadget_unregister_driver unconditionally, even if it didn't register it earlier due to other failures. This patch fixes this. Reported-by: Vegard Nossum Signed-off-by: Marek Szyprowski Tested-by: Vegard Nossum Signed-off-by: Felipe Balbi drivers/usb/gadget/legacy/inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 31b994a4986dcdd664c597afcef2c0918763019a Author: Marek Szyprowski Date: Mon Feb 8 13:42:14 2016 +0100 usb: gadget: remove driver from pending list on probe error Retry gadget probe only if the probe result is -EPROBE_DEFER, not on every probe error. Signed-off-by: Marek Szyprowski Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/udc-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dd71a17b1193dd4a4c35ecd0ba227aac3d110836 Author: Bryan O'Donoghue Date: Tue Feb 23 01:29:58 2016 +0000 x86/platform/intel/quark: Change the kernel's IMR lock bit to false Currently when setting up an IMR around the kernel's .text section we lock that IMR, preventing further modification. While superficially this appears to be the right thing to do, in fact this doesn't account for a legitimate change in the memory map such as when executing a new kernel via kexec. In such a scenario a second kernel can have a different size and location to it's predecessor and can view some of the memory occupied by it's predecessor as legitimately usable DMA RAM. If this RAM were then subsequently allocated to DMA agents within the system it could conceivably trigger an IMR violation. This patch fixes the this potential situation by keeping the kernel's .text section IMR lock bit false by default. Suggested-by: Ingo Molnar Reported-by: Andy Shevchenko Signed-off-by: Bryan O'Donoghue Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: boon.leong.ong@intel.com Cc: paul.gortmaker@windriver.com Link: http://lkml.kernel.org/r/1456190999-12685-2-git-send-email-pure.logic@nexus-software.ie Signed-off-by: Ingo Molnar arch/x86/platform/intel-quark/imr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dbb0c7c430ddbe4299f3580baec0e2503f6f5a93 Author: Tomeu Vizoso Date: Thu Jan 21 08:52:26 2016 +0100 PM / devfreq: tegra: Set freq in rate callback As per the documentation of the devfreq_dev_profile.target callback, set the freq argument to the new frequency before returning. This caused endless messages like this after recent changes in the core: devfreq 6000c800.actmon: Couldn't update frequency transition information. Signed-off-by: Tomeu Vizoso Reported-by: Tyler Baker Tested-by: Thierry Reding Acked-by: Thierry Reding Signed-off-by: MyungJoo Ham drivers/devfreq/tegra-devfreq.c | 2 ++ 1 file changed, 2 insertions(+) commit 9fd4b9fc7695a4da1363a0b439853f88fb6a034f Author: Trond Myklebust Date: Mon Feb 22 17:46:34 2016 -0500 NFSv4.x/pnfs: Fix a race between layoutget and bulk recalls Replace another case where the layout 'plh_block_lgets' can trigger infinite loops in send_layoutget(). Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit 2454dfea0aef8a883d4302c38124edb373d47a25 Author: Trond Myklebust Date: Mon Feb 22 17:34:59 2016 -0500 NFSv4.x/pnfs: Fix a race between layoutget and pnfs_destroy_layout If the server reboots while there is a layoutget outstanding, then the call to pnfs_choose_layoutget_stateid() will fail with an EAGAIN error, which causes an infinite loop in send_layoutget(). The reason why we never break out of the loop is that the layout 'plh_block_lgets' field is never cleared. Fix is to replace plh_block_lgets with NFS_LAYOUT_INVALID_STID, which can be reset after a new layoutget. Fixes: ab7d763e477c5 ("pNFS: Ensure nfs4_layoutget_prepare returns...") Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) commit 4de8ebeff8ddefaceeb7fc6a9b1a514fc9624509 Merge: 692b8c6 6e22c83 Author: Linus Torvalds Date: Mon Feb 22 14:09:18 2016 -0800 Merge tag 'trace-fixes-v4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Two more small fixes. One is by Yang Shi who added a READ_ONCE_NOCHECK() to the scan of the stack made by the stack tracer. As the stack tracer scans the entire kernel stack, KASAN triggers seeing it as a "stack out of bounds" error. As the scan is looking at the contents of the stack from parent functions. The NOCHECK() tells KASAN that this is done on purpose, and is not some kind of stack overflow. The second fix is to the ftrace selftests, to retrieve the PID of executed commands from the shell with '$!' and not by parsing 'jobs'" * tag 'trace-fixes-v4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing, kasan: Silence Kasan warning in check_stack of stack_tracer ftracetest: Fix instance test to use proper shell command for pids commit a0d54c3899aaeb047969d9479263c6bcf385c331 Author: Tero Kristo Date: Sat Feb 20 13:12:57 2016 +0200 clk: ti: omap3+: dpll: use non-locking version of clk_get_rate As the code in this file is being executed within irq context in some cases, we must avoid the clk_get_rate which uses mutex internally. Switch the code to use clk_hw_get_rate instead which is non-locking. This fixes an issue where PM runtime will hang the system if enabled with a serial console before a suspend-resume cycle. Signed-off-by: Tero Kristo Tested-by: Tony Lindgren Fixes: a53ad8ef3dcc ("clk: ti: Convert to clk_hw based provider APIs") Signed-off-by: Stephen Boyd drivers/clk/ti/dpll3xxx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 692b8c663cbaf892d10106fbca543b4bbc3202ad Merge: dea08e6 4d8c8bd Author: Linus Torvalds Date: Mon Feb 22 13:57:01 2016 -0800 Merge tag 'for-linus-4.5-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen bug fixes from David Vrabel: - Two scsiback fixes (resource leak and spurious warning). - Fix DMA mapping of compound pages on arm/arm64. - Fix some pciback regressions in MSI-X handling. - Fix a pcifront crash due to some uninitialize state. * tag 'for-linus-4.5-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. xen/pcifront: Report the errors better. xen/pciback: Save the number of MSI-X entries to be copied later. xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY xen: fix potential integer overflow in queue_reply xen/arm: correctly handle DMA mapping of compound pages xen/scsiback: avoid warnings when adding multiple LUNs to a domain xen/scsiback: correct frontend counting commit dea08e604408d0303e2332896c5fdd8c1f7d79a2 Merge: 5c102d0 d856626 Author: Linus Torvalds Date: Mon Feb 22 12:18:07 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Looks like a lot, but mostly driver fixes scattered all over as usual. Of note: 1) Add conditional sched in nf conntrack in cleanup to avoid NMI watchdogs. From Florian Westphal. 2) Fix deadlock in nfnetlink cttimeout, also from Floarian. 3) Fix handling of slaves in bonding ARP monitor validation, from Jay Vosburgh. 4) Callers of ip_cmsg_send() are responsible for freeing IP options, some were not doing so. Fix from Eric Dumazet. 5) Fix per-cpu bugs in mvneta driver, from Gregory CLEMENT. 6) Fix vlan handling in mv88e6xxx DSA driver, from Vivien Didelot. 7) bcm7xxx PHY driver bug fixes from Florian Fainelli. 8) Avoid unaligned accesses to protocol headers wrt. GRE, from Alexander Duyck. 9) SKB leaks and other problems in arc_emac driver, from Alexander Kochetkov. 10) tcp_v4_inbound_md5_hash() releases listener socket instead of request socket on error path, oops. Fix from Eric Dumazet. 11) Missing socket release in pppoe_rcv_core() that seems to have existed basically forever. From Guillaume Nault. 12) Missing slave_dev unregister in dsa_slave_create() error path, from Florian Fainelli. 13) crypto_alloc_hash() never returns NULL, fix return value check in __tcp_alloc_md5sig_pool. From Insu Yun. 14) Properly expire exception route entries in ipv4, from Xin Long. 15) Fix races in tcp/dccp listener socket dismantle, from Eric Dumazet. 16) Don't set IFF_TX_SKB_SHARING in vxlan, geneve, or GRE, it's not legal. These drivers modify the SKB on transmit. From Jiri Benc. 17) Fix regression in the initialziation of netdev->tx_queue_len. From Phil Sutter. 18) Missing unlock in tipc_nl_add_bc_link() error path, from Insu Yun. 19) SCTP port hash sizing does not properly ensure that table is a power of two in size. From Neil Horman. 20) Fix initializing of software copy of MAC address in fmvj18x_cs driver, from Ken Kawasaki" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (129 commits) bnx2x: Fix 84833 phy command handler bnx2x: Fix led setting for 84858 phy. bnx2x: Correct 84858 PHY fw version bnx2x: Fix 84833 RX CRC bnx2x: Fix link-forcing for KR2 net: ethernet: davicom: fix devicetree irq resource fmvj18x_cs: fix incorrect indexing of dev->dev_addr[] when copying the MAC address Driver: Vmxnet3: Update Rx ring 2 max size net: netcp: rework the code for get/set sw_data in dma desc soc: ti: knav_dma: rename pad in struct knav_dma_desc to sw_data net: ti: netcp: restore get/set_pad_info() functionality MAINTAINERS: Drop myself as xen netback maintainer sctp: Fix port hash table size computation can: ems_usb: Fix possible tx overflow Bluetooth: hci_core: Avoid mixing up req_complete and req_complete_skb net: bcmgenet: Fix internal PHY link state af_unix: Don't use continue to re-execute unix_stream_read_generic loop unix_diag: fix incorrect sign extension in unix_lookup_by_ino bnxt_en: Failure to update PHY is not fatal condition. bnxt_en: Remove unnecessary call to update PHY settings. ... commit 5c102d0eca3c41b10ccc1525cbb1eba7fd6efd7c Merge: a16152c 000e094 Author: Linus Torvalds Date: Mon Feb 22 12:12:46 2016 -0800 Merge tag 'hwmon-for-linus-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Two fixes headed for stable: - Remove an unnecessary speed_index lookup for thermal hook in the gpio-fan driver. The unnecessary speed lookup can hog the system. - Handle negative conversion values correctly in the ads1015 driver" * tag 'hwmon-for-linus-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook hwmon: (ads1015) Handle negative conversion values correctly commit a16152c897d74abcca15c120c746264ac4b3bfd1 Merge: 7ee302f c2bab61 Author: Linus Torvalds Date: Mon Feb 22 12:04:11 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "One ocrdma fix: - The new CQ API support was added to ocrdma, but they got the arming logic wrong, so without this, transfers eventually fail when they fail to arm the interrupt properly under load Two related fixes for mlx4: - When we added the 64bit extended counters support to the core IB code, they forgot to update the RoCE side of the mlx4 driver (the IB side they properly updated). I debated whether or not to include these patches as they could be considered feature enablement patches, but the existing code will blindy copy the 32bit counters, whether any counters were requested at all (a bug). These two patches make it (a) check to see that counters were requested and (b) copy the right counters (the 64bit support is new, the 32bit is not). For that reason I went ahead and took them" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/mlx4: Add support for the port info class for RoCE ports IB/mlx4: Add support for extended counters over RoCE ports RDMA/ocrdma: Fix arm logic to align with new cq API commit 7ee302f6f770712a54060928ee3390f6572655bc Merge: 81f70ba 1a1503c Author: Linus Torvalds Date: Mon Feb 22 11:55:18 2016 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Some bugfixes from I2C for you: A fix for a RuntimePM regression with OMAP, a fix to enable TCO for Lewisburg platforms, and a typo fix while we are here" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: i801: Adding Intel Lewisburg support for iTCO i2c: uniphier: fix typos in error messages i2c: omap: Fix PM regression with deferred probe for pm_runtime_reinit commit 253baffdcefba73011e6d2102e69e0b86547836f Merge: bf5b1f3 8f31852 Author: Thomas Gleixner Date: Mon Feb 22 19:31:44 2016 +0100 Merge tag 'gic-fixes-4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull GIC fixes for 4.5-rc5 from Marc Zyngier: - EOI handling for LPIs when GICv3 is in EOImode==1 - Another fallout from changing page size while allocating ITS tables - Missing memory barrier in the 32bit GICv3 code commit 3f315c5b850fa7aff73f50de8e316b98f611a32b Author: Ivaylo Dimitrov Date: Fri Feb 5 16:37:08 2016 +0200 ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption Commit e7b11dc7b77b ("ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption") partially fixed onenand configuration when GPMC module is reset. Finish the job by also providing the correct values in ONENAND_REG_SYS_CFG1 register. Fixes: e7b11dc7b77b ("ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption") Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Ivaylo Dimitrov Tested-by: Aaro Koskinen Signed-off-by: Tony Lindgren arch/arm/mach-omap2/gpmc-onenand.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9b18572e83bfd5378b3fcff3acf123f7bddf558a Author: Mika Kuoppala Date: Thu Feb 18 17:58:09 2016 +0200 drm/i915/gen9: Verify and enforce dc6 state writes It has been observed that sometimes disabling the dc6 fails and dc6 state pops back up, brief moment after disabling. This has to be dmc save/restore timing issue or other bug in the way dc states are handled. Try to work around this issue as we don't have firmware fix yet available. Verify that the value we wrote for the dmc sticks, and also enforce it by rewriting it, if it didn't. v2: Zero rereads on rewrite for extra paranoia (Imre) Testcase: kms_flip/basic-flip-vs-dpms References: https://bugs.freedesktop.org/show_bug.cgi?id=93768 Cc: Patrik Jakobsson Cc: Rodrigo Vivi Cc: Imre Deak Signed-off-by: Mika Kuoppala Reviewed-by: Imre Deak Signed-off-by: Imre Deak Link: http://patchwork.freedesktop.org/patch/msgid/1455811089-27884-1-git-send-email-mika.kuoppala@intel.com (cherry picked from commit 779cb5d3ddd72950ec726f86e38f7575c7fbdd4c) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_runtime_pm.c | 41 +++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) commit 9b6f20984c5402af06e13cde64b5fe7c31853d1a Author: Patrik Jakobsson Date: Thu Feb 18 17:21:11 2016 +0200 drm/i915/gen9: Check for DC state mismatch The DMC can incorrectly run off and allow DC states on it's own. We don't know the root-cause for this yet but this patch makes it more visible. Reviewed-by: Mika Kuoppala Signed-off-by: Patrik Jakobsson Signed-off-by: Imre Deak Link: http://patchwork.freedesktop.org/patch/msgid/1455808874-22089-2-git-send-email-mika.kuoppala@intel.com (cherry picked from commit 832dba889e27487c3087149f1039acc3feb89003) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.h | 1 + drivers/gpu/drm/i915/intel_csr.c | 2 ++ drivers/gpu/drm/i915/intel_runtime_pm.c | 8 ++++++++ 3 files changed, 11 insertions(+) commit 39d4275058baf53e89203407bf3841ff2c74fa32 Author: Alex Deucher Date: Fri Feb 19 18:05:10 2016 -0500 drm/radeon/pm: adjust display configuration after powerstate set_power_state defaults to no displays, so we need to update the display configuration after setting up the powerstate on the first call. In most cases this is not an issue since ends up getting called multiple times at any given modeset and the proper order is achieved in the display changed handling at the top of the function. Reviewed-by: Christian König Acked-by: Jordan Lazare Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_pm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8e7cedc6f7fe762ffe6e348502be34b11fa79298 Author: Alex Deucher Date: Fri Feb 19 17:55:31 2016 -0500 drm/amdgpu/pm: adjust display configuration after powerstate set_power_state defaults to no displays, so we need to update the display configuration after setting up the powerstate on the first call. In most cases this is not an issue since ends up getting called multiple times at any given modeset and the proper order is achieved in the display changed handling at the top of the function. Reviewed-by: Christian König Acked-by: Jordan Lazare Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0c67df48597f0e60eaf7f187ee38f6ccce56561e Author: Alex Deucher Date: Fri Feb 19 15:30:15 2016 -0500 drm/amdgpu/pm: add some checks for PX I.e., doesn't make sense to change power states or check the temperature when the asic is powered off. Reviewed-by: Christian König Acked-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) commit 10f950f640e689336af0a0d587a4b3c26a73cd44 Author: Alex Deucher Date: Fri Feb 19 15:18:45 2016 -0500 drm/amdgpu: fix locking in force performance level Looks like a copy paste typo when we added powerplay support. Reviewed-by: Christian König Acked-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 04ab3b7622a618ea081d17427c15a292710b40cb Author: Alex Deucher Date: Thu Feb 18 11:10:09 2016 -0500 drm/amdgpu/gfx8: fix priv reg interrupt enable Looks like a copy/paste typo. Reviewed-by: Christian König Noticed-by: David Panariti Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7e31a0159461818a1bda49662921b98a29c1187b Author: Takashi Iwai Date: Mon Feb 22 15:18:13 2016 +0100 ALSA: hda - Apply clock gate workaround to Skylake, too Some Skylake machines show the codec probe errors in certain situations, e.g. HP Z240 desktop fails to probe the onboard Realtek codec at reloading the snd-hda-intel module like: snd_hda_intel 0000:00:1f.3: spurious response 0x200:0x2, last cmd=0x000000 snd_hda_intel 0000:00:1f.3: azx_get_response timeout, switching to polling mode: lastcmd=0x000f0000 snd_hda_intel 0000:00:1f.3: No response from codec, disabling MSI: last cmd=0x000f0000 snd_hda_intel 0000:00:1f.3: Codec #0 probe error; disabling it... hdaudio hdaudioC0D2: no AFG or MFG node found snd_hda_intel 0000:00:1f.3: no codecs initialized Also, HP G470 G3 suffers from the similar problem, as reported in bugzilla below. On this machine, the codec probe error appears even at a fresh boot. As Libin suggested, the same workaround used for Broxton in the commit [6639484ddaf6: ALSA: hda - disable dynamic clock gating on Broxton before reset] can be applied for Skylake in order to fix this problem. The Intel HW team also confirmed that this is needed for SKL. This patch makes the workaround applied to both SKL and BXT platforms. The referred macros are moved and one superfluous macro (IS_BROXTON()) is another one (IS_BXT()) as well. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112731 Suggested-by: Libin Yang Cc: # v4.4+ Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 53188eb40121a135892881c5f61e41efce60b00a Author: Imre Deak Date: Tue Feb 16 18:56:46 2016 +0200 drm/i915/skl: Ensure HW is powered during DDB HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Spotted-by: Mika Kuoppala Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93441 CC: Chris Wilson Signed-off-by: Imre Deak Reviewed-by: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/1455719489-3008-1-git-send-email-imre.deak@intel.com (cherry picked from commit 4d800030238878c1a98d1d3a37a3d673eea661ce) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_pm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 380bdff2d05b498227c80caedd125e8cfcdba00d Author: Imre Deak Date: Fri Feb 12 18:55:21 2016 +0200 drm/i915/lvds: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-13-git-send-email-imre.deak@intel.com (cherry picked from commit ecb2448218acf23c401434c26be256147833b221) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lvds.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 31feb61a688bd4b1c1cb66cc24d931ee77826d93 Author: Imre Deak Date: Fri Feb 12 18:55:20 2016 +0200 drm/i915/hdmi: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-12-git-send-email-imre.deak@intel.com (cherry picked from commit 5b0921748c0b1d0362bbfa802dc25a5c23de7e76) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_hdmi.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit fe97fd7eb87255883ae1da2d726baaae2b50e80d Author: Imre Deak Date: Fri Feb 12 18:55:19 2016 +0200 drm/i915/dsi: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-11-git-send-email-imre.deak@intel.com (cherry picked from commit 3f3f42b887fbffc3353e44ef9f32456c19ae4280) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_dsi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit b81b801f8675838d69d1062a47ca46530ca7217b Author: Imre Deak Date: Fri Feb 12 18:55:18 2016 +0200 drm/i915/dp: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-10-git-send-email-imre.deak@intel.com (cherry picked from commit 6fa9a5ecf7a54450b255229ac1fc6df276cf0653) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_dp.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 02f9f5e62a9b0a1af2edd4fbd8194c9c5475459b Author: Imre Deak Date: Fri Feb 12 18:55:17 2016 +0200 drm/i915: Ensure the HW is powered when accessing the CRC HW block The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. While at it also add the missing reference around the HW access in i915_interrupt_info(). v2: - update the commit message mentioning that this also fixes the HW access in the interrupt info debugfs entry (Daniel) Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-9-git-send-email-imre.deak@intel.com (cherry picked from commit e129649b7a3e1d50d196e159492496777769437e) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_debugfs.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) commit d59410219ae396a5649eecff1a041e4588aff999 Author: Imre Deak Date: Fri Feb 12 18:55:16 2016 +0200 drm/i915/ddi: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. CC: Chris Wilson Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-8-git-send-email-imre.deak@intel.com (cherry picked from commit e27daab49718e3232318d8b539cb302521b4b724) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ddi.c | 112 +++++++++++++++++++++++++++------------ 1 file changed, 79 insertions(+), 33 deletions(-) commit 7a6252c6bce1124eebf620948280f8255a83f04a Author: Imre Deak Date: Fri Feb 12 18:55:15 2016 +0200 drm/i915/crt: Ensure the HW is powered during HW state readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93439 CC: Chris Wilson Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-7-git-send-email-imre.deak@intel.com (cherry picked from commit 1c8fdda1ea947ae8cf994969a1c285acc7089cb9) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_crt.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 5a24fab098d6f1aeae3e184a704cf2cd1f677ecd Author: Imre Deak Date: Fri Feb 12 18:55:14 2016 +0200 drm/i915: Ensure the HW is powered during HW access in assert_pipe The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-6-git-send-email-imre.deak@intel.com (cherry picked from commit 4feed0ebfa45879bc422c9a0bfa3cffec82ea60a) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit bacd67d6a36c8905258d08ed6ef41346fa01607c Author: Imre Deak Date: Fri Feb 12 18:55:13 2016 +0200 drm/i915: Ensure the HW is powered when disabling VGA The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-5-git-send-email-imre.deak@intel.com (cherry picked from commit 6392f8478e6f119467b1ad06e30e1f078e62efc1) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 013ef6cfc411bfe4a6009eaa7dabb6531bbb41bb Author: Imre Deak Date: Fri Feb 12 18:55:12 2016 +0200 drm/i915/ibx: Ensure the HW is powered during PLL HW readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Reviewed-by: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-4-git-send-email-imre.deak@intel.com (cherry picked from commit 12fda3876d08519bdf6f0acc70dd35754b422ed5) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9fb84d5a9299ac678dedc56487f394e5f68b91cb Author: Imre Deak Date: Fri Feb 12 18:55:11 2016 +0200 drm/i915: Ensure the HW is powered during display pipe HW readout The assumption when adding the intel_display_power_is_enabled() checks was that if it returns success the power can't be turned off afterwards during the HW access, which is guaranteed by modeset locks. This isn't always true, so make sure we hold a dedicated reference for the time of the access. Signed-off-by: Imre Deak Revieved-by: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/1455296121-4742-3-git-send-email-imre.deak@intel.com (cherry picked from commit 1729050eb4bbc192e54069e82069f2811313c1dd) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 67 ++++++++++++++++++++++++++---------- 1 file changed, 48 insertions(+), 19 deletions(-) commit 5af9a454769bb5528ba1e5268e5649414ae832bd Author: Imre Deak Date: Wed Feb 17 14:17:42 2016 +0200 drm/i915: Add helper to get a display power ref if it was already enabled We have many places in the code where we check if a given display power domain is enabled and if so access registers backed by this power domain. We assumed that some modeset lock will prevent the power reference from vanishing in the middle of the HW access, but this assumption doesn't always hold. In such cases we get either the wakeref not held, or an unclaimed register access error message. To fix this in a future-proof way that's independent of other locks wrap any such access with a get_ref_if_enabled()/put_ref() pair. Kudos to Ville and Joonas for the ideas of this new interface. v2: - init the power_domains ptr when declaring it everywhere (Joonas) v3: - don't report the device to be powered if runtime PM is disabled CC: Mika Kuoppala CC: Chris Wilson CC: Joonas Lahtinen CC: Ville Syrjälä Signed-off-by: Imre Deak Reviewed-by: Joonas Lahtinen Link: http://patchwork.freedesktop.org/patch/msgid/1455711462-7442-1-git-send-email-imre.deak@intel.com (cherry picked from commit 09731280028ce03e6a27e1998137f1775a2839f3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_drv.h | 3 + drivers/gpu/drm/i915/intel_runtime_pm.c | 100 +++++++++++++++++++++++++++++--- 2 files changed, 94 insertions(+), 9 deletions(-) commit c7edd7f99cdaec65e9303b4c9edc19bb595564ed Author: Jean-Philippe Brucker Date: Fri Feb 19 11:04:45 2016 +0100 ARM: 8534/1: virt: fix hyp-stub build for pre-ARMv7 CPUs ARMv6 CPUs do not have virtualisation extensions, but hyp-stub.S is still included into the image to keep it generic. In order to use ARMv7 instructions during HYP initialisation, add -march=armv7-a flag to hyp-stub's build. On an ARMv6 CPU, __hyp_stub_install returns as soon as it detects that the mode isn't HYP, so we will never reach those instructions. Signed-off-by: Jean-Philippe Brucker Signed-off-by: Russell King arch/arm/boot/compressed/Makefile | 2 ++ arch/arm/kernel/Makefile | 1 + 2 files changed, 3 insertions(+) commit 1b17cb796f5d40ffa239c6926385abd83a77a49b Author: Martin Schwidefsky Date: Fri Feb 19 15:29:05 2016 +0100 s390/fpu: signals vs. floating point control register git commit 904818e2f229f3d94ec95f6932a6358c81e73d78 "s390/kernel: introduce fpu-internal.h with fpu helper functions" introduced the fpregs_store / fp_regs_load helper. These function fail to save and restore the floating pointer control registers. The effect is that the FPC is not correctly handled on signal delivery and signal return. Cc: stable@vger.kernel.org # 4.4 Signed-off-by: Martin Schwidefsky arch/s390/include/asm/fpu/internal.h | 2 ++ 1 file changed, 2 insertions(+) commit 342300cc9cd3428bc6bfe5809bfcc1b9a0f06702 Author: Martin Schwidefsky Date: Fri Feb 19 14:44:14 2016 +0100 s390/compat: correct restore of high gprs on signal return git commit 8070361799ae1e3f4ef347bd10f0a508ac10acfb "s390: add support for vector extension" broke 31-bit compat processes in regard to signal handling. The restore_sigregs_ext32() function is used to restore the additional elements from the user space signal frame. Among the additional elements are the upper registers halves for 64-bit register support for 31-bit processes. The copy_from_user that is used to retrieve the high-gprs array from the user stack uses an incorrect length, 8 bytes instead of 64 bytes. This causes incorrect upper register halves to get loaded. Cc: stable@vger.kernel.org # 3.8+ Signed-off-by: Martin Schwidefsky arch/s390/kernel/compat_signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ab3ac233a8b4ffcc27c8475b83dee49fc46bc76 Author: Aneesh Kumar K.V Date: Sat Feb 20 20:41:54 2016 +0530 powerpc/mm/hash: Clear the invalid slot information correctly We can get a hash pte fault with 4k base page size and find the pte already inserted with 64K base page size. In that case we need to clear the existing slot information from the old pte. Fix this correctly With THP, we also clear the slot information with respect to all the 64K hash pte mapping that 16MB page. They are all invalid now. This make sure we don't find the slot valid when we fault with 4k base page size. Finding the slot valid should not result in any wrong behavior because we do check again in hash page table for the validity. But we can avoid that check completely. Fixes: a43c0eb8364c022 ("powerpc/mm: Convert 4k hash insert to C") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/mm/hash64_64k.c | 8 +++++++- arch/powerpc/mm/hugepage-hash64.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) commit f6bf0fa14cf848ae770e0b7842c9b11ce2f01645 Author: Gavin Shan Date: Fri Feb 12 16:03:05 2016 +1100 powerpc/eeh: Fix partial hotplug criterion During error recovery, the device could be removed as part of the partial hotplug. The criterion used to come with partial hotplug is: if the device driver provides error_detected(), slot_reset() and resume() callbacks, it's immune from hotplug. Otherwise, it's going to experience partial hotplug during EEH recovery. But the criterion isn't correct enough: mlx4_core driver for Mellanox adapters provides error_detected(), slot_reset() callbacks, but resume() isn't there. Those Mellanox adapters won't be to involved in the partial hotplug. This fixes the criterion to a practical one: adpater with driver that provides error_detected(), slot_reset() will be immune from partial hotplug. resume() isn't mandatory. Fixes: f2da4ccf ("powerpc/eeh: More relaxed hotplug criterion") Cc: stable@vger.kernel.org #v4.4+ Signed-off-by: Gavin Shan Signed-off-by: Michael Ellerman arch/powerpc/kernel/eeh_driver.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d856626d3b051a3ad7139ba59463b692c131f844 Merge: dd78dac 90cfde4 Author: David S. Miller Date: Sun Feb 21 22:51:55 2016 -0500 Merge tag 'linux-can-fixes-for-4.5-20160221' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-02-21 this is a pull reqeust of one patch for net/master. The patch is by Gerhard Uttenthaler and fixes a potential tx overflow in the ems_usb driver. ==================== Signed-off-by: David S. Miller commit dd78dac893bc66de0bc241bdf54c2211c2c55567 Merge: 9ca69b7 4ec0b6d Author: David S. Miller Date: Sun Feb 21 22:50:55 2016 -0500 Merge branch 'bnx2x-848xx-phy-fixes' Yuval Mintz says: ==================== bnx2x: Fix 848xx phys This series contains link-related fixes, mostly for the 848xx phys [2 patches are for 84833, and 2 patches are for 84858]. ==================== Signed-off-by: David S. Miller commit 4ec0b6d506186de559b331bd08f8483463116f72 Author: Yuval Mintz Date: Sun Feb 21 15:07:29 2016 +0200 bnx2x: Fix 84833 phy command handler Current initialization sequence is lacking, causing some configurations to fail. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 81 +++++++++++++++--------- drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h | 4 ++ 2 files changed, 56 insertions(+), 29 deletions(-) commit bb1187af658f9ed05a24ab0f25d3b41324176590 Author: Yuval Mintz Date: Sun Feb 21 15:07:28 2016 +0200 bnx2x: Fix led setting for 84858 phy. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 94 ++++++++++++++++++++++-- drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h | 2 + 2 files changed, 91 insertions(+), 5 deletions(-) commit 27ba2d2df0d7882008d9cf21f7dc05711415eeac Author: Yuval Mintz Date: Sun Feb 21 15:07:27 2016 +0200 bnx2x: Correct 84858 PHY fw version The phy's firmware version isn't being parsed properly as it's currently parsed like the rest of the 848xx phys. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 92 ++++++++++++++++++++---- 1 file changed, 79 insertions(+), 13 deletions(-) commit 512ab9a001eb88e197859cefbb89b609a971251f Author: Yuval Mintz Date: Sun Feb 21 15:07:26 2016 +0200 bnx2x: Fix 84833 RX CRC There's a problem in current 84833 phy configuration - in case 1Gb link is configured and jumbo-sized packets are being used, device will experience RX crc errors. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 26 ++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit 1e411f0138a1b05e805e2043f73f546dba651e27 Author: Yuval Mintz Date: Sun Feb 21 15:07:25 2016 +0200 bnx2x: Fix link-forcing for KR2 Currently, when link is using KR2 it cannot be forced to any speed other than 20g. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 9ca69b705486a6fd5c3ecf0558b2203c376ec048 Merge: b5a099c 3bd7594 Author: David S. Miller Date: Sun Feb 21 22:46:26 2016 -0500 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2016-02-20 Here's an important patch for 4.5 which fixes potential invalid pointer access when processing completed Bluetooth HCI commands. Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit b5a099c67a1c36b91356624ce86eb3f9f48a82c7 Author: Robert Jarzmik Date: Sat Feb 20 21:45:26 2016 +0100 net: ethernet: davicom: fix devicetree irq resource The dm9000 driver doesn't work in at least one device-tree configuration, spitting an error message on irq resource : [    1.062495] dm9000 8000000.ethernet: insufficient resources [    1.068439] dm9000 8000000.ethernet: not found (-2). [    1.073451] dm9000: probe of 8000000.ethernet failed with error -2 The reason behind is that the interrupt might be provided by a gpio controller, not probed when dm9000 is probed, and needing the probe deferral mechanism to apply. Currently, the interrupt is directly taken from resources. This patch changes this to use the more generic platform_get_irq(), which handles the deferral. Moreover, since commit Fixes: 7085a7401ba5 ("drivers: platform: parse IRQ flags from resources"), the interrupt trigger flags are honored in platform_get_irq(), so remove the needless code in dm9000. Signed-off-by: Robert Jarzmik Acked-by: Marcel Ziswiler Cc: Sergei Shtylyov Tested-by: Sergei Ianovich Signed-off-by: David S. Miller drivers/net/ethernet/davicom/dm9000.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit 1ad5466812c0b4d7851f98573be6a332e82bc920 Author: Ken Kawasaki Date: Sat Feb 20 19:14:36 2016 +0900 fmvj18x_cs: fix incorrect indexing of dev->dev_addr[] when copying the MAC address fix incorrect indexing of dev->dev_addr[] when copying the MAC address of FMV-J182 at buf[5]. Signed-off-by: Ken Kawasaki Signed-off-by: David S. Miller drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 14112ca5625db8a7fbdc724783510751577a8a1b Author: Shrikrishna Khare Date: Fri Feb 19 11:19:52 2016 -0800 Driver: Vmxnet3: Update Rx ring 2 max size Device emulation supports max size of 4096. Signed-off-by: Shrikrishna Khare Signed-off-by: Bhavesh Davda Signed-off-by: David S. Miller drivers/net/vmxnet3/vmxnet3_defs.h | 2 +- drivers/net/vmxnet3/vmxnet3_int.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit d3e17183b9820ccf3c1aacc5ec5459a23a574ba7 Merge: 3301be3 0632448 Author: David S. Miller Date: Sun Feb 21 22:03:21 2016 -0500 Merge branch 'netcp-fixes' Murali Karicheri says: ==================== net: ti: netcp: restore get/set_pad_info() functionality This series fixes a regression and add some improvements for the ease of maintainance. Incorporated comments against v1. Changelogs: v2 : combined 2-3 into one patch as this involves a header change fixed a parse warning in 3/4 per comment from Arnd. Removed Sign-off from Arnd against 1/4 added comments in 3/3 to alert on the usage of sw data per review comments v1 : added 2-4 to accomodate feedback received from review v0 : initial version to fix the regression (From Grygorii) ==================== Signed-off-by: David S. Miller commit 0632448134d0ac1450a19d26f90948fde3b558ad Author: Karicheri, Muralidharan Date: Fri Feb 19 12:58:44 2016 -0500 net: netcp: rework the code for get/set sw_data in dma desc SW data field in descriptor can be used by software to hold private data for the driver. As there are 4 words available for this purpose, use separate macros to place it or retrieve the same to/from descriptors. Also do type cast of data types accordingly. Cc: Wingman Kwok Cc: Mugunthan V N CC: Arnd Bergmann CC: Grygorii Strashko CC: David Laight Signed-off-by: Murali Karicheri Acked-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 72 +++++++++++++++++++++++++++--------- 1 file changed, 55 insertions(+), 17 deletions(-) commit b1cb86ae0e5951e9747ec7a5b33d1c1217791b75 Author: Karicheri, Muralidharan Date: Fri Feb 19 12:58:43 2016 -0500 soc: ti: knav_dma: rename pad in struct knav_dma_desc to sw_data Rename the pad to sw_data as per description of this field in the hardware spec(refer sprugr9 from www.ti.com). Latest version of the document is at http://www.ti.com/lit/ug/sprugr9h/sprugr9h.pdf and section 3.1 Host Packet Descriptor describes this field. Define and use a constant for the size of sw_data field similar to other fields in the struct for desc and document the sw_data field in the header. As the sw_data is not touched by hw, it's type can be changed to u32. Rename the helpers to match with the updated dma desc field sw_data. Cc: Wingman Kwok Cc: Mugunthan V N CC: Arnd Bergmann CC: Grygorii Strashko CC: David Laight Signed-off-by: Murali Karicheri Acked-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 40 +++++++++++++++++++----------------- include/linux/soc/ti/knav_dma.h | 4 +++- 2 files changed, 24 insertions(+), 20 deletions(-) commit 9ecfe875c4f311618cc918aded716017dcd2ddf1 Author: Karicheri, Muralidharan Date: Fri Feb 19 12:58:42 2016 -0500 net: ti: netcp: restore get/set_pad_info() functionality The commit 899077791403 ("netcp: try to reduce type confusion in descriptors") introduces a regression in Kernel 4.5-rc1 and it breaks get/set_pad_info() functionality. The TI NETCP driver uses pad0 and pad1 fields of knav_dma_desc to store DMA/MEM buffer pointer and buffer size respectively. And in both cases for Keystone 2 the pointer type size is 32 bit regardless of LAPE enabled or not, because CONFIG_ARCH_DMA_ADDR_T_64BIT originally is not expected to be defined. Unfortunately, above commit changed buffer's pointers save/restore code (get/set_pad_info()) and added intermediate conversation to u64 which works incorrectly on 32bit Keystone 2 and causes TI NETCP driver crash in RX/TX path due to "Unable to handle kernel NULL pointer" exception. This issue was reported and discussed in [1]. Hence, fix it by partially reverting above commit and restoring get/set_pad_info() functionality as it was before. [1] https://www.mail-archive.com/netdev@vger.kernel.org/msg95361.html Cc: Wingman Kwok Cc: Mugunthan V N CC: David Laight CC: Arnd Bergmann Reported-by: Franklin S Cooper Jr Signed-off-by: Grygorii Strashko Signed-off-by: Murali Karicheri Acked-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 59 +++++++++++------------------------- 1 file changed, 18 insertions(+), 41 deletions(-) commit 56e5fd8feb286ab71f4ca7674505b0d17967376d Author: Fabio Estevam Date: Sun Feb 21 11:35:00 2016 -0300 ASoC: fsl_ssi: Go back to explicit register defaults Commit 5c408fee2546 ("ASoC: fsl_ssi: remove explicit register defaults") causes the driver to fail to probe: fsl-ssi-dai 2028000.ssi: No cache defaults, reading back from HW fsl-ssi-dai 2028000.ssi: Failed to init register map fsl-ssi-dai: probe of 2028000.ssi failed with error -22 , so revert this commit. Reported-by: Mika Penttilä Signed-off-by: Fabio Estevam Signed-off-by: Mark Brown sound/soc/fsl/fsl_ssi.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit 3301be32d4ba95136ff52fb0aee2bdb6077f40b1 Author: Ian Campbell Date: Fri Feb 19 11:44:51 2016 +0000 MAINTAINERS: Drop myself as xen netback maintainer Wei has been picking this up for quite a while now. Signed-off-by: Ian Campbell Cc: Wei Liu Acked-by: Wei Liu Signed-off-by: David S. Miller MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit d9749fb5942f51555dc9ce1ac0dbb1806960a975 Author: Neil Horman Date: Thu Feb 18 16:10:57 2016 -0500 sctp: Fix port hash table size computation Dmitry Vyukov noted recently that the sctp_port_hashtable had an error in its size computation, observing that the current method never guaranteed that the hashsize (measured in number of entries) would be a power of two, which the input hash function for that table requires. The root cause of the problem is that two values need to be computed (one, the allocation order of the storage requries, as passed to __get_free_pages, and two the number of entries for the hash table). Both need to be ^2, but for different reasons, and the existing code is simply computing one order value, and using it as the basis for both, which is wrong (i.e. it assumes that ((1< Reported-by: Dmitry Vyukov CC: Dmitry Vyukov CC: Vladislav Yasevich CC: "David S. Miller" Signed-off-by: David S. Miller net/sctp/protocol.c | 46 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-) commit 4328daa2e79ed904a42ce00a9f38b9c36b44b21a Author: Mike Snitzer Date: Sun Feb 21 19:09:22 2016 -0500 dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths Using request-based DM mpath configured with the following stacking (.request_fn DM mpath ontop of scsi-mq paths): echo Y > /sys/module/scsi_mod/parameters/use_blk_mq echo N > /sys/module/dm_mod/parameters/use_blk_mq 'struct dm_rq_target_io' would leak if a request is requeued before a blk-mq clone is allocated (or fails to allocate). free_rq_tio() wasn't being called. kmemleak reported: unreferenced object 0xffff8800b90b98c0 (size 112): comm "kworker/7:1H", pid 5692, jiffies 4295056109 (age 78.589s) hex dump (first 32 bytes): 00 d0 5c 2c 03 88 ff ff 40 00 bf 01 00 c9 ff ff ..\,....@....... e0 d9 b1 34 00 88 ff ff 00 00 00 00 00 00 00 00 ...4............ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] kmem_cache_alloc+0xc3/0x1e0 [] mempool_alloc_slab+0x15/0x20 [] mempool_alloc+0x6e/0x170 [] dm_old_prep_fn+0x3c/0x180 [dm_mod] [] blk_peek_request+0x168/0x290 [] dm_request_fn+0xb2/0x1b0 [dm_mod] [] __blk_run_queue+0x33/0x40 [] blk_delay_work+0x25/0x40 [] process_one_work+0x14f/0x3d0 [] worker_thread+0x125/0x4b0 [] kthread+0xd8/0xf0 [] ret_from_fork+0x3f/0x70 [] 0xffffffffffffffff crash> struct -o dm_rq_target_io struct dm_rq_target_io { ... } SIZE: 112 Fixes: e5863d9ad7 ("dm: allocate requests in target when stacking on blk-mq devices") Cc: stable@vger.kernel.org # 4.0+ Signed-off-by: Mike Snitzer drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) commit bf5b1f352cc1ad1c53673ebeb76b8128da0e079f Merge: 49b245e aeb67ae Author: Thomas Gleixner Date: Sun Feb 21 20:51:26 2016 +0100 Merge tag 'irqchip-urgent-4.5' of git://git.infradead.org/users/jcooper/linux into irq/urgent Pull irqchip fixes for v4.5 from Jason Cooper: - mxs: Add a missing set_handle_irq() commit 9aafabc7fece13c8e2a1f680908c73ee19f0f79b Author: Ivaylo Dimitrov Date: Tue Feb 2 14:47:37 2016 +0200 power: bq27xxx_battery: Restore device name Patch <703df6c09795> ("power: bq27xxx_battery: Reorganize I2C into a module") has removed the device name numbering from bq27xxx_battery_i2c_probe. Fix that by restoring the code. Fixes: 703df6c097956d17a818e63961c82e8e9eef9fef Signed-off-by: Ivaylo Dimitrov Reviewed-by: Pali Rohár Tested-by: Pali Rohár Signed-off-by: Sebastian Reichel drivers/power/bq27xxx_battery_i2c.c | 37 ++++++++++++++++++++++++++++++++--- include/linux/power/bq27xxx_battery.h | 1 + 2 files changed, 35 insertions(+), 3 deletions(-) commit e35a49b163fa2108cf82c6f07a3fbe371e468878 Author: Sebastian Reichel Date: Sun Jan 17 21:36:03 2016 +0100 MAINTAINERS: update bq27xxx driver Update reviewers for bq27xxx, so that Pali and Andrew are reviewers with status and maintainer inherited from the power supply subsystem entry. Signed-off-by: Sebastian Reichel Acked-by: Pali Rohár Acked-by: Andrew F. Davis MAINTAINERS | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 90cfde46586d2286488d8ed636929e936c0c9ab2 Author: Gerhard Uttenthaler Date: Tue Dec 22 17:29:16 2015 +0100 can: ems_usb: Fix possible tx overflow This patch fixes the problem that more CAN messages could be sent to the interface as could be send on the CAN bus. This was more likely for slow baud rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under heavy TX load this produced another bulk transfer without checking the free_slots variable and hence caused the overflow in the interface. Signed-off-by: Gerhard Uttenthaler Cc: linux-stable Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/ems_usb.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 7a64cd887fdb97f074c3fda03bee0bfb9faceac3 Author: Lisa Du Date: Wed Feb 17 09:32:52 2016 +0800 drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE There's one point was missed in the patch commit da49889deb34 ("staging: binder: Support concurrent 32 bit and 64 bit processes."). When configure BINDER_IPC_32BIT, the size of binder_uintptr_t was 32bits, but size of void * is 64bit on 64bit system. Correct it here. Signed-off-by: Lisa Du Signed-off-by: Nicolas Boichat Fixes: da49889deb34 ("staging: binder: Support concurrent 32 bit and 64 bit processes.") Cc: Acked-by: Olof Johansson Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e5bdfd50d6f76077bf8441d130c606229e100d40 Author: Greg Kroah-Hartman Date: Sat Feb 20 14:19:34 2016 -0800 Revert "usb: hub: do not clear BOS field during reset device" This reverts commit d8f00cd685f5c8e0def8593e520a7fef12c22407. Tony writes: This upstream commit is causing an oops: d8f00cd685f5 ("usb: hub: do not clear BOS field during reset device") This patch has already been included in several -stable kernels. Here are the affected kernels: 4.5.0-rc4 (current git) 4.4.2 4.3.6 (currently in review) 4.1.18 3.18.27 3.14.61 How to reproduce the problem: Boot kernel with slub debugging enabled (otherwise memory corruption will cause random oopses later instead of immediately) Plug in USB 3.0 disk to xhci USB 3.0 port dd if=/dev/sdc of=/dev/null bs=65536 (where /dev/sdc is the USB 3.0 disk) Unplug USB cable while dd is still going Oops is immediate: Reported-by: Tony Battersby Cc: Du, Changbin Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hub.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit f9a96d2e7e46ed1ece71cf5b34ad9fe2492bacc5 Merge: 3c7dc6a d061c1c Author: Greg Kroah-Hartman Date: Sat Feb 20 14:18:34 2016 -0800 Merge tag 'usb-serial-4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.5-rc5 Here are some new device ids. Signed-off-by: Johan Hovold commit 3c7dc6a079182bdab5ff7a66307bd63c2be837eb Merge: 18558ca 8c0614c Author: Greg Kroah-Hartman Date: Sat Feb 20 14:13:55 2016 -0800 Merge tag 'usb-ci-v4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus Peter writes: Some tiny bug fixes for chipidea driver commit 81f70ba233d5f660e1ea5fe23260ee323af5d53a Author: Linus Torvalds Date: Sat Feb 20 13:39:35 2016 -0800 Linux 4.5-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0389075ecfb6231818de9b0225d3a5a21a661171 Merge: 06b74c6 f4eafd8 Author: Linus Torvalds Date: Sat Feb 20 09:32:40 2016 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "This is unusually large, partly due to the EFI fixes that prevent accidental deletion of EFI variables through efivarfs that may brick machines. These fixes are somewhat involved to maintain compatibility with existing install methods and other usage modes, while trying to turn off the 'rm -rf' bricking vector. Other fixes are for large page ioremap()s and for non-temporal user-memcpy()s" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Fix vmalloc_fault() to handle large pages properly hpet: Drop stale URLs x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable lib/ucs2_string: Correct ucs2 -> utf8 conversion efi: Add pstore variables to the deletion whitelist efi: Make efivarfs entries immutable by default efi: Make our variable validation list include the guid efi: Do variable name validation tests in utf8 efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version lib/ucs2_string: Add ucs2 -> utf8 helper functions commit 06b74c658c595e4ef9fd5746f927a1cb6c3a59d5 Merge: e6a1c1e 059fcd8 Author: Linus Torvalds Date: Sat Feb 20 09:30:42 2016 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "A handful of CPU hotplug related fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Plug potential memory leak in CPU_UP_PREPARE perf/core: Remove the bogus and dangerous CPU_DOWN_FAILED hotplug state perf/core: Remove bogus UP_CANCELED hotplug state perf/x86/amd/uncore: Plug reference leak commit e6a1c1e9ddcc873c33833d5c1fc69f22b1838962 Merge: da6b736 6ecad91 Author: Linus Torvalds Date: Sat Feb 20 09:22:11 2016 -0800 Merge tag 'powerpc-4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix build error on 32-bit with checkpoint restart from Aneesh Kumar - Fix dedotify for binutils >= 2.26 from Andreas Schwab - Don't trace hcalls on offline CPUs from Denis Kirjanov - eeh: Fix stale cached primary bus from Gavin Shan - eeh: Fix stale PE primary bus from Gavin Shan - mm: Fix Multi hit ERAT cause by recent THP update from Aneesh Kumar K.V - ioda: Set "read" permission when "write" is set from Alexey Kardashevskiy * tag 'powerpc-4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/ioda: Set "read" permission when "write" is set powerpc/mm: Fix Multi hit ERAT cause by recent THP update powerpc/powernv: Fix stale PE primary bus powerpc/eeh: Fix stale cached primary bus powerpc/pseries: Don't trace hcalls on offline CPUs powerpc: Fix dedotify for binutils >= 2.26 powerpc/book3s_32: Fix build error with checkpoint restart commit da6b7366dbfc93f59873e252b8d53f17fb47a802 Merge: 37aa4da ee1cdcd Author: Linus Torvalds Date: Sat Feb 20 09:19:56 2016 -0800 Merge tag 'dmaengine-fix-4.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "A few fixes for drivers, nothing major here. Fixes are: iotdma fix to restart channels, new ID for wildcat PCH, residue fix for edma, disable irq for non-cyclic in dw" * tag 'dmaengine-fix-4.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer dmaengine: edma: fix residue race for cyclic dmaengine: dw: pci: add ID for WildcatPoint PCH dmaengine: IOATDMA: fix timer code that continues to restart channels during idle commit 37aa4dac99418efa17329d98c2a0ed372ed9aa9e Merge: a703f42 4462b4b Author: Linus Torvalds Date: Sat Feb 20 09:16:51 2016 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver fixes from Stephen Boyd: "An assortment of vendor specific clk drivers fixes, most notably fallout from adding Tegra210 and rockchip rk3036/rk3368 drivers this cycle. There's also the random smattering of sparse/checker fixes, a build "fix" to get the Tango clk driver to compile because the Kconfig symbol was renamed after the fact, and a clk gpio fix for a patch mismerge" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (28 commits) clk: gpio: Really allow an optional clock= DT property Revert "clk: qcom: Specify LE device endianness" clk: versatile: mask VCO bits before writing clk: tegra: super: Fix sparse warnings for functions not declared as static clk: tegra: Fix sparse warnings for functions not declared as static clk: tegra: Fix sparse warning for pll_m clk: tegra: Use definition for pll_u override bit clk: tegra: Fix warning caused by pll_u failing to lock clk: tegra: Fix clock sources for Tegra210 EMC clk: tegra: Add the APB2APE audio clock on Tegra210 clk: tegra: Add missing of_node_put() clk: tegra: Fix PLLE SS coefficients clk: tegra: Fix typos around clearing PLLE bits during enable clk: tegra: Do not disable PLLE when under hardware control clk: tegra: Fix pllx dyn step calculation clk: tegra: pll: Fix potential sleeping-while-atomic clk: tegra: Fix the misnaming of nvenc from msenc clk: tegra: Fix naming of MISC registers clk: tango4: rename ARCH_TANGOX to ARCH_TANGO clk: scpi: Fix checking return value of platform_device_register_simple() ... commit a703f42d6caa724236521a5a7dcf4ab637483b66 Merge: 59ceeaa 4fbbed4 Author: Linus Torvalds Date: Sat Feb 20 09:13:18 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull more drm fixes from Dave Airlie: "Some more fixes trickled in: A bunch of VC4 ones since it's a pretty new driver not much chance of regressions, and it fixes GPU resets. Also one atomic fix, one set of fixes for a common bug in TTM cleanup, and one i915 hotplug fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/nouveau: use post-decrement in error handling drm/atomic: Allow for holes in connector state, v2. drm/i915: Fix hpd live status bits for g4x drm/vc4: Use runtime PM to power cycle the device when the GPU hangs. drm/vc4: Enable runtime PM. drm/vc4: Fix spurious GPU resets due to BO reuse. drm/vc4: Drop error message on seqno wait timeouts. drm/vc4: Fix -ERESTARTSYS error return from BO waits. drm/vc4: Return an ERR_PTR from BO creation instead of NULL. drm/vc4: Fix the clear color for the first tile rendered. drm/vc4: Validate that WAIT_BO padding is cleared. drm/radeon: use post-decrement in error handling drm/amdgpu: use post-decrement in error handling commit 59ceeaaf355fa0fb16558ef7c24413c804932ada Author: Simon Guinot Date: Thu Sep 10 00:15:18 2015 +0200 kernel/resource.c: fix muxed resource handling in __request_region() In __request_region, if a conflict with a BUSY and MUXED resource is detected, then the caller goes to sleep and waits for the resource to be released. A pointer on the conflicting resource is kept. At wake-up this pointer is used as a parent to retry to request the region. A first problem is that this pointer might well be invalid (if for example the conflicting resource have already been freed). Another problem is that the next call to __request_region() fails to detect a remaining conflict. The previously conflicting resource is passed as a parameter and __request_region() will look for a conflict among the children of this resource and not at the resource itself. It is likely to succeed anyway, even if there is still a conflict. Instead, the parent of the conflicting resource should be passed to __request_region(). As a fix, this patch doesn't update the parent resource pointer in the case we have to wait for a muxed region right after. Reported-and-tested-by: Vincent Pelletier Signed-off-by: Simon Guinot Tested-by: Vincent Donnefort Cc: stable@kernel.org Signed-off-by: Linus Torvalds kernel/resource.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 3bd7594e69bd97c962faa6a5ae15dd8c6c082636 Author: Douglas Anderson Date: Fri Feb 19 14:25:21 2016 -0800 Bluetooth: hci_core: Avoid mixing up req_complete and req_complete_skb In commit 44d271377479 ("Bluetooth: Compress the size of struct hci_ctrl") we squashed down the size of the structure by using a union with the assumption that all users would use the flag to determine whether we had a req_complete or a req_complete_skb. Unfortunately we had a case in hci_req_cmd_complete() where we weren't looking at the flag. This can result in a situation where we might be storing a hci_req_complete_skb_t in a hci_req_complete_t variable, or vice versa. During some testing I found at least one case where the function hci_req_sync_complete() was called improperly because the kernel thought that it didn't require an SKB. Looking through the stack in kgdb I found that it was called by hci_event_packet() and that hci_event_packet() had both of its locals "req_complete" and "req_complete_skb" pointing to the same place: both to hci_req_sync_complete(). Let's make sure we always check the flag. For more details on debugging done, see . Fixes: 44d271377479 ("Bluetooth: Compress the size of struct hci_ctrl") Signed-off-by: Douglas Anderson Acked-by: Johan Hedberg Signed-off-by: Marcel Holtmann net/bluetooth/hci_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 7ae8fd0351f912b075149a1e03a017be8b903b9a Author: Maxim Patlasov Date: Tue Feb 16 11:45:33 2016 -0800 fs/pnode.c: treat zero mnt_group_id-s as unequal propagate_one(m) calculates "type" argument for copy_tree() like this: > if (m->mnt_group_id == last_dest->mnt_group_id) { > type = CL_MAKE_SHARED; > } else { > type = CL_SLAVE; > if (IS_MNT_SHARED(m)) > type |= CL_MAKE_SHARED; > } The "type" argument then governs clone_mnt() behavior with respect to flags and mnt_master of new mount. When we iterate through a slave group, it is possible that both current "m" and "last_dest" are not shared (although, both are slaves, i.e. have non-NULL mnt_master-s). Then the comparison above erroneously makes new mount shared and sets its mnt_master to last_source->mnt_master. The patch fixes the problem by handling zero mnt_group_id-s as though they are unequal. The similar problem exists in the implementation of "else" clause above when we have to ascend upward in the master/slave tree by calling: > last_source = last_source->mnt_master; > last_dest = last_source->mnt_parent; proper number of times. The last step is governed by "n->mnt_group_id != last_dest->mnt_group_id" condition that may lie if both are zero. The patch fixes this case in the same way as the former one. [AV: don't open-code an obvious helper...] Signed-off-by: Maxim Patlasov Signed-off-by: Al Viro fs/pnode.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 0bacbe528e26422e424d110ebda4ec68ea0fd5eb Author: Al Viro Date: Tue Feb 2 02:28:05 2016 +0000 affs_do_readpage_ofs(): just use kmap_atomic() around memcpy() It forgets kunmap() on a failure exit, but there's really no point keeping the page kmapped at all - after all, what we are doing is a bunch of memcpy() into the parts of page, so kmap_atomic()/kunmap_atomic() just around those memcpy() is enough. Spotted-by: Insu Yun Signed-off-by: Al Viro fs/affs/file.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 0e9a7da51b028aee7a72c95096c99fe5ea2a01f0 Author: Mateusz Guzik Date: Thu Feb 4 02:56:30 2016 +0100 xattr handlers: plug a lock leak in simple_xattr_list The code could leak xattrs->lock on error. Problem introduced with 786534b92f3ce68f4 "tmpfs: listxattr should include POSIX ACL xattrs". Signed-off-by: Mateusz Guzik Signed-off-by: Al Viro fs/xattr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2feb55f89096b22e2de066e411a3263647211987 Author: Wouter van Kesteren Date: Tue Feb 16 22:20:59 2016 +0100 fs: allow no_seek_end_llseek to actually seek The user-visible impact of the issue is for example that without this patch sensors-detect breaks when trying to seek in /dev/cpu/0/cpuid. '~0ULL' is a 'unsigned long long' that when converted to a loff_t, which is signed, gets turned into -1. later in vfs_setpos we have 'if (offset > maxsize)', which makes it always return EINVAL. Fixes: b25472f9b961 ("new helpers: no_seek_end_llseek{,_size}()") Signed-off-by: Wouter van Kesteren Reviewed-by: Andreas Dilger Signed-off-by: Al Viro fs/read_write.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d07c0278da1f4cfc91c3d46d0d07a0d13a949892 Author: Jaedon Shin Date: Fri Feb 19 13:48:50 2016 +0900 net: bcmgenet: Fix internal PHY link state The PHY link state is not chaged in GENETv2 caused by the previous commit 49f7a471e4d1 ("net: bcmgenet: Properly configure PHY to ignore interrupt") was set to PHY_IGNORE_INTERRUPT in bcmgenet_mii_probe(). The internal PHY should use phy_mac_interrupt() when not in use PHY_POLL. The statement for phy_mac_interrupt() has two conditions. The first condition to check GENET_HAS_MDIO_INTR is not related PHY link state, so this patch removes it. Fixes: 49f7a471e4d1 ("net: bcmgenet: Properly configure PHY to ignore interrupt") Signed-off-by: Jaedon Shin Acked-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 18eceb818dc37bbc783ec7ef7703f270cc6cd281 Author: Rainer Weikusat Date: Thu Feb 18 12:39:46 2016 +0000 af_unix: Don't use continue to re-execute unix_stream_read_generic loop The unix_stream_read_generic function tries to use a continue statement to restart the receive loop after waiting for a message. This may not work as intended as the caller might use a recvmsg call to peek at control messages without specifying a message buffer. If this was the case, the continue will cause the function to return without an error and without the credential information if the function had to wait for a message while it had returned with the credentials otherwise. Change to using goto to restart the loop without checking the condition first in this case so that credentials are returned either way. Signed-off-by: Rainer Weikusat Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/unix/af_unix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b5f0549231ffb025337be5a625b0ff9f52b016f0 Author: Dmitry V. Levin Date: Fri Feb 19 04:27:48 2016 +0300 unix_diag: fix incorrect sign extension in unix_lookup_by_ino The value passed by unix_diag_get_exact to unix_lookup_by_ino has type __u32, but unix_lookup_by_ino's argument ino has type int, which is not a problem yet. However, when ino is compared with sock_i_ino return value of type unsigned long, ino is sign extended to signed long, and this results to incorrect comparison on 64-bit architectures for inode numbers greater than INT_MAX. This bug was found by strace test suite. Fixes: 5d3cae8bc39d ("unix_diag: Dumping exact socket core") Signed-off-by: Dmitry V. Levin Acked-by: Cong Wang Signed-off-by: David S. Miller net/unix/diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a0e2f2622eb65b59bcefb01c5c475af4fab0e6d Merge: 8d2c3ab ba41d46 Author: David S. Miller Date: Fri Feb 19 23:39:32 2016 -0500 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Phy related fixes. 3 small patches to fix PHY related code. ==================== Signed-off-by: David S. Miller commit ba41d46fe03223279054e58d570069fdc62fb768 Author: Michael Chan Date: Fri Feb 19 19:43:21 2016 -0500 bnxt_en: Failure to update PHY is not fatal condition. If we fail to update the PHY, we should print a warning and continue. The current code to exit is buggy as it has not freed up the NIC resources yet. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit de73018fb5474b33dc4f6d6b8d889e40232e325b Author: Michael Chan Date: Fri Feb 19 19:43:20 2016 -0500 bnxt_en: Remove unnecessary call to update PHY settings. Fix bnxt_update_phy_setting() to check the correct parameters when determining whether to update the PHY. Requested line speed/duplex should only be checked for forced speed mode. This avoids unnecessary link interruptions when loading the driver. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 035a1539ab63bfdb284bdf6e8459e35897c60564 Author: Michael Chan Date: Fri Feb 19 19:43:19 2016 -0500 bnxt_en: Poll link at the end of __bnxt_open_nic(). When shutting down the NIC, we shutdown async event processing before freeing all the rings. If there is a link change event during reset, the driver may miss it and the link state may be incorrect after the NIC is re-opened. Poll the link at the end of __bnxt_open_nic() to get the correct link status. Signed-off-by Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + 1 file changed, 1 insertion(+) commit 000e0949148382c4962489593a2f05504c2a6771 Author: Nishanth Menon Date: Fri Feb 19 18:09:51 2016 -0600 hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook Thermal hook gpio_fan_get_cur_state is only interested in knowing the current speed index that was setup in the system, this is already available as part of fan_data->speed_index which is always set by set_fan_speed. Using get_fan_speed_index is useful when we have no idea about the fan speed configuration (for example during fan_ctrl_init). When thermal framework invokes gpio_fan_get_cur_state=>get_fan_speed_index via gpio_fan_get_cur_state especially in a polled configuration for thermal governor, we basically hog the i2c interface to the extent that other functions fail to get any traffic out :(. Instead, just provide the last state set in the driver - since the gpio fan driver is responsible for the fan state immaterial of override, the fan_data->speed_index should accurately reflect the state. Fixes: b5cf88e46bad ("(gpio-fan): Add thermal control hooks") Reported-by: Tony Lindgren Cc: Guenter Roeck Cc: Eduardo Valentin Signed-off-by: Nishanth Menon Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck drivers/hwmon/gpio-fan.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 747ffe11b440ef9ea752888806d3aac677ca52a4 Author: Dan Williams Date: Fri Feb 19 15:21:14 2016 -0800 libnvdimm, tools/testing/nvdimm: fix 'ars_status' output buffer sizing Use the output length specified in the command to size the receive buffer rather than the arbitrary 4K limit. This bug was hiding the fact that the ndctl implementation of ndctl_bus_cmd_new_ars_status() was not specifying an output buffer size. Cc: Cc: Vishal Verma Signed-off-by: Dan Williams drivers/acpi/nfit.c | 13 +++++++------ drivers/nvdimm/bus.c | 8 ++++---- include/linux/libnvdimm.h | 1 - tools/testing/nvdimm/test/nfit.c | 8 ++++++-- 4 files changed, 17 insertions(+), 13 deletions(-) commit e1d09dc0ccc6c91e3916476f636edb76da1f65bb Author: Mario Kleiner Date: Fri Feb 19 02:06:39 2016 +0100 drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc. This fixes a regression introduced in Linux 4.4. This is a port of the same fix for radeon-kms in the patch "drm/radeon: Don't hang in radeon_flip_work_func on disabled crtc. (v2)" Limit the amount of time amdgpu_flip_work_func can delay programming a page flip, by both limiting the maximum amount of time per wait cycle and the maximum number of wait cycles. Continue the flip if the limit is exceeded, even if that may result in a visual or timing glitch. This is to prevent a hang of page flips, as reported in fdo bug #93746: Disconnecting a DisplayPort display in parallel to a kms pageflip getting queued can cause the following hang of page flips and thereby an unusable desktop: 1. kms pageflip ioctl() queues pageflip -> queues execution of amdgpu_flip_work_func. 2. Hotunplug of display causes the driver to DPMS OFF the unplugged display. Display engine shuts down, scanout no longer moves, but stays at its resting position at start line of vblank. 3. amdgpu_flip_work_func executes while crtc is off, and due to the non-moving scanout position, the new flip delay code introduced into Linux 4.4 by commit 8e36f9d33c13 ("drm/amdgpu: Fixup hw vblank counter/ts..") enters an infinite wait loop. 4. After reconnecting the display, the pageflip continues to hang in 3. and the display doesn't update its view of the desktop. This patch fixes the Linux 4.4 regression from fdo bug #93746 Reported-by: Bernd Steinhauser Signed-off-by: Mario Kleiner Cc: # 4.4+ Cc: Michel Dänzer Cc: Alex Deucher Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit 2b8341b3f917c108b47f6a8a771a40d226c57883 Author: Mario Kleiner Date: Fri Feb 19 02:06:38 2016 +0100 drm/radeon: Don't hang in radeon_flip_work_func on disabled crtc. (v2) This fixes a regression introduced in Linux 4.4. Limit the amount of time radeon_flip_work_func can delay programming a page flip, by both limiting the maximum amount of time per wait cycle and the maximum number of wait cycles. Continue the flip if the limit is exceeded, even if that may result in a visual or timing glitch. This is to prevent a hang of page flips, as reported in fdo bug #93746: Disconnecting a DisplayPort display in parallel to a kms pageflip getting queued can cause the following hang of page flips and thereby an unusable desktop: 1. kms pageflip ioctl() queues pageflip -> queues execution of radeon_flip_work_func. 2. Hotunplug of display causes the driver to DPMS OFF the unplugged display. Display engine shuts down, scanout no longer moves, but stays at its resting position at start line of vblank. 3. radeon_flip_work_func executes while crtc is off, and due to the non-moving scanout position, the new flip delay code introduced into Linux 4.4 by commit 5b5561b3660d ("drm/radeon: Fixup hw vblank counter/ts..") enters an infinite wait loop. 4. After reconnecting the display, the pageflip continues to hang in 3. and the display doesn't update its view of the desktop. This patch fixes the Linux 4.4 regression from fdo bug #93746 v2: Skip wait immediately if !radeon_crtc->enabled, as suggested by Michel. Reported-by: Bernd Steinhauser Signed-off-by: Mario Kleiner Tested-by: Bernd Steinhauser Cc: # 4.4+ Cc: Michel Dänzer Cc: Alex Deucher Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_display.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 020ecbba0548cefc91c3c5de32c28a62bcf37ed9 Merge: ce6b714 74dae42 Author: Linus Torvalds Date: Fri Feb 19 13:44:12 2016 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 bugfixes from Ted Ts'o: "Miscellaneous ext4 bug fixes for v4.5" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix crashes in dioread_nolock mode ext4: fix bh->b_state corruption ext4: fix memleak in ext4_readdir() ext4: remove unused parameter "newblock" in convert_initialized_extent() ext4: don't read blocks from disk after extents being swapped ext4: fix potential integer overflow ext4: add a line break for proc mb_groups display ext4: ioctl: fix erroneous return value ext4: fix scheduling in atomic on group checksum failure ext4 crypto: move context consistency check to ext4_file_open() ext4 crypto: revalidate dentry after adding or removing the key commit ce6b71432d42afe5c3ae25ab2980304c32ecb915 Merge: 87d9ac7 413eddc Author: Linus Torvalds Date: Fri Feb 19 13:40:42 2016 -0800 Merge branch 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fix from Chris Mason: "My for-linus-4.5 branch has a btrfs DIO error passing fix. I know how much you love DIO, so I'm going to suggest against reading it. We'll follow up with a patch to drop the error arg from dio_end_io in the next merge window." * 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: fix direct IO requests not reporting IO error to user space commit 87d9ac712b727705dc07e05e851e84387397d696 Merge: 23300f6 52b4b95 Author: Linus Torvalds Date: Fri Feb 19 13:36:00 2016 -0800 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "10 fixes" * emailed patches from Andrew Morton : mm: slab: free kmem_cache_node after destroy sysfs file ipc/shm: handle removed segments gracefully in shm_mmap() MAINTAINERS: update Kselftest Framework mailing list devm_memremap_release(): fix memremap'd addr handling mm/hugetlb.c: fix incorrect proc nr_hugepages value mm, x86: fix pte_page() crash in gup_pte_range() fsnotify: turn fsnotify reaper thread into a workqueue job Revert "fsnotify: destroy marks with call_srcu instead of dedicated thread" mm: fix regression in remap_file_pages() emulation thp, dax: do not try to withdraw pgtable from non-anon VMA commit e817c2f33efb4aa7f02c98dfab9a5f8ff383ea7e Author: Andreas Gruenbacher Date: Thu Feb 18 12:04:08 2016 +0100 selinux: Don't sleep inside inode_getsecid hook The inode_getsecid hook is called from contexts in which sleeping is not allowed, so we cannot revalidate inode security labels from there. Use the non-validating version of inode_security() instead. Reported-by: Benjamin Coddington Signed-off-by: Andreas Gruenbacher Acked-by: Stephen Smalley Signed-off-by: Paul Moore security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d2c3ab4445640957d136caa3629857d63544a2a Author: Paul Bolle Date: Thu Feb 18 21:29:08 2016 +0100 ser_gigaset: use container_of() instead of detour The purpose of gigaset_device_release() is to kfree() the struct ser_cardstate that contains our struct device. This is done via a bit of a detour. First we make our struct device's driver_data point to the container of our struct ser_cardstate (which is a struct cardstate). In gigaset_device_release() we then retrieve that driver_data again. And after that we finally kfree() the struct ser_cardstate that was saved in the struct cardstate. All of this can be achieved much easier by using container_of() to get from our struct device to its container, struct ser_cardstate. Do so. Note that at the time the detour was implemented commit b8b2c7d845d5 ("base/platform: assert that dev_pm_domain callbacks are called unconditionally") had just entered the tree. That commit disconnected our platform_device and our platform_driver. These were reconnected again in v4.5-rc2 through commit 25cad69f21f5 ("base/platform: Fix platform drivers with no probe callback"). And one of the consequences of that fix was that it broke the detour via driver_data. That's because it made __device_release_driver() stop being a NOP for our struct device and actually do stuff again. One of the things it now does, is setting our driver_data to NULL. That, in turn, makes it impossible for gigaset_device_release() to get to our struct cardstate. Which has the net effect of leaking a struct ser_cardstate at every call of this driver's tty close() operation. So using container_of() has the additional benefit of actually working. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Signed-off-by: Paul Bolle Acked-by: Tilman Schmidt Signed-off-by: David S. Miller drivers/isdn/gigaset/ser-gigaset.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 0b7662cf97ee41af03bc8d4498ff4100d0843338 Merge: 1003e19 c699404d Author: David S. Miller Date: Fri Feb 19 15:51:18 2016 -0500 Merge tag 'wireless-drivers-for-davem-2016-02-18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== rtlwifi * fix broken VHT (802.11ac) support, reported by Linus wlcore * fix firmware initialisation regression on wl1271 iwlwifi * fix a race that users reported when we try to load the firmware and the hardware rfkill interrupt triggers at the same time * fix a very visible bug in scheduled scan: the firmware doesn't support scheduled scan with no profile configured and the supplicant sometimes requests such scheduled scans * build system fix to be able to link iwlwifi statically into kernel * firmware name update for 8265 * typo fix in return value ==================== Signed-off-by: David S. Miller commit 1003e19c466dc37812b5f88b2d5308ee63bb3fa0 Author: Steve Wise Date: Thu Feb 18 06:34:24 2016 -0800 cxgb3: fix up vpd strings for kstrto*() The vpd strings are left justified, in a fixed length array, with possible trailing white space and no NUL. So fix them up before calling kstrto*(). This is a recent regression which causes cxgb3 to fail to load. Fixes: e72c932 ("cxgb3: Convert simple_strtoul to kstrtox") Signed-off-by: Steve Wise Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 34 ++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 7 deletions(-) commit c868ee7063bdb53f3ef9eac7bcec84960980b471 Author: Paolo Abeni Date: Wed Feb 17 19:30:01 2016 +0100 lwt: fix rx checksum setting for lwt devices tunneling over ipv6 the commit 35e2d1152b22 ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.") changed the default xmit checksum setting for lwt vxlan/geneve ipv6 tunnels, so that now the checksum is not set into external UDP header. This commit changes the rx checksum setting for both lwt vxlan/geneve devices created by openvswitch accordingly, so that lwt over ipv6 tunnel pairs are again able to communicate with default values. Signed-off-by: Paolo Abeni Acked-by: Jiri Benc Acked-by: Jesse Gross Signed-off-by: David S. Miller drivers/net/geneve.c | 3 ++- net/openvswitch/vport-vxlan.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) commit b53ce3e7d407aa4196877a48b8601181162ab158 Author: Insu Yun Date: Wed Feb 17 11:47:35 2016 -0500 tipc: unlock in error path tipc_bcast_unlock need to be unlocked in error path. Signed-off-by: Insu Yun Signed-off-by: David S. Miller net/tipc/link.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 29d1441dfc737c9422db02e4c95eb4ea0035effd Merge: a97eb33 1bc4e2b Author: David S. Miller Date: Fri Feb 19 15:35:29 2016 -0500 Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge Antonio Quartulli says: ==================== Two of the fixes included in this patchset prevent wrong memory access - it was triggered when removing an object from a list after it was already free'd due to bad reference counting. This misbehaviour existed for both the gw_node and the orig_node_vlan object and has been fixed by Sven Eckelmann. The last patch fixes our interface feasibility check and prevents it from looping indefinitely when two net_device objects reference each other via iflink index (i.e. veth pair), by Andrew Lunn ==================== Signed-off-by: David S. Miller commit a97eb33ff225f34a8124774b3373fd244f0e83ce Author: Anton Protopopov Date: Tue Feb 16 21:43:16 2016 -0500 rtnl: RTM_GETNETCONF: fix wrong return value An error response from a RTM_GETNETCONF request can return the positive error value EINVAL in the struct nlmsgerr that can mislead userspace. Signed-off-by: Anton Protopopov Acked-by: Cong Wang Signed-off-by: David S. Miller net/ipv4/devinet.c | 2 +- net/ipv6/addrconf.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit cfdd28beb3205dbd1e91571516807199c8ab84ca Author: Nikolay Aleksandrov Date: Wed Feb 17 18:00:31 2016 +0100 net: make netdev_for_each_lower_dev safe for device removal When I used netdev_for_each_lower_dev in commit bad531623253 ("vrf: remove slave queue and private slave struct") I thought that it acts like netdev_for_each_lower_private and can be used to remove the current device from the list while walking, but unfortunately it acts more like netdev_for_each_lower_private_rcu and doesn't allow it. The difference is where the "iter" points to, right now it points to the current element and that makes it impossible to remove it. Change the logic to be similar to netdev_for_each_lower_private and make it point to the "next" element so we can safely delete the current one. VRF is the only such user right now, there's no change for the read-only users. Here's what can happen now: [98423.249858] general protection fault: 0000 [#1] SMP [98423.250175] Modules linked in: vrf bridge(O) stp llc nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace sunrpc crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ppdev aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd evdev serio_raw pcspkr virtio_balloon parport_pc parport i2c_piix4 i2c_core virtio_console acpi_cpufreq button 9pnet_virtio 9p 9pnet fscache ipv6 autofs4 ext4 crc16 mbcache jbd2 sg virtio_blk virtio_net sr_mod cdrom e1000 ata_generic ehci_pci uhci_hcd ehci_hcd usbcore usb_common virtio_pci ata_piix libata floppy virtio_ring virtio scsi_mod [last unloaded: bridge] [98423.255040] CPU: 1 PID: 14173 Comm: ip Tainted: G O 4.5.0-rc2+ #81 [98423.255386] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [98423.255777] task: ffff8800547f5540 ti: ffff88003428c000 task.ti: ffff88003428c000 [98423.256123] RIP: 0010:[] [] netdev_lower_get_next+0x1e/0x30 [98423.256534] RSP: 0018:ffff88003428f940 EFLAGS: 00010207 [98423.256766] RAX: 0002000100000004 RBX: ffff880054ff9000 RCX: 0000000000000000 [98423.257039] RDX: ffff88003428f8b8 RSI: ffff88003428f950 RDI: ffff880054ff90c0 [98423.257287] RBP: ffff88003428f940 R08: 0000000000000000 R09: 0000000000000000 [98423.257537] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003428f9e0 [98423.257802] R13: ffff880054a5fd00 R14: ffff88003428f970 R15: 0000000000000001 [98423.258055] FS: 00007f3d76881700(0000) GS:ffff88005d000000(0000) knlGS:0000000000000000 [98423.258418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [98423.258650] CR2: 00007ffe5951ffa8 CR3: 0000000052077000 CR4: 00000000000406e0 [98423.258902] Stack: [98423.259075] ffff88003428f960 ffffffffa0442636 0002000100000004 ffff880054ff9000 [98423.259647] ffff88003428f9b0 ffffffff81518205 ffff880054ff9000 ffff88003428f978 [98423.260208] ffff88003428f978 ffff88003428f9e0 ffff88003428f9e0 ffff880035b35f00 [98423.260739] Call Trace: [98423.260920] [] vrf_dev_uninit+0x76/0xa0 [vrf] [98423.261156] [] rollback_registered_many+0x205/0x390 [98423.261401] [] unregister_netdevice_many+0x1c/0x70 [98423.261641] [] rtnl_delete_link+0x3c/0x50 [98423.271557] [] rtnl_dellink+0xcb/0x1d0 [98423.271800] [] ? __inc_zone_state+0x4a/0x90 [98423.272049] [] rtnetlink_rcv_msg+0x84/0x200 [98423.272279] [] ? trace_hardirqs_on+0xd/0x10 [98423.272513] [] ? rtnetlink_rcv+0x1b/0x40 [98423.272755] [] ? rtnetlink_rcv+0x40/0x40 [98423.272983] [] netlink_rcv_skb+0x97/0xb0 [98423.273209] [] rtnetlink_rcv+0x2a/0x40 [98423.273476] [] netlink_unicast+0x11b/0x1a0 [98423.273710] [] netlink_sendmsg+0x3e1/0x610 [98423.273947] [] sock_sendmsg+0x38/0x70 [98423.274175] [] ___sys_sendmsg+0x2e3/0x2f0 [98423.274416] [] ? do_raw_spin_unlock+0xbe/0x140 [98423.274658] [] ? handle_mm_fault+0x26c/0x2210 [98423.274894] [] ? handle_mm_fault+0x4d/0x2210 [98423.275130] [] ? __fget_light+0x91/0xb0 [98423.275365] [] __sys_sendmsg+0x42/0x80 [98423.275595] [] SyS_sendmsg+0x12/0x20 [98423.275827] [] entry_SYSCALL_64_fastpath+0x16/0x7a [98423.276073] Code: c3 31 c0 5d c3 0f 1f 84 00 00 00 00 00 66 66 66 66 90 48 8b 06 55 48 81 c7 c0 00 00 00 48 89 e5 48 8b 00 48 39 f8 74 09 48 89 06 <48> 8b 40 e8 5d c3 31 c0 5d c3 0f 1f 84 00 00 00 00 00 66 66 66 [98423.279639] RIP [] netdev_lower_get_next+0x1e/0x30 [98423.279920] RSP CC: David Ahern CC: David S. Miller CC: Roopa Prabhu CC: Vlad Yasevich Fixes: bad531623253 ("vrf: remove slave queue and private slave struct") Signed-off-by: Nikolay Aleksandrov Reviewed-by: David Ahern Tested-by: David Ahern Signed-off-by: David S. Miller include/linux/netdevice.h | 2 +- net/core/dev.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit 6697b2cf69d4363266ca47eaebc49ef13dabc1c9 Author: Dan Williams Date: Thu Feb 4 16:51:00 2016 -0800 nfit: fix multi-interface dimm handling, acpi6.1 compatibility ACPI 6.1 clarified that multi-interface dimms require multiple control region entries (DCRs) per dimm. Previously we were assuming that a control region is only present when block-data-windows are present. This implementation was done with an eye to be compatibility with the looser ACPI 6.0 interpretation of this table. 1/ When coalescing the memory device (MEMDEV) tables for a single dimm, coalesce on device_handle rather than control region index. 2/ Whenever we disocver a control region with non-zero block windows re-scan for block-data-window (BDW) entries. We may need to revisit this if a DIMM ever implements a format interface outside of blk or pmem, but that is not on the foreseeable horizon. Cc: Signed-off-by: Dan Williams drivers/acpi/nfit.c | 71 ++++++++++++++++++++++++++--------------------------- 1 file changed, 35 insertions(+), 36 deletions(-) commit 6e22c8366416251a3d88ba6c92d13d595089f0ed Author: Yang Shi Date: Fri Feb 12 12:46:00 2016 -0800 tracing, kasan: Silence Kasan warning in check_stack of stack_tracer When enabling stack trace via "echo 1 > /proc/sys/kernel/stack_tracer_enabled", the below KASAN warning is triggered: BUG: KASAN: stack-out-of-bounds in check_stack+0x344/0x848 at addr ffffffc0689ebab8 Read of size 8 by task ksoftirqd/4/29 page:ffffffbdc3a27ac0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x0() page dumped because: kasan: bad access detected CPU: 4 PID: 29 Comm: ksoftirqd/4 Not tainted 4.5.0-rc1 #129 Hardware name: Freescale Layerscape 2085a RDB Board (DT) Call trace: [] dump_backtrace+0x0/0x3a0 [] show_stack+0x24/0x30 [] dump_stack+0xd8/0x168 [] kasan_report_error+0x6a0/0x920 [] kasan_report+0x70/0xb8 [] __asan_load8+0x60/0x78 [] check_stack+0x344/0x848 [] stack_trace_call+0x1c4/0x370 [] ftrace_ops_no_ops+0x2c0/0x590 [] ftrace_graph_call+0x0/0x14 [] fpsimd_thread_switch+0x24/0x1e8 [] __switch_to+0x34/0x218 [] __schedule+0x3ac/0x15b8 [] schedule+0x5c/0x178 [] smpboot_thread_fn+0x350/0x960 [] kthread+0x1d8/0x2b0 [] ret_from_fork+0x10/0x40 Memory state around the buggy address: ffffffc0689eb980: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f4 f4 f4 ffffffc0689eba00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffc0689eba80: 00 00 f1 f1 f1 f1 00 f4 f4 f4 f3 f3 f3 f3 00 00 ^ ffffffc0689ebb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0689ebb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 The stacker tracer traverses the whole kernel stack when saving the max stack trace. It may touch the stack red zones to cause the warning. So, just disable the instrumentation to silence the warning. Link: http://lkml.kernel.org/r/1455309960-18930-1-git-send-email-yang.shi@linaro.org Signed-off-by: Yang Shi Signed-off-by: Steven Rostedt kernel/trace/trace_stack.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9a154c8911e39e32bdbc2cd6c9b08a64e17612aa Author: Steven Rostedt Date: Fri Dec 11 14:36:17 2015 -0500 ftracetest: Fix instance test to use proper shell command for pids The ftracetest instance test used parsing of the "jobs" output to find the pid of the subshell that is executed previously. But this is not portable to all major shells that may run these tests. The proper way to get the pid of the subshell is the shell command "$!". This will return the pid of the previously executed command. Use that instead, otherwise the test does not work in all environments. Link: http://lkml.kernel.org/r/20151211143617.65f4d7a1@gandalf.local.home Reported-by: Michael Ellerman Signed-off-by: Steven Rostedt .../testing/selftests/ftrace/test.d/instances/instance.tc | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) commit e327b3f564031a8d0090a6b3e3562a8b59bafe0e Author: Peter Ujfalusi Date: Fri Feb 19 16:12:19 2016 +0200 Revert "regulator: tps65217: remove tps65217.dtsi file" This reverts commit 8e6ebfaa9b384088002baa10f7534efa73a0794e. Without the patch reverted regulators will not work. This prevents MMC to be working for example so the boards can not boot to MMC rootfs. Tested it on beaglebone white and bisect also points to the reverted commit. The issue can be also fixed by adding "regulator-compatible =" to all board dts file for the regulators. Signed-off-by: Peter Ujfalusi Signed-off-by: Tony Lindgren .../devicetree/bindings/regulator/tps65217.txt | 10 ---- arch/arm/boot/dts/am335x-bone-common.dtsi | 14 ++---- arch/arm/boot/dts/am335x-chilisom.dtsi | 14 +----- arch/arm/boot/dts/am335x-nano.dts | 14 +----- arch/arm/boot/dts/am335x-pepper.dts | 14 +----- arch/arm/boot/dts/am335x-sl50.dts | 13 +---- arch/arm/boot/dts/tps65217.dtsi | 56 ++++++++++++++++++++++ 7 files changed, 67 insertions(+), 68 deletions(-) commit 23300f657594656e7ebac3130b43460ebc4381cc Merge: ff5f168 52d7523 Author: Linus Torvalds Date: Fri Feb 19 08:40:05 2016 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Here are some more arm64 fixes for 4.5. This has mostly come from Yang Shi, who saw some issues under -rt that also affect mainline. The rest of it is pretty small, but still worth having. We've got an old issue outstanding with valid_user_regs which will likely wait until 4.6 (since it would really benefit from some time in -next) and another issue with kasan and idle which should be fixed next week. Apart from that, pretty quiet here (and still no sign of the THP issue reported on s390...) Summary: - Allow EFI stub to use strnlen(), which is required by recent libfdt - Avoid smp_processor_id() in preempt context during unwinding - Avoid false Kasan warnings during unwinding - Ensure early devices are picked up by the IOMMU DMA ops - Avoid rebuilding the kernel for the 'install' target - Run fixup handlers for alignment faults on userspace access" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: allow the kernel to handle alignment faults on user accesses arm64: kbuild: make "make install" not depend on vmlinux arm64: dma-mapping: fix handling of devices registered before arch_initcall arm64/efi: Make strnlen() available to the EFI namespace arm/arm64: crypto: assure that ECB modes don't require an IV arm64: make irq_stack_ptr more robust arm64: debug: re-enable irqs before sending breakpoint SIGTRAP arm64: disable kasan when accessing frame->fp in unwind_frame commit ff5f16820f632079d5095884adc5d71ee3249fa4 Merge: 409ee13 12d319b Author: Linus Torvalds Date: Fri Feb 19 08:33:12 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Several bug fixes: - There are four different stack tracers, and three of them have bugs. For 4.5 the bugs are fixed and we prepare a cleanup patch for the next merge window. - Three bug fixes for the dasd driver in regard to parallel access volumes and the new max_dev_sectors block device queue limit - The irq restore optimization needs a fixup for memcpy_real - The diagnose trace code has a conflict with lockdep" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/dasd: fix performance drop s390/maccess: reduce stnsm instructions s390/diag: avoid lockdep recursion s390/dasd: fix refcount for PAV reassignment s390/dasd: prevent incorrect length error under z/VM after PAV changes s390: fix DAT off memory access, e.g. on kdump s390/oprofile: fix address range for asynchronous stack s390/perf_event: fix address range for asynchronous stack s390/stacktrace: add save_stack_trace_regs() s390/stacktrace: save full stack traces s390/stacktrace: add missing end marker s390/stacktrace: fix address ranges for asynchronous and panic stack s390/stacktrace: fix save_stack_trace_tsk() for current task commit 409ee136f28f71cbec518cfc85a379a508ccbaa0 Merge: 9001b8e d9ff0eb Author: Linus Torvalds Date: Fri Feb 19 08:25:40 2016 -0800 Merge tag 'pinctrl-v4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull Pin control fixes from Linus Walleij: "Pin control fixes for the v4.5 series, all are individual driver fixes: - Fix the PXA2xx driver to export its init function so we do not break modular compiles. - Hide unused functions in the Nomadik driver. - Fix up direction control in the Mediatek driver. - Toggle the sunxi GPIO lines to input when you read them on the H3 GPIO controller, lest you only get garbage. - Fix up the number of settings in the MVEBU driver. - Fix a serious SMP race condition in the Samsung driver" * tag 'pinctrl-v4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: samsung: fix SMP race condition pinctrl: mvebu: fix num_settings in mpp group assignment pinctrl: sunxi: H3 requires irq_read_needs_mux pinctrl: mediatek: fix direction control issue pinctrl: nomadik: hide unused functions pinctrl: pxa: export pxa2xx_pinctrl_init() commit 9001b8e4f08dd7ae8429214979bd7783160932c5 Merge: 705d43d 67ec107 Author: Linus Torvalds Date: Fri Feb 19 08:01:41 2016 -0800 Merge tag 'sound-4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This update contains again a few more fixes for ALSA core stuff although it's no longer high flux: two race fixes in sequencer and one PCM race fix for non-atomic PCM ops. In addition, HD-audio gained a similar fix for race at reloading the driver" * tag 'sound-4.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream ALSA: seq: Fix double port list deletion ALSA: hda - Cancel probe work instead of flush at remove ALSA: seq: Fix leak of pool buffer at concurrent writes commit 65b4bcb82967fd5a60694c3477e58a04a9170aea Author: Alan Date: Fri Feb 19 11:42:32 2016 +0530 ASoC: Intel: Skylake: fix pointer scaling skl_tplg_tlv_control_set does pointer maths on data but forgets that data is not uint8_t so the maths is already scaled in the pointer type. Signed-off-by: Alan Cox Signed-off-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 316fa9e09ad76e095b9d7e9350c628b918370a22 Author: Charles Keepax Date: Thu Feb 18 15:47:13 2016 +0000 ASoC: samsung: Use IRQ safe spin lock calls Lockdep warns of a potential lock inversion, i2s->lock is held numerous times whilst we are under the substream lock (snd_pcm_stream_lock). If we use the IRQ unsafe spin lock calls, you can also end up locking snd_pcm_stream_lock whilst under i2s->lock (if an IRQ happens whilst we are holding i2s->lock). This could result in deadlock. [ 18.147001] CPU0 CPU1 [ 18.151509] ---- ---- [ 18.156022] lock(&(&pri_dai->spinlock)->rlock); [ 18.160701] local_irq_disable(); [ 18.166622] lock(&(&substream->self_group.lock)->rlock); [ 18.174595] lock(&(&pri_dai->spinlock)->rlock); [ 18.181806] [ 18.184408] lock(&(&substream->self_group.lock)->rlock); [ 18.190045] [ 18.190045] *** DEADLOCK *** This patch changes to using the irq safe spinlock calls, to avoid this issue. Fixes: ce8bcdbb61d9 ("ASoC: samsung: i2s: Protect more registers with a spinlock") Signed-off-by: Charles Keepax Tested-by: Anand Moon Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/samsung/i2s.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 52d7523d84d534c241ebac5ac89f5c0a6cb51e41 Author: EunTaik Lee Date: Tue Feb 16 04:44:35 2016 +0000 arm64: mm: allow the kernel to handle alignment faults on user accesses Although we don't expect to take alignment faults on access to normal memory, misbehaving (i.e. buggy) user code can pass MMIO pointers into system calls, leading to things like get_user accessing device memory. Rather than OOPS the kernel, allow any exception fixups to run and return something like -EFAULT back to userspace. This makes the behaviour more consistent with userspace, even though applications with access to device mappings can easily cause other issues if they try hard enough. Acked-by: Catalin Marinas Signed-off-by: Eun Taik Lee [will: dropped __kprobes annotation and rewrote commit mesage] Signed-off-by: Will Deacon arch/arm64/mm/fault.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 8684fa3e7a9ee629ca60bd811d1597646451f918 Author: Masahiro Yamada Date: Fri Feb 19 15:05:50 2016 +0900 arm64: kbuild: make "make install" not depend on vmlinux For the same reason as commit 19514fc665ff ("arm, kbuild: make "make install" not depend on vmlinux"), the install targets should never trigger the rebuild of the kernel. Signed-off-by: Masahiro Yamada Signed-off-by: Will Deacon arch/arm64/Makefile | 2 +- arch/arm64/boot/Makefile | 4 ++-- arch/arm64/boot/install.sh | 14 ++++++++++++++ 3 files changed, 17 insertions(+), 3 deletions(-) commit 8c0614ca312c847ca5409ea11c39434dec69631d Author: Wei Yongjun Date: Sat Feb 6 22:57:06 2016 +0800 usb: chipidea: fix return value check in ci_hdrc_pci_probe() In case of error, the function usb_phy_generic_register() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun Signed-off-by: Peter Chen drivers/usb/chipidea/ci_hdrc_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a4de018d2b0364e40a626fa521ec21e31a10ac84 Author: Alan Date: Mon Feb 15 19:09:46 2016 +0000 usb: chipidea: error on overflow for port_test_write The write value is 8bit, but currently writing a larger number (eg a doubled digit) is not errored but instead gets cast and sets off an action probably undesired. Signed-off-by: Alan Cox Signed-off-by: Peter Chen (Change the style of commit log to fix checkpatch.pl warning) drivers/usb/chipidea/debug.c | 3 +++ 1 file changed, 3 insertions(+) commit 74dae4278546b897eb81784fdfcce872ddd8b2b8 Author: Jan Kara Date: Fri Feb 19 00:33:21 2016 -0500 ext4: fix crashes in dioread_nolock mode Competing overwrite DIO in dioread_nolock mode will just overwrite pointer to io_end in the inode. This may result in data corruption or extent conversion happening from IO completion interrupt because we don't properly set buffer_defer_completion() when unlocked DIO races with locked DIO to unwritten extent. Since unlocked DIO doesn't need io_end for anything, just avoid allocating it and corrupting pointer from inode for locked DIO. A cleaner fix would be to avoid these games with io_end pointer from the inode but that requires more intrusive changes so we leave that for later. Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit ed8ad83808f009ade97ebbf6519bc3a97fefbc0c Author: Jan Kara Date: Fri Feb 19 00:18:25 2016 -0500 ext4: fix bh->b_state corruption ext4 can update bh->b_state non-atomically in _ext4_get_block() and ext4_da_get_block_prep(). Usually this is fine since bh is just a temporary storage for mapping information on stack but in some cases it can be fully living bh attached to a page. In such case non-atomic update of bh->b_state can race with an atomic update which then gets lost. Usually when we are mapping bh and thus updating bh->b_state non-atomically, nobody else touches the bh and so things work out fine but there is one case to especially worry about: ext4_finish_bio() uses BH_Uptodate_Lock on the first bh in the page to synchronize handling of PageWriteback state. So when blocksize < pagesize, we can be atomically modifying bh->b_state of a buffer that actually isn't under IO and thus can race e.g. with delalloc trying to map that buffer. The result is that we can mistakenly set / clear BH_Uptodate_Lock bit resulting in the corruption of PageWriteback state or missed unlock of BH_Uptodate_Lock. Fix the problem by always updating bh->b_state bits atomically. CC: stable@vger.kernel.org Reported-by: Nikolay Borisov Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) commit 4fbbed46dca83bcba3a0170205110a06c116a8e6 Author: Rasmus Villemoes Date: Mon Feb 15 19:41:46 2016 +0100 drm/nouveau: use post-decrement in error handling We need to use post-decrement to get the dma_map_page undone also for i==0, and to avoid some very unpleasant behaviour if dma_map_page failed already at i==0. Signed-off-by: Rasmus Villemoes Reviewed-by: Ben Skeggs Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5fff80bbdb6b84a94f90391ba674471d37b57eb2 Author: Maarten Lankhorst Date: Wed Feb 17 08:32:05 2016 +0100 drm/atomic: Allow for holes in connector state, v2. Because we record connector_mask using 1 << drm_connector_index now the connector_mask should stay the same even when other connectors are removed. This was not the case with MST, in that case when removing a connector all other connectors may change their index. This is fixed by waiting until the first get_connector_state to allocate connector_state, and force reallocation when state is too small. As a side effect connector arrays no longer have to be preallocated, and can be allocated on first use which means a less allocations in the page flip only path. Changes since v1: - Whitespace. (Ville) - Call ida_remove when destroying the connector. (Ville) - u32 alloc -> int. (Ville) Fixes: 14de6c44d149 ("drm/atomic: Remove drm_atomic_connectors_for_crtc.") Signed-off-by: Maarten Lankhorst Cc: Ville Syrjälä Reviewed-by: Lyude Reviewed-by: Ville Syrjälä Signed-off-by: Dave Airlie drivers/gpu/drm/drm_atomic.c | 44 +++++++++++++++------------------ drivers/gpu/drm/drm_atomic_helper.c | 2 +- drivers/gpu/drm/drm_crtc.c | 49 +++++++++++++++---------------------- include/drm/drm_crtc.h | 8 +++++- 4 files changed, 48 insertions(+), 55 deletions(-) commit acc146943957d7418a6846f06e029b2c5e87e0d5 Author: Peter Rosin Date: Thu Feb 18 14:07:52 2016 +0100 hwmon: (ads1015) Handle negative conversion values correctly Make the divisor signed as DIV_ROUND_CLOSEST is undefined for negative dividends when the divisor is unsigned. Signed-off-by: Peter Rosin Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck drivers/hwmon/ads1015.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4462b4bbfc33a44f19710ead784ff361bda2c3b3 Author: Stephen Boyd Date: Thu Feb 18 19:07:44 2016 -0800 clk: gpio: Really allow an optional clock= DT property We mis-merged the original patch from Russell here and so the patch went almost all the way, except that we still failed to probe when there wasn't a clocks property in the DT node. Allow that case by making a negative value from of_clk_get_parent_count() into "no parents", like the original patch did. Fixes: 7ed88aa2efa5 ("clk: fix clk-gpio.c with optional clock= DT property") Cc: Russell King Cc: Michael Turquette Signed-off-by: Stephen Boyd drivers/clk/clk-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5441ea115ef153458b443917b02c7f5686cc2bd7 Merge: aaa7dd2 36cb625 Author: Dave Airlie Date: Fri Feb 19 12:50:00 2016 +1000 Merge tag 'drm-vc4-fixes-2016-02-17' of github.com:anholt/linux into drm-fixes This pull request fixes GPU reset (which was disabled shortly after V3D integration due to build breakage) and waits for idle in the presence of signals (which X likes to do a lot). * tag 'drm-vc4-fixes-2016-02-17' of github.com:anholt/linux: drm/vc4: Use runtime PM to power cycle the device when the GPU hangs. drm/vc4: Enable runtime PM. drm/vc4: Fix spurious GPU resets due to BO reuse. drm/vc4: Drop error message on seqno wait timeouts. drm/vc4: Fix -ERESTARTSYS error return from BO waits. drm/vc4: Return an ERR_PTR from BO creation instead of NULL. drm/vc4: Fix the clear color for the first tile rendered. drm/vc4: Validate that WAIT_BO padding is cleared. commit aaa7dd2ced17c8e977faeadc4884c422456371c5 Merge: 42412b1 bc3f5d8 Author: Dave Airlie Date: Fri Feb 19 12:49:03 2016 +1000 Merge branch 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Just two small fixes in the ttm_tt_populate error handling; one for radeon, one for amdgpu. * 'drm-fixes-4.5' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: use post-decrement in error handling drm/amdgpu: use post-decrement in error handling commit 42412b120d2877df40171c5ea22218f30fe89e20 Merge: 705d43d 8d409cb Author: Dave Airlie Date: Fri Feb 19 12:43:03 2016 +1000 Merge tag 'drm-intel-fixes-2016-02-18' of git://anongit.freedesktop.org/drm-intel into drm-fixes single g4x hpd fix. * tag 'drm-intel-fixes-2016-02-18' of git://anongit.freedesktop.org/drm-intel: drm/i915: Fix hpd live status bits for g4x commit d07fbb8fdf57c4af28679ad7c4b2542e78ca7218 Merge: 437b300 9f74660 Author: Trond Myklebust Date: Thu Feb 18 20:22:03 2016 -0500 Merge tag 'nfs-rdma-4.5-1' of git://git.linux-nfs.org/projects/anna/nfs-rdma NFS: NFSoRDMA Client Bugfix This patch fixes a bug where NFS v4.1 callbacks were returning RPC_GARBAGE_ARGS to the server. Signed-off-by: Anna Schumaker commit 705d43dbe10d6e213a75187ac92b61f9bd00af0b Merge: dd8fc10 7dcd182 Author: Linus Torvalds Date: Thu Feb 18 16:34:15 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching Pull livepatching fixes from Jiri Kosina: - regression (from 4.4) fix for ordering issue, introduced by an earlier ftrace change, that broke live patching of modules. The fix replaces the ftrace module notifier by direct call in order to make the ordering guaranteed and well-defined. The patch, from Jessica Yu, has been acked both by Steven and Rusty - error message fix from Miroslav Benes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: ftrace/module: remove ftrace module notifier livepatch: change the error message in asm/livepatch.h header files commit dd8fc10e606127e2dffdb6704e7ec203c86a214d Merge: 2850713 2a8d9cd Author: Linus Torvalds Date: Thu Feb 18 16:24:48 2016 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two simple fixes. One prevents a soft lockup on some target removal scenarios and the other prevents us trying to probe the marvell console device, which causes it to time out and need the bus resetting" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: fix soft lockup in scsi_remove_target() on module removal SCSI: Add Marvell configuration device to VPD blacklist commit 52b4b950b50740bff507a62907e86710743c22e7 Author: Dmitry Safonov Date: Wed Feb 17 13:11:37 2016 -0800 mm: slab: free kmem_cache_node after destroy sysfs file When slub_debug alloc_calls_show is enabled we will try to track location and user of slab object on each online node, kmem_cache_node structure and cpu_cache/cpu_slub shouldn't be freed till there is the last reference to sysfs file. This fixes the following panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 IP: list_locations+0x169/0x4e0 PGD 257304067 PUD 438456067 PMD 0 Oops: 0000 [#1] SMP CPU: 3 PID: 973074 Comm: cat ve: 0 Not tainted 3.10.0-229.7.2.ovz.9.30-00007-japdoll-dirty #2 9.30 Hardware name: DEPO Computers To Be Filled By O.E.M./H67DE3, BIOS L1.60c 07/14/2011 task: ffff88042a5dc5b0 ti: ffff88037f8d8000 task.ti: ffff88037f8d8000 RIP: list_locations+0x169/0x4e0 Call Trace: alloc_calls_show+0x1d/0x30 slab_attr_show+0x1b/0x30 sysfs_read_file+0x9a/0x1a0 vfs_read+0x9c/0x170 SyS_read+0x58/0xb0 system_call_fastpath+0x16/0x1b Code: 5e 07 12 00 b9 00 04 00 00 3d 00 04 00 00 0f 4f c1 3d 00 04 00 00 89 45 b0 0f 84 c3 00 00 00 48 63 45 b0 49 8b 9c c4 f8 00 00 00 <48> 8b 43 20 48 85 c0 74 b6 48 89 df e8 46 37 44 00 48 8b 53 10 CR2: 0000000000000020 Separated __kmem_cache_release from __kmem_cache_shutdown which now called on slab_kmem_cache_release (after the last reference to sysfs file object has dropped). Reintroduced locking in free_partial as sysfs file might access cache's partial list after shutdowning - partial revert of the commit 69cb8e6b7c29 ("slub: free slabs without holding locks"). Zap __remove_partial and use remove_partial (w/o underscores) as free_partial now takes list_lock which s partial revert for commit 1e4dd9461fab ("slub: do not assert not having lock in removing freed partial") Signed-off-by: Dmitry Safonov Suggested-by: Vladimir Davydov Acked-by: Vladimir Davydov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 12 ++++++------ mm/slab.h | 1 + mm/slab_common.c | 1 + mm/slob.c | 4 ++++ mm/slub.c | 38 +++++++++++++++++--------------------- 5 files changed, 29 insertions(+), 27 deletions(-) commit 1ac0b6dec656f3f78d1c3dd216fad84cb4d0a01e Author: Kirill A. Shutemov Date: Wed Feb 17 13:11:35 2016 -0800 ipc/shm: handle removed segments gracefully in shm_mmap() remap_file_pages(2) emulation can reach file which represents removed IPC ID as long as a memory segment is mapped. It breaks expectations of IPC subsystem. Test case (rewritten to be more human readable, originally autogenerated by syzkaller[1]): #define _GNU_SOURCE #include #include #include #include #define PAGE_SIZE 4096 int main() { int id; void *p; id = shmget(IPC_PRIVATE, 3 * PAGE_SIZE, 0); p = shmat(id, NULL, 0); shmctl(id, IPC_RMID, NULL); remap_file_pages(p, 3 * PAGE_SIZE, 0, 7, 0); return 0; } The patch changes shm_mmap() and code around shm_lock() to propagate locking error back to caller of shm_mmap(). [1] http://github.com/google/syzkaller Signed-off-by: Kirill A. Shutemov Reported-by: Dmitry Vyukov Cc: Davidlohr Bueso Cc: Manfred Spraul Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ipc/shm.c | 53 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 10 deletions(-) commit 64f00850011b834746bab94119d1d5eb7eabb19a Author: Shuah Khan Date: Wed Feb 17 13:11:32 2016 -0800 MAINTAINERS: update Kselftest Framework mailing list Kselftest Framework now has a dedicated mailing list linux-kselftest. Update the entry in MAINTAINERS file. Signed-off-by: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9273a8bbf58a15051e53a777389a502420ddc60e Author: Toshi Kani Date: Wed Feb 17 13:11:29 2016 -0800 devm_memremap_release(): fix memremap'd addr handling The pmem driver calls devm_memremap() to map a persistent memory range. When the pmem driver is unloaded, this memremap'd range is not released so the kernel will leak a vma. Fix devm_memremap_release() to handle a given memremap'd address properly. Signed-off-by: Toshi Kani Acked-by: Dan Williams Cc: Christoph Hellwig Cc: Ross Zwisler Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f8b74815a452ff2904b5d7fcce1a5ae2a4d7ca5e Author: Vaishali Thakkar Date: Wed Feb 17 13:11:26 2016 -0800 mm/hugetlb.c: fix incorrect proc nr_hugepages value Currently incorrect default hugepage pool size is reported by proc nr_hugepages when number of pages for the default huge page size is specified twice. When multiple huge page sizes are supported, /proc/sys/vm/nr_hugepages indicates the current number of pre-allocated huge pages of the default size. Basically /proc/sys/vm/nr_hugepages displays default_hstate-> max_huge_pages and after boot time pre-allocation, max_huge_pages should equal the number of pre-allocated pages (nr_hugepages). Test case: Note that this is specific to x86 architecture. Boot the kernel with command line option 'default_hugepagesz=1G hugepages=X hugepagesz=2M hugepages=Y hugepagesz=1G hugepages=Z'. After boot, 'cat /proc/sys/vm/nr_hugepages' and 'sysctl -a | grep hugepages' returns the value X. However, dmesg output shows that Z huge pages were pre-allocated. So, the root cause of the problem here is that the global variable default_hstate_max_huge_pages is set if a default huge page size is specified (directly or indirectly) on the command line. After the command line processing in hugetlb_init, if default_hstate_max_huge_pages is set, the value is assigned to default_hstae.max_huge_pages. However, default_hstate.max_huge_pages may have already been set based on the number of pre-allocated huge pages of default_hstate size. The solution to this problem is if hstate->max_huge_pages is already set then it should not set as a result of global max_huge_pages value. Basically if the value of the variable hugepages is set multiple times on a command line for a specific supported hugepagesize then proc layer should consider the last specified value. Signed-off-by: Vaishali Thakkar Reviewed-by: Naoya Horiguchi Cc: Mike Kravetz Cc: Hillf Danton Cc: Kirill A. Shutemov Cc: Dave Hansen Cc: Paul Gortmaker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 457a98b0809fa6cde7aab8c314a59d99772b445e Author: Hugh Dickins Date: Wed Feb 17 13:11:23 2016 -0800 mm, x86: fix pte_page() crash in gup_pte_range() Commit 3565fce3a659 ("mm, x86: get_user_pages() for dax mappings") has moved up the pte_page(pte) in x86's fast gup_pte_range(), for no discernible reason: put it back where it belongs, after the pte_flags check and the pfn_valid cross-check. That may be the cause of the NULL pointer dereference in gup_pte_range(), seen when vfio called vaddr_get_pfn() when starting a qemu-kvm based VM. Signed-off-by: Hugh Dickins Reported-by: Michael Long Tested-by: Michael Long Acked-by: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0918f1c309b86301605650c836ddd2021d311ae2 Author: Jeff Layton Date: Wed Feb 17 13:11:21 2016 -0800 fsnotify: turn fsnotify reaper thread into a workqueue job We don't require a dedicated thread for fsnotify cleanup. Switch it over to a workqueue job instead that runs on the system_unbound_wq. In the interest of not thrashing the queued job too often when there are a lot of marks being removed, we delay the reaper job slightly when queueing it, to allow several to gather on the list. Signed-off-by: Jeff Layton Tested-by: Eryu Guan Reviewed-by: Jan Kara Cc: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/notify/mark.c | 49 ++++++++++++++++++------------------------------- 1 file changed, 18 insertions(+), 31 deletions(-) commit 13d34ac6e55b8284c592c67e166ac614b3c4c1d7 Author: Jeff Layton Date: Wed Feb 17 13:11:18 2016 -0800 Revert "fsnotify: destroy marks with call_srcu instead of dedicated thread" This reverts commit c510eff6beba ("fsnotify: destroy marks with call_srcu instead of dedicated thread"). Eryu reported that he was seeing some OOM kills kick in when running a testcase that adds and removes inotify marks on a file in a tight loop. The above commit changed the code to use call_srcu to clean up the marks. While that does (in principle) work, the srcu callback job is limited to cleaning up entries in small batches and only once per jiffy. It's easily possible to overwhelm that machinery with too many call_srcu callbacks, and Eryu's reproduer did just that. There's also another potential problem with using call_srcu here. While you can obviously sleep while holding the srcu_read_lock, the callbacks run under local_bh_disable, so you can't sleep there. It's possible when putting the last reference to the fsnotify_mark that we'll end up putting a chain of references including the fsnotify_group, uid, and associated keys. While I don't see any obvious ways that that could occurs, it's probably still best to avoid using call_srcu here after all. This patch reverts the above patch. A later patch will take a different approach to eliminated the dedicated thread here. Signed-off-by: Jeff Layton Reported-by: Eryu Guan Tested-by: Eryu Guan Cc: Jan Kara Cc: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/notify/mark.c | 66 +++++++++++++++++++++++++++++++--------- include/linux/fsnotify_backend.h | 5 +-- 2 files changed, 53 insertions(+), 18 deletions(-) commit 48f7df329474b49d83d0dffec1b6186647f11976 Author: Kirill A. Shutemov Date: Wed Feb 17 13:11:15 2016 -0800 mm: fix regression in remap_file_pages() emulation Grazvydas Ignotas has reported a regression in remap_file_pages() emulation. Testcase: #define _GNU_SOURCE #include #include #include #include #define SIZE (4096 * 3) int main(int argc, char **argv) { unsigned long *p; long i; p = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); if (p == MAP_FAILED) { perror("mmap"); return -1; } for (i = 0; i < SIZE / 4096; i++) p[i * 4096 / sizeof(*p)] = i; if (remap_file_pages(p, 4096, 0, 1, 0)) { perror("remap_file_pages"); return -1; } if (remap_file_pages(p, 4096 * 2, 0, 1, 0)) { perror("remap_file_pages"); return -1; } assert(p[0] == 1); munmap(p, SIZE); return 0; } The second remap_file_pages() fails with -EINVAL. The reason is that remap_file_pages() emulation assumes that the target vma covers whole area we want to over map. That assumption is broken by first remap_file_pages() call: it split the area into two vma. The solution is to check next adjacent vmas, if they map the same file with the same flags. Fixes: c8d78c1823f4 ("mm: replace remap_file_pages() syscall with emulation") Signed-off-by: Kirill A. Shutemov Reported-by: Grazvydas Ignotas Tested-by: Grazvydas Ignotas Cc: [4.0+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mmap.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) commit 69a8ec2d8155b9121ca2990d43f8363b8e2bf550 Author: Kirill A. Shutemov Date: Wed Feb 17 13:11:12 2016 -0800 thp, dax: do not try to withdraw pgtable from non-anon VMA DAX doesn't deposit pgtables when it maps huge pages: nothing to withdraw. It can lead to crash. Signed-off-by: Kirill A. Shutemov Cc: Dan Williams Cc: Matthew Wilcox Cc: Andrea Arcangeli Cc: Ross Zwisler Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ba4a3550e93415f4ff300810b8d0659949fea193 Author: Gao Pan Date: Mon Jan 18 15:44:01 2016 +0800 spi: imx: fix spi resource leak with dma transfer In spi_imx_dma_transfer(), when desc_rx = dmaengine_prep_slave_sg() fails, the context goes to label no_dma and then return. However, the memory allocated for desc_tx has not been freed yet, which leads to resource leak. Signed-off-by: Gao Pan Reviewed-by: Fugang Duan Signed-off-by: Mark Brown drivers/spi/spi-imx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit f3bb23764fac042d189129d485d3a9246cb777da Author: Arnd Bergmann Date: Wed Feb 17 23:25:11 2016 +0100 USB: cdc_subset: only build when one driver is enabled This avoids a harmless randconfig warning I get when USB_NET_CDC_SUBSET is enabled, but all of the more specific drivers are not: drivers/net/usb/cdc_subset.c:241:2: #warning You need to configure some hardware for this driver The current behavior is clearly intentional, giving a warning when a user picks a configuration that won't do anything good. The only reason for even addressing this is that I'm getting close to eliminating all 'randconfig' warnings on ARM, and this came up a couple of times. My workaround is to not even build the module when none of the configurations are enable. Alternatively we could simply remove the #warning (nothing wrong for compile-testing), turn it into a runtime warning, or change the Kconfig options into a menu to hide CONFIG_USB_NET_CDC_SUBSET. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/usb/Kconfig | 10 ++++++++++ drivers/net/usb/Makefile | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) commit f468a729a2ddb1a26f8c4b98a82050e4030fe458 Author: Jiri Benc Date: Tue Feb 16 22:18:26 2016 +0100 vxlan: do not use fdb in metadata mode In metadata mode, the vxlan interface is not supposed to use the fdb control plane but an external one (openvswitch or static routes). With the current code, packets may leak into the fdb handling code which usually causes them to be dropped anyway but may have strange side effects. Just drop the packets directly when in metadata mode if the destination data are not correctly provided on egress. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/net/vxlan.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit e60b13e4f56fc56cc0dea845ce0711773d514149 Author: Anton Protopopov Date: Wed Feb 17 11:19:56 2016 -0500 mISDN: prevent possible NULL pointer dereference A return value of the bchannel_get_rxbuf() function is compared with the positive ENOMEM value instead of the negative -ENOMEM value to detect a memory allocation problem. Thus, after a possible memory allocation failure the bc->bch.rx_skb will be NULL which will lead to a NULL pointer dereference. Signed-off-by: Anton Protopopov Signed-off-by: David S. Miller drivers/isdn/hardware/mISDN/netjet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 449f14f01f65f45f332e3360aa46b3d3571b2cba Author: Anton Protopopov Date: Wed Feb 17 10:54:13 2016 -0500 net: caif: fix erroneous return value The cfrfml_receive() function might return positive value EPROTO Signed-off-by: Anton Protopopov Signed-off-by: David S. Miller net/caif/cfrfml.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48bb230e8723d7dd87928f0c0c3f6cb1fd5bc9be Author: Anton Protopopov Date: Wed Feb 17 10:53:59 2016 -0500 appletalk: fix erroneous return value The atalk_sendmsg() function might return wrong value ENETUNREACH instead of -ENETUNREACH. Signed-off-by: Anton Protopopov Signed-off-by: David S. Miller net/appletalk/ddp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a09f4af177d2a5b7dc424aba6ba808f4a674ce81 Author: Amitoj Kaur Chawla Date: Wed Feb 17 20:33:26 2016 +0530 lance: Return correct error code Failure of kzalloc should cause the enclosing function to return -ENOMEM, not -ENODEV. Additionally, removed the following checkpatch warnings: ERROR: spaces required around that '==' (ctx:VxV) ERROR: space required before the open parenthesis '(' CHECK: Comparison to NULL could be written "!lp" Signed-off-by: Amitoj Kaur Chawla Signed-off-by: David S. Miller drivers/net/ethernet/amd/lance.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a813104d923339144078939175faf4e66aca19b4 Author: Phil Sutter Date: Wed Feb 17 15:37:43 2016 +0100 IFF_NO_QUEUE: Fix for drivers not calling ether_setup() My implementation around IFF_NO_QUEUE driver flag assumed that leaving tx_queue_len untouched (specifically: not setting it to zero) by drivers would make it possible to assign a regular qdisc to them without having to worry about setting tx_queue_len to a useful value. This was only partially true: I overlooked that some drivers don't call ether_setup() and therefore not initialize tx_queue_len to the default value of 1000. Consequently, removing the workarounds in place for that case in qdisc implementations which cared about it (namely, pfifo, bfifo, gred, htb, plug and sfb) leads to problems with these specific interface types and qdiscs. Luckily, there's already a sanitization point for drivers setting tx_queue_len to zero, which can be reused to assign the fallback value most qdisc implementations used, which is 1. Fixes: 348e3435cbefa ("net: sched: drop all special handling of tx_queue_len == 0") Tested-by: Mathieu Desnoyers Signed-off-by: Phil Sutter Signed-off-by: David S. Miller net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d13b161c2c7c67401bb222c30302339285ac148e Author: Jiri Benc Date: Wed Feb 17 15:32:53 2016 +0100 gre: clear IFF_TX_SKB_SHARING ether_setup sets IFF_TX_SKB_SHARING but this is not supported by gre as it modifies the skb on xmit. Also, clean up whitespace in ipgre_tap_setup when we're already touching it. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 5 +++-- net/ipv6/ip6_gre.c | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) commit fc41cdb322a2a513efd60f81133efecd69d4f336 Author: Jiri Benc Date: Wed Feb 17 15:31:35 2016 +0100 geneve: clear IFF_TX_SKB_SHARING ether_setup sets IFF_TX_SKB_SHARING but this is not supported by geneve as it modifies the skb on xmit. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/net/geneve.c | 1 + 1 file changed, 1 insertion(+) commit 82a0f6b4aba95a21729f56ed0cbe57f2701b4872 Author: Jiri Benc Date: Tue Feb 16 22:16:53 2016 +0100 vxlan: clear IFF_TX_SKB_SHARING ether_setup sets IFF_TX_SKB_SHARING but this is not supported by vxlan as it modifies the skb on xmit. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/net/vxlan.c | 1 + 1 file changed, 1 insertion(+) commit 8f318526a292c5e7cebb82f3f766b83c22343293 Author: Marc Zyngier Date: Thu Feb 18 19:15:45 2016 +0000 irqchip/gic-v3: Add missing barrier to 32bit version of gic_read_iar() Commit 1a1ebd5 ("irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor") fixed the missing barrier on arm64, but forgot to update the 32bit counterpart, which has the same requirements. Let's fix it. Fixes: 1a1ebd5 ("irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor") Signed-off-by: Marc Zyngier arch/arm/include/asm/arch_gicv3.h | 1 + 1 file changed, 1 insertion(+) commit aeee0e66c6b46cee311be22cb82735763eceb7c3 Author: David Wragg Date: Thu Feb 18 17:43:29 2016 +0000 geneve: Refine MTU limit Calculate the maximum MTU taking into account the size of headers involved in GENEVE encapsulation, as for other tunnel types. Changes in v3: - Correct comment style Changes in v2: - Conform more closely to ip_tunnel_change_mtu - Exclude GENEVE options from max MTU calculation Signed-off-by: David Wragg Acked-by: Jesse Gross Signed-off-by: David S. Miller drivers/net/geneve.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) commit 7716682cc58e305e22207d5bb315f26af6b1e243 Author: Eric Dumazet Date: Thu Feb 18 05:39:18 2016 -0800 tcp/dccp: fix another race at listener dismantle Ilya reported following lockdep splat: kernel: ========================= kernel: [ BUG: held lock freed! ] kernel: 4.5.0-rc1-ceph-00026-g5e0a311 #1 Not tainted kernel: ------------------------- kernel: swapper/5/0 is freeing memory ffff880035c9d200-ffff880035c9dbff, with a lock still held there! kernel: (&(&queue->rskq_lock)->rlock){+.-...}, at: [] inet_csk_reqsk_queue_add+0x28/0xa0 kernel: 4 locks held by swapper/5/0: kernel: #0: (rcu_read_lock){......}, at: [] netif_receive_skb_internal+0x4b/0x1f0 kernel: #1: (rcu_read_lock){......}, at: [] ip_local_deliver_finish+0x3f/0x380 kernel: #2: (slock-AF_INET){+.-...}, at: [] sk_clone_lock+0x19b/0x440 kernel: #3: (&(&queue->rskq_lock)->rlock){+.-...}, at: [] inet_csk_reqsk_queue_add+0x28/0xa0 To properly fix this issue, inet_csk_reqsk_queue_add() needs to return to its callers if the child as been queued into accept queue. We also need to make sure listener is still there before calling sk->sk_data_ready(), by holding a reference on it, since the reference carried by the child can disappear as soon as the child is put on accept queue. Reported-by: Ilya Dryomov Fixes: ebb516af60e1 ("tcp/dccp: fix race at listener dismantle phase") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller include/net/inet_connection_sock.h | 5 +++-- net/dccp/ipv4.c | 14 +++++++------- net/dccp/ipv6.c | 14 +++++++------- net/ipv4/inet_connection_sock.c | 14 +++++++------- net/ipv4/tcp_ipv4.c | 14 +++++++------- net/ipv6/tcp_ipv6.c | 14 +++++++------- 6 files changed, 38 insertions(+), 37 deletions(-) commit deed49df7390d5239024199e249190328f1651e7 Author: Xin Long Date: Thu Feb 18 21:21:19 2016 +0800 route: check and remove route cache when we get route Since the gc of ipv4 route was removed, the route cached would has no chance to be removed, and even it has been timeout, it still could be used, cause no code to check it's expires. Fix this issue by checking and removing route cache when we get route. Signed-off-by: Xin Long Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller include/net/ip_fib.h | 1 + net/ipv4/route.c | 77 ++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 64 insertions(+), 14 deletions(-) commit f5bdd66c705484b4bc77eb914be15c1b7881fae7 Author: Alexandra Yates Date: Wed Feb 17 19:36:20 2016 -0800 Adding Intel Lewisburg device IDs for SATA This patch complements the list of device IDs previously added for lewisburg sata. Signed-off-by: Alexandra Yates Signed-off-by: Tejun Heo Cc: stable@vger.kernel.org drivers/ata/ahci.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 018361767a21fb2d5ebd3ac182c04baf8a8b4e08 Author: Gabor Juhos Date: Wed Feb 17 12:58:20 2016 +0100 pata-rb532-cf: get rid of the irq_to_gpio() call The RB532 platform specific irq_to_gpio() implementation has been removed with commit 832f5dacfa0b ("MIPS: Remove all the uses of custom gpio.h"). Now the platform uses the generic stub which causes the following error: pata-rb532-cf pata-rb532-cf: no GPIO found for irq149 pata-rb532-cf: probe of pata-rb532-cf failed with error -2 Drop the irq_to_gpio() call and get the GPIO number from platform data instead. After this change, the driver works again: scsi host0: pata-rb532-cf ata1: PATA max PIO4 irq 149 ata1.00: CFA: CF 1GB, 20080820, max MWDMA4 ata1.00: 1989792 sectors, multi 0: LBA ata1.00: configured for PIO4 scsi 0:0:0:0: Direct-Access ATA CF 1GB 0820 PQ: 0\ ANSI: 5 sd 0:0:0:0: [sda] 1989792 512-byte logical blocks: (1.01 GB/971 MiB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't\ support DPO or FUA sda: sda1 sda2 sd 0:0:0:0: [sda] Attached SCSI disk Fixes: 832f5dacfa0b ("MIPS: Remove all the uses of custom gpio.h") Cc: Alban Bedel Cc: Ralf Baechle Cc: Arnd Bergmann Cc: #v4.3+ Signed-off-by: Gabor Juhos Signed-off-by: Tejun Heo drivers/ata/pata_rb532_cf.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 619fe32640b4b01f370574d50344ae0f62689816 Author: Jamal Hadi Salim Date: Thu Feb 18 07:38:04 2016 -0500 net_sched fix: reclassification needs to consider ether protocol changes actions could change the etherproto in particular with ethernet tunnelled data. Typically such actions, after peeling the outer header, will ask for the packet to be reclassified. We then need to restart the classification with the new proto header. Example setup used to catch this: sudo tc qdisc add dev $ETH ingress sudo $TC filter add dev $ETH parent ffff: pref 1 protocol 802.1Q \ u32 match u32 0 0 flowid 1:1 \ action vlan pop reclassify Fixes: 3b3ae880266d ("net: sched: consolidate tc_classify{,_compat}") Signed-off-by: Jamal Hadi Salim Acked-by: Daniel Borkmann Signed-off-by: David S. Miller net/sched/sch_api.c | 1 + 1 file changed, 1 insertion(+) commit 39712e599b3d01bc34df113f51652ae4e1bdb8bf Merge: 562a9f9 28a01d2 Author: David S. Miller Date: Thu Feb 18 10:44:27 2016 -0500 Merge branch 'mlxsw-fixes' Jiri Pirko says: ==================== mlxsw fixes Another bulk of fixes from Ido. ==================== Signed-off-by: David S. Miller commit 28a01d2d7dbf6d56e6130b3094b7c62a54773f27 Author: Ido Schimmel Date: Thu Feb 18 11:30:02 2016 +0100 mlxsw: spectrum: Allow for PVID deletion When PVID is toggled off on a port member in a VLAN filtering bridge or the PVID VLAN is deleted, make the port drop untagged packets. Reverse the operation when PVID is toggled back on. Set the PVID back to the default (1), when leaving the bridge so that untagged traffic will be directed to the CPU. Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 69 +++++++++++++++++++--- 3 files changed, 63 insertions(+), 9 deletions(-) commit 148f472da5db4d78fcfe61807c18f020eb5bd7fc Author: Ido Schimmel Date: Thu Feb 18 11:30:01 2016 +0100 mlxsw: reg: Add the Switch Port Acceptable Frame Types register When VLAN filtering is enabled on a bridge and PVID is deleted from a bridge port, then untagged frames are not allowed to ingress into the bridge from this port. Add the Switch Port Acceptable Frame Types (SPAFT) register, which configures the frame admittance of the port. Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/reg.h | 58 +++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) commit 1a1503c5396eb7f2edf4b8ef6067853014478c0c Author: Alexandra Yates Date: Wed Feb 17 18:21:21 2016 -0800 i2c: i801: Adding Intel Lewisburg support for iTCO Starting from Intel Sunrisepoint (Skylake PCH) the iTCO watchdog resources have been moved to reside under the i801 SMBus host controller whereas previously they were under the LPC device. This patch adds Intel lewisburg SMBus support for iTCO device. It allows to load watchdog dynamically when the hardware is present. Fixes: cdc5a3110e7c ("i2c: i801: add Intel Lewisburg device IDs") Reviewed-by: Jean Delvare Signed-off-by: Alexandra Yates Signed-off-by: Wolfram Sang Cc: stable@kernel.org drivers/i2c/busses/i2c-i801.c | 2 ++ 1 file changed, 2 insertions(+) commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 Author: Bjørn Mork Date: Fri Feb 12 16:40:00 2016 +0100 USB: option: add "4G LTE usb-modem U901" Thomas reports: T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=05c6 ProdID=6001 Rev=00.00 S: Manufacturer=USB Modem S: Product=USB Modem S: SerialNumber=1234567890ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage Cc: Reported-by: Thomas Schäfer Signed-off-by: Bjørn Mork Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) commit a150b085b66c87bd4d362a523cb85ce2b0a2d77b Author: Vineet Gupta Date: Tue Feb 16 12:36:18 2016 +0530 ARCv2: boot report CCMs (Closely Coupled Memories) - ARCv2 uses a seperate BCR for {I,D}CCM base address: ARCompact encoded both base/size in same BCR - Size encoding in common BCR is different for ARCompact/ARCv2 Signed-off-by: Vineet Gupta arch/arc/include/asm/arcregs.h | 32 ++++++++++------- arch/arc/kernel/setup.c | 78 +++++++++++++++++++++++++++--------------- 2 files changed, 70 insertions(+), 40 deletions(-) commit 98341f7dc9d9080d7999654ab589657272559b04 Author: Vineet Gupta Date: Mon Feb 15 15:58:42 2016 +0530 ARCv2: boot print Low Latency Memory Signed-off-by: Vineet Gupta arch/arc/kernel/mcip.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0eca6fdb3193410fbe66b6f064431cc394513e82 Author: Vineet Gupta Date: Tue Feb 16 09:42:57 2016 +0530 ARC: Assume multiplier is always present It is unlikely that designs running Linux will not have multiplier. Further the current support is not complete as tool don't generate a multilib w/o multiplier. Signed-off-by: Vineet Gupta arch/arc/Kconfig | 8 -------- arch/arc/Makefile | 4 ---- arch/arc/kernel/setup.c | 2 -- 3 files changed, 14 deletions(-) commit 6627ae19385283b89356a199d7f03c75ba35fb29 Author: Ken Lin Date: Mon Feb 1 14:57:25 2016 -0500 USB: cp210x: add IDs for GE B650V3 and B850V3 boards Add USB ID for cp2104/5 devices on GE B650v3 and B850v3 boards. Signed-off-by: Ken Lin Signed-off-by: Akshay Bhat Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) commit 3158a8d416f4e1b79dcc867d67cb50013140772c Author: Andrey Skvortsov Date: Fri Jan 29 00:07:30 2016 +0300 USB: option: add support for SIM7100E $ lsusb: Bus 001 Device 101: ID 1e0e:9001 Qualcomm / Option $ usb-devices: T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=101 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 2 P: Vendor=1e0e ProdID=9001 Rev= 2.32 S: Manufacturer=SimTech, Incorporated S: Product=SimTech, Incorporated S: SerialNumber=0123456789ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) The last interface (6) is used for Android Composite ADB interface. Serial port layout: 0: QCDM/DIAG 1: NMEA 2: AT 3: AT/PPP 4: audio Signed-off-by: Andrey Skvortsov Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 67ec1072b053c15564e6090ab30127895dc77a89 Author: Takashi Iwai Date: Wed Feb 17 14:30:26 2016 +0100 ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream A non-atomic PCM stream may take snd_pcm_link_rwsem rw semaphore twice in the same code path, e.g. one in snd_pcm_action_nonatomic() and another in snd_pcm_stream_lock(). Usually this is OK, but when a write lock is issued between these two read locks, the problem happens: the write lock is blocked due to the first reade lock, and the second read lock is also blocked by the write lock. This eventually deadlocks. The reason is the way rwsem manages waiters; it's queued like FIFO, so even if the writer itself doesn't take the lock yet, it blocks all the waiters (including reads) queued after it. As a workaround, in this patch, we replace the standard down_write() with an spinning loop. This is far from optimal, but it's good enough, as the spinning time is supposed to be relatively short for normal PCM operations, and the code paths requiring the write lock aren't called so often. Reported-by: Vinod Koul Tested-by: Ramesh Babu Cc: # v3.18+ Signed-off-by: Takashi Iwai sound/core/pcm_native.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit f4eafd8bcd5229e998aa252627703b8462c3b90f Author: Toshi Kani Date: Wed Feb 17 18:16:54 2016 -0700 x86/mm: Fix vmalloc_fault() to handle large pages properly A kernel page fault oops with the callstack below was observed when a read syscall was made to a pmem device after a huge amount (>512GB) of vmalloc ranges was allocated by ioremap() on a x86_64 system: BUG: unable to handle kernel paging request at ffff880840000ff8 IP: vmalloc_fault+0x1be/0x300 PGD c7f03a067 PUD 0 Oops: 0000 [#1] SM Call Trace: __do_page_fault+0x285/0x3e0 do_page_fault+0x2f/0x80 ? put_prev_entity+0x35/0x7a0 page_fault+0x28/0x30 ? memcpy_erms+0x6/0x10 ? schedule+0x35/0x80 ? pmem_rw_bytes+0x6a/0x190 [nd_pmem] ? schedule_timeout+0x183/0x240 btt_log_read+0x63/0x140 [nd_btt] : ? __symbol_put+0x60/0x60 ? kernel_read+0x50/0x80 SyS_finit_module+0xb9/0xf0 entry_SYSCALL_64_fastpath+0x1a/0xa4 Since v4.1, ioremap() supports large page (pud/pmd) mappings in x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc range is limited to pte mappings. vmalloc faults do not normally happen in ioremap'd ranges since ioremap() sets up the kernel page tables, which are shared by user processes. pgd_ctor() sets the kernel's PGD entries to user's during fork(). When allocation of the vmalloc ranges crosses a 512GB boundary, ioremap() allocates a new pud table and updates the kernel PGD entry to point it. If user process's PGD entry does not have this update yet, a read/write syscall to the range will cause a vmalloc fault, which hits the Oops above as it does not handle a large page properly. Following changes are made to vmalloc_fault(). 64-bit: - No change for the PGD sync operation as it handles large pages already. - Add pud_huge() and pmd_huge() to the validation code to handle large pages. - Change pud_page_vaddr() to pud_pfn() since an ioremap range is not directly mapped (while the if-statement still works with a bogus addr). - Change pmd_page() to pmd_pfn() since an ioremap range is not backed by struct page (while the if-statement still works with a bogus addr). 32-bit: - No change for the sync operation since the index3 PGD entry covers the entire vmalloc range, which is always valid. (A separate change to sync PGD entry is necessary if this memory layout is changed regardless of the page size.) - Add pmd_huge() to the validation code to handle large pages. This is for completeness since vmalloc_fault() won't happen in ioremap'd ranges as its PGD entry is always valid. Reported-by: Henning Schild Signed-off-by: Toshi Kani Acked-by: Borislav Petkov Cc: # 4.1+ Cc: Andrew Morton Cc: Andy Lutomirski Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Toshi Kani Cc: linux-mm@kvack.org Cc: linux-nvdimm@lists.01.org Link: http://lkml.kernel.org/r/1455758214-24623-1-git-send-email-toshi.kani@hpe.com Signed-off-by: Ingo Molnar arch/x86/mm/fault.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 562a9f91a0300ecaaf28722f57bcdd9cd5f38f0e Author: Insu Yun Date: Mon Feb 15 21:23:47 2016 -0500 et131x: check return value of dma_alloc_coherent For error handling, dma_alloc_coherent's return value needs to be checked, not argument. Signed-off-by: Insu Yun Signed-off-by: David S. Miller drivers/net/ethernet/agere/et131x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4fbe366ce304d836d53685c1dd26865dc1fea66c Merge: 1eea84b ad2eceb Author: David S. Miller Date: Wed Feb 17 22:24:57 2016 -0500 Merge branch 'thunderx-fixes' Sunil Goutham says: ==================== net: thunderx: Miscellaneous fixes This patch series fixes couple of issues w.r.t multiqset mode and receive packet statastics. ==================== Signed-off-by: David S. Miller commit ad2ecebd67d8a80fe5412d11df375a5ed2db7cd1 Author: Sunil Goutham Date: Tue Feb 16 16:29:51 2016 +0530 net: thunderx: Fix receive packet stats Counting rx packets for every CQE_RX in CQ irq handler is incorrect. Synchronization is missing when multiple queues are receiving packets simultaneously. Like transmit packet stats use HW stats here. Also removed unused 'cqe_type' parameter in nicvf_rcv_pkt_handler(). Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 11 ++++++----- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 8 ++------ drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 3 +-- 3 files changed, 9 insertions(+), 13 deletions(-) commit 8d210d54c5250c52b69266f299e64fe8356f9453 Author: Sunil Goutham Date: Tue Feb 16 16:29:50 2016 +0530 net: thunderx: Fix for HW TSO not enabled for secondary qsets For secondary Qsets 'hw_tso' is not getting set as probe() returns much earlier. Fixed it by moving silicon revision check. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6a9bab79bb79bd9b2eda16f0aba1b4c43f677be9 Author: Sunil Goutham Date: Tue Feb 16 16:29:49 2016 +0530 net: thunderx: Fix for multiqset not configured upon interface toggle When a interface is assigned morethan 8 queues and the logical interface is toggled i.e down & up, additional queues or qsets are not initialized as secondary qset count is being set to zero while tearing down. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 1 - 1 file changed, 1 deletion(-) commit 1eea84b74cd28773c37bf1bda69915f7b9a67efc Author: Insu Yun Date: Mon Feb 15 21:30:33 2016 -0500 tcp: correctly crypto_alloc_hash return check crypto_alloc_hash never returns NULL Signed-off-by: Insu Yun Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 73dcb556538a4192222c3a919a51e1701bae553b Author: Florian Fainelli Date: Wed Feb 17 18:43:22 2016 -0800 net: dsa: Unregister slave_dev in error path With commit 0071f56e46da ("dsa: Register netdev before phy"), we are now trying to free a network device that has been previously registered, and in case of errors, this will make us hit the BUG_ON(dev->reg_state != NETREG_UNREGISTERED) condition. Fix this by adding a missing unregister_netdev() before free_netdev(). Fixes: 0071f56e46da ("dsa: Register netdev before phy") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller net/dsa/slave.c | 1 + 1 file changed, 1 insertion(+) commit 67b4eab91caf2ad574cab1b17ae09180ea2e116e Author: Bjorn Helgaas Date: Wed Feb 17 12:26:38 2016 -0600 Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed" Revert 811a4e6fce09 ("PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed"). This is part of reverting 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it introduced. Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki CC: Jiang Liu arch/x86/pci/intel_mid_pci.c | 4 ++-- arch/x86/pci/irq.c | 10 ++++++---- drivers/acpi/pci_irq.c | 10 ++++++---- include/linux/pci.h | 17 ----------------- 4 files changed, 14 insertions(+), 27 deletions(-) commit aeb67ae7d1a318c8456345b8012474be6a3ff74a Author: Oleksij Rempel Date: Fri Jan 29 10:57:53 2016 +0100 irqchip/mxs: Add missing set_handle_irq() The rework of the driver missed to move the call to set_handle_irq() into asm9260_of_init(). As a consequence no interrupt entry point is installed and no interrupts are delivered Solution is: Install the interrupt entry handler. Fixes: 7e4ac676ee ("irqchip/mxs: Add Alphascale ASM9260 support") Signed-off-by: Oleksij Rempel Link: https://lkml.kernel.org/r/1454061473-24957-1-git-send-email-linux@rempel-privat.de Signed-off-by: Jason Cooper drivers/irqchip/irq-mxs.c | 1 + 1 file changed, 1 insertion(+) commit 79be1a1c9090048f6f327204b8b1cf4ac067b487 Author: Clemens Gruber Date: Mon Feb 15 23:46:45 2016 +0100 phy: marvell: Fix and unify reg-init behavior For the Marvell 88E1510, marvell_of_reg_init was called too late, in the config_aneg function. Since commit 113c74d83eef ("net: phy: turn carrier off on phy attach"), this lead to the link not coming up at boot anymore, due to the phy state machine being stuck at waiting for interrupts (off by default on the 88E1510). For seven other Marvell PHYs, marvell_of_reg_init was not called at all. Add a generic marvell_config_init function, which in turn calls marvell_of_reg_init. PHYs, which already have a specific config_init function with a call to marvell_of_reg_init, are left untouched. The generic marvell_config_init function is called for all the others, to get consistent behavior across all Marvell PHYs. Fixes: 113c74d83eef ("net: phy: turn carrier off on phy attach") Signed-off-by: Clemens Gruber Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 7dcd182bec271ab341b05b66b6006995795fc0e7 Author: Jessica Yu Date: Tue Feb 16 17:32:33 2016 -0500 ftrace/module: remove ftrace module notifier Remove the ftrace module notifier in favor of directly calling ftrace_module_enable() and ftrace_release_mod() in the module loader. Hard-coding the function calls directly in the module loader removes dependence on the module notifier call chain and provides better visibility and control over what gets called when, which is important to kernel utilities such as livepatch. This fixes a notifier ordering issue in which the ftrace module notifier (and hence ftrace_module_enable()) for coming modules was being called after klp_module_notify(), which caused livepatch modules to initialize incorrectly. This patch removes dependence on the module notifier call chain in favor of hard coding the corresponding function calls in the module loader. This ensures that ftrace and livepatch code get called in the correct order on patch module load and unload. Fixes: 5156dca34a3e ("ftrace: Fix the race between ftrace and insmod") Signed-off-by: Jessica Yu Reviewed-by: Steven Rostedt Reviewed-by: Petr Mladek Acked-by: Rusty Russell Reviewed-by: Josh Poimboeuf Reviewed-by: Miroslav Benes Signed-off-by: Jiri Kosina include/linux/ftrace.h | 6 ++++-- kernel/module.c | 4 ++++ kernel/trace/ftrace.c | 36 +----------------------------------- 3 files changed, 9 insertions(+), 37 deletions(-) commit 29e73269aa4d36f92b35610c25f8b01c789b0dc8 Author: Guillaume Nault Date: Mon Feb 15 17:01:10 2016 +0100 pppoe: fix reference counting in PPPoE proxy Drop reference on the relay_po socket when __pppoe_xmit() succeeds. This is already handled correctly in the error path. Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller drivers/net/ppp/pppoe.c | 2 ++ 1 file changed, 2 insertions(+) commit 705bcdda81eda8b4b4c564c4be7b8cfad6a180d6 Author: Geert Uytterhoeven Date: Mon Feb 15 13:41:31 2016 +0100 ravb: Update DT binding example for final CPG/MSSR bindings The example in the DT binding documentation uses the preliminary DT bindings for the r8a7795 MSTP clocks, which never went upstream. Update the example to use the DT bindings for the upstream Clock Pulse Generator / Module Standby and Software Reset hardware block. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/renesas,ravb.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9ffa8a1863962b0fc29f4670c3b949d87f1b54bf Merge: 853effc 6a9863a Author: David S. Miller Date: Wed Feb 17 15:52:59 2016 -0500 Merge branch 'mlxsw-fixes' Jiri Pirko says: ==================== mlxsw fixes Just a couple of fixes from Ido. ==================== Signed-off-by: David S. Miller commit 6a9863a62206dad8ad236bcde489978aedb072fa Author: Ido Schimmel Date: Mon Feb 15 13:19:54 2016 +0100 mlxsw: spectrum: Set STP state when leaving 802.1D bridge When a VLAN device leaves a bridge its STP state is set to DISABLED, which causes the hardware to discard any packets coming through the port with this VLAN. Fix that by setting STP state to FORWARDING when the device leaves its bridge and allow traffic to be directed to CPU. Fixes: 26f0e7fb15de ("mlxsw: spectrum: Add support for VLAN devices bridging") Reported-by: Elad Raz Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 1e5ad30c649a82a062ce79a87c1296e6c6f328c2 Author: Ido Schimmel Date: Mon Feb 15 13:19:53 2016 +0100 mlxsw: Treat local port 64 as valid MLXSW_PORT_MAX_PORTS represents the maximum number of local ports, which is 65 for both ASICs (SwitchX-2 and Spectrum) supported by this driver. Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/port.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 853effc55b0f975abd6d318cca486a9c1b67e10f Author: Mark Tomlinson Date: Mon Feb 15 16:24:44 2016 +1300 l2tp: Fix error creating L2TP tunnels A previous commit (33f72e6) added notification via netlink for tunnels when created/modified/deleted. If the notification returned an error, this error was returned from the tunnel function. If there were no listeners, the error code ESRCH was returned, even though having no listeners is not an error. Other calls to this and other similar notification functions either ignore the error code, or filter ESRCH. This patch checks for ESRCH and does not flag this as an error. Reviewed-by: Hamish Martin Signed-off-by: Mark Tomlinson Signed-off-by: David S. Miller net/l2tp/l2tp_netlink.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 2850713576e81e3b887cd92a9965fba0dd1717c0 Merge: c28b947 18f922d0 Author: Linus Torvalds Date: Wed Feb 17 11:59:23 2016 -0800 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A collection of fixes from the past few weeks that should go into 4.5. This contains: - Overflow fix for sysfs discard show function from Alan. - A stacking limit init fix for max_dev_sectors, so we don't end up artificially capping some use cases. From Keith. - Have blk-mq proper end unstarted requests on a dying queue, instead of pushing that to the driver. From Keith. - NVMe: - Update to Kconfig description for NVME_SCSI, since it was vague and having it on is important for some SUSE distros. From Christoph. - Set of fixes from Keith, around surprise removal. Also kills the no-merge flag, so it supports merging. - Set of fixes for lightnvm from Matias, Javier, and Wenwei. - Fix null_blk oops when asked for lightnvm, but not available. From Matias. - Copy-to-user EINTR fix from Hannes, fixing a case where SG_IO fails if interrupted by a signal. - Two floppy fixes from Jiri, fixing signal handling and blocking open. - A use-after-free fix for O_DIRECT, from Mike Krinkin. - A block module ref count fix from Roman Pen. - An fs IO wait accounting fix for O_DSYNC from Stephane Gasparini. - Smaller reallo fix for xen-blkfront from Bob Liu. - Removal of an unused struct member in the deadline IO scheduler, from Tahsin. - Also from Tahsin, properly initialize inode struct members associated with cgroup writeback, if enabled. - From Tejun, ensure that we keep the superblock pinned during cgroup writeback" * 'for-linus' of git://git.kernel.dk/linux-block: (25 commits) blk: fix overflow in queue_discard_max_hw_show writeback: initialize inode members that track writeback history writeback: keep superblock pinned during cgroup writeback association switches bio: return EINTR if copying to user space got interrupted NVMe: Rate limit nvme IO warnings NVMe: Poll device while still active during remove NVMe: Requeue requests on suspended queues NVMe: Allow request merges NVMe: Fix io incapable return values blk-mq: End unstarted requests on dying queue block: Initialize max_dev_sectors to 0 null_blk: oops when initializing without lightnvm block: fix module reference leak on put_disk() call for cgroups throttle nvme: fix Kconfig description for BLK_DEV_NVME_SCSI kernel/fs: fix I/O wait not accounted for RW O_DSYNC floppy: refactor open() flags handling lightnvm: allow to force mm initialization lightnvm: check overflow and correct mlc pairs lightnvm: fix request intersection locking in rrpc lightnvm: warn if irqs are disabled in lock laddr ... commit c28b947d048d6539389309af70be0ac599122ec0 Merge: 35683dd 43f3408 Author: Linus Torvalds Date: Wed Feb 17 11:50:53 2016 -0800 Merge tag 'devicetree-fixes-for-4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull DeviceTree fixes from Rob Herring: - Fix irq msi-map calculation for nonzero rid-base. - Binding doc updates for GICv3, fsl-imx-uart, and S3C RTC. * tag 'devicetree-fixes-for-4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: rtc: s3c: Document required clocks in the DT binding serial: fsl-imx-uart: Fix typo in fsl,dte-mode description dt-bindings: arm, gic-v3: require that reserved cells are always 0 of/irq: Fix msi-map calculation for nonzero rid-base commit 35683dd326b89751b5b45cb188978c83b22729c5 Merge: a9f70bd dada168 Author: Linus Torvalds Date: Wed Feb 17 11:45:10 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This has two main sets of fixes: - A bunch of Exynos fixes, mainly for their MIC component. - vblank regression fixes from Mario, apparantly some changes in 4.4 caused some vblank breakage on radeon/nouveau, this set fixes all the issues seen. There is also a revert of one of the MST changse, that I was overzealous in including, that broke 30" MST monitors, and two qxl fixes" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/qxl: fix erroneous return value drm/nouveau/display: Enable vblank irqs after display engine is on again. drm/radeon/pm: Handle failure of drm_vblank_get. drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2) drm: Fix drm_vblank_pre/post_modeset regression from Linux 4.4 drm: Prevent vblank counter bumps > 1 with active vblank clients. (v2) drm: No-Op redundant calls to drm_vblank_off() (v2) drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Revert "drm/dp/mst: change MST detection scheme" drm/exynos/decon: fix disable clocks order drm/exynos: fix incorrect cpu address for dma_mmap_attrs() drm/exynos: exynos5433_decon: fix wrong state in decon_vblank_enable drm/exynos: exynos5433_decon: fix wrong state assignment in decon_enable drm/exynos: dsi: restore support for drm bridge drm/exynos: mic: make all functions static drm/exynos: mic: convert to component framework drm/exynos: mic: use devm_clk interface drm/exynos: fix types for compilation on 64bit architectures drm/exynos: ipp: fix incorrect format specifiers in debug messages drm/exynos: depend on ARCH_EXYNOS for DRM_EXYNOS commit a9f70bd4e787191ca27941e4dd9c1de00593fb58 Merge: 65c23c6 b33c8ff Author: Linus Torvalds Date: Wed Feb 17 11:35:41 2016 -0800 Merge tag 'trace-fixes-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "This includes two fixes. The first is something that has come up a few times and has been worked out individually, but it's come up now enough that the problem should be generic. Tracepoints are protected by RCU sched. There are several tracepoints within core infrastructure like kfree(). If a tracepoint is called when the CPU is going down, or when it's coming up but has yet to be recognized by RCU, a RCU warning is triggered. This is a true bug as that tracepoint is not protected by RCU. Usually, this is taken care of by testing for cpu online as a tracepoint condition. But as this is happening more often, moving it from a individual tracepoint to a check in the tracepoint infrastructure is more robust. Note, there is now a duplicate of a cpu online test, because this update does not remove the individual checks. But the overhead is small enough that the removal can be done in another release. The second change is strange linker breakage due to the branch tracer's builtin_constant_p() check failing, and treating the condition as a variable instead of a constant. Arnd Bergmann found that this can be fixed by testing !!(cond) instead of just (cond)" * tag 'trace-fixes-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix freak link error caused by branch tracer tracepoints: Do not trace when cpu is offline commit fe25d078874f2c29c38f4160467d74f5756537c9 Author: Bjorn Helgaas Date: Wed Feb 17 12:26:33 2016 -0600 Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled" Revert 8affb487d4a4 ("x86/PCI: Don't alloc pcibios-irq when MSI is enabled"). This is part of reverting 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it introduced. Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki CC: Jiang Liu CC: Joerg Roedel arch/x86/pci/common.c | 8 -------- 1 file changed, 8 deletions(-) commit 2eca0d6ceea1f108b2d3ac81fb34698c4fd41006 Author: Shanker Donthineni Date: Tue Feb 16 18:00:36 2016 -0600 irqchip/gicv3-its: Avoid cache flush beyond ITS_BASERn memory size Function its_alloc_tables() maintains two local variables, "order" and and "alloc_size", to hold memory size that has been allocated to ITS_BASEn. We don't always refresh the variable alloc_size whenever value of the variable order changes, causing the following two problems. - Cache flush operation with size more than required. - Information reported by pr_info is not correct. Use a helper macro that converts page order to size in bytes instead of variable "alloc_size" to fix both the problems. Signed-off-by: Shanker Donthineni Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-its.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 18f922d037211a15543af935861bf92161e697e9 Author: Alan Date: Wed Feb 17 14:15:30 2016 +0000 blk: fix overflow in queue_discard_max_hw_show We get this right for queue_discard_max_show but not max_hw_show. Follow the same pattern as queue_discard_max_show instead so that we don't truncate. Signed-off-by: Alan Cox Signed-off-by: Jens Axboe block/blk-sysfs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 437b300c6b28040ad87e4caf042e05f2c5f13c6d Author: Scott Mayhew Date: Tue Feb 16 16:20:25 2016 -0500 auth_gss: fix panic in gss_pipe_downcall() in fips mode On Mon, 15 Feb 2016, Trond Myklebust wrote: > Hi Scott, > > On Mon, Feb 15, 2016 at 2:28 PM, Scott Mayhew wrote: > > md5 is disabled in fips mode, and attempting to import a gss context > > using md5 while in fips mode will result in crypto_alg_mod_lookup() > > returning -ENOENT, which will make its way back up to > > gss_pipe_downcall(), where the BUG() is triggered. Handling the -ENOENT > > allows for a more graceful failure. > > > > Signed-off-by: Scott Mayhew > > --- > > net/sunrpc/auth_gss/auth_gss.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c > > index 799e65b..c30fc3b 100644 > > --- a/net/sunrpc/auth_gss/auth_gss.c > > +++ b/net/sunrpc/auth_gss/auth_gss.c > > @@ -737,6 +737,9 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) > > case -ENOSYS: > > gss_msg->msg.errno = -EAGAIN; > > break; > > + case -ENOENT: > > + gss_msg->msg.errno = -EPROTONOSUPPORT; > > + break; > > default: > > printk(KERN_CRIT "%s: bad return from " > > "gss_fill_context: %zd\n", __func__, err); > > -- > > 2.4.3 > > > > Well debugged, but I unfortunately do have to ask if this patch is > sufficient? In addition to -ENOENT, and -ENOMEM, it looks to me as if > crypto_alg_mod_lookup() can also fail with -EINTR, -ETIMEDOUT, and > -EAGAIN. Don't we also want to handle those? You're right, I was focusing on the panic that I could easily reproduce. I'm still not sure how I could trigger those other conditions. > > In fact, peering into the rats nest that is > gss_import_sec_context_kerberos(), it looks as if that is just a tiny > subset of all the errors that we might run into. Perhaps the right > thing to do here is to get rid of the BUG() (but keep the above > printk) and just return a generic error? That sounds fine to me -- updated patch attached. -Scott >From d54c6b64a107a90a38cab97577de05f9a4625052 Mon Sep 17 00:00:00 2001 From: Scott Mayhew Date: Mon, 15 Feb 2016 15:12:19 -0500 Subject: [PATCH] auth_gss: remove the BUG() from gss_pipe_downcall() Instead return a generic error via gss_msg->msg.errno. None of the errors returned by gss_fill_context() should necessarily trigger a kernel panic. Signed-off-by: Scott Mayhew Signed-off-by: Trond Myklebust net/sunrpc/auth_gss/auth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c89757061a4e4017a21ef632dc100449a7bab7dd Author: Kinglong Mee Date: Mon Feb 1 09:39:29 2016 +0800 pnfs/blocklayout: fix a memeory leak when using,vmalloc_to_page unreferenced object 0xffffc90000abf000 (size 16900): comm "fsync02", pid 15765, jiffies 4297431627 (age 423.772s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 a0 c2 19 00 88 ff ff ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] __vmalloc_node_range+0x231/0x280 [] __vmalloc+0x4a/0x50 [] ext_tree_prepare_commit+0x231/0x2e0 [blocklayoutdriver] [] bl_prepare_layoutcommit+0xe/0x10 [blocklayoutdriver] [] pnfs_layoutcommit_inode+0x29c/0x330 [nfsv4] [] pnfs_generic_sync+0x13/0x20 [nfsv4] [] nfs4_file_fsync+0x58/0x150 [nfsv4] [] vfs_fsync_range+0x4b/0xb0 [] do_fsync+0x3d/0x70 [] SyS_fsync+0x10/0x20 [] entry_SYSCALL_64_fastpath+0x12/0x76 [] 0xffffffffffffffff v2, add missing include header Signed-off-by: Kinglong Mee Signed-off-by: Trond Myklebust fs/nfs/blocklayout/extent_tree.c | 10 ++++++++-- include/linux/nfs_xdr.h | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) commit 4bdf87ebda016b864b388f96ae349e76983ebac4 Author: Christoph Hellwig Date: Wed Feb 17 15:48:28 2016 +0100 nfs4: fix stateid handling for the NFS v4.2 operations The newly added NFS v4.2 operations (ALLOCATE, DEALLOCATE, SEEK and CLONE) use a helper called nfs42_set_rw_stateid to select a stateid that is sent to the server. But they don't set the inode and state fields in the nfs4_exception structure, and this don't partake in the stateid recovery protocol. Because of this they will simply return errors insted of trying to recover a stateid when the server return a BAD_STATEID error. Additionally CLONE has the problem that it operates on two files and thus two stateids, and thus needs to call the exception handler twice to recover stateids. While we're at it stop grabbing an addititional reference to the open context in all these operations - having the file open guarantees that the open context won't go away. All this can be produces with the generic/168 and generic/170 tests in xfstests which stress the CLONE stateid handling. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust fs/nfs/nfs42proc.c | 119 ++++++++++++++++++++++++++++++++++------------------- 1 file changed, 76 insertions(+), 43 deletions(-) commit d9dfd8d741683347ee159d25f5b50c346a0df557 Author: Benjamin Coddington Date: Wed Feb 17 10:41:41 2016 -0500 NFSv4: Fix a dentry leak on alias use In the case where d_add_unique() finds an appropriate alias to use it will have already incremented the reference count. An additional dget() to swap the open context's dentry is unnecessary and will leak a reference. Signed-off-by: Benjamin Coddington Fixes: 275bb307865a3 ("NFSv4: Move dentry instantiation into the NFSv4-...") Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d148bbd37a52b030b131ac5408c0f8293325ca0b Author: David Rivshin Date: Fri Feb 12 19:45:36 2016 -0500 drivers: net: cpsw-phy-sel: add dev_warn() for unsupported PHY mode The cpsw-phy-sel driver supports only MII, RMII, and RGMII PHY modes, and silently handled any other values as if MII was specified. In a case where the PHY mode was incorrectly specified, or a bug elsewhere, there would be no indication of a problem. If MII was the correct mode, then this will go unnoticed, otherwise the symptom will be a failure to transmit/receive data over the RMII/RGMII link. Add a dev_warn() to make this condition obvious and provide a breadcrumb to follow. Cc: Mugunthan V N Signed-off-by: David Rivshin Acked-by: Mugunthan V N Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw-phy-sel.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit cd772de358d6e001d308292c542f7908511287a4 Author: Woojung.Huh@microchip.com Date: Thu Feb 11 17:29:47 2016 +0000 phy: keep pause flags in phy driver features genphy_config_init() masked out pause flags set in phy driver structure. Pause flags needs to be preserved in phydev->supported & phydev->advertising. Signed-off-by: Woojung Huh Signed-off-by: David S. Miller drivers/net/phy/phy_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1543b765d21c09e9f7c2a38a00f56433bbdc28ad Merge: aac8d3c 925ab1a Author: David S. Miller Date: Wed Feb 17 10:29:27 2016 -0500 Merge branch 'mlx4-fixes' Or Gerlitz says: ==================== Mellanox 10/40G mlx4 driver fixes for 4.5-rc Bunch of fixes from the team to the mlx4 Eth and core drivers. Series generated against net commit aac8d3c "qmi_wwan: add "4G LTE usb-modem U901"" Please push patches 1,2 and 6 to -stable as well changes from v0: - handled another wrongly accounted HW counter in patch #1 (Rick) - fixed coding style issues in patch #4 (Sergei) ==================== Signed-off-by: David S. Miller commit 925ab1aa9394bbaeac47ee5b65d3fdf0fb8135cf Author: Eugenia Emantayev Date: Wed Feb 17 17:24:27 2016 +0200 net/mlx4_en: Avoid changing dev->features directly in run-time It's forbidden to manually change dev->features in run-time. Currently, this is done in the driver to make sure that GSO_UDP_TUNNEL is advertized only when VXLAN tunnel is set. However, since the stack actually does features intersection with hw_enc_features, we can safely revert to advertizing features early when registering the netdevice. Fixes: f4a1edd56120 ('net/mlx4_en: Advertize encapsulation offloads [...]') Signed-off-by: Eugenia Emantayev Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 85743f1eb34548ba4b056d2f184a3d107a3b8917 Author: Huy Nguyen Date: Wed Feb 17 17:24:26 2016 +0200 net/mlx4_core: Set UAR page size to 4KB regardless of system page size problem description: The current code sets UAR page size equal to system page size. The ConnectX-3 and ConnectX-3 Pro HWs require minimum 128 UAR pages. The mlx4 kernel drivers are not loaded if there is less than 128 UAR pages. solution: Always set UAR page to 4KB. This allows more UAR pages if the OS has PAGE_SIZE larger than 4KB. For example, PowerPC kernel use 64KB system page size, with 4MB uar region, there are 4MB/2/64KB = 32 uars (half for uar, half for blueflame). This does not meet minimum 128 UAR pages requirement. With 4KB UAR page, there are 4MB/2/4KB = 512 uars which meet the minimum requirement. Note that only codes in mlx4_core that deal with firmware know that uar page size is 4KB. Codes that deal with usr page in cq and qp context (mlx4_ib, mlx4_en and part of mlx4_core) still have the same assumption that uar page size equals to system page size. Note that with this implementation, on 64KB system page size kernel, there are 16 uars per system page but only one uars is used. The other 15 uars are ignored because of the above assumption. Regarding SR-IOV, mlx4_core in hypervisor will set the uar page size to 4KB and mlx4_core code in virtual OS will obtain the uar page size from firmware. Regarding backward compatibility in SR-IOV, if hypervisor has this new code, the virtual OS must be updated. If hypervisor has old code, and the virtual OS has this new code, the new code will be backward compatible with the old code. If the uar size is big enough, this new code in VF continues to work with 64 KB uar page size (on PowerPc kernel). If the uar size does not meet 128 uars requirement, this new code not loaded in VF and print the same error message as the old code in Hypervisor. Signed-off-by: Huy Nguyen Reviewed-by: Yishai Hadas Signed-off-by: David S. Miller drivers/infiniband/hw/mlx4/qp.c | 7 ++- drivers/net/ethernet/mellanox/mlx4/cq.c | 4 +- drivers/net/ethernet/mellanox/mlx4/en_resources.c | 3 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx4/eq.c | 7 +-- drivers/net/ethernet/mellanox/mlx4/main.c | 56 ++++++++++++++++++----- drivers/net/ethernet/mellanox/mlx4/pd.c | 12 +++-- include/linux/mlx4/device.h | 13 ++++++ 8 files changed, 84 insertions(+), 22 deletions(-) commit 22e3817e6c8301dc0520b855c8a2d764580e719c Author: Daniel Jurgens Date: Wed Feb 17 17:24:25 2016 +0200 net/mlx4_core: Do not BUG_ON during reset when PCI is offline The PCI channel could go offline during reset due to EEH. Don't bug on in this case, the error is recoverable. Fixes: f6bc11e42646 ('net/mlx4_core: Enhance the catas flow to support device reset') Signed-off-by: Daniel Jurgens Reviewed-by: Yishai Hadas Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/catas.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 6b94bab0ee8d5def6a2aac0ef6204ee6e24386b6 Author: Eran Ben Elisha Date: Wed Feb 17 17:24:24 2016 +0200 net/mlx4_core: Fix potential corruption in counters database The error flow in procedure handle_existing_counter() is wrong. The procedure should exit after encountering the error, not continue as if everything is OK. Fixes: 68230242cdbc ('net/mlx4_core: Add port attribute when tracking counters') Signed-off-by: Eran Ben Elisha Signed-off-by: Jack Morgenstein Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 31c128b66e5b28f468076e4f3ca3025c35342041 Author: Eugenia Emantayev Date: Wed Feb 17 17:24:23 2016 +0200 net/mlx4_en: Choose time-stamping shift value according to HW frequency Previously, the shift value used for time-stamping was constant and didn't depend on the HW chip frequency. Change that to take the frequency into account and calculate the maximal value in cycles per wraparound of ten seconds. This time slot was chosen since it gives a good accuracy in time synchronization. Algorithm for shift value calculation: * Round up the maximal value in cycles to nearest power of two * Calculate maximal multiplier by division of all 64 bits set to above result * Then, invert the function clocksource_khz2mult() to get the shift from maximal mult value Fixes: ec693d47010e ('net/mlx4_en: Add HW timestamping (TS) support') Signed-off-by: Eugenia Emantayev Reviewed-by: Matan Barak Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_clock.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) commit 281e8b2fdf8e4ef366b899453cae50e09b577ada Author: Amir Vadai Date: Wed Feb 17 17:24:22 2016 +0200 net/mlx4_en: Count HW buffer overrun only once RdropOvflw counts overrun of HW buffer, therefore should be used for rx_fifo_errors only. Currently RdropOvflw counter is mistakenly also set into rx_missed_errors and rx_over_errors too, which makes the device total dropped packets accounting to show wrong results. Fix that. Use it for rx_fifo_errors only. Fixes: c27a02cd94d6 ('mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC') Signed-off-by: Amir Vadai Signed-off-by: Eugenia Emantayev Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_port.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9f74660bcf1e4cca577be99e54bc77b5df62b508 Author: Chuck Lever Date: Mon Feb 15 10:23:59 2016 -0500 xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len Some NFSv4.1 OPEN requests were hanging waiting for the NFS server to finish recalling delegations. Turns out that each NFSv4.1 CB request on RDMA gets a GARBAGE_ARGS reply from the Linux client. Commit 756b9b37cfb2e3dc added a line in bc_svc_process that overwrites the incoming rq_rcv_buf's length with the value in rq_private_buf.len. But rpcrdma_bc_receive_call() does not invoke xprt_complete_bc_request(), thus rq_private_buf.len is not initialized. svc_process_common() is invoked with a zero-length RPC message, and fails. Fixes: 756b9b37cfb2e3dc ('SUNRPC: Fix callback channel') Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/backchannel.c | 2 ++ 1 file changed, 2 insertions(+) commit c2bab619813a525d3f58b5ffbfcdc4edee27e497 Author: Eran Ben Elisha Date: Thu Feb 11 10:24:44 2016 +0200 IB/mlx4: Add support for the port info class for RoCE ports Report that driver supports IB_PMA_CLASS_CAP_EXT_WIDTH in respond for IB_MGMT_CLASS_PERF_MGMT mad with IB_PMA_CLASS_PORT_INFO attr id. Signed-off-by: Eran Ben Elisha Signed-off-by: Matan Barak Reviewed-by: Or Gerlitz Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/mad.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit c3c0c83667a9fe78cc28c27ec9e5ace3411ae775 Author: Eran Ben Elisha Date: Thu Feb 11 10:24:43 2016 +0200 IB/mlx4: Add support for extended counters over RoCE ports When attribute IB_PMA_PORT_COUNTERS_EXT is set, we now return 64 bit values for the counters. Signed-off-by: Eran Ben Elisha Signed-off-by: Matan Barak Reviewed-by: Or Gerlitz Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/mad.c | 50 +++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 13 deletions(-) commit b41f7852f3b981df30727f5cd64c1877ceee794e Author: Devesh Sharma Date: Thu Feb 11 00:21:52 2016 -0500 RDMA/ocrdma: Fix arm logic to align with new cq API Today ocrdma driver defer arming the CQ till poll is called. This was used to prevent calling poll-cq on an armed CQ. Recently a set of new CQ API has been introduced into the linux kernel. The implementation of this API guarantees that a given CQ is never armed before calling poll on it. Most of the kernel ULPs have already moved to use this new API or have a code where poll is called before arming the CQ. Thus, the above workaround in ocrdma is not needed anymore. This patch removes the additional logic to deffer arm till poll is called. This patch adds a simple scheme where ib_req_notify_cq() will actually arm the cq. Signed-off-by: Devesh Sharma Signed-off-by: Doug Ledford drivers/infiniband/hw/ocrdma/ocrdma.h | 3 --- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 18 ++++-------------- 2 files changed, 4 insertions(+), 17 deletions(-) commit bba40e6948b94cba71965285fbac31bd078c024a Author: Cristian Birsan Date: Thu Feb 11 08:58:17 2016 -0700 usb: musb: Fix DMA desired mode for Mentor DMA engine Commit 754fe4a92c07 ("usb: musb: Remove ifdefs for TX DMA for musb_host.c") introduces a problem setting the desired channel mode for the Mentor DMA engine. There is a case where an address is incorrectly assigned to the DMA channel desired mode when it should instead be assigned the actual mode value. This results in the value of channel->desired_mode not being correct. Acked-by: Sergei Shtylyov Signed-off-by: Cristian Birsan Signed-off-by: Joshua Henderson Signed-off-by: Felipe Balbi drivers/usb/musb/musb_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96c7de4ff41c2ed6da43141a4deb922de09617d0 Author: Andrzej Hajda Date: Mon Feb 15 15:35:25 2016 +0100 usb: gadget: fsl_qe_udc: fix IS_ERR_VALUE usage IS_ERR_VALUE macro should be used only with unsigned long type. Otherwise it can work incorrectly. The patch follows conclusion from discussion on LKML [1][2]. [1]: http://permalink.gmane.org/gmane.linux.kernel/2120927 [2]: http://permalink.gmane.org/gmane.linux.kernel/2150581 Signed-off-by: Andrzej Hajda Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/fsl_qe_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 390f0ffe92aea878b763c7fd8afd1dff62e0d20b Author: Anton Bondarenko Date: Wed Feb 17 14:28:47 2016 +0100 spi: imx: allow only WML aligned transfers to use DMA RX DMA tail data handling doesn't work correctly in many cases with current implementation. It happens because SPI core was setup to generates both RX and RX TAIL events. And RX TAIL event does not work correctly. This can be easily verified by sending SPI transaction with size modulus WML(32 in our case) not equal 0. Also removing change introduced in f6ee9b582d2db652497b73c1f117591dfb6d3a90 since this change only fix usecases with transfer size from 33 to 128 bytes and doesn't fix 129 bytes and bigger. This is output from transaction with len 138 bytes in loopback mode at 10Mhz: TX0000: a3 97 a2 55 53 be f1 fc f9 79 6b 52 14 13 e9 e2 TX0010: 2d 51 8e 1f 56 08 57 27 a7 05 d4 d0 52 82 77 75 TX0020: 1b 99 4a ed 58 3d 6a 52 36 d5 24 4a 68 8e ad 95 TX0030: 5f 3c 35 b5 c4 8c dd 6c 11 32 3d e2 b4 b4 59 cf TX0040: ce 23 3d 27 df a7 f9 96 fc 1e e0 66 2c 0e 7b 8c TX0050: ca 30 42 8f bc 9f 7b ce d1 b8 b1 87 ec 8a d6 bb TX0060: 2e 15 63 0e 3c dc a4 3a 7a 06 20 a7 93 1b 34 dd TX0070: 4c f5 ec 88 96 68 d6 68 a0 09 6f 8e 93 47 c9 41 TX0080: db ac cf 97 89 f3 51 05 79 71 RX0000: a3 97 a2 55 53 be f1 fc f9 79 6b 52 14 13 e9 e2 RX0010: 2d 51 8e 1f 56 08 57 27 a7 05 d4 d0 52 82 77 75 RX0020: 1b 99 4a ed 58 3d 6a 52 36 d5 24 4a 68 8e ad 95 RX0030: 5f 3c 35 00 00 b5 00 00 00 c4 00 00 8c 00 00 dd RX0040: 6c 11 32 3d e2 b4 b4 59 cf ce 23 3d 27 df a7 f9 RX0050: 96 fc 1e e0 66 2c 0e 7b 8c ca 30 42 8f 1f 1f bc RX0060: 9f 7b ce d1 b8 b1 87 ec 8a d6 bb 2e 15 63 0e ed RX0070: ed 3c 58 58 58 dc 3d 3d a4 6a 6a 3a 52 52 7a 36 RX0080: 06 20 a7 93 1b 34 dd 4c f5 ec Zeros at offset 33 and 34 caused by reading empty RX FIFO which not possible if DMA RX read was triggered by RX event. This mean DMA was triggered by RX TAIL event. Signed-off-by: Anton Bondarenko Signed-off-by: Sascha Hauer Signed-off-by: Mark Brown drivers/spi/spi-imx.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) commit 6ecad912a0073c768db1491c27ca55ad2d0ee68f Author: Alexey Kardashevskiy Date: Wed Feb 17 18:26:31 2016 +1100 powerpc/ioda: Set "read" permission when "write" is set Quite often drivers set only "write" permission assuming that this includes "read" permission as well and this works on plenty of platforms. However IODA2 is strict about this and produces an EEH when "read" permission is not set and reading happens. This adds a workaround in the IODA code to always add the "read" bit when the "write" bit is set. Fixes: 10b35b2b7485 ("powerpc/powernv: Do not set "read" flag if direction==DMA_NONE") Cc: stable@vger.kernel.org # 4.2+ Cc: Benjamin Herrenschmidt Signed-off-by: Alexey Kardashevskiy Tested-by: Douglas Miller Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 722ec35f7faefcc34d12616eca7976a848870f9d Author: Marek Szyprowski Date: Tue Feb 16 15:14:44 2016 +0100 arm64: dma-mapping: fix handling of devices registered before arch_initcall This patch ensures that devices, which got registered before arch_initcall will be handled correctly by IOMMU-based DMA-mapping code. Cc: Fixes: 13b8629f6511 ("arm64: Add IOMMU dma_ops") Acked-by: Robin Murphy Signed-off-by: Marek Szyprowski Signed-off-by: Will Deacon arch/arm64/mm/dma-mapping.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8d409cb3e8a24196be7271defafd4638f3e0b514 Author: Ville Syrjälä Date: Wed Feb 10 19:59:05 2016 +0200 drm/i915: Fix hpd live status bits for g4x Looks like g4x hpd live status bits actually agree with the spec. At least they do on the machine I have, and apparently on Nick Bowler's g4x as well. So gm45 may be the only platform where they don't agree. At least that seems to be the case based on the (somewhat incomplete) logs/dumps in [1], and Daniel has also tested this on his gm45 sometime in the past. So let's change the bits to match the spec on g4x. That actually makes the g4x bits identical to vlv/chv so we can just share the code between those platforms, leaving gm45 as the special case. [1] https://bugzilla.kernel.org/show_bug.cgi?id=52361 Cc: Shashank Sharma Cc: Sonika Jindal Cc: Daniel Vetter Cc: Jani Nikula Cc: Nick Bowler References: https://lists.freedesktop.org/archives/dri-devel/2016-February/100382.html Reported-by: Nick Bowler Cc: stable@vger.kernel.org Fixes: 237ed86c693d ("drm/i915: Check live status before reading edid") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1455127145-20087-1-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter (cherry picked from commit 0780cd36c7af70c55981ee624084f0f48cae9b95) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 15 ++++++++------- drivers/gpu/drm/i915/intel_dp.c | 14 +++++++------- 2 files changed, 15 insertions(+), 14 deletions(-) commit 059fcd8cd16622da6513804a7a3e826d152c6c96 Author: Thomas Gleixner Date: Tue Feb 9 20:11:34 2016 +0000 perf/core: Plug potential memory leak in CPU_UP_PREPARE If CPU_UP_PREPARE is called it is not guaranteed, that a previously allocated and assigned hash has been freed already, but perf_event_init_cpu() unconditionally allocates and assignes a new hash if the swhash is referenced. By overwriting the pointer the existing hash is not longer accessible. Verify that there is no hash assigned on this cpu before allocating and assigning a new one. Signed-off-by: Thomas Gleixner Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Vince Weaver Link: http://lkml.kernel.org/r/20160209201007.843269966@linutronix.de Signed-off-by: Ingo Molnar kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 27ca9236c96f4a21b72a2b4f08260efeab951bd0 Author: Thomas Gleixner Date: Tue Feb 9 20:11:26 2016 +0000 perf/core: Remove the bogus and dangerous CPU_DOWN_FAILED hotplug state If CPU_DOWN_PREPARE fails the perf hotplug notifier is called for CPU_DOWN_FAILED and calls perf_event_init_cpu(), which checks whether the swhash is referenced. If yes it allocates a new hash and stores the pointer in the per cpu data structure. But at this point the cpu is still online, so there must be a valid hash already. By overwriting the pointer the existing hash is not longer accessible. Remove the CPU_DOWN_FAILED state, as there is nothing to (re)allocate. Signed-off-by: Thomas Gleixner Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Vince Weaver Link: http://lkml.kernel.org/r/20160209201007.763417379@linutronix.de Signed-off-by: Ingo Molnar kernel/events/core.c | 1 - 1 file changed, 1 deletion(-) commit b4f75d44bed1bdbb14ac704bfc38f62a3675e591 Author: Thomas Gleixner Date: Tue Feb 9 20:11:20 2016 +0000 perf/core: Remove bogus UP_CANCELED hotplug state If CPU_UP_PREPARE fails the perf hotplug code calls perf_event_exit_cpu(), which is a pointless exercise. The cpu is not online, so the smp function calls return -ENXIO. So the result is a list walk to call noops. Remove it. Signed-off-by: Thomas Gleixner Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Vince Weaver Link: http://lkml.kernel.org/r/20160209201007.682184765@linutronix.de Signed-off-by: Ingo Molnar kernel/events/core.c | 1 - 1 file changed, 1 deletion(-) commit 901c5ffaaed117a38be9d0c29247c4888d6c8636 Author: Geert Uytterhoeven Date: Mon Feb 15 13:20:08 2016 +0100 ARM: shmobile: Remove shmobile_boot_arg CPU boot configuration writes to shmobile_boot_arg, which is located in the .text section, and thus should not be written to. As of commit 1d33a354bbb618ba ("ARM: shmobile: Per-CPU SMP boot / sleep code for SCU SoCs"), and ignoring accidental remainings, shmobile_boot_arg is always set to MPIDR_HWID_BITMASK by C code. Hence we can just hardcode this in the assembler code, and remove the variable, and thus also remove the need to write to this variable. Signed-off-by: Geert Uytterhoeven Acked-by: Nicolas Pitre Signed-off-by: Simon Horman arch/arm/mach-shmobile/common.h | 1 - arch/arm/mach-shmobile/headsmp.S | 8 ++------ arch/arm/mach-shmobile/platsmp-apmu.c | 1 - arch/arm/mach-shmobile/platsmp-scu.c | 1 - 4 files changed, 2 insertions(+), 9 deletions(-) commit 4e960f52fce16a3bf3261fa92c34cf2306059ba2 Author: Geert Uytterhoeven Date: Mon Feb 15 13:20:07 2016 +0100 ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss If CONFIG_DEBUG_RODATA=y, the kernel crashes during system suspend: Freezing user space processes ... (elapsed 0.004 seconds) done. Freezing remaining freezable tasks ... (elapsed 0.002 seconds) done. PM: suspend of devices complete after 111.948 msecs PM: late suspend of devices complete after 1.086 msecs PM: noirq suspend of devices complete after 11.576 msecs Disabling non-boot CPUs ... Kernel panic - not syncing: Attempted to kill the idle task! 1014ec ---[ end Kernel panic - not syncing: Attempted to kill the idle task! CPU0: stopping This happens because the .text section is marked read-only, while the arrays shmobile_smp_mpidr[], shmobile_smp_fn[], and shmobile_smp_arg[] are being written to. Fix this by moving these arrays from the .text to the .bss section. This requires accessing them through PC-relative offsets. Signed-off-by: Geert Uytterhoeven Reviewed-by: Kees Cook Reviewed-by: Nicolas Pitre Signed-off-by: Simon Horman arch/arm/mach-shmobile/headsmp.S | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit b1568d80123a7e7ab528f587ef6896b2d5413b61 Author: Geert Uytterhoeven Date: Thu Jan 28 16:13:31 2016 +0100 ARM: shmobile: r8a7779: Remove remainings of removed SCU boot setup code Commit 0ca2894b5a900709 ("ARM: shmobile: Use shared SCU SMP boot code on r8a7779") obsoleted the r8a7779-specific SCU boot code, but forgot to remove the setup of shmobile_boot_fn and shmobile_boot_arg, which is overwritten by shmobile_smp_scu_prepare_cpus(). Note that shmobile_scu_base wasn't initialized at that point yet anyway. Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm/mach-shmobile/smp-r8a7779.c | 2 -- 1 file changed, 2 deletions(-) commit d2613f56ce0287211d70a86443a143cae1887911 Author: Geert Uytterhoeven Date: Thu Jan 28 16:04:21 2016 +0100 ARM: shmobile: Move shmobile_scu_base from .text to .bss shmobile_scu_base is being written to, so it doesn't belong in the .text section. Fix this by moving it from asm .text to C .bss, as it's no longer used from asm code since commit 4f6da36f7edd5790 ("ARM: shmobile: Remove old SCU boot code"). Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm/mach-shmobile/headsmp-scu.S | 6 ------ arch/arm/mach-shmobile/platsmp-scu.c | 3 +++ 2 files changed, 3 insertions(+), 6 deletions(-) commit c219b7ddb6a3524a61a89438d86e4a8639706308 Author: Steven Rostedt Date: Wed Feb 10 12:04:22 2016 -0500 sched/deadline: Fix trivial typo in printk() message It's "too much" not "to much". Signed-off-by: Steven Rostedt Acked-by: Juri Lelli Cc: Jiri Kosina Cc: Juri Lelli Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20160210120422.4ca77e68@gandalf.local.home Signed-off-by: Ingo Molnar kernel/sched/deadline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e7f9df25874cedbbc604a5c5c2e7a6efe662387 Author: Michael S. Tsirkin Date: Thu Feb 11 01:05:01 2016 +0200 hpet: Drop stale URLs Looks like the HPET spec at intel.com got moved. It isn't hard to find so drop the link, just mention the revision assumed. Suggested-by: Thomas Gleixner Signed-off-by: Michael S. Tsirkin Acked-by: Greg Kroah-Hartman Cc: Arnd Bergmann Cc: Clemens Ladisch Cc: Jonathan Corbet Cc: Linus Torvalds Cc: Peter Zijlstra Cc: linux-doc@vger.kernel.org Link: http://lkml.kernel.org/r/1455145462-3877-1-git-send-email-mst@redhat.com Signed-off-by: Ingo Molnar Documentation/timers/hpet.txt | 4 +--- arch/x86/Kconfig | 4 ++-- drivers/char/hpet.c | 2 +- 3 files changed, 4 insertions(+), 6 deletions(-) commit ee89b641a9ddca5f2d1e38d205473c4b0d26c670 Author: Geert Uytterhoeven Date: Tue Feb 16 16:10:59 2016 +0100 usb: dwc2: USB_DWC2 should depend on HAS_DMA If NO_DMA=y: ERROR: "usb_gadget_map_request" [drivers/usb/dwc2/dwc2.ko] undefined! ERROR: "usb_gadget_unmap_request" [drivers/usb/dwc2/dwc2.ko] undefined! ERROR: "bad_dma_ops" [drivers/usb/dwc2/dwc2.ko] undefined! Add a dependency on HAS_DMA to fix this. Signed-off-by: Geert Uytterhoeven Acked-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/dwc2/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 62943b7dfa35887a40f71f698deec4488bf73036 Author: Tang, Jianqiang Date: Tue Feb 16 15:02:07 2016 -0800 usb: dwc2: host: fix the data toggle error in full speed descriptor dma There will be data toggle error happen for full speed buld-out transfer. The data toggle bit is saved in qh for non-control transfers, it is wrong to check the qtd for that case. Also fix one static analysis tool issue after fix the data toggle error. John Youn: * Added WARN() to warn on improper usage of the dwc2_hcd_save_data_toggle() function. Signed-off-by: Dyson Lee Signed-off-by: Tang, Jianqiang Signed-off-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/dwc2/hcd_ddma.c | 2 +- drivers/usb/dwc2/hcd_intr.c | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) commit 3142a16b9816c24501103a92010a283eb6e2766c Author: Vardan Mikayelyan Date: Tue Feb 16 15:01:53 2016 -0800 usb: dwc2: host: fix logical omissions in dwc2_process_non_isoc_desc Fixes memory manipulation issues and makes Host DDMA bulk transfers work. dwc2_process_non_isoc_desc() must return non zero value ONLY when failure happens in one of the queued descriptors. After receiving non zero value the caller must stop processing of remaining QTDs and their descriptors from chain. Commit 26a19ea699060fde ("usb: dwc2: host: fix use of qtd after free in desc dma mode") breaks non_isoc transaction completion logic in Host DDMA mode. There were bugs before that, but after this patch dwc2_process_non_isoc_desc() returns fail status even if descriptor was processed normally. This causes break from loop which is processing remaining descriptors assigned to QTD, which is not correct for QTDs containing more than one descriptor. Current dwc2 driver gathers queued BULK URBs until receiving URB without URB_NO_INTERRUPT flag. Once getting it, SW creates descriptor chain, stores it in qh structure and passes start address to HW. Multiple URB data is contained in that chain. Hence on getting error on descriptor after its processing by HW, SW should go out of both loops(qh->qtd, qtd->descs) and report the failure. Fixes: 26a19ea699060fde ("usb: dwc2: host: fix use of qtd after free in desc dma mode") Cc: Gregory Herrero Signed-off-by: Vardan Mikayelyan Signed-off-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/dwc2/hcd_ddma.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) commit c450960187f45d4260db87c7dd4fc0bceb5565d8 Author: John Youn Date: Tue Feb 16 20:10:53 2016 -0800 usb: dwc3: Fix assignment of EP transfer resources The assignement of EP transfer resources was not handled properly in the dwc3 driver. Commit aebda6187181 ("usb: dwc3: Reset the transfer resource index on SET_INTERFACE") previously fixed one aspect of this where resources may be exhausted with multiple calls to SET_INTERFACE. However, it introduced an issue where composite devices with multiple interfaces can be assigned the same transfer resources for different endpoints. This patch solves both issues. The assignment of transfer resources cannot perfectly follow the data book due to the fact that the controller driver does not have all knowledge of the configuration in advance. It is given this information piecemeal by the composite gadget framework after every SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook programming model in this scenario can cause errors. For two reasons: 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION and SET_INTERFACE (8.1.5). This is incorrect in the scenario of multiple interfaces. 2) The databook does not mention doing more DEPXFERCFG for new endpoint on alt setting (8.1.6). The following simplified method is used instead: All hardware endpoints can be assigned a transfer resource and this setting will stay persistent until either a core reset or hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and do DEPXFERCFG for every hardware endpoint as well. We are guaranteed that there are as many transfer resources as endpoints. This patch triggers off of the calling dwc3_gadget_start_config() for EP0-out, which always happens first, and which should only happen in one of the above conditions. Fixes: aebda6187181 ("usb: dwc3: Reset the transfer resource index on SET_INTERFACE") Cc: # v3.2+ Reported-by: Ravi Babu Signed-off-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/dwc3/core.h | 1 - drivers/usb/dwc3/ep0.c | 5 ---- drivers/usb/dwc3/gadget.c | 70 +++++++++++++++++++++++++++++++++++------------ 3 files changed, 52 insertions(+), 24 deletions(-) commit bd84f4ae9986ac9acd278566ccb39c60bc961abb Author: John Youn Date: Mon Feb 15 15:30:20 2016 -0800 usb: dwc2: Add extra delay when forcing dr_mode Fixes an issue found on rockchip rk3036 and rk3188 SOC platforms. For some reason, the existing msleep(25) is not enough after the force mode. The following patch was reported to fix the issue. This does increase the probe delay again slightly, but not up to the level it was before the original series of patches that this fixes. It does not cause any other issues when tested on Synopsys HAPS and Altera socfpga platforms. Need to revisit this series next release to see if we can address these issues without having an unconditional delay. Fixes: 09c96980dc72 ("usb: dwc2: Add functions to set and clear force mode") Reported-by: Caesar Wang Reported-by: Michael Niewoehner Tested-by: Heiko Stuebner Tested-by: Caesar Wang Signed-off-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/dwc2/core.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 12d319b920fa673a4d5e7c1785c5dc82dcd15257 Author: Stefan Haberland Date: Fri Feb 12 14:50:52 2016 +0100 s390/dasd: fix performance drop Commit ca369d51b ("sd: Fix device-imposed transfer length limits") introduced a new queue limit max_dev_sectors which limits the maximum sectors for requests. The default value leads to small dasd requests and therefor to a performance drop. Set the max_dev_sectors value to the same value as the max_hw_sectors to use the maximum available request size for DASD devices. Signed-off-by: Stefan Haberland Cc: stable@vger.kernel.org # 4.4+ Signed-off-by: Martin Schwidefsky drivers/s390/block/dasd.c | 1 + 1 file changed, 1 insertion(+) commit a82eee7424525e34e98d821dd059ce14560a1e35 Author: Toshi Kani Date: Thu Feb 11 14:24:17 2016 -0700 x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() Data corruption issues were observed in tests which initiated a system crash/reset while accessing BTT devices. This problem is reproducible. The BTT driver calls pmem_rw_bytes() to update data in pmem devices. This interface calls __copy_user_nocache(), which uses non-temporal stores so that the stores to pmem are persistent. __copy_user_nocache() uses non-temporal stores when a request size is 8 bytes or larger (and is aligned by 8 bytes). The BTT driver updates the BTT map table, which entry size is 4 bytes. Therefore, updates to the map table entries remain cached, and are not written to pmem after a crash. Change __copy_user_nocache() to use non-temporal store when a request size is 4 bytes. The change extends the current byte-copy path for a less-than-8-bytes request, and does not add any overhead to the regular path. Reported-and-tested-by: Micah Parrish Reported-and-tested-by: Brian Boylston Signed-off-by: Toshi Kani Cc: Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Borislav Petkov Cc: Brian Gerst Cc: Dan Williams Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Peter Zijlstra Cc: Ross Zwisler Cc: Thomas Gleixner Cc: Toshi Kani Cc: Vishal Verma Cc: linux-nvdimm@lists.01.org Link: http://lkml.kernel.org/r/1455225857-12039-3-git-send-email-toshi.kani@hpe.com [ Small readability edits. ] Signed-off-by: Ingo Molnar arch/x86/lib/copy_user_64.S | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) commit ee9737c924706aaa72c2ead93e3ad5644681dc1c Author: Toshi Kani Date: Thu Feb 11 14:24:16 2016 -0700 x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable Add comments to __copy_user_nocache() to clarify its procedures and alignment requirements. Also change numeric branch target labels to named local labels. No code changed: arch/x86/lib/copy_user_64.o: text data bss dec hex filename 1239 0 0 1239 4d7 copy_user_64.o.before 1239 0 0 1239 4d7 copy_user_64.o.after md5: 58bed94c2db98c1ca9a2d46d0680aaae copy_user_64.o.before.asm 58bed94c2db98c1ca9a2d46d0680aaae copy_user_64.o.after.asm Signed-off-by: Toshi Kani Cc: Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Toshi Kani Cc: brian.boylston@hpe.com Cc: dan.j.williams@intel.com Cc: linux-nvdimm@lists.01.org Cc: micah.parrish@hpe.com Cc: ross.zwisler@linux.intel.com Cc: vishal.l.verma@intel.com Link: http://lkml.kernel.org/r/1455225857-12039-2-git-send-email-toshi.kani@hpe.com [ Small readability edits and added object file comparison. ] Signed-off-by: Ingo Molnar arch/x86/lib/copy_user_64.S | 114 ++++++++++++++++++++++++++++---------------- 1 file changed, 73 insertions(+), 41 deletions(-) commit 52499d93d6dec3872de3b982219af6d4c182a452 Author: Heiko Carstens Date: Fri Feb 12 12:40:31 2016 +0100 s390/maccess: reduce stnsm instructions When fixing the DAT off bug ("s390: fix DAT off memory access, e.g. on kdump") both Christian and I missed that we can save an additional stnsm instruction. This saves us a couple of cycles which could improve the speed of memcpy_real. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/mm/maccess.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 8bc9162cd2bf37036c486b384ac445b59b334b04 Author: Thomas Gleixner Date: Tue Feb 16 23:04:41 2016 +0100 perf/x86/amd/uncore: Plug reference leak In the error path of amd_uncore_cpu_up_prepare() the newly allocated uncore struct is freed, but the percpu pointer still references it. Set it to NULL. Signed-off-by: Thomas Gleixner Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Vince Weaver Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1602162302170.19512@nanos Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/perf_event_amd_uncore.c | 2 ++ 1 file changed, 2 insertions(+) commit dada168b3b76439d83aff34f8fbd9c512c2d136a Author: Anton Protopopov Date: Sat Feb 6 23:25:28 2016 -0500 drm/qxl: fix erroneous return value The qxl_gem_prime_mmap() function returns ENOSYS instead of -ENOSYS Signed-off-by: Anton Protopopov Signed-off-by: Dave Airlie drivers/gpu/drm/qxl/qxl_prime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff683df7bf34f90766a50c7e7454e219aef2710e Author: Mario Kleiner Date: Fri Feb 12 20:30:32 2016 +0100 drm/nouveau/display: Enable vblank irqs after display engine is on again. In the display resume path, move the calls to drm_vblank_on() after the point when the display engine is running again. Since changes were made to drm_update_vblank_count() in Linux 4.4+ to emulate hw vblank counters via vblank timestamping, the function drm_vblank_on() now needs working high precision vblank timestamping and therefore working scanout position queries at time of call. These don't work before the display engine gets restarted, causing miscalculation of vblank counter increments and thereby large forward jumps in vblank count at display resume. These jumps can cause client hangs on resume, or desktop hangs in the case of composited desktops. Fix this Linux 4.4 regression by reordering calls accordingly. Signed-off-by: Mario Kleiner Cc: # 4.4+ Cc: Ben Skeggs Cc: ville.syrjala@linux.intel.com Cc: daniel.vetter@ffwll.ch Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Vetter Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nouveau_display.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e0b34e3857004ac2257458d6354c31349f51e207 Author: Mario Kleiner Date: Fri Feb 12 20:30:31 2016 +0100 drm/radeon/pm: Handle failure of drm_vblank_get. Make sure that drm_vblank_get/put() stay balanced in case drm_vblank_get fails, by skipping the corresponding put. Signed-off-by: Mario Kleiner Reviewed-by: Daniel Vetter Cc: michel@daenzer.net Cc: dri-devel@lists.freedesktop.org Cc: alexander.deucher@amd.com Cc: christian.koenig@amd.com Signed-off-by: Dave Airlie drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit bb74fc1bf3072bd3ab4ed5f43afd287a63baf2d7 Author: Mario Kleiner Date: Fri Feb 12 20:30:30 2016 +0100 drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2) drm_vblank_offdelay can have three different types of values: < 0 is to be always treated the same as dev->vblank_disable_immediate = 0 is to be treated as "never disable vblanks" > 0 is to be treated as disable immediate if kms driver wants it that way via dev->vblank_disable_immediate. Otherwise it is a disable timeout in msecs. This got broken in Linux 3.18+ for the implementation of drm_vblank_on. If the user specified a value of zero which should always reenable vblank irqs in this function, a kms driver could override the users choice by setting vblank_disable_immediate to true. This patch fixes the regression and keeps the user in control. v2: Only reenable vblank if there are clients left or the user requested to "never disable vblanks" via offdelay 0. Enabling vblanks even in the "delayed disable" case (offdelay > 0) was specifically added by Ville in commit cd19e52aee922 ("drm: Kick start vblank interrupts at drm_vblank_on()"), but after discussion it turns out that this was done by accident. Citing Ville: "I think it just ended up as a mess due to changing some of the semantics of offdelay<0 vs. offdelay==0 vs. disable_immediate during the review of the series. So yeah, given how drm_vblank_put() works now, I'd just make this check for offdelay==0." Signed-off-by: Mario Kleiner Reviewed-by: Daniel Vetter Cc: # 3.18+ Cc: michel@daenzer.net Cc: vbabka@suse.cz Cc: ville.syrjala@linux.intel.com Cc: daniel.vetter@ffwll.ch Cc: dri-devel@lists.freedesktop.org Cc: alexander.deucher@amd.com Cc: christian.koenig@amd.com Signed-off-by: Dave Airlie drivers/gpu/drm/drm_irq.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit c61934ed9a0e3911a9935df26858726a7ec35ec0 Author: Mario Kleiner Date: Fri Feb 12 20:30:29 2016 +0100 drm: Fix drm_vblank_pre/post_modeset regression from Linux 4.4 Changes to drm_update_vblank_count() in Linux 4.4 broke the behaviour of the pre/post modeset functions as the new update code doesn't deal with hw vblank counter resets inbetween calls to drm_vblank_pre_modeset an drm_vblank_post_modeset, as it should. This causes mistreatment of such hw counter resets as counter wraparound, and thereby large forward jumps of the software vblank counter which in turn cause vblank event dispatching and vblank waits to fail/hang --> userspace clients hang. This symptom was reported on radeon-kms to cause a infinite hang of KDE Plasma 5 shell's login procedure, preventing users from logging in. Fix this by detecting when drm_update_vblank_count() is called inside a pre->post modeset interval. If so, clamp valid vblank increments to the safe values 0 and 1, pretty much restoring the update behavior of the old update code of Linux 4.3 and earlier. Also reset the last recorded hw vblank count at call to drm_vblank_post_modeset() to be safe against hw that after modesetting, dpms on etc. only fires its first vblank irq after drm_vblank_post_modeset() was already called. Reported-by: Vlastimil Babka Signed-off-by: Mario Kleiner Reviewed-by: Daniel Vetter Tested-by: Vlastimil Babka Cc: # 4.4+ Cc: michel@daenzer.net Cc: vbabka@suse.cz Cc: ville.syrjala@linux.intel.com Cc: daniel.vetter@ffwll.ch Cc: dri-devel@lists.freedesktop.org Cc: alexander.deucher@amd.com Cc: christian.koenig@amd.com Signed-off-by: Dave Airlie drivers/gpu/drm/drm_irq.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 99b8e71597fadd6b2ac85e6e10f221f79dd9c1c1 Author: Mario Kleiner Date: Fri Feb 12 20:30:28 2016 +0100 drm: Prevent vblank counter bumps > 1 with active vblank clients. (v2) This fixes a regression introduced by the new drm_update_vblank_count() implementation in Linux 4.4: Restrict the bump of the software vblank counter in drm_update_vblank_count() to a safe maximum value of +1 whenever there is the possibility that concurrent readers of vblank timestamps could be active at the moment, as the current implementation of the timestamp caching and updating is not safe against concurrent readers for calls to store_vblank() with a bump of anything but +1. A bump != 1 would very likely return corrupted timestamps to userspace, because the same slot in the cache could be concurrently written by store_vblank() and read by one of those readers in a non-atomic fashion and without the read-retry logic detecting this collision. Concurrent readers can exist while drm_update_vblank_count() is called from the drm_vblank_off() or drm_vblank_on() functions or other non-vblank- irq callers. However, all those calls are happening with the vbl_lock locked thereby preventing a drm_vblank_get(), so the vblank refcount can't increase while drm_update_vblank_count() is executing. Therefore a zero vblank refcount during execution of that function signals that is safe for arbitrary counter bumps if called from outside vblank irq, whereas a non-zero count is not safe. Whenever the function is called from vblank irq, we have to assume concurrent readers could show up any time during its execution, even if the refcount is currently zero, as vblank irqs are usually only enabled due to the presence of readers, and because when it is called from vblank irq it can't hold the vbl_lock to protect it from sudden bumps in vblank refcount. Therefore also restrict bumps to +1 when the function is called from vblank irq. Such bumps of more than +1 can happen at other times than reenabling vblank irqs, e.g., when regular vblank interrupts get delayed by more than 1 frame due to long held locks, long irq off periods, realtime preemption on RT kernels, or system management interrupts. A better solution would be to rewrite the timestamp caching to use full seqlocks to allow concurrent writes and reads for arbitrary vblank counter increments. v2: Add code comment that this is essentially a hack and should be replaced by a full seqlock implementation for caching of timestamps. Signed-off-by: Mario Kleiner Reviewed-by: Daniel Vetter Cc: # 4.4+ Cc: michel@daenzer.net Cc: vbabka@suse.cz Cc: ville.syrjala@linux.intel.com Cc: daniel.vetter@ffwll.ch Cc: dri-devel@lists.freedesktop.org Cc: alexander.deucher@amd.com Cc: christian.koenig@amd.com Signed-off-by: Dave Airlie drivers/gpu/drm/drm_irq.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit e8235891b33799d597ff4ab5e45afe173a65da30 Author: Mario Kleiner Date: Fri Feb 12 20:30:27 2016 +0100 drm: No-Op redundant calls to drm_vblank_off() (v2) Otherwise if a kms driver calls into drm_vblank_off() more than once before calling drm_vblank_on() again, the redundant calls to vblank_disable_and_save() will call drm_update_vblank_count() while hw vblank counters and vblank timestamping are in a undefined state during modesets, dpms off etc. At least with the legacy drm helpers it is not unusual to get multiple calls to drm_vblank_off and drm_vblank_on, e.g., half a dozen calls to drm_vblank_off and two calls to drm_vblank_on were observed on radeon-kms during dpms-off -> dpms-on transition. We don't no-op calls from atomic modesetting drivers, as they should do a proper job of tracking hw state. Fixes large jumps of the software maintained vblank counter due to the hardware vblank counter resetting to zero during dpms off or modeset, e.g., if radeon-kms is modified to use drm_vblank_off/on instead of drm_vblank_pre/post_modeset(). This fixes a regression caused by the changes made to drm_update_vblank_count() in Linux 4.4. v2: Don't no-op on atomic modesetting drivers, per suggestion of Daniel Vetter. Signed-off-by: Mario Kleiner Reviewed-by: Daniel Vetter Cc: # 4.4+ Cc: michel@daenzer.net Cc: vbabka@suse.cz Cc: ville.syrjala@linux.intel.com Cc: alexander.deucher@amd.com Cc: christian.koenig@amd.com Signed-off-by: Dave Airlie drivers/gpu/drm/drm_irq.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 34855706c30d52b0a744da44348b5d1cc39fbe51 Author: Gerd Hoffmann Date: Tue Feb 16 14:25:00 2016 +0100 drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command This avoids integer overflows on 32bit machines when calculating reloc_info size, as reported by Alan Cox. Cc: stable@vger.kernel.org Cc: gnomes@lxorguk.ukuu.org.uk Signed-off-by: Gerd Hoffmann Reviewed-by: Daniel Vetter Signed-off-by: Dave Airlie drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e8f051e9d8fe15d71d8d47c0d878d51bf5f864ad Merge: 8ae22cb 00780f3 Author: Dave Airlie Date: Wed Feb 17 14:14:22 2016 +1000 Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Summary: - fix compilation warnings on ARM64bit. - fix mic driver initialization. . MIC is a part of KMS so it converts it to use component framework like other KMS drivers did. - fix wrong driver state and disable clock order on DECON driver. - fix incorrect use of dma_mmap_attrs function. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos/decon: fix disable clocks order drm/exynos: fix incorrect cpu address for dma_mmap_attrs() drm/exynos: exynos5433_decon: fix wrong state in decon_vblank_enable drm/exynos: exynos5433_decon: fix wrong state assignment in decon_enable drm/exynos: dsi: restore support for drm bridge drm/exynos: mic: make all functions static drm/exynos: mic: convert to component framework drm/exynos: mic: use devm_clk interface drm/exynos: fix types for compilation on 64bit architectures drm/exynos: ipp: fix incorrect format specifiers in debug messages drm/exynos: depend on ARCH_EXYNOS for DRM_EXYNOS commit 8ae22cb419ad0bae84d3ed9784c92922fa6343eb Author: Dave Airlie Date: Wed Feb 17 11:36:38 2016 +1000 Revert "drm/dp/mst: change MST detection scheme" This reverts commit cfcfa086d43ced33e1099b9befb12f17fca102e1. This causes the tiling properties to break in some unexpected ways, Revert it for now. Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie drivers/gpu/drm/drm_dp_mst_topology.c | 37 +++++++++++++++++------------------ 1 file changed, 18 insertions(+), 19 deletions(-) commit aac8d3c282e024c344c5b86dc1eab7af88bb9716 Author: Bjørn Mork Date: Fri Feb 12 16:42:14 2016 +0100 qmi_wwan: add "4G LTE usb-modem U901" Thomas reports: T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=05c6 ProdID=6001 Rev=00.00 S: Manufacturer=USB Modem S: Product=USB Modem S: SerialNumber=1234567890ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage Reported-by: Thomas Schäfer Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 729235554d805c63e5e274fcc6a98e71015dd847 Author: Eric Dumazet Date: Thu Feb 11 22:50:29 2016 -0800 tcp: md5: release request socket instead of listener If tcp_v4_inbound_md5_hash() returns an error, we must release the refcount on the request socket, not on the listener. The bug was added for IPv4 only. Fixes: 079096f103fac ("tcp/dccp: install syn_recv requests into ehash table") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_ipv4.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 413eddc6ca748dc52057f142d707b9378af692fc Merge: bc4ef75 1636d1d Author: Chris Mason Date: Tue Feb 16 16:52:10 2016 -0800 Merge branch 'for-chris-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.5 commit 3d65ae4634ed8350aee98a4e6f4e41fe40c7d282 Author: Tahsin Erdogan Date: Tue Feb 16 13:34:39 2016 -0800 writeback: initialize inode members that track writeback history inode struct members that track cgroup writeback information should be reinitialized when inode gets allocated from kmem_cache. Otherwise, their values remain and get used by the new inode. Signed-off-by: Tahsin Erdogan Acked-by: Tejun Heo Fixes: d10c80955265 ("writeback: implement foreign cgroup inode bdi_writeback switching") Signed-off-by: Jens Axboe fs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 372022830b06d9980c7e8b41fa0a4081cff883b0 Author: Eric Dumazet Date: Thu Feb 11 08:58:18 2016 -0800 tcp: do not set rtt_min to 1 There are some cases where rtt_us derives from deltas of jiffies, instead of using usec timestamps. Since we want to track minimal rtt, better to assume a delta of 0 jiffie might be in fact be very close to 1 jiffie. It is kind of sad jiffies_to_usecs(1) calls a function instead of simply using a constant. Fixes: f672258391b42 ("tcp: track min RTT using windowed min-filter") Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Cc: Yuchung Cheng Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 6c5d89a34a486ad782dfb5b6b3b8fb4976ae7619 Author: Ken Kawasaki Date: Thu Feb 11 20:27:04 2016 +0900 pcnet_cs: add new id add new id (CONTEC C-NET(PC)C-100TX2) Signed-off-by: Ken Kawasaki Signed-off-by: David S. Miller drivers/net/ethernet/8390/pcnet_cs.c | 1 + 1 file changed, 1 insertion(+) commit a407054f830ca9a28febdeeeaa34d2ed420b9ed3 Author: Sascha Hauer Date: Thu Feb 11 11:44:49 2016 +0100 net: dsa: remove phy_disconnect from error path The phy has not been initialized, disconnecting it in the error path results in a NULL pointer exception. Drop the phy_disconnect from the error path. Signed-off-by: Sascha Hauer Reviewed-by: Andrew Lunn Acked-by: Neil Armstrong Signed-off-by: David S. Miller net/dsa/slave.c | 1 - 1 file changed, 1 deletion(-) commit bd16a7248042dc62285fdc5598ec4888c0865819 Author: Sascha Hauer Date: Thu Feb 11 11:44:48 2016 +0100 net: dsa: mv88e6xxx: Add support for Marvell 88E6240 The Marvell 88E6240 has been tested successfully without further changes. Add entry to the table of supported devices. Signed-off-by: Sascha Hauer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6352.c | 1 + 1 file changed, 1 insertion(+) commit d5c91fb72f1652ea3026925240a0998a42ddb16b Author: Jon Paul Maloy Date: Wed Feb 10 16:14:57 2016 -0500 tipc: fix premature addition of node to lookup table In commit 5266698661401a ("tipc: let broadcast packet reception use new link receive function") we introduced a new per-node broadcast reception link instance. This link is created at the moment the node itself is created. Unfortunately, the allocation is done after the node instance has already been added to the node lookup hash table. This creates a potential race condition, where arriving broadcast packets are able to find and access the node before it has been fully initialized, and before the above mentioned link has been created. The result is occasional crashes in the function tipc_bcast_rcv(), which is trying to access the not-yet existing link. We fix this by deferring the addition of the node instance until after it has been fully initialized in the function tipc_node_create(). Acked-by: Ying Xue Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/node.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7facc5fbde878b2441962748823966bf2ec1d446 Merge: 56bb7fd 51dd55b Author: David S. Miller Date: Tue Feb 16 15:50:03 2016 -0500 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. Fixed autoneg logic and some related cleanups, fixed tx push operation, and reduced default ring sizes. ==================== Signed-off-by: David S. Miller commit 51dd55b5688e81f9f13fb520a59900d4c3959a9a Author: Michael Chan Date: Wed Feb 10 17:33:50 2016 -0500 bnxt_en: Reduce default ring sizes. The current default tx ring size of 512 causes an extra page to be allocated for the tx ring with only 1 entry in it. Reduce it to 511. The default rx ring size is also reduced to 511 to use less memory by default. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4419dbe6a0f031ddb2df4cd993805546a566d20e Author: Michael Chan Date: Wed Feb 10 17:33:49 2016 -0500 bnxt_en: Fix implementation of tx push operation. tx push is supported for small packets to reduce DMA latency. The following bugs are fixed in this patch: 1. Fix the definition of the push BD which is different from the DMA BD. 2. The push buffer has to be zero padded to the next 64-bit word boundary or tx checksum won't be correct. 3. Increase the tx push packet threshold to 164 bytes (192 bytes with the BD) so that small tunneled packets are within the threshold. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 42 ++++++++++++++++++------------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 11 ++++++-- 2 files changed, 34 insertions(+), 19 deletions(-) commit 1c49c421f3ec446f1e0eda6d965a6cb23214d7a1 Author: Michael Chan Date: Wed Feb 10 17:33:48 2016 -0500 bnxt_en: Remove 20G support and advertise only 40GbaseCR4. 20G is not supported by production hardware and only the 40GbaseCR4 standard is supported. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) commit 0d8abf020199b0cbc5fb3aa309d36f0ac1b91631 Author: Michael Chan Date: Wed Feb 10 17:33:47 2016 -0500 bnxt_en: Cleanup and Fix flow control setup logic Cleanup bnxt_probe_phy() to cleanly separate 2 code blocks for autoneg on and off. Autoneg flow control is possible only if autoneg is enabled. In bnxt_get_settings(), Pause and Asym_Pause are always supported. Only the advertisement bits change depending on the ethtool -A setting in auto mode. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 20 +++++++------------- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 15 ++------------- 2 files changed, 9 insertions(+), 26 deletions(-) commit b763499ee16b74707af0fb26ab0a26bd9719870b Author: Michael Chan Date: Wed Feb 10 17:33:46 2016 -0500 bnxt_en: Fix ethtool autoneg logic. 1. Determine autoneg on|off setting from link_info->autoneg. Using the firmware returned setting can be misleading if autoneg is changed and there hasn't been a phy update from the firmware. 2. If autoneg is disabled, link_info->autoneg should be set to 0 to indicate both speed and flow control autoneg are disabled. 3. To enable autoneg flow control, speed autoneg must be enabled. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 56bb7fd994f4cc163de08006bf68d959027a9f36 Author: Arnd Bergmann Date: Wed Feb 10 16:09:02 2016 +0100 bridge: mdb: avoid uninitialized variable warning A recent change to the mdb code confused the compiler to the point where it did not realize that the port-group returned from br_mdb_add_group() is always valid when the function returns a nonzero return value, so we get a spurious warning: net/bridge/br_mdb.c: In function 'br_mdb_add': net/bridge/br_mdb.c:542:4: error: 'pg' may be used uninitialized in this function [-Werror=maybe-uninitialized] __br_mdb_notify(dev, entry, RTM_NEWMDB, pg); Slightly rearranging the code in br_mdb_add_group() makes the problem go away, as gcc is clever enough to see that both functions check for 'ret != 0'. Signed-off-by: Arnd Bergmann Fixes: 9e8430f8d60d ("bridge: mdb: Passing the port-group pointer to br_mdb module") Signed-off-by: David S. Miller net/bridge/br_mdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b5e4d0bcf77e56362252a7ced4dbb476425e1655 Author: Hariprasad Shenai Date: Wed Feb 10 12:28:49 2016 +0530 cxgb4: Add pci device id for chelsio t540 lom adapter Signed-off-by: Hariprasad Shenai Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h | 1 + 1 file changed, 1 insertion(+) commit 9c80a5d2e61380d3c5b634890f1893d0179c81f9 Merge: 7856520 b530b16 Author: David S. Miller Date: Tue Feb 16 15:26:31 2016 -0500 Merge branch 'arc_emac-fixes' Alexander Kochetkov says: ==================== Fixes for rockchip EMAC Here is a set of 3 patches what fix koops, memory leak and rockchip EMAC hang. Tested on radxarock lite. ==================== Signed-off-by: David S. Miller commit b530b16413b7f99977ded50a3c4bebd2ea79c41b Author: Alexander Kochetkov Date: Tue Feb 9 18:20:40 2016 +0300 net: arc_emac: fix sk_buff leak EMAC could be disabled, while there is some sb_buff in use. That buffers got lost for linux. In order to reproduce run on device during active ethernet work: ifconfig eth0 down Signed-off-by: Alexander Kochetkov Signed-off-by: David S. Miller drivers/net/ethernet/arc/emac_main.c | 62 ++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) commit 99f93a156a2aa9ac1e44f7cb1a197425e6d9879a Author: Alexander Kochetkov Date: Tue Feb 9 18:20:39 2016 +0300 net: arc_emac: reset txbd_curr and txbd_dirty pointers to zero EMAC reset internal tx ring pointer to zero at statup. txbd_curr and txbd_dirty can be different from zero. That cause ethernet transfer hang (no packets transmitted). In order to reproduce, run on device: ifconfig eth0 down ifconfig eth0 up Signed-off-by: Alexander Kochetkov Signed-off-by: David S. Miller drivers/net/ethernet/arc/emac_main.c | 3 +++ 1 file changed, 3 insertions(+) commit c278c253f3d992c6994d08aa0efb2b6806ca396f Author: Alexander Kochetkov Date: Tue Feb 9 18:20:38 2016 +0300 net: arc_emac: fix koops caused by sk_buff free There is a race between arc_emac_tx() and arc_emac_tx_clean(). sk_buff got freed by arc_emac_tx_clean() while arc_emac_tx() submitting sk_buff. In order to free sk_buff arc_emac_tx_clean() checks: if ((info & FOR_EMAC) || !txbd->data) break; ... dev_kfree_skb_irq(skb); If condition false, arc_emac_tx_clean() free sk_buff. In order to submit txbd, arc_emac_tx() do: priv->tx_buff[*txbd_curr].skb = skb; ... priv->txbd[*txbd_curr].data = cpu_to_le32(addr); ... ... <== arc_emac_tx_clean() check condition here ... <== (info & FOR_EMAC) is false ... <== !txbd->data is false ... *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len); In order to reproduce the situation, run device: # iperf -s run on host: # iperf -t 600 -c [ 28.396284] ------------[ cut here ]------------ [ 28.400912] kernel BUG at .../net/core/skbuff.c:1355! [ 28.414019] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 28.419150] Modules linked in: [ 28.422219] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 4.4.0+ #120 [ 28.429516] Hardware name: Rockchip (Device Tree) [ 28.434216] task: c0665070 ti: c0660000 task.ti: c0660000 [ 28.439622] PC is at skb_put+0x10/0x54 [ 28.443381] LR is at arc_emac_poll+0x260/0x474 [ 28.447821] pc : [] lr : [] psr: a0070113 [ 28.447821] sp : c0661e58 ip : eea68502 fp : ef377000 [ 28.459280] r10: 0000012c r9 : f08b2000 r8 : eeb57100 [ 28.464498] r7 : 00000000 r6 : ef376594 r5 : 00000077 r4 : ef376000 [ 28.471015] r3 : 0030488b r2 : ef13e880 r1 : 000005ee r0 : eeb57100 [ 28.477534] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 28.484658] Control: 10c5387d Table: 8eaf004a DAC: 00000051 [ 28.490396] Process swapper/0 (pid: 0, stack limit = 0xc0660210) [ 28.496393] Stack: (0xc0661e58 to 0xc0662000) [ 28.500745] 1e40: 00000002 00000000 [ 28.508913] 1e60: 00000000 ef376520 00000028 f08b23b8 00000000 ef376520 ef7b6900 c028fc64 [ 28.517082] 1e80: 2f158000 c0661ea8 c0661eb0 0000012c c065e900 c03bdeac ffff95e9 c0662100 [ 28.525250] 1ea0: c0663924 00000028 c0661ea8 c0661ea8 c0661eb0 c0661eb0 0000001e c0660000 [ 28.533417] 1ec0: 40000003 00000008 c0695a00 0000000a c066208c 00000100 c0661ee0 c0027410 [ 28.541584] 1ee0: ef0fb700 2f158000 00200000 ffff95e8 00000004 c0662100 c0662080 00000003 [ 28.549751] 1f00: 00000000 00000000 00000000 c065b45c 0000001e ef005000 c0647a30 00000000 [ 28.557919] 1f20: 00000000 c0027798 00000000 c005cf40 f0802100 c0662ffc c0661f60 f0803100 [ 28.566088] 1f40: c0661fb8 c00093bc c000ffb4 60070013 ffffffff c0661f94 c0661fb8 c00137d4 [ 28.574267] 1f60: 00000001 00000000 00000000 c001ffa0 00000000 c0660000 00000000 c065a364 [ 28.582441] 1f80: c0661fb8 c0647a30 00000000 00000000 00000000 c0661fb0 c000ffb0 c000ffb4 [ 28.590608] 1fa0: 60070013 ffffffff 00000051 00000000 00000000 c005496c c0662400 c061bc40 [ 28.598776] 1fc0: ffffffff ffffffff 00000000 c061b680 00000000 c0647a30 00000000 c0695294 [ 28.606943] 1fe0: c0662488 c0647a2c c066619c 6000406a 413fc090 6000807c 00000000 00000000 [ 28.615127] [] (skb_put) from [] (0xef376520) [ 28.621218] Code: e5902054 e590c090 e3520000 0a000000 (e7f001f2) [ 28.627307] ---[ end trace 4824734e2243fdb6 ]--- [ 34.377068] Internal error: Oops: 17 [#1] SMP ARM [ 34.382854] Modules linked in: [ 34.385947] CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 4.4.0+ #120 [ 34.392219] Hardware name: Rockchip (Device Tree) [ 34.396937] task: ef02d040 ti: ef05c000 task.ti: ef05c000 [ 34.402376] PC is at __dev_kfree_skb_irq+0x4/0x80 [ 34.407121] LR is at arc_emac_poll+0x130/0x474 [ 34.411583] pc : [] lr : [] psr: 60030013 [ 34.411583] sp : ef05de68 ip : 0008e83c fp : ef377000 [ 34.423062] r10: c001bec4 r9 : 00000000 r8 : f08b24c8 [ 34.428296] r7 : f08b2400 r6 : 00000075 r5 : 00000019 r4 : ef376000 [ 34.434827] r3 : 00060000 r2 : 00000042 r1 : 00000001 r0 : 00000000 [ 34.441365] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 34.448507] Control: 10c5387d Table: 8f25c04a DAC: 00000051 [ 34.454262] Process ksoftirqd/0 (pid: 3, stack limit = 0xef05c210) [ 34.460449] Stack: (0xef05de68 to 0xef05e000) [ 34.464827] de60: ef376000 c028fd94 00000000 c0669480 c0669480 ef376520 [ 34.473022] de80: 00000028 00000001 00002ae4 ef376520 ef7b6900 c028fc64 2f158000 ef05dec0 [ 34.481215] dea0: ef05dec8 0000012c c065e900 c03bdeac ffff983f c0662100 c0663924 00000028 [ 34.489409] dec0: ef05dec0 ef05dec0 ef05dec8 ef05dec8 ef7b6000 ef05c000 40000003 00000008 [ 34.497600] dee0: c0695a00 0000000a c066208c 00000100 ef05def8 c0027410 ef7b6000 40000000 [ 34.505795] df00: 04208040 ffff983e 00000004 c0662100 c0662080 00000003 ef05c000 ef027340 [ 34.513985] df20: ef05c000 c0666c2c 00000000 00000001 00000002 00000000 00000000 c0027568 [ 34.522176] df40: ef027340 c003ef48 ef027300 00000000 ef027340 c003edd4 00000000 00000000 [ 34.530367] df60: 00000000 c003c37c ffffff7f 00000001 00000000 ef027340 00000000 00030003 [ 34.538559] df80: ef05df80 ef05df80 00000000 00000000 ef05df90 ef05df90 ef05dfac ef027300 [ 34.546750] dfa0: c003c2a4 00000000 00000000 c000f578 00000000 00000000 00000000 00000000 [ 34.554939] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 34.563129] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffffffff dfff7fff [ 34.571360] [] (__dev_kfree_skb_irq) from [] (arc_emac_poll+0x130/0x474) [ 34.579840] [] (arc_emac_poll) from [] (net_rx_action+0xdc/0x28c) [ 34.587712] [] (net_rx_action) from [] (__do_softirq+0xcc/0x1f8) [ 34.595482] [] (__do_softirq) from [] (run_ksoftirqd+0x2c/0x50) [ 34.603168] [] (run_ksoftirqd) from [] (smpboot_thread_fn+0x174/0x18c) [ 34.611466] [] (smpboot_thread_fn) from [] (kthread+0xd8/0xec) [ 34.619075] [] (kthread) from [] (ret_from_fork+0x14/0x3c) [ 34.626317] Code: e8bd8010 e3a00000 e12fff1e e92d4010 (e59030a4) [ 34.632572] ---[ end trace cca5a3d86a82249a ]--- Signed-off-by: Alexander Kochetkov Signed-off-by: David S. Miller drivers/net/ethernet/arc/emac_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 78565208d73ca9b654fb9a6b142214d52eeedfd1 Author: Alexander Duyck Date: Tue Feb 9 06:14:43 2016 -0800 net: Copy inner L3 and L4 headers as unaligned on GRE TEB This patch corrects the unaligned accesses seen on GRE TEB tunnels when generating hash keys. Specifically what this patch does is make it so that we force the use of skb_copy_bits when the GRE inner headers will be unaligned due to NET_IP_ALIGNED being a non-zero value. Signed-off-by: Alexander Duyck Acked-by: Tom Herbert Signed-off-by: David S. Miller net/core/flow_dissector.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 7b4c534ed43c6c132e507142b3edaa5256f08f53 Merge: 266b495 b0eed40 Author: David S. Miller Date: Tue Feb 16 15:21:48 2016 -0500 Merge branch 'mlx5-fixes' Saeed Mahameed says: ==================== mlx5 driver fixes for 4.5-rc2 We added here a patch from Matan and Alaa for addressing Linus comments on the mess w.r.t reserved field names in the driver/firmware auto-generated file. Once the patch hits linus tree, we'll ask Doug to rebase his tree on that rc so both net-next and rdma-next development for 4.6 will be done under the fixed robust form. Also provided two patches that addresses the dynamic ndo initialization issue of mlx5e netdevice. Or and Saeed. changes from V1: (Only first patch was changed) In this V we fixed the issues addressed in Or's previous e-mail. 1. Offsets took into account two dimensional u8 arrays 2. Offsets took into account nesting unions and structs 3. Offsets for unions 4. Offsets for any reserved field ==================== Signed-off-by: David S. Miller commit b0eed40ea15235b1dd138093901569077ba532ee Author: Saeed Mahameed Date: Tue Feb 9 14:57:44 2016 +0200 net/mlx5e: Use static constant netdevice ndos Currently our netdevice ops is a one static global variable which is referenced by all mlx5e netdevice instances. This can be problematic when different driver instances do not share same HW capabilities (e.g SRIOV PF and VFs probed to the host). Now we have two constant global netdevice ops variables, one for basic netdevice ops and the other with extended SRIOV ops, on netdevice construction we choose the one suitable for current device capabilities. Fixes: 66e49dedada6 ("net/mlx5e: Add support for SR-IOV ndos") Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 41 ++++++++++++++++------- 1 file changed, 28 insertions(+), 13 deletions(-) commit b236872739df6410c7c60874ff8f3fb188ffb9d0 Author: Saeed Mahameed Date: Tue Feb 9 14:57:43 2016 +0200 net/mlx5e: Remove select queue ndo initialization Currently mlx5e_select_queue is redundant since num_tc is always 1. Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 --- 1 file changed, 3 deletions(-) commit b4ff3a36d3e409d365a09b6b783ff895063ff4ef Author: Matan Barak Date: Tue Feb 9 14:57:42 2016 +0200 net/mlx5: Use offset based reserved field names in the IFC header file mlx5_ifc.h is a header file representing the API and ABI between the driver to the firmware and hardware. This file is used from both the mlx5_ib and mlx5_core drivers. Previously, this file used incrementing counter to indicate reserved fields, for example: struct mlx5_ifc_odp_per_transport_service_cap_bits { u8 send[0x1]; u8 receive[0x1]; u8 write[0x1]; u8 read[0x1]; u8 reserved_0[0x1]; u8 srq_receive[0x1]; u8 reserved_1[0x1a]; }; If one developer implements through net-next feature A that uses reserved_0, they replace it with featureA and renames reserved_1 to reserved_0. In the same kernel cycle, a 2nd developer could implement feature B through the rdma tree, that uses reserved_1 and split it to featureB and a smaller reserved_1 field. This will cause a conflict when the two trees are merged. The source of this conflict is that the 1st developer changed *all* reserved fields. As Linus suggested, we change the layout of structs to: struct mlx5_ifc_odp_per_transport_service_cap_bits { u8 send[0x1]; u8 receive[0x1]; u8 write[0x1]; u8 read[0x1]; u8 reserved_at_4[0x1]; u8 srq_receive[0x1]; u8 reserved_at_6[0x1a]; }; This makes the conflicts much more rare and preserves the locality of changes. Signed-off-by: Matan Barak Signed-off-by: Alaa Hleihel Reported-by: Linus Torvalds Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller include/linux/mlx5/mlx5_ifc.h | 2968 ++++++++++++++++++++--------------------- 1 file changed, 1484 insertions(+), 1484 deletions(-) commit 36cb6253f9383fd9a59ee7b8458c6232ef48577c Author: Eric Anholt Date: Mon Feb 8 12:59:02 2016 -0800 drm/vc4: Use runtime PM to power cycle the device when the GPU hangs. This gets us functional GPU reset again, like we had until a refactor at merge time. Tested with a little patch to stuff in a broken binner job every 100 frames. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_drv.h | 6 +++++- drivers/gpu/drm/vc4/vc4_gem.c | 26 +++++++++++++++++++++----- drivers/gpu/drm/vc4/vc4_v3d.c | 12 ------------ 3 files changed, 26 insertions(+), 18 deletions(-) commit 001bdb55d9eb72a9e2d5b623bacfc52da74ae03e Author: Eric Anholt Date: Fri Feb 5 17:41:49 2016 -0800 drm/vc4: Enable runtime PM. This may actually get us a feature that the closed driver didn't have: turning off the GPU in between rendering jobs, while the V3D device is still opened by the client. There may be some tuning to be applied here to use autosuspend so that we don't bounce the device's power so much, but in steady-state GPU-bound rendering we keep the power on (since we keep multiple jobs outstanding) and even if we power cycle on every job we can still manage at least 680 fps. More importantly, though, runtime PM will allow us to power off the device to do a GPU reset. v2: Switch #ifdef to CONFIG_PM not CONFIG_PM_SLEEP (caught by kbuild test robot) Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_drv.h | 1 + drivers/gpu/drm/vc4/vc4_gem.c | 10 ++++++++++ drivers/gpu/drm/vc4/vc4_v3d.c | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+) commit c4ce60dc30912df09b2438f1e5594eae1ef64d1e Author: Eric Anholt Date: Mon Feb 8 11:19:14 2016 -0800 drm/vc4: Fix spurious GPU resets due to BO reuse. We were tracking the "where are the head pointers pointing" globally, so if another job reused the same BOs and execution was at the same point as last time we checked, we'd stop and trigger a reset even though the GPU had made progress. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_drv.h | 6 +++++- drivers/gpu/drm/vc4/vc4_gem.c | 19 ++++++++++++++----- 2 files changed, 19 insertions(+), 6 deletions(-) commit 2ee94657e2bbd13b358060edc91b2b2fdef9038f Author: Eric Anholt Date: Mon Jan 25 14:33:50 2016 -0800 drm/vc4: Drop error message on seqno wait timeouts. These ioctls end up getting exposed to fairly directly to GL users, and having normal user operations print DRM errors is obviously wrong. The message was originally to give us some idea of what happened when a hang occurred, but we have a DRM_INFO from reset for that. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_gem.c | 3 --- 1 file changed, 3 deletions(-) commit 13cf8909ead67e313ea203ee524b3cf4b09b3c9d Author: Eric Anholt Date: Mon Jan 25 14:32:41 2016 -0800 drm/vc4: Fix -ERESTARTSYS error return from BO waits. This caused the wait ioctls to claim that waiting had completed when we actually got interrupted by a signal before it was done. Fixes broken rendering throttling that produced serious lag in X window dragging. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_gem.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 2c68f1fcfb9cfc10deff9bc59774aa331a6fabd2 Author: Eric Anholt Date: Mon Jan 25 14:13:12 2016 -0800 drm/vc4: Return an ERR_PTR from BO creation instead of NULL. Fixes igt vc4_create_bo/create-bo-0 by returning -EINVAL from the ioctl instead of -ENOMEM. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_bo.c | 16 ++++++++-------- drivers/gpu/drm/vc4/vc4_gem.c | 4 ++-- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_render_cl.c | 4 ++-- drivers/gpu/drm/vc4/vc4_validate.c | 4 ++-- 5 files changed, 15 insertions(+), 15 deletions(-) commit 54aec44ab02b1fa216706671ae12d64af74443c5 Author: Eric Anholt Date: Mon Jan 25 13:52:41 2016 -0800 drm/vc4: Fix the clear color for the first tile rendered. Apparently in hardware (as opposed to simulation), the clear colors need to be uploaded before the render config, otherwise they won't take effect. Fixes igt's vc4_wait_bo/used-bo-* subtests. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_render_cl.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit e001523666d0b07592abe1822b78ed0e5c2a34ab Author: Eric Anholt Date: Mon Jan 25 13:05:00 2016 -0800 drm/vc4: Validate that WAIT_BO padding is cleared. This is ABI future-proofing if we ever want to extend the pad to mean something. Signed-off-by: Eric Anholt drivers/gpu/drm/vc4/vc4_gem.c | 3 +++ 1 file changed, 3 insertions(+) commit 266b495f11d6706018f66250cb02a788ff2490d7 Author: Jay Vosburgh Date: Mon Feb 8 12:10:02 2016 -0800 bonding: don't use stale speed and duplex information There is presently a race condition between the bonding periodic link monitor and the updating of a slave's speed and duplex. The former occurs on a periodic basis, and the latter in response to a driver's calling of netif_carrier_on. It is possible for the periodic monitor to run between the driver call of netif_carrier_on and the receipt of the NETDEV_CHANGE event that causes bonding to update the slave's speed and duplex. This manifests most notably as a report that a slave is up and "0 Mbps full duplex" after enslavement, but in principle could report an incorrect speed and duplex after any link up event if the device comes up with a different speed or duplex. This affects the 802.3ad aggregator selection, as the speed and duplex are selection criteria. This is fixed by updating the speed and duplex in the periodic monitor, prior to using that information. This was done historically in bonding, but the call to bond_update_speed_duplex was removed in commit 876254ae2758 ("bonding: don't call update_speed_duplex() under spinlocks"), as it might sleep under lock. Later, the locking was changed to only hold RTNL, and so after commit 876254ae2758 ("bonding: don't call update_speed_duplex() under spinlocks") this call is again safe. Tested-by: "Tantilov, Emil S" Cc: Veaceslav Falico Cc: dingtianhong Fixes: 876254ae2758 ("bonding: don't call update_speed_duplex() under spinlocks") Signed-off-by: Jay Vosburgh Acked-by: Ding Tianhong Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 1 + 1 file changed, 1 insertion(+) commit a5a23ad52d1310976891c30471f4ee8d73f3cc9e Author: Arnd Bergmann Date: Mon Feb 8 15:33:42 2016 +0100 net: am79c961a: avoid %? in inline assembly The am79c961a.c driver fails to build with clang because of an unusual inline assembly construct: drivers/net/ethernet/amd/am79c961a.c:53:7: error: invalid % escape in inline assembly string "str%?h %1, [%2] @ NET_RAP\n\t" The same change has been done a decade ago in arch/arm as of 6a39dd6222dd ("[ARM] 3759/2: Remove uses of %?"), but apparently some drivers were missed. Signed-off-by: Arnd Bergmann Acked-by: Russell King Signed-off-by: David S. Miller drivers/net/ethernet/amd/am79c961a.c | 64 ++++++++++++++++++------------------ 1 file changed, 32 insertions(+), 32 deletions(-) commit bd59cfc51df7ddc88755a60a1293cee55f5d0a12 Author: Robert Jarzmik Date: Sat Feb 6 22:23:20 2016 +0100 net: smc91x: propagate irq return code The smc91x driver doesn't honor the probe deferral mechanism when the interrupt source is not yet available, such as one provided by a gpio controller not probed. Fix this by propagating the platform_get_irq() error code as the probe return value. Signed-off-by: Robert Jarzmik Cc: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/smsc/smc91x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bfb3a9df6106b5384773734896bf0034f5790243 Merge: 5d8e498 815717d Author: David S. Miller Date: Tue Feb 16 14:55:36 2016 -0500 Merge branch 'bcm7xxx-fixes' Florian Fainelli says: ==================== Subject: [PATCH net v2 0/4] net: phy: bcm7xxx 40nm PHY fixes Here is a collection of fixes for the 40nm Ethernet PHY supported by the 7xxx PHY driver, please also queue these fixes for stable. Changes in v2: - dropped the cleanup patch, not appropriate - added another patch removing bogus wildcard entries ==================== Signed-off-by: David S. Miller commit 815717d1473e0d5c3a31c350975325e07ed736fa Author: Florian Fainelli Date: Sat Feb 6 12:58:51 2016 -0800 net: phy: bcm7xxx: Remove wildcard entries Remove the two wildcard entries, they serve no purpose and will match way too many devices, some of them being covered by the driver in drivers/net/phy/broadcom.c. Remove the now unused bcm7xxx_dummy_config_init() function which would produce a warning. Fixes: b560a58c45c6 ("net: phy: add Broadcom BCM7xxx internal PHY driver") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/bcm7xxx.c | 31 ------------------------------- 1 file changed, 31 deletions(-) commit 258bf44364263cb6391f35ebaca3c2366655bded Author: Florian Fainelli Date: Sat Feb 6 12:58:50 2016 -0800 net: phy: bcm7xxx: Fix bcm7xxx_config_init() check Since we were wrongly advertising gigabit features for these 10/100 only Ethernet PHYs, bcm7xxx_config_init() which is supposed to apply workaround would have not run since the check would be true, now that we have fixed the PHY features, remove that check since it has no reasoning to be there anymore. Fixes: e18556ee3bd83 ("net: phy: bcm7xxx: do not use PHY_BRCM_100MBPS_WAR") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/bcm7xxx.c | 4 ---- 1 file changed, 4 deletions(-) commit c6dd213abe40132f83e6ee569d70f3d60aa8b257 Author: Florian Fainelli Date: Sat Feb 6 12:58:49 2016 -0800 net: phy: bcm7xxx: Fix 40nm EPHY features The PHY entries for BCM7425/29/35 declare the 40nm Ethernet PHY as being 10/100/1000 capable, while this is just a 10/100 capable PHY device, fix that. Fixes: d068b02cfdfc2 ("net: phy: add BCM7425 and BCM7429 PHYs") Fixes: 9458ceab4917 ("net: phy: bcm7xxx: Add entry for BCM7435") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/bcm7xxx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 50d899808d33a5b0aa82be23e824119944042689 Author: Florian Fainelli Date: Sat Feb 6 12:58:48 2016 -0800 net: phy: bcm7xxx: Fix shadow mode 2 disabling The clear and set masks in the call to phy_set_clr_bits() called from bcm7xxx_config_init() are inverted. We need to fix this by swapping the two arguments, that is, set 0 bits, but clear the shade mode 2 enable bit. Fixes: b560a58c45c66 ("net: phy: add Broadcom BCM7xxx internal PHY driver") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/bcm7xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d8e498f2e81283a594bd6161f2581a195081765 Merge: dba36b3 50bfd83 Author: David S. Miller Date: Tue Feb 16 14:53:00 2016 -0500 Merge branch 'ravb-fixes' Sergei Shtylyov says: ==================== ravb: fix the fallout of R-Car gen3 gPTP support Here's a set of 2 patches against DaveM's 'net.git' repo fixing up the incomplete commit f5d7837f96e5 ("ravb: ptp: Add CONFIG mode support"). I'm proposing these as fixes but they can be merged as cleanups as well... [1/2] ravb: kill duplicate setting of CCC.CSEL [2/2] ravb: skip gPTP start/stop on R-Car gen3 ==================== Signed-off-by: David S. Miller commit 50bfd83830b89f9273672dcaedf3b765724fd023 Author: Sergei Shtylyov Date: Sat Feb 6 17:47:22 2016 +0300 ravb: skip gPTP start/stop on R-Car gen3 When adding support for the R-Car gen3 gPTP active in configuration mode, some call sites of ravb_ptp_{init|stop}() were missed due to an oversight. Add checks for the R-Car gen2 SoCs around these... Fixes: f5d7837f96e5 ("ravb: ptp: Add CONFIG mode support") Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit d0c5f45ae3ede897114dea204fbaaa4dd18fa9cb Author: Sergei Shtylyov Date: Sat Feb 6 17:46:35 2016 +0300 ravb: kill duplicate setting of CCC.CSEL When adding support for the R-Car gen3 gPTP active in configuration mode, the code setting the CCC.CSEL field was duplicated due to an oversight. For R-Car gen 2 it's just redundant and for R-Car gen3 the write at this time is probably ignored due to CCC.GAC bit being already set... Fixes: f5d7837f96e5 ("ravb: ptp: Add CONFIG mode support") Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 4 ---- 1 file changed, 4 deletions(-) commit 65c23c65bee479faceb042a52f5a7278dfa8d972 Merge: d82834e 4b550af Author: Linus Torvalds Date: Tue Feb 16 10:52:59 2016 -0800 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "A small set of cifs fixes. I am still reviewing some more, recently submitted SMB3 fixes, but these three are small and safe and ready now" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix erroneous return value cifs: fix potential overflow in cifs_compose_mount_options cifs: remove redundant check for null string pointer commit d82834ee13e8060bd20c7d3b834d2ac5ff89469a Merge: 87bbcfd c53d7a8 Author: Linus Torvalds Date: Tue Feb 16 10:50:46 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull ARM KVM fixes from Paolo Bonzini: - Fix for an unpleasant crash when the VM is created without a timer - Allow HYP mode to access the full PA space, and not only 40bit * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: arm64: KVM: Configure TCR_EL2.PS at runtime KVM: arm/arm64: Fix reference to uninitialised VGIC commit 5ff8eaac1636bf6deae86491f4818c4c69d1a9ac Author: Tejun Heo Date: Tue Feb 16 11:34:07 2016 -0700 writeback: keep superblock pinned during cgroup writeback association switches If cgroup writeback is in use, an inode is associated with a cgroup for writeback. If the inode's main dirtier changes to another cgroup, the association gets updated asynchronously. Nothing was pinning the superblock while such switches are in progress and superblock could go away while async switching is pending or in progress leading to crashes like the following. kernel BUG at fs/jbd2/transaction.c:319! invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 1 PID: 29158 Comm: kworker/1:10 Not tainted 4.5.0-rc3 #51 Hardware name: Google Google, BIOS Google 01/01/2011 Workqueue: events inode_switch_wbs_work_fn task: ffff880213dbbd40 ti: ffff880209264000 task.ti: ffff880209264000 RIP: 0010:[] [] start_this_handle+0x382/0x3e0 RSP: 0018:ffff880209267c30 EFLAGS: 00010202 ... Call Trace: [] jbd2__journal_start+0xf4/0x190 [] __ext4_journal_start_sb+0x4e/0x70 [] ext4_evict_inode+0x12c/0x3d0 [] evict+0xbb/0x190 [] iput+0x130/0x190 [] inode_switch_wbs_work_fn+0x343/0x4c0 [] process_one_work+0x129/0x300 [] worker_thread+0x126/0x480 [] kthread+0xc4/0xe0 [] ret_from_fork+0x3f/0x70 Fix it by bumping s_active while cgroup association switching is in flight. Signed-off-by: Tejun Heo Reported-and-tested-by: Tahsin Erdogan Link: http://lkml.kernel.org/g/CAAeU0aNCq7LGODvVGRU-oU_o-6enii5ey0p1c26D1ZzYwkDc5A@mail.gmail.com Fixes: d10c80955265 ("writeback: implement foreign cgroup inode bdi_writeback switching") Cc: stable@vger.kernel.org #v4.5+ Signed-off-by: Jens Axboe fs/fs-writeback.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit dba36b382e7a3feb5b04849543dc6ec5d522482e Merge: a5527dd 5cc6ce9 Author: David S. Miller Date: Tue Feb 16 12:56:00 2016 -0500 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contain a rather large batch for your net that includes accumulated bugfixes, they are: 1) Run conntrack cleanup from workqueue process context to avoid hitting soft lockup via watchdog for large tables. This is required by the IPv6 masquerading extension. From Florian Westphal. 2) Use original skbuff from nfnetlink batch when calling netlink_ack() on error since this needs to access the skb->sk pointer. 3) Incremental fix on top of recent Sasha Levin's lock fix for conntrack resizing. 4) Fix several problems in nfnetlink batch message header sanitization and error handling, from Phil Turnbull. 5) Select NF_DUP_IPV6 based on CONFIG_IPV6, from Arnd Bergmann. 6) Fix wrong signess in return values on nf_tables counter expression, from Anton Protopopov. Due to the NetDev 1.1 organization burden, I had no chance to pass up this to you any sooner in this release cycle, sorry about that. ==================== Signed-off-by: David S. Miller commit a5527dda344fff0514b7989ef7a755729769daa1 Author: Rainer Weikusat Date: Thu Feb 11 19:37:27 2016 +0000 af_unix: Guard against other == sk in unix_dgram_sendmsg The unix_dgram_sendmsg routine use the following test if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { to determine if sk and other are in an n:1 association (either established via connect or by using sendto to send messages to an unrelated socket identified by address). This isn't correct as the specified address could have been bound to the sending socket itself or because this socket could have been connected to itself by the time of the unix_peer_get but disconnected before the unix_state_lock(other). In both cases, the if-block would be entered despite other == sk which might either block the sender unintentionally or lead to trying to unlock the same spin lock twice for a non-blocking send. Add a other != sk check to guard against this. Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue") Reported-By: Philipp Hahn Signed-off-by: Rainer Weikusat Tested-by: Philipp Hahn Signed-off-by: David S. Miller net/unix/af_unix.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit c53d7a846ee7273c21ca317500480eb7dcdd2c5a Merge: c05235d 3c5b1d9 Author: Paolo Bonzini Date: Tue Feb 16 18:51:55 2016 +0100 Merge tag 'kvm-arm-for-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/ARM fixes for 4.5-rc4 - Fix for an unpleasant crash when the VM is created without a timer - Allow HYP mode to access the full PA space, and not only 40bit commit 1b92ee3d03af6643df395300ba7748f19ecdb0c5 Author: Rainer Weikusat Date: Mon Feb 8 18:47:19 2016 +0000 af_unix: Don't set err in unix_stream_read_generic unless there was an error The present unix_stream_read_generic contains various code sequences of the form err = -EDISASTER; if () goto out; This has the unfortunate side effect of possibly causing the error code to bleed through to the final out: return copied ? : err; and then to be wrongly returned if no data was copied because the caller didn't supply a data buffer, as demonstrated by the program available at http://pad.lv/1540731 Change it such that err is only set if an error condition was detected. Fixes: 3822b5c2fc62 ("af_unix: Revert 'lock_interruptible' in stream receive code") Reported-by: Joseph Salisbury Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller net/unix/af_unix.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 87bbcfdecc5579042459bb42ede81ed23e4b9a79 Merge: e5310a1 4692400 Author: Linus Torvalds Date: Tue Feb 16 08:04:06 2016 -0800 Merge tag 'for-linus-20160216' of git://git.infradead.org/intel-iommu Pull IOMMU SVM fixes from David Woodhouse: "Minor register size and interrupt acknowledgement fixes which only showed up in testing on newer hardware, but mostly a fix to the MM refcount handling to prevent a recursive refcount issue when mmap() is used on the file descriptor associated with a bound PASID" * tag 'for-linus-20160216' of git://git.infradead.org/intel-iommu: iommu/vt-d: Clear PPR bit to ensure we get more page request interrupts iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG iommu/vt-d: Fix mm refcounting to hold mm_count not mm_users commit c699404db182836498bd9d9a36ef044de2cab4fd Merge: fb724ed 20aa99b Author: Kalle Valo Date: Tue Feb 16 17:58:30 2016 +0200 Merge tag 'iwlwifi-for-kalle-2016-02-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes These are a few fixes for the current cycle. 3 out of the 5 patches fix a bugzilla. * fix a race that users reported when we try to load the firmware and the hardware rfkill interrupt triggers at the same time. * Luca fixes a very visible bug in scheduled scan: our firmware doesn't support scheduled scan with no profile configured and the supplicant sometimes requests such scheduled scans. * build system fix * firmware name update for 8265 * typo fix in return value commit 02a5f765c961ea778e30a8356f32528e65f34942 Merge: 4682c21 a680759 Author: Ingo Molnar Date: Tue Feb 16 16:46:40 2016 +0100 Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent Pull EFI bug fixes from Matt Fleming: * Fix bugs in our code that converts ucs2 strings to utf8 where we unintentionally drop bits from the original string (Jason Andryuk) * Add the efi-pstore variables to the variable whitelist so that users can continue to delete them via efivarfs without needing to manipulate the immutable flag (Matt Fleming) Signed-off-by: Ingo Molnar commit e5310a1cb4f56c54488ecaf29b1abf3b790cfddc Merge: 2a4be2c 4dd638f Author: Linus Torvalds Date: Tue Feb 16 07:15:20 2016 -0800 Merge tag 'spi-fix-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small clutch of driver specific fixes. The OMAP one is a bit worrying since it seems to be triggered by some changes in the runtime PM core code and I suspect there's other drivers across that are going to be using the same pattern outside of OMAP but nothing seems to be coming up in the testing people are doing" * tag 'spi-fix-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: omap2-mcspi: Fix PM regression with deferred probe for pm_runtime_reinit spi: bcm2835aux: fix bitmask defines spi: atmel: fix gpio chip-select in case of non-DT platform spi/fsl-espi: Correct the maximum transaction length spi: imx: fix spi resource leak with dma transfer spi: fix counting in spi-loopback-test code commit 2a4be2c52556ded8df08904f4032aed98654a017 Merge: 1926e54 daf670b Author: Linus Torvalds Date: Tue Feb 16 07:13:53 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fixes from Geert Uytterhoeven: "Summary: - Wire up new copy_file_range syscall - Update defconfigs" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k/defconfig: Update defconfigs for v4.5-rc1 m68k: Wire up copy_file_range commit bc3f5d8c4ca01555820617eb3b6c0857e4df710d Author: Rasmus Villemoes Date: Mon Feb 15 19:41:47 2016 +0100 drm/radeon: use post-decrement in error handling We need to use post-decrement to get the pci_map_page undone also for i==0, and to avoid some very unpleasant behaviour if pci_map_page failed already at i==0. Reviewed-by: Christian König Signed-off-by: Rasmus Villemoes Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 09ccbb74b6718ad4d1290de3f5669212c0ac7d4b Author: Rasmus Villemoes Date: Mon Feb 15 19:41:45 2016 +0100 drm/amdgpu: use post-decrement in error handling We need to use post-decrement to get the pci_map_page undone also for i==0, and to avoid some very unpleasant behaviour if pci_map_page failed already at i==0. Reviewed-by: Christian König Signed-off-by: Rasmus Villemoes Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1bc4e2b000e7fa9773d6623bc8850561ce10a4fb Author: Andrew Lunn Date: Thu Feb 11 22:15:57 2016 +0100 batman-adv: Avoid endless loop in bat-on-bat netdevice check batman-adv checks in different situation if a new device is already on top of a different batman-adv device. This is done by getting the iflink of a device and all its parent. It assumes that this iflink is always a parent device in an acyclic graph. But this assumption is broken by devices like veth which are actually a pair of two devices linked to each other. The recursive check would therefore get veth0 when calling dev_get_iflink on veth1. And it gets veth0 when calling dev_get_iflink with veth1. Creating a veth pair and loading batman-adv freezes parts of the system ip link add veth0 type veth peer name veth1 modprobe batman-adv An RCU stall will be detected on the system which cannot be fixed. INFO: rcu_sched self-detected stall on CPU 1: (5264 ticks this GP) idle=3e9/140000000000001/0 softirq=144683/144686 fqs=5249 (t=5250 jiffies g=46 c=45 q=43) Task dump for CPU 1: insmod R running task 0 247 245 0x00000008 ffffffff8151f140 ffffffff8107888e ffff88000fd141c0 ffffffff8151f140 0000000000000000 ffffffff81552df0 ffffffff8107b420 0000000000000001 ffff88000e3fa700 ffffffff81540b00 ffffffff8107d667 0000000000000001 Call Trace: [] ? rcu_dump_cpu_stacks+0x7e/0xd0 [] ? rcu_check_callbacks+0x3f0/0x6b0 [] ? hrtimer_run_queues+0x47/0x180 [] ? update_process_times+0x2d/0x50 [] ? tick_handle_periodic+0x1b/0x60 [] ? smp_trace_apic_timer_interrupt+0x5e/0x90 [] ? apic_timer_interrupt+0x82/0x90 [] ? __dev_get_by_index+0x37/0x40 [] ? batadv_hard_if_event+0xee/0x3a0 [batman_adv] [] ? register_netdevice_notifier+0x81/0x1a0 [...] This can be avoided by checking if two devices are each others parent and stopping the check in this situation. Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created on batman-adv as hard-interface") Signed-off-by: Andrew Lunn [sven@narfation.org: rewritten description, extracted fix] Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/hard-interface.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit 13d5e5d4725c64ec06040d636832e78453f477b7 Author: Takashi Iwai Date: Tue Feb 16 14:15:59 2016 +0100 ALSA: seq: Fix double port list deletion The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to double mutex locks] split the management of two linked lists (source and destination) into two individual calls for avoiding the AB/BA deadlock. However, this may leave the possible double deletion of one of two lists when the counterpart is being deleted concurrently. It ends up with a list corruption, as revealed by syzkaller fuzzer. This patch fixes it by checking the list emptiness and skipping the deletion and the following process. BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks) Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_ports.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit a68075908a37850918ad96b056acc9ac4ce1bd90 Author: Jason Andryuk Date: Fri Feb 12 23:13:33 2016 +0000 lib/ucs2_string: Correct ucs2 -> utf8 conversion The comparisons should be >= since 0x800 and 0x80 require an additional bit to store. For the 3 byte case, the existing shift would drop off 2 more bits than intended. For the 2 byte case, there should be 5 bits bits in byte 1, and 6 bits in byte 2. Signed-off-by: Jason Andryuk Reviewed-by: Laszlo Ersek Cc: Peter Jones Cc: Matthew Garrett Cc: "Lee, Chun-Yi" Signed-off-by: Matt Fleming lib/ucs2_string.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit e246eb568bc4cbbdd8a30a3c11151ff9b7ca7312 Author: Matt Fleming Date: Mon Feb 15 10:34:05 2016 +0000 efi: Add pstore variables to the deletion whitelist Laszlo explains why this is a good idea, 'This is because the pstore filesystem can be backed by UEFI variables, and (for example) a crash might dump the last kilobytes of the dmesg into a number of pstore entries, each entry backed by a separate UEFI variable in the above GUID namespace, and with a variable name according to the above pattern. Please see "drivers/firmware/efi/efi-pstore.c". While this patch series will not prevent the user from deleting those UEFI variables via the pstore filesystem (i.e., deleting a pstore fs entry will continue to delete the backing UEFI variable), I think it would be nice to preserve the possibility for the sysadmin to delete Linux-created UEFI variables that carry portions of the crash log, *without* having to mount the pstore filesystem.' There's also no chance of causing machines to become bricked by deleting these variables, which is the whole purpose of excluding things from the whitelist. Use the LINUX_EFI_CRASH_GUID guid and a wildcard '*' for the match so that we don't have to update the string in the future if new variable name formats are created for crash dump variables. Reported-by: Laszlo Ersek Acked-by: Peter Jones Tested-by: Peter Jones Cc: Matthew Garrett Cc: "Lee, Chun-Yi" Signed-off-by: Matt Fleming drivers/firmware/efi/vars.c | 1 + 1 file changed, 1 insertion(+) commit 4682c211a80ee93214b72d95f861b0f6e90e5445 Merge: 1926e54 ed8b0de Author: Ingo Molnar Date: Tue Feb 16 13:14:57 2016 +0100 Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent Pull EFI fixes from Matt Fleming: * Prevent accidental deletion of EFI variables through efivarfs that may brick machines. We use a whitelist of known-safe variables to allow things like installing distributions to work out of the box, and instead restrict vendor-specific variable deletion by making non-whitelist variables immutable (Peter Jones) Signed-off-by: Ingo Molnar commit 0ba4581c84cfb39fd527f6b3457f1c97f6356c04 Author: Hans Verkuil Date: Wed Feb 10 08:09:10 2016 -0200 [media] adv7604: fix tx 5v detect regression The 5 volt detect functionality broke in 3.14: the code reads IO register 0x70 again after it has already been cleared. Instead it should use the cached irq_reg_0x70 value and the io_write to 0x71 to clear 0x70 can be dropped since this has already been done. Signed-off-by: Hans Verkuil Cc: # for v3.14 and up Signed-off-by: Mauro Carvalho Chehab drivers/media/i2c/adv7604.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9727a9545adec59f4bccb83d1a709711f4acf242 Author: Mauro Carvalho Chehab Date: Fri Feb 12 15:44:31 2016 -0200 [media] media.h: get rid of MEDIA_ENT_F_CONN_TEST Defining it as a connector was a bad idea. Remove it while it is not too late. Signed-off-by: Mauro Carvalho Chehab Documentation/DocBook/media/v4l/media-types.xml | 4 ---- drivers/media/usb/au0828/au0828-video.c | 3 +-- include/uapi/linux/media.h | 2 -- 3 files changed, 1 insertion(+), 8 deletions(-) commit 1f4522400e7e49464da5e584a463bd315283790f Author: Hans Verkuil Date: Thu Feb 11 12:28:55 2016 -0200 [media] [for,v4.5] media.h: increase the spacing between function ranges Each function range is quite narrow and especially for connectors this will pose a problem. Increase the function ranges while we still can and move the connector range to the end so that range is practically limitless. [mchehab@osg.samsung.com: Rebased to apply at Linus tree] Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab include/uapi/linux/media.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 7f4e346263f59ff50b531dda94609fb13ca12401 Author: Thierry Reding Date: Tue Feb 16 11:16:31 2016 +0100 arm64/efi: Make strnlen() available to the EFI namespace Changes introduced in the upstream version of libfdt pulled in by commit 91feabc2e224 ("scripts/dtc: Update to upstream commit b06e55c88b9b") use the strnlen() function, which isn't currently available to the EFI name- space. Add it to the EFI namespace to avoid a linker error. Cc: Catalin Marinas Cc: Rob Herring Reviewed-by: Ard Biesheuvel Signed-off-by: Thierry Reding Signed-off-by: Will Deacon arch/arm64/kernel/image.h | 1 + arch/arm64/lib/strnlen.S | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit 3db152093efb750bc47fd4d69355b90b18113105 Author: Sven Eckelmann Date: Sun Jan 31 13:28:00 2016 +0100 batman-adv: Only put orig_node_vlan list reference when removed The batadv_orig_node_vlan reference counter in batadv_tt_global_size_mod can only be reduced when the list entry was actually removed. Otherwise the reference counter may reach zero when batadv_tt_global_size_mod is called from two different contexts for the same orig_node_vlan but only one context is actually removing the entry from the list. The release function for this orig_node_vlan is not called inside the vlan_list_lock spinlock protected region because the function batadv_tt_global_size_mod still holds a orig_node_vlan reference for the object pointer on the stack. Thus the actual release function (when required) will be called only at the end of the function. Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c18bdd018e8912ca73ad6c12120b7283b5038875 Author: Sven Eckelmann Date: Sun Jan 31 13:27:59 2016 +0100 batman-adv: Only put gw_node list reference when removed The batadv_gw_node reference counter in batadv_gw_node_update can only be reduced when the list entry was actually removed. Otherwise the reference counter may reach zero when batadv_gw_node_update is called from two different contexts for the same gw_node but only one context is actually removing the entry from the list. The release function for this gw_node is not called inside the list_lock spinlock protected region because the function batadv_gw_node_update still holds a gw_node reference for the object pointer on the stack. Thus the actual release function (when required) will be called only at the end of the function. Fixes: bd3524c14bd0 ("batman-adv: remove obsolete deleted attribute for gateway node") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/gateway_client.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit fb896c44f88a75843a072cd6961b1615732f7811 Author: Liad Kaufman Date: Sun Feb 14 15:32:58 2016 +0200 iwlwifi: mvm: inc pending frames counter also when txing non-sta Until this patch, when TXing non-sta the pending_frames counter wasn't increased, but it WAS decreased in iwl_mvm_rx_tx_cmd_single(), what makes it negative in certain conditions. This in turn caused much trouble when we need to remove the station since we won't be waiting forever until pending_frames gets 0. In certain cases, we were exhausting the station table even in BSS mode, because we had a lot of stale stations. Increase the counter also in iwl_mvm_tx_skb_non_sta() after a successful TX to avoid this outcome. CC: [3.18+] Signed-off-by: Liad Kaufman Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit c906f38e8853cfd407b30d2f4756a93c1d8f698f Author: Kirill Tkhai Date: Tue Feb 16 00:20:19 2016 -0500 ext4: fix memleak in ext4_readdir() When ext4_bread() fails, fname_crypto_str remains allocated after return. Fix that. Signed-off-by: Kirill Tkhai Signed-off-by: Theodore Ts'o CC: Dmitry Monakhov fs/ext4/dir.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 1636d1d77ef4e01e57f706a4cae3371463896136 Author: Filipe Manana Date: Mon Feb 15 16:20:26 2016 +0000 Btrfs: fix direct IO requests not reporting IO error to user space If a bio for a direct IO request fails, we were not setting the error in the parent bio (the main DIO bio), making us not return the error to user space in btrfs_direct_IO(), that is, it made __blockdev_direct_IO() return the number of bytes issued for IO and not the error a bio created and submitted by btrfs_submit_direct() got from the block layer. This essentially happens because when we call: dio_end_io(dio_bio, bio->bi_error); It does not set dio_bio->bi_error to the value of the second argument. So just add this missing assignment in endio callbacks, just as we do in the error path at btrfs_submit_direct() when we fail to clone the dio bio or allocate its private object. This follows the convention of what is done with other similar APIs such as bio_endio() where the caller is responsible for setting the bi_error field in the bio it passes as an argument to bio_endio(). This was detected by the new generic test cases in xfstests: 271, 272, 276 and 278. Which essentially setup a dm error target, then load the error table, do a direct IO write and unload the error table. They expect the write to fail with -EIO, which was not getting reported when testing against btrfs. Cc: stable@vger.kernel.org # 4.3+ Fixes: 4246a0b63bd8 ("block: add a bi_error field to struct bio") Signed-off-by: Filipe Manana fs/btrfs/inode.c | 2 ++ 1 file changed, 2 insertions(+) commit d9ff0eb9ca4b00ce2fbf9ede1e99681f05c0bc91 Author: Youngmin Nam Date: Tue Feb 9 00:49:28 2016 +0900 pinctrl: samsung: fix SMP race condition Previously, samsung_gpio_drection_in/output function were not covered with a spinlock. For example, samsung_gpio_direction_output function consists of two functions. 1. samsung_gpio_set 2. samsung_gpio_set_direction When 2 CPUs try to control the same gpio pin heavily, (situation like i2c control with gpio emulation) This situation can cause below problem. CPU 0 | CPU1 | samsung_gpio_direction_output | samsung_gpio_set(pin A as 1) | samsung_gpio_direction_output | samsung_gpio_set(pin A as 0) samsung_gpio_set_direction | | samsung_gpio_set_direction The initial value of pin A will be set as 0 while we wanted to set pin A as 1. This patch modifies samsung_gpio_direction_in/output function to be done in one spinlock to fix race condition. Additionally, the new samsung_gpio_set_value was added to implement gpio set callback(samsung_gpio_set) with spinlock using this function. Cc: stable@vger.kernel.org Signed-off-by: Youngmin Nam Acked-by: Tomasz Figa Signed-off-by: Linus Walleij drivers/pinctrl/samsung/pinctrl-samsung.c | 48 ++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 13 deletions(-) commit b33c8ff4431a343561e2319f17c14286f2aa52e2 Author: Arnd Bergmann Date: Fri Feb 12 22:26:42 2016 +0100 tracing: Fix freak link error caused by branch tracer In my randconfig tests, I came across a bug that involves several components: * gcc-4.9 through at least 5.3 * CONFIG_GCOV_PROFILE_ALL enabling -fprofile-arcs for all files * CONFIG_PROFILE_ALL_BRANCHES overriding every if() * The optimized implementation of do_div() that tries to replace a library call with an division by multiplication * code in drivers/media/dvb-frontends/zl10353.c doing u32 adc_clock = 450560; /* 45.056 MHz */ if (state->config.adc_clock) adc_clock = state->config.adc_clock; do_div(value, adc_clock); In this case, gcc fails to determine whether the divisor in do_div() is __builtin_constant_p(). In particular, it concludes that __builtin_constant_p(adc_clock) is false, while __builtin_constant_p(!!adc_clock) is true. That in turn throws off the logic in do_div() that also uses __builtin_constant_p(), and instead of picking either the constant- optimized division, and the code in ilog2() that uses __builtin_constant_p() to figure out whether it knows the answer at compile time. The result is a link error from failing to find multiple symbols that should never have been called based on the __builtin_constant_p(): dvb-frontends/zl10353.c:138: undefined reference to `____ilog2_NaN' dvb-frontends/zl10353.c:138: undefined reference to `__aeabi_uldivmod' ERROR: "____ilog2_NaN" [drivers/media/dvb-frontends/zl10353.ko] undefined! ERROR: "__aeabi_uldivmod" [drivers/media/dvb-frontends/zl10353.ko] undefined! This patch avoids the problem by changing __trace_if() to check whether the condition is known at compile-time to be nonzero, rather than checking whether it is actually a constant. I see this one link error in roughly one out of 1600 randconfig builds on ARM, and the patch fixes all known instances. Link: http://lkml.kernel.org/r/1455312410-1058841-1-git-send-email-arnd@arndb.de Acked-by: Nicolas Pitre Fixes: ab3c9c686e22 ("branch tracer, intel-iommu: fix build with CONFIG_BRANCH_TRACER=y") Cc: stable@vger.kernel.org # v2.6.30+ Signed-off-by: Arnd Bergmann Signed-off-by: Steven Rostedt include/linux/compiler.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f37755490fe9bf76f6ba1d8c6591745d3574a6a6 Author: Steven Rostedt (Red Hat) Date: Mon Feb 15 12:36:14 2016 -0500 tracepoints: Do not trace when cpu is offline The tracepoint infrastructure uses RCU sched protection to enable and disable tracepoints safely. There are some instances where tracepoints are used in infrastructure code (like kfree()) that get called after a CPU is going offline, and perhaps when it is coming back online but hasn't been registered yet. This can probuce the following warning: [ INFO: suspicious RCU usage. ] 4.4.0-00006-g0fe53e8-dirty #34 Tainted: G S ------------------------------- include/trace/events/kmem.h:141 suspicious rcu_dereference_check() usage! other info that might help us debug this: RCU used illegally from offline CPU! rcu_scheduler_active = 1, debug_locks = 1 no locks held by swapper/8/0. stack backtrace: CPU: 8 PID: 0 Comm: swapper/8 Tainted: G S 4.4.0-00006-g0fe53e8-dirty #34 Call Trace: [c0000005b76c78d0] [c0000000008b9540] .dump_stack+0x98/0xd4 (unreliable) [c0000005b76c7950] [c00000000010c898] .lockdep_rcu_suspicious+0x108/0x170 [c0000005b76c79e0] [c00000000029adc0] .kfree+0x390/0x440 [c0000005b76c7a80] [c000000000055f74] .destroy_context+0x44/0x100 [c0000005b76c7b00] [c0000000000934a0] .__mmdrop+0x60/0x150 [c0000005b76c7b90] [c0000000000e3ff0] .idle_task_exit+0x130/0x140 [c0000005b76c7c20] [c000000000075804] .pseries_mach_cpu_die+0x64/0x310 [c0000005b76c7cd0] [c000000000043e7c] .cpu_die+0x3c/0x60 [c0000005b76c7d40] [c0000000000188d8] .arch_cpu_idle_dead+0x28/0x40 [c0000005b76c7db0] [c000000000101e6c] .cpu_startup_entry+0x50c/0x560 [c0000005b76c7ed0] [c000000000043bd8] .start_secondary+0x328/0x360 [c0000005b76c7f90] [c000000000008a6c] start_secondary_prolog+0x10/0x14 This warning is not a false positive either. RCU is not protecting code that is being executed while the CPU is offline. Instead of playing "whack-a-mole(TM)" and adding conditional statements to the tracepoints we find that are used in this instance, simply add a cpu_online() test to the tracepoint code where the tracepoint will be ignored if the CPU is offline. Use of raw_smp_processor_id() is fine, as there should never be a case where the tracepoint code goes from running on a CPU that is online and suddenly gets migrated to a CPU that is offline. Link: http://lkml.kernel.org/r/1455387773-4245-1-git-send-email-kda@linux-powerpc.org Reported-by: Denis Kirjanov Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints") Cc: stable@vger.kernel.org # v2.6.28+ Signed-off-by: Steven Rostedt include/linux/tracepoint.h | 5 +++++ 1 file changed, 5 insertions(+) commit e0fa0d0189f6be61343dbff1f71bef20125576e7 Author: Trond Myklebust Date: Mon Feb 15 12:56:17 2016 -0500 pNFS: Always set NFS_LAYOUT_RETURN_REQUESTED with lo->plh_return_iomode When setting the layout return mode, we must always also set the NFS_LAYOUT_RETURN_REQUESTED flag to ensure that we send a layoutreturn. Otherwise pnfs_error_mark_layout_for_return() could set the mode, but fail to send the layoutreturn because another is already in flight. Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 2f21596882f4a0edc387051910d56f8732970080 Author: Trond Myklebust Date: Mon Feb 15 12:36:04 2016 -0500 pNFS: Fix pnfs_mark_matching_lsegs_return() We don't need to schedule a layoutreturn if the layout segment can be freed immediately. Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit ee1cdcdae59563535485a5f56ee72c894ab7d7ad Author: Andy Shevchenko Date: Wed Feb 10 15:59:42 2016 +0200 dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer The commit 2895b2cad6e7 ("dmaengine: dw: fix cyclic transfer callbacks") re-enabled BLOCK interrupts with regard to make cyclic transfers work. However, this change becomes a regression for non-cyclic transfers as interrupt counters under stress test had been grown enormously (approximately per 4-5 bytes in the UART loop back test). Taking into consideration above enable BLOCK interrupts if and only if channel is programmed to perform cyclic transfer. Fixes: 2895b2cad6e7 ("dmaengine: dw: fix cyclic transfer callbacks") Signed-off-by: Andy Shevchenko Acked-by: Mans Rullgard Tested-by: Mans Rullgard Acked-by: Viresh Kumar Cc: Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit bee038a4bd2efe8188cc80dfdad706a9abe568ad Author: Jeremy Linton Date: Fri Feb 12 09:47:52 2016 -0600 arm/arm64: crypto: assure that ECB modes don't require an IV ECB modes don't use an initialization vector. The kernel /proc/crypto interface doesn't reflect this properly. Acked-by: Ard Biesheuvel Signed-off-by: Jeremy Linton Signed-off-by: Will Deacon arch/arm/crypto/aes-ce-glue.c | 4 ++-- arch/arm64/crypto/aes-glue.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 0b8c82190c12e530eb6003720dac103bf63e146e Author: Takashi Iwai Date: Mon Feb 15 16:37:24 2016 +0100 ALSA: hda - Cancel probe work instead of flush at remove The commit [991f86d7ae4e: ALSA: hda - Flush the pending probe work at remove] introduced the sync of async probe work at remove for fixing the race. However, this may lead to another hangup when the module removal is performed quickly before starting the probe work, because it issues flush_work() and it's blocked forever. The workaround is to use cancel_work_sync() instead of flush_work() there. Fixes: 991f86d7ae4e ('ALSA: hda - Flush the pending probe work at remove') Cc: # v3.17+ Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d99a36f4728fcbcc501b78447f625bdcce15b842 Author: Takashi Iwai Date: Mon Feb 15 16:20:24 2016 +0100 ALSA: seq: Fix leak of pool buffer at concurrent writes When multiple concurrent writes happen on the ALSA sequencer device right after the open, it may try to allocate vmalloc buffer for each write and leak some of them. It's because the presence check and the assignment of the buffer is done outside the spinlock for the pool. The fix is to move the check and the assignment into the spinlock. (The current implementation is suboptimal, as there can be multiple unnecessary vmallocs because the allocation is done before the check in the spinlock. But the pool size is already checked beforehand, so this isn't a big problem; that is, the only possible path is the multiple writes before any pool assignment, and practically seen, the current coverage should be "good enough".) The issue was triggered by syzkaller fuzzer. BugLink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.com Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_memory.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 4d8c8bd6f2062c9988817183a91fe2e623c8aa5e Author: Konrad Rzeszutek Wilk Date: Thu Feb 11 16:10:26 2016 -0500 xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Occasionaly PV guests would crash with: pciback 0000:00:00.1: Xen PCI mapped GSI0 to IRQ16 BUG: unable to handle kernel paging request at 0000000d1a8c0be0 .. snip.. ] find_next_bit+0xb/0x10 [] cpumask_next_and+0x22/0x40 [] pci_device_probe+0xb8/0x120 [] ? driver_sysfs_add+0x77/0xa0 [] driver_probe_device+0x1a4/0x2d0 [] ? pci_match_device+0xdd/0x110 [] __device_attach_driver+0xa7/0xb0 [] ? __driver_attach+0xa0/0xa0 [] bus_for_each_drv+0x62/0x90 [] __device_attach+0xbd/0x110 [] device_attach+0xb/0x10 [] pci_bus_add_device+0x3c/0x70 [] pci_bus_add_devices+0x38/0x80 [] pcifront_scan_root+0x13e/0x1a0 [] pcifront_backend_changed+0x262/0x60b [] ? xenbus_gather+0xd6/0x160 [] ? put_object+0x2f/0x50 [] xenbus_otherend_changed+0x9d/0xa0 [] backend_changed+0xe/0x10 [] xenwatch_thread+0xc8/0x190 [] ? woken_wake_function+0x10/0x10 which was the result of two things: When we call pci_scan_root_bus we would pass in 'sd' (sysdata) pointer which was an 'pcifront_sd' structure. However in the pci_device_add it expects that the 'sd' is 'struct sysdata' and sets the dev->node to what is in sd->node (offset 4): set_dev_node(&dev->dev, pcibus_to_node(bus)); __pcibus_to_node(const struct pci_bus *bus) { const struct pci_sysdata *sd = bus->sysdata; return sd->node; } However our structure was pcifront_sd which had nothing at that offset: struct pcifront_sd { int domain; /* 0 4 */ /* XXX 4 bytes hole, try to pack */ struct pcifront_device * pdev; /* 8 8 */ } That is an hole - filled with garbage as we used kmalloc instead of kzalloc (the second problem). This patch fixes the issue by: 1) Use kzalloc to initialize to a well known state. 2) Put 'struct pci_sysdata' at the start of 'pcifront_sd'. That way access to the 'node' will access the right offset. Signed-off-by: Konrad Rzeszutek Wilk Cc: Reviewed-by: Boris Ostrovsky Signed-off-by: David Vrabel drivers/pci/xen-pcifront.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 00780f3b1a10d1be006b920505faf1d02f76f0e4 Author: Andrzej Hajda Date: Thu Feb 11 12:25:04 2016 +0100 drm/exynos/decon: fix disable clocks order Decon requires that clocks should be disabled in reverse order. Otherwise system hangs. Signed-off-by: Andrzej Hajda Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d380a1632c4e036d50c898e874a194fd4bf8bdee Author: Marek Szyprowski Date: Thu Feb 11 12:32:07 2016 +0100 drm/exynos: fix incorrect cpu address for dma_mmap_attrs() dma_mmap_attrs() should be called with cpu address returned by dma_alloc_attrs(). Existing code however passed pages array base as cpu address. This worked only by a pure luck on ARM architecture. This patch fixes this issue. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_gem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 74ebc70622c95b3e767f62b73a3ef624c913e5dd Author: Marek Szyprowski Date: Wed Feb 3 13:42:54 2016 +0100 drm/exynos: exynos5433_decon: fix wrong state in decon_vblank_enable BIT_IRQS_ENABLED was never set because of incorrect test in decon_vlank_enable() function, what resulted in lack of enabling vblank support. This patch fixes this issue. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c90f950ce3b33a020292c7e7feca644a706265ca Author: Marek Szyprowski Date: Wed Feb 3 13:42:53 2016 +0100 drm/exynos: exynos5433_decon: fix wrong state assignment in decon_enable Patch ebf3fd403b79ba6561bd1a4bb5a7cacc99da08e5 ("drm/exynos: add pm_runtime to DECON 5433") removed some code from decon_enable() function, but it left set_bit(BIT_SUSPENDED, &ctx->flags) call, which was earlier called only in error path. This patch removes it, what finally lets driver to go out of suspended state. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 -- 1 file changed, 2 deletions(-) commit e7ad6606c000bf71df1ed0dcfca91227ce375db3 Author: Marek Szyprowski Date: Wed Feb 3 13:42:51 2016 +0100 drm/exynos: dsi: restore support for drm bridge This patch fixes issue introduced by commit cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 ("drm/exynos: remove struct exynos_drm_display"), which removed assigning of drm bridge to drm encoder. Lack of it caused that no bridge callbacks were called on encoder enable/disable actions. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_dsi.c | 1 + 1 file changed, 1 insertion(+) commit 8b0be57286642f87a968c00932c3f2ef936f6b7b Author: Marek Szyprowski Date: Wed Feb 3 13:42:50 2016 +0100 drm/exynos: mic: make all functions static There is no point exposing all internal functions to global kernel name space, so make all internals functions static. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_mic.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 622688f36e9b98ab0c0a01a47c33635519e735cb Author: Marek Szyprowski Date: Wed Feb 3 13:42:49 2016 +0100 drm/exynos: mic: convert to component framework MIC is SoC component and important part of kms pipeline on Exynos5433, so convert it to use component framework like other KMS/CRTC drivers. MIC driver is already listed on KMS component driver list in Exynos DRM core, so without this conversion, initialization of Exynos DRM core fails on Exynos 5433 SoC. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_mic.c | 56 +++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 20 deletions(-) commit 38b5e5f4d76df1116b0b5a76fb9b7549a44efe6e Author: Marek Szyprowski Date: Wed Feb 3 13:42:48 2016 +0100 drm/exynos: mic: use devm_clk interface Drivers should use devm_clk* interface instead of of_clk* functions. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_mic.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 0f10c71a10d04e86fd842d621f678ee1fd233695 Author: Marek Szyprowski Date: Wed Feb 3 13:42:47 2016 +0100 drm/exynos: fix types for compilation on 64bit architectures This patch fixes compilation warnings (on 64bit architectures) and bugs related to casting pointers through 32bit integers. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_g2d.c | 5 +++-- drivers/gpu/drm/exynos/exynos_drm_gem.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_vidi.c | 8 +++++--- 3 files changed, 9 insertions(+), 6 deletions(-) commit 977b5067c232020c5e27842aa5bec3e93d336e60 Author: Marek Szyprowski Date: Wed Feb 3 13:42:46 2016 +0100 drm/exynos: ipp: fix incorrect format specifiers in debug messages Drivers should use %p for printing pointers instead of hardcoding them as hexadecimal integers. This patch fixes compilation warnings on 64bit architectures. Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_fimc.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_ipp.c | 32 ++++++++++++++--------------- drivers/gpu/drm/exynos/exynos_drm_rotator.c | 2 +- 4 files changed, 19 insertions(+), 19 deletions(-) commit c327cd635c5367d9d6b063dd2d8c78484d4e4fb3 Author: Joonyoung Shim Date: Wed Feb 3 13:42:45 2016 +0100 drm/exynos: depend on ARCH_EXYNOS for DRM_EXYNOS Because PLAT_SAMSUNG isn't include exynos SoCs for arm64, but ARCH_EXYNOS can do it. And it also needs to add ARCH_S3C64XX instead of PLAT_SAMSUNG. Signed-off-by: Joonyoung Shim Signed-off-by: Marek Szyprowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2cfec6a2f989d5c921ba11a329ff8ea986702b9b Author: Konrad Rzeszutek Wilk Date: Thu Feb 11 16:10:25 2016 -0500 xen/pcifront: Report the errors better. The messages should be different depending on the type of error. Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: David Vrabel arch/x86/include/asm/xen/pci.h | 4 ++-- arch/x86/pci/xen.c | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) commit d159457b84395927b5a52adb72f748dd089ad5e5 Author: Konrad Rzeszutek Wilk Date: Thu Feb 11 16:10:24 2016 -0500 xen/pciback: Save the number of MSI-X entries to be copied later. Commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 (xen/pciback: Save xen_pci_op commands before processing it) broke enabling MSI-X because it would never copy the resulting vectors into the response. The number of vectors requested was being overwritten by the return value (typically zero for success). Save the number of vectors before processing the op, so the correct number of vectors are copied afterwards. Signed-off-by: Konrad Rzeszutek Wilk Cc: Reviewed-by: Jan Beulich Signed-off-by: David Vrabel drivers/xen/xen-pciback/pciback_ops.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 8d47065f7d1980dde52abb874b301054f3013602 Author: Konrad Rzeszutek Wilk Date: Thu Feb 11 16:10:23 2016 -0500 xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Commit 408fb0e5aa7fda0059db282ff58c3b2a4278baa0 (xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set) prevented enabling MSI-X on passed-through virtual functions, because it checked the VF for PCI_COMMAND_MEMORY but this is not a valid bit for VFs. Instead, check the physical function for PCI_COMMAND_MEMORY. Signed-off-by: Konrad Rzeszutek Wilk Cc: Reviewed-by: Jan Beulich Signed-off-by: David Vrabel drivers/xen/xen-pciback/pciback_ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 85c0a87cd117e83361932b2b160c9af178fdb21a Author: Insu Yun Date: Mon Jan 18 11:54:43 2016 -0500 xen: fix potential integer overflow in queue_reply When len is greater than UINT_MAX - sizeof(*rb), in next allocation, it can overflow integer range and allocates small size of heap. After that, memcpy will overflow the allocated heap. Therefore, it needs to check the size of given length. Signed-off-by: Insu Yun Signed-off-by: David Vrabel drivers/xen/xenbus/xenbus_dev_frontend.c | 2 ++ 1 file changed, 2 insertions(+) commit 814a3c0c2a8dfad97089f6bdc71b374f6076490e Author: Tony Lindgren Date: Wed Feb 10 15:02:44 2016 -0800 mmc: omap_hsmmc: Fix PM regression with deferred probe for pm_runtime_reinit Commit 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") introduced pm_runtime_reinit() that is used to reinitialize PM runtime after -EPROBE_DEFER. This allows shutting down the device after a failed probe. However, for drivers using pm_runtime_use_autosuspend() this can cause a state where suspend callback is never called after -EPROBE_DEFER. On the following device driver probe, hardware state is different from the PM runtime state causing omap_device to produce the following error: omap_device_enable() called from invalid state 1 And with omap_device and omap hardware being picky for PM, this will block any deeper idle states in hardware. The solution is to fix the drivers to follow the PM runtime documentation: 1. For sections of code that needs the device disabled, use pm_runtime_put_sync_suspend() if pm_runtime_set_autosuspend() has been set. 2. For driver exit code, use pm_runtime_dont_use_autosuspend() before pm_runtime_put_sync() if pm_runtime_use_autosuspend() has been set. Fixes: 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") Cc: linux-mmc@vger.kernel.org Cc: Alan Stern Cc: Kevin Hilman Cc: Nishanth Menon Cc: Rafael J. Wysocki Cc: Ulf Hansson Cc: Tero Kristo Signed-off-by: Tony Lindgren Signed-off-by: Ulf Hansson drivers/mmc/host/omap_hsmmc.c | 2 ++ 1 file changed, 2 insertions(+) commit 46924008273ed03bd11dbb32136e3da4cfe056e1 Author: David Woodhouse Date: Mon Feb 15 12:42:38 2016 +0000 iommu/vt-d: Clear PPR bit to ensure we get more page request interrupts According to the VT-d specification we need to clear the PPR bit in the Page Request Status register when handling page requests, or the hardware won't generate any more interrupts. This wasn't actually necessary on SKL/KBL (which may well be the subject of a hardware erratum, although it's harmless enough). But other implementations do appear to get it right, and we only ever get one interrupt unless we clear the PPR bit. Reported-by: CQ Tang Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org drivers/iommu/intel-svm.c | 4 ++++ include/linux/intel-iommu.h | 3 +++ 2 files changed, 7 insertions(+) commit 844c9f476a43db0bdf61df409026a026ce98ec1b Author: Shawn Lin Date: Mon Feb 15 16:28:12 2016 +0800 spi: rockchip: add missing spi_master_put Add missing spi_master_put for rockchip_spi_remove since it calls spi_master_get already. Signed-off-by: Shawn Lin Signed-off-by: Mark Brown drivers/spi/spi-rockchip.c | 2 ++ 1 file changed, 2 insertions(+) commit b8659adda9e295eca0b10a67f3b15a8644c8ed6f Author: Shawn Lin Date: Mon Feb 15 16:27:58 2016 +0800 spi: rockchip: disable runtime pm when in err case Before registering master, driver enables runtime pm. This patch pm_runtime_disable in err case while probing driver to balance pm reference count. Signed-off-by: Shawn Lin Signed-off-by: Mark Brown drivers/spi/spi-rockchip.c | 1 + 1 file changed, 1 insertion(+) commit 20aa99bbddae74bded68338f9ba200ccae02858b Author: Anton Protopopov Date: Thu Feb 11 08:35:15 2016 +0200 iwlwifi: pcie: fix erroneous return value The iwl_trans_pcie_start_fw() function may return the positive value EIO instead of -EIO in case of error. Signed-off-by: Anton Protopopov Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a6bd005fe92dc1cc808c4c6aa43e3b2a8272bbfa Author: Emmanuel Grumbach Date: Sun Jan 31 15:02:30 2016 +0200 iwlwifi: pcie: fix RF-Kill vs. firmware load race When we load the firmware, we hold trans_pcie->mutex to avoid nested flows. We also rely on the ISR to wake up the thread when the DMA has finished copying a chunk. During this flow, we enable the RF-Kill interrupt. The problem is that the RF-Kill interrupt handler can take the mutex and bring the device down. This means that if we load the firmware while the RF-Kill switch is enabled (which will happen when we load the INIT firmware to read the device's capabilities and register to mac80211), we may get an RF-Kill interrupt immediately and the ISR will be waiting for the mutex held by the thread that is currently loading the firmware. At this stage, the ISR won't be able to service the DMA's interrupt needed to wake up the thread that load the firmware. We are in a deadlock situation which ends when the thread that loads the firmware fails on timeout and releases the mutex. To fix this, take the mutex later in the flow, disable the interrupts and synchronize_irq() to give a chance to the RF-Kill interrupt to run and complete. After that, mask all the interrupts besides the DMA interrupt and proceed with firmware load. Make sure to check that there was no RF-Kill interrupt when the interrupts were disabled. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=111361 Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 9 + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 8 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 188 ++++++++++++--------- 3 files changed, 123 insertions(+), 82 deletions(-) commit c777e2a8b65420b31dac28a453e35be984f5808b Author: Aneesh Kumar K.V Date: Tue Feb 9 06:50:31 2016 +0530 powerpc/mm: Fix Multi hit ERAT cause by recent THP update With ppc64 we use the deposited pgtable_t to store the hash pte slot information. We should not withdraw the deposited pgtable_t without marking the pmd none. This ensure that low level hash fault handling will skip this huge pte and we will handle them at upper levels. Recent change to pmd splitting changed the above in order to handle the race between pmd split and exit_mmap. The race is explained below. Consider following race: CPU0 CPU1 shrink_page_list() add_to_swap() split_huge_page_to_list() __split_huge_pmd_locked() pmdp_huge_clear_flush_notify() // pmd_none() == true exit_mmap() unmap_vmas() zap_pmd_range() // no action on pmd since pmd_none() == true pmd_populate() As result the THP will not be freed. The leak is detected by check_mm(): BUG: Bad rss-counter state mm:ffff880058d2e580 idx:1 val:512 The above required us to not mark pmd none during a pmd split. The fix for ppc is to clear the huge pte of _PAGE_USER, so that low level fault handling code skip this pte. At higher level we do take ptl lock. That should serialze us against the pmd split. Once the lock is acquired we do check the pmd again using pmd_same. That should always return false for us and hence we should retry the access. We do the pmd_same check in all case after taking plt with THP (do_huge_pmd_wp_page, do_huge_pmd_numa_page and huge_pmd_set_accessed) Also make sure we wait for irq disable section in other cpus to finish before flipping a huge pte entry with a regular pmd entry. Code paths like find_linux_pte_or_hugepte depend on irq disable to get a stable pte_t pointer. A parallel thp split need to make sure we don't convert a pmd pte to a regular pmd entry without waiting for the irq disable section to finish. Fixes: eef1b3ba053a ("thp: implement split_huge_pmd()") Acked-by: Kirill A. Shutemov Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/pgtable.h | 4 ++++ arch/powerpc/mm/pgtable_64.c | 32 ++++++++++++++++++++++++++++ include/asm-generic/pgtable.h | 8 +++++++ mm/huge_memory.c | 1 + 4 files changed, 45 insertions(+) commit 1bc74f1ccd457832dc515fc1febe6655985fdcd2 Author: Gavin Shan Date: Tue Feb 9 15:50:22 2016 +1100 powerpc/powernv: Fix stale PE primary bus When PCI bus is unplugged during full hotplug for EEH recovery, the platform PE instance (struct pnv_ioda_pe) isn't released and it dereferences the stale PCI bus that has been released. It leads to kernel crash when referring to the stale PCI bus. This fixes the issue by correcting the PE's primary bus when it's oneline at plugging time, in pnv_pci_dma_bus_setup() which is to be called by pcibios_fixup_bus(). Cc: stable@vger.kernel.org # v4.1+ Reported-by: Andrew Donnellan Reported-by: Pradipta Ghosh Signed-off-by: Gavin Shan Tested-by: Andrew Donnellan Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 1 + arch/powerpc/platforms/powernv/pci.c | 20 ++++++++++++++++++++ arch/powerpc/platforms/powernv/pci.h | 1 + 3 files changed, 22 insertions(+) commit 05ba75f848647135f063199dc0e9f40fee769724 Author: Gavin Shan Date: Tue Feb 9 15:50:21 2016 +1100 powerpc/eeh: Fix stale cached primary bus When PE is created, its primary bus is cached to pe->bus. At later point, the cached primary bus is returned from eeh_pe_bus_get(). However, we could get stale cached primary bus and run into kernel crash in one case: full hotplug as part of fenced PHB error recovery releases all PCI busses under the PHB at unplugging time and recreate them at plugging time. pe->bus is still dereferencing the PCI bus that was released. This adds another PE flag (EEH_PE_PRI_BUS) to represent the validity of pe->bus. pe->bus is updated when its first child EEH device is online and the flag is set. Before unplugging in full hotplug for error recovery, the flag is cleared. Fixes: 8cdb2833 ("powerpc/eeh: Trace PCI bus from PE") Cc: stable@vger.kernel.org #v3.11+ Reported-by: Andrew Donnellan Reported-by: Pradipta Ghosh Signed-off-by: Gavin Shan Tested-by: Andrew Donnellan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/eeh.h | 1 + arch/powerpc/kernel/eeh_driver.c | 3 +++ arch/powerpc/kernel/eeh_pe.c | 2 +- arch/powerpc/platforms/powernv/eeh-powernv.c | 5 ++++- 4 files changed, 9 insertions(+), 2 deletions(-) commit 126df08c52375817c237f38c3bcd01d78a60c090 Author: Denis Kirjanov Date: Mon Dec 14 23:18:06 2015 +0300 powerpc/pseries: Don't trace hcalls on offline CPUs If a cpu is hotplugged while the hcall trace points are active, it's possible to hit a warning from RCU due to the trace points calling into RCU from an offline cpu, eg: RCU used illegally from offline CPU! rcu_scheduler_active = 1, debug_locks = 1 Make the hypervisor tracepoints conditional by using TRACE_EVENT_FN_COND. Acked-by: Steven Rostedt Signed-off-by: Denis Kirjanov Signed-off-by: Michael Ellerman arch/powerpc/include/asm/trace.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 5e56276e7555b34550d51459a801ff75eca8b907 Author: Luca Coelho Date: Tue Feb 2 15:11:15 2016 +0200 iwlwifi: mvm: don't allow sched scans without matches to be started The firmware can perform a scheduled scan with not matchsets passed, but it can't send notification that results were found. Since the userspace then cannot know when we got new results and the firmware wouldn't trigger a wake in case we are sleeping, it's better not to allow scans without matchsets. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=110831 Cc: [3.17+] Signed-off-by: Luca Coelho Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 4 ++++ 1 file changed, 4 insertions(+) commit 1926e54f115725a9248d0c4c65c22acaf94de4c4 Author: Simon Horman Date: Mon Feb 15 10:49:47 2016 +0900 MAINTAINERS: Update mailing list for Renesas ARM64 SoC Development Update the mailing list used for development of support for ARM64 Renesas SoCs. This is a follow-up for a similar change for other Renesas SoCs and drivers uses by Renesas SoCs. The ARM64 SoC entry was not updated in that patch as it was not yet present in mainline. The motivation for the mailing list update is that Renesas SoCs are now much wider than the SH architecture and there is some desire from some for the linux-sh list to refocus on discussion of the work on the SH architecture. Acked-by: Magnus Damm Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman Signed-off-by: Linus Torvalds MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 631c0e84d941a43c9477afbea6374a18b816f68e Merge: 18558ca bdbe58e Author: Linus Torvalds Date: Sun Feb 14 18:34:12 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull i915 drm fixes from Dave Airlie: "Jani sent a bunch of i915 display fixes as my weekend started, but hopefully you can fit them in" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/i915: fix error path in intel_setup_gmbus() drm/i915/skl: Fix typo in DPLL_CFGCR1 definition drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() drm/i915: Pretend cursor is always on for ILK-style WM calculations (v2) drm/i915/dp: reduce missing TPS3 support errors to debug logging drm/i915/dp: abstract training pattern selection drm/i915/dsi: skip gpio element execution when not supported drm/i915/dsi: don't pass arbitrary data to sideband drm/i915/dsi: defend gpio table against out of bounds access drm/i915/bxt: Don't save/restore eDP panel power during suspend (v3) drm/i915: Allow i915_gem_object_get_page() on userptr as well commit 18558cae0272f8fd9647e69d3fec1565a7949865 Author: Linus Torvalds Date: Sun Feb 14 13:05:20 2016 -0800 Linux 4.5-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bdbe58e6c60e49930d9c33e7d2b9a7789ed8c1a9 Merge: c92a428 ed3f9fd Author: Dave Airlie Date: Mon Feb 15 06:54:50 2016 +1000 Merge tag 'drm-intel-fixes-2016-02-12' of git://anongit.freedesktop.org/drm-intel into drm-fixes i915 display fixes mostly. * tag 'drm-intel-fixes-2016-02-12' of git://anongit.freedesktop.org/drm-intel: drm/i915: fix error path in intel_setup_gmbus() drm/i915/skl: Fix typo in DPLL_CFGCR1 definition drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() drm/i915: Pretend cursor is always on for ILK-style WM calculations (v2) drm/i915/dp: reduce missing TPS3 support errors to debug logging drm/i915/dp: abstract training pattern selection drm/i915/dsi: skip gpio element execution when not supported drm/i915/dsi: don't pass arbitrary data to sideband drm/i915/dsi: defend gpio table against out of bounds access drm/i915/bxt: Don't save/restore eDP panel power during suspend (v3) drm/i915: Allow i915_gem_object_get_page() on userptr as well commit 58dd2b5be1db1c6b99450768f91886396583957c Merge: 60f4058 3b2b9ea Author: Linus Torvalds Date: Sun Feb 14 12:47:45 2016 -0800 Merge tag 'char-misc-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are 3 fixes for some reported issues. Two nvmem driver fixes, and one mei fix. All have been in linux-next just fine" * tag 'char-misc-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: nvmem: qfprom: Specify LE device endianness nvmem: core: return error for non word aligned access mei: validate request value in client notify request ioctl commit 60f40585c9c9c5c09af1b7854e1299a61fc95b21 Merge: 779ee19 00cd29b Author: Linus Torvalds Date: Sun Feb 14 12:34:53 2016 -0800 Merge tag 'driver-core-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fix from Greg KH: "Here is one driver core, well klist, fix for 4.5-rc4. It fixes a problem found in the scsi device list traversal that probably also could be triggered by other subsystems. The fix has been in linux-next for a while with no reported problems" * tag 'driver-core-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: klist: fix starting point removed bug in klist iterators commit 779ee19da757d6bbf5504840f8b624f525de9797 Merge: 9db8cc1 c8053b5 Author: Linus Torvalds Date: Sun Feb 14 12:29:59 2016 -0800 Merge tag 'tty-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are a number of small tty and serial driver fixes for 4.5-rc4 that resolve some reported issues. One of them got reverted as it wasn't correct based on testing, and all have been in linux-next for a while" * tag 'tty-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "8250: uniphier: allow modular build with 8250 console" pty: make sure super_block is still valid in final /dev/tty close pty: fix possible use after free of tty->driver_data tty: Add support for PCIe WCH382 2S multi-IO card serial/omap: mark wait_for_xmitr as __maybe_unused serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) 8250: uniphier: allow modular build with 8250 console tty: Drop krefs for interrupted tty lock commit 9db8cc1ae5b0805230f710ddf4f2de0591db820a Merge: 102a92c 6b44d1e Author: Linus Torvalds Date: Sun Feb 14 12:24:28 2016 -0800 Merge tag 'usb-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull PHY fixes from Greg KH: "Here are a couple of PHY driver fixes for 4.5-rc4. A few small phy issues. All have been in linux-next with no reported issues" * tag 'usb-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload phy: twl4030-usb: Relase usb phy on unload phy: core: fix wrong err handle for phy_power_on phy: Restrict phy-hi6220-usb to HiSilicon arm64 commit 102a92ce28cc08176b7d748e0679f69d46a5a377 Merge: cb490d6 580df49 Author: Linus Torvalds Date: Sun Feb 14 12:07:55 2016 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Thomas Gleixner: "Another round of fixes for the perf tooling side: - Prevent a NULL pointer dereference in tracepoint error handling - Fix a thread handling bug in the intel_pt error handling code - Search both .eh_frame and .debug_frame sections as toolchains seem to have random choices of storing the CFI information - Fix the perf state interval output values, which got broken when fixing the overall output" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf stat: Fix interval output values perf probe: Search both .eh_frame and .debug_frame sections for probe location perf tools: Fix thread lifetime related segfaut in intel_pt perf tools: tracepoint_error() can receive e=NULL, robustify it commit cb490d632b9c7a3f08a9c73b88956132b6ad299c Merge: 6a81094 8a5fd56 Author: Linus Torvalds Date: Sun Feb 14 12:02:05 2016 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull lockdep fix from Thomas Gleixner: "A single fix for the stack trace caching logic in lockdep, where the duplicate avoidance managed to store no back trace at all" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Fix stack trace caching logic commit 6a810945ed23554aa71634ff0bf976da41de9045 Merge: 8ab54ed 0f26922 Author: Linus Torvalds Date: Sun Feb 14 11:57:24 2016 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix preventing a 32bit overflow in timespec/val to cputime conversions on 32bit machines" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() commit 8ab54ed6412f42a1769cf64d4900f49a422d4292 Merge: 2d23e61 49b245e Author: Linus Torvalds Date: Sun Feb 14 11:49:30 2016 -0800 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irqchip fixes from Thomas Gleixner: "Another set of ARM SoC related irqchip fixes: - Plug a memory leak in gicv3-its - Limit features to the root gic interrupt controller - Add a missing barrier in the gic-v3 IAR access - Another compile test fix for sun4i" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor irqchip/gic: Only set the EOImodeNS bit for the root controller irqchip/gic: Only populate set_affinity for the root controller irqchip/gicv3-its: Fix memory leak in its_free_tables() irqchip/sun4i: Fix compilation outside of arch/arm commit 2d23e61fa2ecef787c3d1198b8ce8333264b5b8e Merge: ab57a61 59fd121 Author: Linus Torvalds Date: Sun Feb 14 10:50:26 2016 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Two small fixlets for x86: - Prevent a KASAN false positive in thread_saved_pc() - Fix a 32-bit truncation problem in the x86 numa code" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/numa: Fix 32-bit memblock range truncation bug on 32-bit NUMA kernels x86: Fix KASAN false positives in thread_saved_pc() commit ab57a6111c987456f6848e20c55764d75f67ca2d Merge: be3f4e0 f4d3d50 Author: Linus Torvalds Date: Sun Feb 14 10:49:01 2016 -0800 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: "Here's the first round of MIPS fixes after the merge window: - Detect Octeon III's PCI correctly. - Fix return value of the MT7620 probing function. - Wire up the copy_file_range syscall. - Fix 64k page support on 32 bit kernels. - Fix the early Coherency Manager probe. - Allow only hardware-supported page sizes to be selected for R6000. - Fix corner cases for the RDHWR nstruction emulation on old hardware. - Fix FPU handling corner cases. - Remove stale entry for BCM33xx from the MAINTAINERS file. - 32 and 64 bit ELF headers are different, handle them correctly" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: mips: Differentiate between 32 and 64 bit ELF header MIPS: Octeon: Update OCTEON_FEATURE_PCIE for Octeon III MIPS: pci-mt7620: Fix return value check in mt7620_pci_probe() MIPS: Fix early CM probing MIPS: Wire up copy_file_range syscall. MIPS: Fix 64k page support for 32 bit kernels. MIPS: R6000: Don't allow 64k pages for R6000. MIPS: traps.c: Correct microMIPS RDHWR emulation MIPS: traps.c: Don't emulate RDHWR in the CpU #0 exception handler MAINTAINERS: Remove stale entry for BCM33xx chips MIPS: Fix FPU disable with preemption MIPS: Properly disable FPU in start_thread() MIPS: Fix buffer overflow in syscall_get_arguments() commit be3f4e0fb3e1ba33c94c43c7cdab9e5165d508b4 Merge: 8b9f9eb e972c37 Author: Linus Torvalds Date: Sun Feb 14 10:46:47 2016 -0800 Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "A couple of ARM fixes from Linus for the ICST clock generator code" [ "Linus" here is Linus Walleij. Name-stealer. Linus "there can be only one" Torvalds ] * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8519/1: ICST: try other dividends than 1 ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() commit 8b9f9ebe07f4ff1340f44e40aa7ce517d55e1882 Merge: 7686e3c 8e7199c Author: Linus Torvalds Date: Sun Feb 14 10:40:21 2016 -0800 Merge branch 'component' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull component helper fixes from Russell King: "A few fixes for problems people have encountered with the recent update to the component helpers" * 'component' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: component: remove device from master match list on failed add component: Detach components when deleting master struct component: fix crash on x86_64 with hda audio drivers commit 7686e3c16c4a3669472298ecfc4636485658642b Merge: 2f2e9f2 75c1657 Author: Linus Torvalds Date: Sat Feb 13 17:35:23 2016 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull more rdma fixes from Doug Ledford: "I think we are getting pretty close to done now. There are four one-off fixes in this update: - fix ipoib multicast joins - fix mlx4 error handling - fix mlx5 size computation - fix a thinko in core code" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/mlx5: Fix RC transport send queue overhead computation IB/ipoib: fix for rare multicast join race condition IB/core: Fix reading capability mask of the port info class net/mlx4: fix some error handling in mlx4_multi_func_init() commit 2f2e9f2dd1f454f3c4f751b6f83359bc48f21096 Merge: 4617c22 5327c7d Author: Linus Torvalds Date: Sat Feb 13 16:39:27 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target fixes from Nicholas Bellinger: "This includes the long awaited series to address a set of bugs around active I/O remote-port LUN_RESET, as well as properly handling this same case with concurrent fabric driver session disconnect -> reconnect. Note this set of LUN_RESET bug-fixes has been surviving extended testing on both v4.5-rc1 and v3.14.y code over the last weeks, and is CC'ed for stable as it's something folks using multiple ESX connected hosts with slow backends can certainly trigger. The highlights also include: - Fix WRITE_SAME/DISCARD emulation 4k sector conversion in target/iblock (Mike Christie) - Fix TMR abort interaction and AIO type TMR response in qla2xxx target (Quinn Tran + Swapnil Nagle) - Fix >= v3.17 stale descriptor pointer regression in qla2xxx target (Quinn Tran) - Fix >= v4.5-rc1 return regression with unmap_zeros_data_store new configfs store handler (nab) - Add CPU affinity flag + convert qla2xxx to use bit (Quinn + HCH + Bart)" * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: qla2xxx: use TARGET_SCF_USE_CPUID flag to indiate CPU Affinity target/transport: add flag to indicate CPU Affinity is observed target: Fix incorrect unmap_zeroes_data_store return qla2xxx: Use ATIO type to send correct tmr response qla2xxx: Fix stale pointer access. target/user: Fix cast from pointer to phys_addr_t target: Drop legacy se_cmd->task_stop_comp + REQUEST_STOP usage target: Fix race with SCF_SEND_DELAYED_TAS handling target: Fix remote-port TMR ABORT + se_cmd fabric stop target: Fix TAS handling for multi-session se_node_acls target: Fix LUN_RESET active TMR descriptor handling target: Fix LUN_RESET active I/O handling for ACK_KREF qla2xxx: Fix TMR ABORT interaction issue between qla2xxx and TCM qla2xxx: Fix warning reported by static checker target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors commit 7864d92621b6897595fa698b27240828592ebd71 Author: Sebastian Hesselbarth Date: Mon Feb 1 23:48:23 2016 +0100 pinctrl: mvebu: fix num_settings in mpp group assignment When assigning mpp settings from static mpp modes to mpp groups, we do not want any groups that have no supported setting for a specific Kirkwood variant. However, when there is at least a single supported setting, we need to assign the number of all settings in this mode to grp->num_settings as we are reusing the static modes table. Fixes: 0581b16b1840 ("pinctrl: mvebu: complain about missing group after checking variant") Reported-by: Aaro Koskinen Tested-by: Aaro Koskinen Cc: Gregory Clement Cc: Andrew Lunn Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Sebastian Hesselbarth Signed-off-by: Linus Walleij drivers/pinctrl/mvebu/pinctrl-mvebu.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 4617c2203fbc36f496e6d1060299ba27b8e4d01c Merge: b4e4334 a53b839 Author: Linus Torvalds Date: Sat Feb 13 13:05:56 2016 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal management fixes from Eduardo Valentin: "Specifics in this pull request: - Compilation fixes on SPEAR, and U8500 thermal drivers. - RCAR thermal driver now recognizes OF-thermal based thermal zones. - Small code rework on OF-thermal. - These change have been CI tested using KernelCI bot [1,2]. \o/ I am taking over on Rui's behalf while he is out. Happy New Chinese Year! [1] - https://kernelci.org/build/evalenti/kernel/v4.5-rc3-16-ga53b8394ec3c/ [2] - https://kernelci.org/boot/all/job/evalenti/kernel/v4.5-rc3-16-ga53b8394ec3c/" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: cpu_cooling: fix out of bounds access in time_in_idle thermal: allow u8500-thermal driver to be a module thermal: allow spear-thermal driver to be a module thermal: spear: use __maybe_unused for PM functions thermal: rcar: enable to use thermal-zone on DT thermal: of: use for_each_available_child_of_node for child iterator commit b4e4334d7bea8992bc8525763b5b4f34e89c520b Merge: e835a65 07d86ca Author: Linus Torvalds Date: Sat Feb 13 13:04:47 2016 -0800 Merge tag 'sound-fix-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull another sound fix from Takashi Iwai: "This contains a fix for the double-free of usb-audio MIDI device at probe failure" * tag 'sound-fix-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: avoid freeing umidi object twice commit e835a65f7ab143acf9aee6f9a98ef1c7afd2a835 Merge: 0cbb0b9 37eda9d Author: Linus Torvalds Date: Sat Feb 13 08:18:21 2016 -0800 Merge tag 'arc-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: "I've been sitting on some of these fixes for a while. - Corner case of returning to delay slot from interrupt - Changing default interrupt prioiry level - Kconfig'ize support for super pages - Other minor fixes" * tag 'arc-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: mm: Introduce explicit super page size support ARCv2: intc: Allow interruption by lowest priority interrupt ARCv2: Check for LL-SC livelock only if LLSC is enabled ARC: shrink cpuinfo by not saving full timer BCR ARCv2: clocksource: Rename GRTC -> GFRC ... ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2 commit db92ea5d4df00271b57d79c2d03dae5a5d60fcc1 Author: Michael McConville Date: Fri Feb 5 20:46:25 2016 -0500 dscc4: Undefined signed int shift My analysis in the below mail applies, although the second part is unnecessary because i isn't used in arithmetic operations here: https://marc.info/?l=openbsd-tech&m=145377854103866&w=2 Thanks for your time. Signed-off-by: Michael McConville Acked-by: Francois Romieu Signed-off-by: David S. Miller drivers/net/wan/dscc4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 66d9cd0f5422bf35e3897b2022858dafd8c6abd2 Author: Vivien Didelot Date: Fri Feb 5 14:07:14 2016 -0500 net: dsa: mv88e6xxx: do not leave reserved VLANs BRIDGE_VLAN_FILTERING automatically adds a newly bridged port to the VLAN with the bridge's default_pvid. The mv88e6xxx driver currently reserves VLANs 4000+ for unbridged ports isolation. When a port joins a bridge, it leaves its reserved VLAN. When a port leaves a bridge, it joins again its reserved VLAN. But if the VLAN filtering is disabled, or if this hardware VLAN is already in use, the bridged port ends up with no default VLAN, and the communication with the CPU is thus broken. To fix this, make a port join its reserved VLAN once on setup, never leave it, and restore its PVID after another one was eventually used. Signed-off-by: Vivien Didelot Tested-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) commit 3c06f08b657205489d408ee7cbbcbbb1d8a6bf85 Author: Vivien Didelot Date: Fri Feb 5 14:04:39 2016 -0500 net: dsa: mv88e6xxx: fix software VLAN deletion The current bridge code calls switchdev_port_obj_del on a VLAN port even if the corresponding switchdev_port_obj_add call returned -EOPNOTSUPP. If the DSA driver doesn't return -EOPNOTSUPP for a software port VLAN in its port_vlan_del function, the VLAN is not deleted. Unbridging the port also generates a stack trace for the same reason. This can be quickly tested on a VLAN filtering enabled system with: # brctl addbr br0 # brctl addif br0 lan0 # brctl addbr br1 # brctl addif br1 lan1 # brctl delif br1 lan1 Both bridges have a default default_pvid set to 1. lan0 uses the hardware VLAN 1 while lan1 falls back to the software VLAN 1. Unbridging lan1 does not delete its software VLAN, and thus generates the following stack trace: [ 2991.681705] device lan1 left promiscuous mode [ 2991.686237] br1: port 1(lan1) entered disabled state [ 2991.725094] ------------[ cut here ]------------ [ 2991.729761] WARNING: CPU: 0 PID: 869 at net/bridge/br_vlan.c:314 __vlan_group_free+0x4c/0x50() [ 2991.738437] Modules linked in: [ 2991.741546] CPU: 0 PID: 869 Comm: ip Not tainted 4.4.0 #16 [ 2991.747039] Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) [ 2991.753511] Backtrace: [ 2991.756008] [<80014450>] (dump_backtrace) from [<8001469c>] (show_stack+0x20/0x24) [ 2991.763604] r6:80512644 r5:00000009 r4:00000000 r3:00000000 [ 2991.769343] [<8001467c>] (show_stack) from [<80268e44>] (dump_stack+0x24/0x28) [ 2991.776618] [<80268e20>] (dump_stack) from [<80025568>] (warn_slowpath_common+0x98/0xc4) [ 2991.784750] [<800254d0>] (warn_slowpath_common) from [<80025650>] (warn_slowpath_null+0x2c/0x34) [ 2991.793557] r8:00000000 r7:9f786a8c r6:9f76c440 r5:9f786a00 r4:9f68ac00 [ 2991.800366] [<80025624>] (warn_slowpath_null) from [<80512644>] (__vlan_group_free+0x4c/0x50) [ 2991.808946] [<805125f8>] (__vlan_group_free) from [<80514488>] (nbp_vlan_flush+0x44/0x68) [ 2991.817147] r4:9f68ac00 r3:9ec70000 [ 2991.820772] [<80514444>] (nbp_vlan_flush) from [<80506f08>] (del_nbp+0xac/0x130) [ 2991.828201] r5:9f56f800 r4:9f786a00 [ 2991.831841] [<80506e5c>] (del_nbp) from [<8050774c>] (br_del_if+0x40/0xbc) [ 2991.838724] r7:80590f68 r6:00000000 r5:9ec71c38 r4:9f76c440 [ 2991.844475] [<8050770c>] (br_del_if) from [<80503dc0>] (br_del_slave+0x1c/0x20) [ 2991.851802] r5:9ec71c38 r4:9f56f800 [ 2991.855428] [<80503da4>] (br_del_slave) from [<80484a34>] (do_setlink+0x324/0x7b8) [ 2991.863043] [<80484710>] (do_setlink) from [<80485e90>] (rtnl_newlink+0x508/0x6f4) [ 2991.870616] r10:00000000 r9:9ec71ba8 r8:00000000 r7:00000000 r6:9f6b0400 r5:9f56f800 [ 2991.878548] r4:8076278c [ 2991.881110] [<80485988>] (rtnl_newlink) from [<80484048>] (rtnetlink_rcv_msg+0x18c/0x22c) [ 2991.889315] r10:9f7d4e40 r9:00000000 r8:00000000 r7:00000000 r6:9f7d4e40 r5:9f6b0400 [ 2991.897250] r4:00000000 [ 2991.899814] [<80483ebc>] (rtnetlink_rcv_msg) from [<80497c74>] (netlink_rcv_skb+0xb0/0xcc) [ 2991.908104] r8:00000000 r7:9f7d4e40 r6:9f7d4e40 r5:80483ebc r4:9f6b0400 [ 2991.914928] [<80497bc4>] (netlink_rcv_skb) from [<80483eb4>] (rtnetlink_rcv+0x34/0x3c) [ 2991.922874] r6:9f5ea000 r5:00000028 r4:9f7d4e40 r3:80483e80 [ 2991.928622] [<80483e80>] (rtnetlink_rcv) from [<80497604>] (netlink_unicast+0x180/0x200) [ 2991.936742] r4:9f4edc00 r3:80483e80 [ 2991.940362] [<80497484>] (netlink_unicast) from [<80497a88>] (netlink_sendmsg+0x33c/0x350) [ 2991.948648] r8:00000000 r7:00000028 r6:00000000 r5:9f5ea000 r4:9ec71f4c [ 2991.955481] [<8049774c>] (netlink_sendmsg) from [<80457ff0>] (sock_sendmsg+0x24/0x34) [ 2991.963342] r10:00000000 r9:9ec71e28 r8:00000000 r7:9f1e2140 r6:00000000 r5:00000000 [ 2991.971276] r4:9ec71f4c [ 2991.973849] [<80457fcc>] (sock_sendmsg) from [<80458af0>] (___sys_sendmsg+0x1fc/0x204) [ 2991.981809] [<804588f4>] (___sys_sendmsg) from [<804598d0>] (__sys_sendmsg+0x4c/0x7c) [ 2991.989640] r10:00000000 r9:9ec70000 r8:80010824 r7:00000128 r6:7ee946c4 r5:00000000 [ 2991.997572] r4:9f1e2140 [ 2992.000128] [<80459884>] (__sys_sendmsg) from [<80459918>] (SyS_sendmsg+0x18/0x1c) [ 2992.007725] r6:00000000 r5:7ee9c7b8 r4:7ee946e0 [ 2992.012430] [<80459900>] (SyS_sendmsg) from [<80010660>] (ret_fast_syscall+0x0/0x3c) [ 2992.020182] ---[ end trace 5d4bc29f4da04280 ]--- To fix this, return -EOPNOTSUPP in _mv88e6xxx_port_vlan_del instead of -ENOENT if the hardware VLAN doesn't exist or the port is not a member. Signed-off-by: Vivien Didelot Tested-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 19a6d156a7bd080f3a855a40a4a08ab475e34b4a Author: Colin Ian King Date: Fri Feb 5 16:30:39 2016 +0000 net: cavium: liquidio: fix check for in progress flag smatch detected a suspicious looking bitop condition: drivers/net/ethernet/cavium/liquidio/lio_main.c:2529 handle_timestamp() warn: suspicious bitop condition (skb_shinfo(skb)->tx_flags | SKBTX_IN_PROGRESS is always non-zero, so the logic is definitely not correct. Use & to mask the correct bit. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/cavium/liquidio/lio_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14a03cf80edf3e19953bb744938e48bc9d496d30 Author: Vitaly Kuznetsov Date: Fri Feb 5 17:29:08 2016 +0100 hv_netvsc: Restore needed_headroom request Commit c0eb454034aa ("hv_netvsc: Don't ask for additional head room in the skb") got rid of needed_headroom setting for the driver. With the change I hit the following issue trying to use ptkgen module: [ 57.522021] kernel BUG at net/core/skbuff.c:1128! [ 57.522021] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC ... [ 58.721068] Call Trace: [ 58.721068] [] netvsc_start_xmit+0x4c6/0x8e0 [hv_netvsc] ... [ 58.721068] [] ? pktgen_finalize_skb+0x25c/0x2a0 [pktgen] [ 58.721068] [] ? __netdev_alloc_skb+0xc0/0x100 [ 58.721068] [] pktgen_thread_worker+0x257/0x1920 [pktgen] Basically, we're calling skb_cow_head(skb, RNDIS_AND_PPI_SIZE) and crash on if (skb_shared(skb)) BUG(); We probably need to restore needed_headroom setting (but shrunk to RNDIS_AND_PPI_SIZE as we don't need more) to request the required headroom space. In theory, it should not give us performance penalty. Signed-off-by: Vitaly Kuznetsov Signed-off-by: David S. Miller drivers/net/hyperv/netvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+) commit 603607de0c574e693e7cfda1aba64bf4439875b7 Merge: 5988818 120cfa5 Author: David S. Miller Date: Sat Feb 13 06:02:25 2016 -0500 Merge branch 'mvneta-fixes' Gregory CLEMENT says: ==================== mvneta fixes for SMP Following this bug report: http://thread.gmane.org/gmane.linux.ports.arm.kernel/468173 and the suggestions from Russell King, I reviewed all the code involving multi-CPU. It ended with this series of patches which should improve the stability of the driver. During my test I found another bug which is fixed by new patch (the second one of this new version of the series) The two first patches fix real bugs, the others fix potential issues in the driver. Changelog: v1 -> v2 Fix spinlock comment. Pointed by David Miller v2 -> v3 - Fix typos and mistake in the comments. Pointed by Sergei Shtylyov - Add a new patch fixing the CPU choice in mvneta_percpu_elect - Use lock in last patch to prevent remaining race condition. Pointed by Jisheng ==================== Signed-off-by: David S. Miller commit 120cfa502c7763f4a3758b9601f2c13d33083d64 Author: Gregory CLEMENT Date: Thu Feb 4 22:09:29 2016 +0100 net: mvneta: Fix race condition during stopping When stopping the port, the CPU notifier are still there whereas the mvneta_stop_dev function calls mvneta_percpu_disable() on each CPUs. It was possible to have a new CPU coming at this point which could be racy. This patch adds a flag preventing executing the code notifier for a new CPU when the port is stopping. It also uses the spinlock introduces previously. To avoid the deadlock, the lock has been moved outside the mvneta_percpu_elect function. Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 36 +++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) commit 5888511ea053fa8d6019252ad333e8a7cb7f9475 Author: Gregory CLEMENT Date: Thu Feb 4 22:09:28 2016 +0100 net: mvneta: The mvneta_percpu_elect function should be atomic Electing a CPU must be done in an atomic way: it should be done after or before the removal/insertion of a CPU and this function is not reentrant. During the loop of mvneta_percpu_elect we associates the queues to the CPUs, if there is a topology change during this loop, then the mapping between the CPUs and the queues could be wrong. During this loop the interrupt mask is also updating for each CPUs, It should not be changed in the same time by other part of the driver. This patch adds spinlock to create the needed critical sections. Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit db488c10f2a00dbd417b158db2b551e5e262e957 Author: Gregory CLEMENT Date: Thu Feb 4 22:09:27 2016 +0100 net: mvneta: Modify the queue related fields from each cpu In the MVNETA_INTR_* registers, the queues related fields are per cpu, according to the datasheet (comment in [] are added by me): "In a multi-CPU system, bits of RX[or TX] queues for which the access by the reading[or writing] CPU is disabled are read as 0, and cannot be cleared[or written]." That means that each time we want to manipulate these bits we had to do it on each cpu and not only on the current cpu. Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 100 ++++++++++++++++------------------ 1 file changed, 46 insertions(+), 54 deletions(-) commit cde4c0fec4e223727c24c2cd7e88ece57b48b70e Author: Gregory CLEMENT Date: Thu Feb 4 22:09:26 2016 +0100 net: mvneta: Remove unused code Since the commit 2dcf75e2793c ("net: mvneta: Associate RX queues with each CPU") all the percpu irq are used and disabled at initialization, so there is no point to disable them first. Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 8 -------- 1 file changed, 8 deletions(-) commit 6b125d63b7f6c30d36dad3d999bbb5d44f359ebd Author: Gregory CLEMENT Date: Thu Feb 4 22:09:25 2016 +0100 net: mvneta: Use on_each_cpu when possible Instead of using a for_each_* loop in which we just call the smp_call_function_single macro, it is more simple to directly use the on_each_cpu macro. Moreover, this macro ensures that the calls will be done all at once. Suggested-by: Russell King Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit cad5d847a093077b499a8b0bbfe6804b9226c03e Author: Gregory CLEMENT Date: Thu Feb 4 22:09:24 2016 +0100 net: mvneta: Fix the CPU choice in mvneta_percpu_elect When passing to the management of multiple RX queue, the mvneta_percpu_elect function was broken. The use of the modulo can lead to elect the wrong cpu. For example with rxq_def=2, if the CPU 2 goes offline and then online, we ended with the third RX queue activated in the same time on CPU 0 and CPU2, which lead to a kernel crash. With this fix, we don't try to get "the closer" CPU if the default CPU is gone, now we just use CPU 0 which always be there. Thanks to this, the code becomes more readable, easier to maintain and more predicable. Cc: stable@vger.kernel.org Fixes: 2dcf75e2793c ("net: mvneta: Associate RX queues with each CPU") Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 129219e4950a3fcf9323b3bbd8b224c7aa873985 Author: Gregory CLEMENT Date: Thu Feb 4 22:09:23 2016 +0100 net: mvneta: Fix for_each_present_cpu usage This patch convert the for_each_present in on_each_cpu, instead of applying on the present cpus it will be applied only on the online cpus. This fix a bug reported on http://thread.gmane.org/gmane.linux.ports.arm.kernel/468173. Using the macro on_each_cpu (instead of a for_each_* loop) also ensures that all the calls will be done all at once. Fixes: f86428854480 ("net: mvneta: Statically assign queues to CPUs") Reported-by: Stefan Roese Suggested-by: Jisheng Zhang Suggested-by: Russell King Signed-off-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 5988818008257ca42010d6b43a3e0e48afec9898 Author: Laura Abbott Date: Thu Feb 4 10:50:45 2016 -0800 vsock: Fix blocking ops call in prepare_to_wait We receoved a bug report from someone using vmware: WARNING: CPU: 3 PID: 660 at kernel/sched/core.c:7389 __might_sleep+0x7d/0x90() do not call blocking ops when !TASK_RUNNING; state=1 set at [] prepare_to_wait+0x2d/0x90 Modules linked in: vmw_vsock_vmci_transport vsock snd_seq_midi snd_seq_midi_event snd_ens1371 iosf_mbi gameport snd_rawmidi snd_ac97_codec ac97_bus snd_seq coretemp snd_seq_device snd_pcm snd_timer snd soundcore ppdev crct10dif_pclmul crc32_pclmul ghash_clmulni_intel vmw_vmci vmw_balloon i2c_piix4 shpchp parport_pc parport acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc btrfs xor raid6_pq 8021q garp stp llc mrp crc32c_intel serio_raw mptspi vmwgfx drm_kms_helper ttm drm scsi_transport_spi mptscsih e1000 ata_generic mptbase pata_acpi CPU: 3 PID: 660 Comm: vmtoolsd Not tainted 4.2.0-0.rc1.git3.1.fc23.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014 0000000000000000 0000000049e617f3 ffff88006ac37ac8 ffffffff818641f5 0000000000000000 ffff88006ac37b20 ffff88006ac37b08 ffffffff810ab446 ffff880068009f40 ffffffff81c63bc0 0000000000000061 0000000000000000 Call Trace: [] dump_stack+0x4c/0x65 [] warn_slowpath_common+0x86/0xc0 [] warn_slowpath_fmt+0x55/0x70 [] ? debug_lockdep_rcu_enabled+0x1d/0x20 [] ? prepare_to_wait+0x2d/0x90 [] ? prepare_to_wait+0x2d/0x90 [] __might_sleep+0x7d/0x90 [] __might_fault+0x43/0xa0 [] copy_from_iter+0x87/0x2a0 [] __qp_memcpy_to_queue+0x9a/0x1b0 [vmw_vmci] [] ? qp_memcpy_to_queue+0x20/0x20 [vmw_vmci] [] qp_memcpy_to_queue_iov+0x17/0x20 [vmw_vmci] [] qp_enqueue_locked+0xa0/0x140 [vmw_vmci] [] vmci_qpair_enquev+0x4f/0xd0 [vmw_vmci] [] vmci_transport_stream_enqueue+0x1b/0x20 [vmw_vsock_vmci_transport] [] vsock_stream_sendmsg+0x2c5/0x320 [vsock] [] ? wake_atomic_t_function+0x70/0x70 [] sock_sendmsg+0x38/0x50 [] SYSC_sendto+0x104/0x190 [] ? vfs_read+0x8a/0x140 [] SyS_sendto+0xe/0x10 [] entry_SYSCALL_64_fastpath+0x12/0x76 transport->stream_enqueue may call copy_to_user so it should not be called inside a prepare_to_wait. Narrow the scope of the prepare_to_wait to avoid the bad call. This also applies to vsock_stream_recvmsg as well. Reported-by: Vinson Lee Tested-by: Vinson Lee Signed-off-by: Laura Abbott Signed-off-by: David S. Miller net/vmw_vsock/af_vsock.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) commit a2cb7ec001559d649b09572a7a5e4f69222eb467 Author: Chun-Hao Lin Date: Fri Feb 5 02:28:00 2016 +0800 r8169:fix system hange problem. There are typos in setting RTL8168H hardware parameters. If system install another version driver that may cuase system hang. Signed-off-by: Chunhao Lin Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 919483096bfe75dda338e98d56da91a263746a0a Author: Eric Dumazet Date: Thu Feb 4 06:23:28 2016 -0800 ipv4: fix memory leaks in ip_cmsg_send() callers Dmitry reported memory leaks of IP options allocated in ip_cmsg_send() when/if this function returns an error. Callers are responsible for the freeing. Many thanks to Dmitry for the report and diagnostic. Reported-by: Dmitry Vyukov Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/ip_sockglue.c | 2 ++ net/ipv4/ping.c | 4 +++- net/ipv4/raw.c | 4 +++- net/ipv4/udp.c | 4 +++- 4 files changed, 11 insertions(+), 3 deletions(-) commit c2bb7bc5c007b7b55087eb05409edc2014f43ca8 Author: Amitoj Kaur Chawla Date: Thu Feb 4 19:25:26 2016 +0530 net: mvpp2: Return correct error codes The return value of kzalloc on failure of allocation of memory should be -ENOMEM and not -1. Found using Coccinelle. A simplified version of the semantic patch used is: // @@ expression *e; position p,q; @@ e@q = kzalloc(...); if@p (e == NULL) { ... return - -1 + -ENOMEM ; } // This function may also return -1 after calling mpp2_prs_tcam_port_map_get. So that the function consistently returns meaningful error values on failure, the -1 is changed to -EINVAL. Signed-off-by: Amitoj Kaur Chawla Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvpp2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 08a965ec93ad0495802462c32b73241d658e189d Author: Amitoj Kaur Chawla Date: Thu Feb 4 19:25:13 2016 +0530 net: cavium: liquidio: Return correct error code The return value of vmalloc on failure of allocation of memory should be -ENOMEM and not -1. Found using Coccinelle. A simplified version of the semantic patch used is: // @@ expression *e; identifier l1; position p,q; @@ e@q = vmalloc(...); if@p (e == NULL) { ... goto l1; } l1: ... return -1 + -ENOMEM ; // Signed-off-by: David S. Miller drivers/net/ethernet/cavium/liquidio/lio_main.c | 2 +- drivers/net/ethernet/cavium/liquidio/octeon_droq.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 21a75f0915dde8674708b39abfcda113911c49b1 Author: Jay Vosburgh Date: Tue Feb 2 13:35:56 2016 -0800 bonding: Fix ARP monitor validation The current logic in bond_arp_rcv will accept an incoming ARP for validation if (a) the receiving slave is either "active" (which includes the currently active slave, or the current ARP slave) or, (b) there is a currently active slave, and it has received an ARP since it became active. For case (b), the receiving slave isn't the currently active slave, and is receiving the original broadcast ARP request, not an ARP reply from the target. This logic can fail if there is no currently active slave. In this situation, the ARP probe logic cycles through all slaves, assigning each in turn as the "current_arp_slave" for one arp_interval, then setting that one as "active," and sending an ARP probe from that slave. The current logic expects the ARP reply to arrive on the sending current_arp_slave, however, due to switch FDB updating delays, the reply may be directed to another slave. This can arise if the bonding slaves and switch are working, but the ARP target is not responding. When the ARP target recovers, a condition may result wherein the ARP target host replies faster than the switch can update its forwarding table, causing each ARP reply to be sent to the previous current_arp_slave. This will never pass the logic in bond_arp_rcv, as neither of the above conditions (a) or (b) are met. Some experimentation on a LAN shows ARP reply round trips in the 200 usec range, but my available switches never update their FDB in less than 4000 usec. This patch changes the logic in bond_arp_rcv to additionally accept an ARP reply for validation on any slave if there is a current ARP slave and it sent an ARP probe during the previous arp_interval. Fixes: aeea64ac717a ("bonding: don't trust arp requests unless active slave really works") Cc: Veaceslav Falico Cc: Andy Gospodarek Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-) commit 07d86ca93db7e5cdf4743564d98292042ec21af7 Author: Andrey Konovalov Date: Sat Feb 13 11:08:06 2016 +0300 ALSA: usb-audio: avoid freeing umidi object twice The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov Acked-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-) commit 0cbb0b92689a1c4e0ac55f6188be563a813ac808 Merge: 29f1bf3 0cf1337 Author: Linus Torvalds Date: Fri Feb 12 15:31:22 2016 -0800 Merge tag 'pci-v4.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "These are some Renesas binding updates for PCI host controllers, a Broadcom fix for a regression we added in v4.5-rc1, and a fix for an AER use-after-free problem that can cause memory corruption. Summary: AER: Flush workqueue on device remove to avoid use-after-free (Sebastian Andrzej Siewior) Broadcom iProc host bridge driver: Allow multiple devices except on PAXC (Ray Jui) Renesas R-Car host bridge driver: Add gen2 device tree support for r8a7793 (Simon Horman) Add device tree support for r8a7793 (Simon Horman)" * tag 'pci-v4.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: rcar: Add device tree support for r8a7793 PCI: rcar: Add gen2 device tree support for r8a7793 PCI: iproc: Allow multiple devices except on PAXC PCI/AER: Flush workqueue on device remove to avoid use-after-free commit 4dd638f8ac6b4ed020297b5d994d9346b84f2009 Merge: 388f7b1 70f340d fe0e230 5cfa1e4 f8efca2 ebea7c0 0e6f357 Author: Mark Brown Date: Fri Feb 12 23:04:41 2016 +0000 Merge remote-tracking branches 'spi/fix/atmel', 'spi/fix/bcm2835aux', 'spi/fix/fsl-espi', 'spi/fix/imx', 'spi/fix/loopback' and 'spi/fix/omap2-mcspi' into spi-linus commit 0e6f357a5deba4b81b1a65acabaa51f2cbd2e2cd Author: Tony Lindgren Date: Wed Feb 10 15:02:46 2016 -0800 spi: omap2-mcspi: Fix PM regression with deferred probe for pm_runtime_reinit Commit 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") introduced pm_runtime_reinit() that is used to reinitialize PM runtime after -EPROBE_DEFER. This allows shutting down the device after a failed probe. However, for drivers using pm_runtime_use_autosuspend() this can cause a state where suspend callback is never called after -EPROBE_DEFER. On the following device driver probe, hardware state is different from the PM runtime state causing omap_device to produce the following error: omap_device_enable() called from invalid state 1 And with omap_device and omap hardware being picky for PM, this will block any deeper idle states in hardware. The solution is to fix the drivers to follow the PM runtime documentation: 1. For sections of code that needs the device disabled, use pm_runtime_put_sync_suspend() if pm_runtime_set_autosuspend() has been set. 2. For driver exit code, use pm_runtime_dont_use_autosuspend() before pm_runtime_put_sync() if pm_runtime_use_autosuspend() has been set. Fixes: 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") Cc: linux-spi@vger.kernel.org Cc: Alan Stern Cc: Kevin Hilman Cc: Mark Brown Cc: Nishanth Menon Cc: Rafael J. Wysocki Cc: Ulf Hansson Cc: Tero Kristo Signed-off-by: Tony Lindgren Signed-off-by: Mark Brown drivers/spi/spi-omap2-mcspi.c | 3 +++ 1 file changed, 3 insertions(+) commit c430daf951c56e1eaf47c1825dcd5574f95ed29a Author: Stephen Boyd Date: Fri Feb 12 09:21:13 2016 -0800 Revert "clk: qcom: Specify LE device endianness" This reverts commit 329cabcecf94d8d7821e729dda284ba9dec44c87. The commit that caused us to specify LE device endianness here, 29bb45f25ff3 (regmap-mmio: Use native endianness for read/write, 2015-10-29), has been reverted in mainline so now when we specify LE it actively breaks big endian kernels because the byte swapping in regmap-mmio is incorrect. Let's revert this change because it will 1) fix the big endian kernels and 2) be redundant to specify LE because that will become the default soon. Cc: Kevin Hilman Tested-by: Kevin Hilman Cc: Mark Brown Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-apq8084.c | 1 - drivers/clk/qcom/gcc-ipq806x.c | 1 - drivers/clk/qcom/gcc-msm8660.c | 1 - drivers/clk/qcom/gcc-msm8916.c | 1 - drivers/clk/qcom/gcc-msm8960.c | 2 -- drivers/clk/qcom/gcc-msm8974.c | 1 - drivers/clk/qcom/lcc-ipq806x.c | 1 - drivers/clk/qcom/lcc-msm8960.c | 1 - drivers/clk/qcom/mmcc-apq8084.c | 1 - drivers/clk/qcom/mmcc-msm8960.c | 2 -- drivers/clk/qcom/mmcc-msm8974.c | 1 - 11 files changed, 13 deletions(-) commit a947b724069a25eae86d8dfed905374d04c3f93c Author: Stephen Boyd Date: Fri Feb 12 09:30:17 2016 -0800 ASoC: qcom: Don't specify LE device endianness This reverts commit 18560a4e3 (ASoC: qcom: Specify LE device endianness). The commit that caused us to specify LE device endianness here, 29bb45f25ff3 (regmap-mmio: Use native endianness for read/write, 2015-10-29), has been reverted in mainline so now when we specify LE it actively breaks big endian kernels because the byte swapping in regmap-mmio is incorrect. Let's revert this change because it will 1) fix the big endian kernels and 2) be redundant to specify LE because that will become the default soon. Signed-off-by: Stephen Boyd Signed-off-by: Mark Brown sound/soc/qcom/lpass-cpu.c | 1 - 1 file changed, 1 deletion(-) commit 43f3408261a2fd5054ada359efa15f0b78faf0a7 Author: Javier Martinez Canillas Date: Tue Feb 9 14:23:52 2016 -0300 rtc: s3c: Document required clocks in the DT binding The S3C Real Time Clock driver requires the clock and source clock to be defined in the device node but that requirement is not documented. Signed-off-by: Javier Martinez Canillas Signed-off-by: Rob Herring Documentation/devicetree/bindings/rtc/s3c-rtc.txt | 6 ++++++ 1 file changed, 6 insertions(+) commit 32e593b9c7be1a14d42ed288ab68a8e7b41ad873 Author: Fabio Estevam Date: Fri Feb 5 17:44:22 2016 -0200 serial: fsl-imx-uart: Fix typo in fsl,dte-mode description We should say "The uart works in DCE mode". Signed-off-by: Fabio Estevam Signed-off-by: Rob Herring Documentation/devicetree/bindings/serial/fsl-imx-uart.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4aff7b854611d91c5fefb1553eb4c328123095ae Author: Will Deacon Date: Wed Feb 3 18:00:58 2016 +0000 dt-bindings: arm, gic-v3: require that reserved cells are always 0 The arm,gic-v3 binding was written with good intentions and doesn't enforce interrupt-cells to be 3, therefore making it easy to extend the irq description in future if necessary: > Cells 4 and beyond are reserved for future use. Unfortunately, this sentence is immediately followed up with: > When the 1st cell has a value of 0 or 1, cells 4 and beyond act as > padding, and may be ignored. It is recommended that padding cells > have a value of 0. Consequently, any extensions to the PPI or SPI interrupt specifiers must be able to work with random crap from legacy DTs, effectively necessitating a new interrupt type in the first cell. Sigh. This patch fixes the text so that additional, reserved cells are required to be zero. This looks like a reasonable thing to require and is already satisifed by the .dts files in-tree. Cc: Mark Rutland Cc: Marc Zyngier Signed-off-by: Will Deacon Acked-by: Marc Zyngier Acked-by: Mark Rutland Signed-off-by: Rob Herring .../devicetree/bindings/interrupt-controller/arm,gic-v3.txt | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 29f1bf34ed38222372365657b9498af2e3f8c208 Merge: 5952cc7 1ecb4ae Author: Linus Torvalds Date: Fri Feb 12 13:12:27 2016 -0800 Merge branch 'akpm'(patches from Andrew) Merge fixes from Andrew Morton: "10 fixes" The lockdep hlist conversion is in the locking tree too, waiting for the next merge window. Andrew thought it should go in now. I'll take it, since it fixes a real problem and looks trivially correct (famous last words). * emailed patches from Andrew Morton : arch/x86/Kconfig: CONFIG_X86_UV should depend on CONFIG_EFI mm: fix pfn_t vs highmem kernel/locking/lockdep.c: convert hash tables to hlists mm,thp: fix spellos in describing __HAVE_ARCH_FLUSH_PMD_TLB_RANGE mm,thp: khugepaged: call pte flush at the time of collapse mm/backing-dev.c: fix error path in wb_init() mm, dax: check for pmd_none() after split_huge_pmd() vsprintf: kptr_restrict is okay in IRQ when 2 mm: fix filemap.c kernel doc warning ubsan: cosmetic fix to Kconfig text commit 75c1657e1d50730dc0130a67977f7831a4e241f4 Author: Leon Romanovsky Date: Thu Feb 11 21:09:57 2016 +0200 IB/mlx5: Fix RC transport send queue overhead computation Fix the RC QPs send queue overhead computation to take into account two additional segments in the WQE which are needed for registration operations. The ATOMIC and UMR segments can't coexist together, so chose maximum out of them. The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") was intended to update RC transport as commit messages states, but added the code to UC transport. Fixes: 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") Signed-off-by: Kamal Heib Signed-off-by: Leon Romanovsky Reviewed-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/qp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 08bc327629cbd63bb2f66677e4b33b643695097c Author: Alex Estrin Date: Thu Feb 11 16:30:51 2016 -0500 IB/ipoib: fix for rare multicast join race condition A narrow window for race condition still exist between multicast join thread and *dev_flush workers. A kernel crash caused by prolong erratic link state changes was observed (most likely a faulty cabling): [167275.656270] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [167275.665973] IP: [] ipoib_mcast_join+0xae/0x1d0 [ib_ipoib] [167275.674443] PGD 0 [167275.677373] Oops: 0000 [#1] SMP ... [167275.977530] Call Trace: [167275.982225] [] ? ipoib_mcast_free+0x200/0x200 [ib_ipoib] [167275.992024] [] ipoib_mcast_join_task+0x2a7/0x490 [ib_ipoib] [167276.002149] [] process_one_work+0x17b/0x470 [167276.010754] [] worker_thread+0x11b/0x400 [167276.019088] [] ? rescuer_thread+0x400/0x400 [167276.027737] [] kthread+0xcf/0xe0 Here was a hit spot: ipoib_mcast_join() { .............. rec.qkey = priv->broadcast->mcmember.qkey; ^^^^^^^ ..... } Proposed patch should prevent multicast join task to continue if link state change is detected. Signed-off-by: Alex Estrin Changes from v4: - as suggested by Doug Ledford, optimized spinlock usage, i.e. ipoib_mcast_join() is called with lock held. Changes from v3: - sync with priv->lock before flag check. Chages from v2: - Move check for OPER_UP flag state to mcast_join() to ensure no event worker is in progress. - minor style fixes. Changes from v1: - No need to lock again if error detected. Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) commit bca71ba0343d28d953d74149d9161ab65a520dd6 Author: Masahiro Yamada Date: Tue Jan 26 18:09:21 2016 +0900 i2c: uniphier: fix typos in error messages Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-uniphier-f.c | 2 +- drivers/i2c/busses/i2c-uniphier.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit e6244deed843bc001697f37e5beb1c0daf4f46a4 Author: Tony Lindgren Date: Wed Feb 10 15:02:45 2016 -0800 i2c: omap: Fix PM regression with deferred probe for pm_runtime_reinit Commit 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") introduced pm_runtime_reinit() that is used to reinitialize PM runtime after -EPROBE_DEFER. This allows shutting down the device after a failed probe. However, for drivers using pm_runtime_use_autosuspend() this can cause a state where suspend callback is never called after -EPROBE_DEFER. On the following device driver probe, hardware state is different from the PM runtime state causing omap_device to produce the following error: omap_device_enable() called from invalid state 1 And with omap_device and omap hardware being picky for PM, this will block any deeper idle states in hardware. The solution is to fix the drivers to follow the PM runtime documentation: 1. For sections of code that needs the device disabled, use pm_runtime_put_sync_suspend() if pm_runtime_set_autosuspend() has been set. 2. For driver exit code, use pm_runtime_dont_use_autosuspend() before pm_runtime_put_sync() if pm_runtime_use_autosuspend() has been set. Fixes: 5de85b9d57ab ("PM / runtime: Re-init runtime PM states at probe error and driver unbind") Signed-off-by: Tony Lindgren Acked-by: Ulf Hansson Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-omap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 38714fbd299f992080a11b977f609136ec8530c2 Author: Han Xu Date: Fri Feb 12 05:13:25 2016 +0000 MAINTAINERS: update Han's email Update my email address from freescale to nxp. Signed-off-by: Han Xu Signed-off-by: Brian Norris MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5952cc779eba58e9c3e0280cb646683e6de4b799 Merge: 0df34ad a5ebb87d Author: Linus Torvalds Date: Fri Feb 12 09:48:55 2016 -0800 Merge tag 'mmc-v4.5-rc2' of git://git.linaro.org/people/ulf.hansson/mmc Pull MMC fixes from Ulf Hansson: "Here are some mmc fixes intended for v4.5 rc4. MMC core: - Fix an sysfs ABI regression - Return an error in a specific error path dealing with mmc ioctls MMC host: - sdhci-pci|acpi: Fix card detect race for Intel BXT/APL - sh_mmcif: Correct TX DMA channel allocation - mmc_spi: Fix error handling for dma mapping errors - sdhci-of-at91: Fix an unbalance issue for the runtime PM usage count - pxamci: Fix the device-tree probe deferral path - pxamci: Fix read-only GPIO polarity" * tag 'mmc-v4.5-rc2' of git://git.linaro.org/people/ulf.hansson/mmc: Revert "mmc: block: don't use parameter prefix if built as module" mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL mmc: sdhci-pci: Fix card detect race for Intel BXT/APL mmc: sdhci: Allow override of get_cd() called from sdhci_request() mmc: sdhci: Allow override of mmc host operations mmc: sh_mmcif: Correct TX DMA channel allocation mmc: block: return error on failed mmc_blk_get() mmc: pxamci: fix the device-tree probe deferral path mmc: mmc_spi: add checks for dma mapping error mmc: sdhci-of-at91: fix pm runtime unbalanced issue in error path mmc: pxamci: fix again read-only gpio detection polarity commit 0df34ad9b703222ead899465b054070758b317f1 Merge: 14379cd 86c2ee1 Author: Linus Torvalds Date: Fri Feb 12 09:42:05 2016 -0800 Merge tag 'sound-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "In this rc, we've got more volume than previous rc, unsurprisingly; the majority of updates in ASoC are about Intel drivers, and another major changes are the continued plumbing of ALSA timer bugs revealed by syzkaller fuzzer. Hopefully both settle down now. Other than that, HD-audio received a couple of code fixes as well as the usual quirks, and various small fixes are found for FireWire devices, ASoC codecs and drivers" * tag 'sound-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (50 commits) ASoC: arizona: fref must be limited in pseudo-fractional mode ASoC: sigmadsp: Fix missleading return value ALSA: timer: Fix race at concurrent reads ALSA: firewire-digi00x: Drop bogus const type qualifier on dot_scrt() ALSA: hda - Fix bad dereference of jack object ALSA: timer: Fix race between stop and interrupt ALSA: timer: Fix wrong instance passed to slave callbacks ASoC: Intel: Add module tags for common match module ASoC: Intel: Load the atom DPCM driver only ASoC: Intel: Create independent acpi match module ASoC: Intel: Revert "ASoC: Intel: fix ACPI probe regression with Atom DPCM driver" ALSA: dummy: Implement timer backend switching more safely ALSA: hda - Fix speaker output from VAIO AiO machines Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo" ALSA: firewire-tascam: remove needless member for control and status message ALSA: firewire-tascam: remove a flag for controller ALSA: firewire-tascam: add support for FW-1804 ALSA: firewire-tascam: fix NULL pointer dereference when model identification fails ALSA: hda - Fix static checker warning in patch_hdmi.c ASoC: Intel: Skylake: Remove autosuspend delay ... commit 14379cdc763dee2b92276ee15e9c1644df1f017a Merge: 4c05121 b82fe6d Author: Linus Torvalds Date: Fri Feb 12 09:39:34 2016 -0800 Merge tag 'fbdev-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: - fix omap2plus_defconfig to enable omapfb as it was in v4.4 - ocfb: fix timings for margins - s6e8ax0, da8xx-fb: fix compile warnings - mmp: fix build failure caused by bad printk parameters - imxfb: fix clock issue which kept the display off * tag 'fbdev-fixes-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: video: fbdev: imxfb: Provide a reset mechanism fbdev: mmp: print IRQ resource using %pR format string fbdev: da8xx-fb: remove incorrect type cast fbdev: s6e8ax0: avoid unused function warnings ocfb: fix tgdel and tvdel timing parameters ARM: omap2plus_defconfig: update display configs commit 4c05121e253beaf9f03cb31480f4aa676835404b Merge: c747f97 12ffbbe Author: Linus Torvalds Date: Fri Feb 12 09:32:37 2016 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "A set of seven fixes: Two regressions in the new hisi_sas arm driver, a blacklist entry for the marvell console which was causing a reset cascade without it, a race fix in the WRITE_SAME/DISCARD routines, a retry fix for the rdac driver, without which, it would prematurely return EIO and a couple of fixes for the hyper-v storvsc driver" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: block/sd: Return -EREMOTEIO when WRITE SAME and DISCARD are disabled SCSI: Add Marvell Console to VPD blacklist scsi_dh_rdac: always retry MODE SELECT on command lock violation storvsc: Use the specified target ID in device lookup storvsc: Install the storvsc specific timeout handler for FC devices hisi_sas: fix v1 hw check for slot error hisi_sas: add dependency for HAS_IOMEM commit c747f97c36c2fcc63768684eea89654855c83ecd Merge: df8c272 c92a428 Author: Linus Torvalds Date: Fri Feb 12 09:27:31 2016 -0800 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm amd fixes from Dave Airlie: "Been pretty quiet. This is an amdgpu fixes pull from AMD, a bunch of powerplay stability fixes, race fix, hibernate fix, and a possible circular locking fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (21 commits) drm/amdgpu: fix issue with overlapping userptrs drm/radeon: hold reference to fences in radeon_sa_bo_new drm/amdgpu: remove unnecessary forward declaration drm/amdgpu: hold reference to fences in amdgpu_sa_bo_new (v2) drm/amdgpu: fix s4 resume drm/amdgpu/cz: plumb pg flags through to powerplay drm/amdgpu/tonga: plumb pg flags through to powerplay drma/dmgpu: move cg and pg flags into shared headers drm/amdgpu: remove unused cg defines drm/amdgpu: add a cgs interface to fetch cg and pg flags drm/amd/powerplay/tonga: disable vce pg drm/amd/powerplay/tonga: disable uvd pg drm/amd/powerplay/cz: disable vce pg drm/amd/powerplay/cz: disable uvd pg drm/amdgpu: be consistent with uvd cg flags drm/amdgpu: clean up vce pg flags for cz/st drm/amdgpu: handle vce pg flags properly drm/amdgpu: handle uvd pg flags properly drm/amdgpu/dpm/ci: switch over to the common pcie caps interface drm/amdgpu/cik: don't mess with aspm if gpu is root bus ... commit df8c2723a1eb568d42ebca806bec17377ae7e84c Merge: 27c9d77 613317b Author: Linus Torvalds Date: Fri Feb 12 09:24:48 2016 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull crypto fix from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: EVM: Use crypto_memneq() for digest comparisons commit 27c9d772e50731dfd682b4ea9459eccec2071c49 Merge: dfc8528 bc4ef75 Author: Linus Torvalds Date: Fri Feb 12 09:21:28 2016 -0800 Merge branch 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fixes from Chris Mason: "This has a few fixes from Filipe, along with a readdir fix from Dave that we've been testing for some time" * 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: btrfs: properly set the termination value of ctx->pos in readdir Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Btrfs: remove no longer used function extent_read_full_page_nolock() Btrfs: fix page reading in extent_same ioctl leading to csum errors Btrfs: fix invalid page accesses in extent_same (dedup) ioctl commit dfc852864d747289d7ed393aab337637eda007be Merge: c05235d 8e0bd49 Author: Linus Torvalds Date: Fri Feb 12 09:17:03 2016 -0800 Merge tag 'xfs-fixes-for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs Pull xfs fix from Dve Chinner: "This contains a fix for an endian conversion issue in new CRC validation in log recovery that was discovered on a ppc64 platform" * tag 'xfs-fixes-for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: xfs: fix endianness error when checking log block crc on big endian platforms commit cf26f1137333251f3515dea31f95775b99df0fd5 Author: Tony Lindgren Date: Fri Feb 12 08:56:52 2016 -0800 ARM: OMAP2+: Fix omap_device for module reload on PM runtime forbid If a driver PM runtime is disabled via sysfs, and the module is unloaded, PM runtime can't do anything to disable the device. Let's let the interconnect disable the device on BUS_NOTIFY_UNBOUND_DRIVER. Otherwise omap_device will produce and error on the following module reload. This can be easily tested with something like: # modprobe omap_hsmmc # echo on > /sys/devices/platform/68000000.ocp/4809c000.mmc/power/control # rmmod omap_hsmmc # modprobe omap_hsmmc Cc: Alan Stern Cc: Nishanth Menon Cc: Rafael J. Wysocki Cc: Tero Kristo Reported-by: Ulf Hansson Acked-by: Kevin Hilman Acked-by: Ulf Hansson Signed-off-by: Tony Lindgren arch/arm/mach-omap2/omap_device.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 08c78e9d61a857c9077240e7ddb67550c6f96d06 Author: Tony Lindgren Date: Fri Feb 12 08:56:52 2016 -0800 ARM: OMAP2+: Improve omap_device error for driver writers Drivers using pm_runtime_use_autosuspend() may not get disabled after -EPROBE_DEFER. On the following device driver probe, hardware state is different from the PM runtime state causing omap_device to produce the following error: omap_device_enable() called from invalid state 1 And with omap_device and omap hardware being picky for PM, this will block any deeper idle states in hardware. Let's add a proper error message so driver writers can easily fix their drivers for PM. In general, the solution is to fix the drivers to follow the PM runtime documentation: 1. For sections of code that needs the device disabled, use pm_runtime_put_sync_suspend() if pm_runtime_set_autosuspend() has been set. 2. For driver exit code, use pm_runtime_dont_use_autosuspend() before pm_runtime_put_sync() if pm_runtime_use_autosuspend() has been set. Let's not return with 0 from _od_runtime_resume() as that will eventually lead into new drivers with broken PM runtime that will block deeper idle states on omaps. Cc: Alan Stern Cc: Nishanth Menon Cc: Rafael J. Wysocki Cc: Tero Kristo Acked-by: Kevin Hilman Acked-by: Ulf Hansson Signed-off-by: Tony Lindgren arch/arm/mach-omap2/omap_device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a80a0eb70c358f8c7dda4bb62b2278dc6285217b Author: Yang Shi Date: Thu Feb 11 13:53:10 2016 -0800 arm64: make irq_stack_ptr more robust Switching between stacks is only valid if we are tracing ourselves while on the irq_stack, so it is only valid when in current and non-preemptible context, otherwise is is just zeroed off. Fixes: 132cd887b5c5 ("arm64: Modify stack trace and dump for use with irq_stack") Acked-by: James Morse Tested-by: James Morse Signed-off-by: Yang Shi Signed-off-by: Will Deacon arch/arm64/kernel/stacktrace.c | 13 ++++++------- arch/arm64/kernel/traps.c | 11 ++++++++++- 2 files changed, 16 insertions(+), 8 deletions(-) commit 2d99b55d378c996b9692a0c93dd25f4ed5d58934 Author: Hannes Reinecke Date: Fri Feb 12 09:39:15 2016 +0100 bio: return EINTR if copying to user space got interrupted Commit 35dc248383bbab0a7203fca4d722875bc81ef091 introduced a check for current->mm to see if we have a user space context and only copies data if we do. Now if an IO gets interrupted by a signal data isn't copied into user space any more (as we don't have a user space context) but user space isn't notified about it. This patch modifies the behaviour to return -EINTR from bio_uncopy_user() to notify userland that a signal has interrupted the syscall, otherwise it could lead to a situation where the caller may get a buffer with no data returned. This can be reproduced by issuing SG_IO ioctl()s in one thread while constantly sending signals to it. Fixes: 35dc248 [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal Signed-off-by: Johannes Thumshirn Signed-off-by: Hannes Reinecke Cc: stable@vger.kernel.org # v.3.11+ Signed-off-by: Jens Axboe block/bio.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit f8e68a7c9af5f8047f7f8295874bedf306063709 Author: Keith Busch Date: Thu Feb 11 13:05:47 2016 -0700 NVMe: Rate limit nvme IO warnings We don't need to spam the kernel logs with thousands of IO cancelling messages. We can infer all IO's are being cancelled with fewer, or even none at all. This patch rate limits the message and uses the debug log level as it is mainly used for testing purposes. Signed-off-by: Keith Busch Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff23a2a15a2117245b4599c1352343c8b8fb4c43 Author: Keith Busch Date: Thu Feb 11 13:05:43 2016 -0700 NVMe: Poll device while still active during remove A device failure or link down wouldn't have been detected during namespace removal. This patch keeps the device in the list for polling so that the thread may see such failure and initiate a reset. The device is removed from the list after disable, so we can safely flush the reset work as it can't be requeued when disable completes. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit ae1fba20015bca7401db2422fe18c9c049184163 Author: Keith Busch Date: Thu Feb 11 13:05:42 2016 -0700 NVMe: Requeue requests on suspended queues It's possible a request may get to the driver after the nvme queue was disabled. This has the request requeue if that happens. Note the request is still "started" by the driver, but requeuing will clear the start state for timeout handling. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 5 +++++ 1 file changed, 5 insertions(+) commit fb724ed5c6175a2407b256d506c9e703c6bb62d4 Author: Emil Goode Date: Wed Feb 10 02:22:16 2016 +0100 wlcore: Fix regression in wlcore_set_partition() The commit 3719c17e1816 ("wlcore/wl18xx: fw logger over sdio") introduced a regression causing the wlcore to time out and go into recovery. Reverting the changes regarding write of the last partition size brings the module back to it's functional state. Fixes: 3719c17e1816 ("wlcore/wl18xx: fw logger over sdio") Reported-by: Ross Green Signed-off-by: Emil Goode [kvalo@codeaurora.org: improved commit log] Signed-off-by: Kalle Valo drivers/net/wireless/ti/wlcore/io.c | 8 ++++---- drivers/net/wireless/ti/wlcore/io.h | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) commit 86c2ee16704522a546c0ee1e8238096e3c391468 Merge: 397da2d f11aec0 Author: Takashi Iwai Date: Fri Feb 12 09:48:51 2016 +0100 Merge tag 'asoc-fix-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.5 A rather large batch of fixes here, almost all in the Intel driver. The changes that got merged in this merge window for Skylake were rather large and as well as issues that you'd expect in a large block of new code there were some problems created for older processors which needed fixing up. Things are largely settling down now hopefully. commit 613317bd212c585c20796c10afe5daaa95d4b0a1 Author: Ryan Ware Date: Thu Feb 11 15:58:44 2016 -0800 EVM: Use crypto_memneq() for digest comparisons This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq(). Reported-by: Xiaofei Rex Guo Signed-off-by: Ryan Ware Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 37eda9df5bd8444263418495632ea6ec750f03f9 Author: Vineet Gupta Date: Wed Feb 10 06:52:07 2016 +0530 ARC: mm: Introduce explicit super page size support MMUv4 supports 2 concurrent page sizes: Normal and Super [4K to 16M] So far Linux supported a single super page size for a given Normal page, depending on the software page walking address split. e.g. we had 11:8:13 address split for 8K page, which meant super page was 2 ^(8+13) = 2M (given that THP size has to be PMD_SHIFT) Now we turn this around, by allowing multiple Super Pages in Kconfig (currently 2M and 16M only) and forcing page walker address split to PGDIR_SHIFT and PAGE_SHIFT For configs without Super page, things are same as before and PGDIR_SHIFT can be hacked to get non default address split The motivation for this change is a customer who needs 16M super page and a 8K Normal page combo. Signed-off-by: Vineet Gupta arch/arc/Kconfig | 19 ++++++++++++++++++ arch/arc/include/asm/pgtable.h | 45 ++++++++++++++++++++++++------------------ 2 files changed, 45 insertions(+), 19 deletions(-) commit 56263b4ceba90b1db77a6b31e22726f101bca807 Author: Eryu Guan Date: Fri Feb 12 01:23:00 2016 -0500 ext4: remove unused parameter "newblock" in convert_initialized_extent() The "newblock" parameter is not used in convert_initialized_extent(), remove it. Signed-off-by: Eryu Guan Signed-off-by: Theodore Ts'o fs/ext4/extents.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bcff24887d00bce102e0857d7b0a8c44a40f53d1 Author: Eryu Guan Date: Fri Feb 12 01:20:43 2016 -0500 ext4: don't read blocks from disk after extents being swapped I notice ext4/307 fails occasionally on ppc64 host, reporting md5 checksum mismatch after moving data from original file to donor file. The reason is that move_extent_per_page() calls __block_write_begin() and block_commit_write() to write saved data from original inode blocks to donor inode blocks, but __block_write_begin() not only maps buffer heads but also reads block content from disk if the size is not block size aligned. At this time the physical block number in mapped buffer head is pointing to the donor file not the original file, and that results in reading wrong data to page, which get written to disk in following block_commit_write call. This also can be reproduced by the following script on 1k block size ext4 on x86_64 host: mnt=/mnt/ext4 donorfile=$mnt/donor testfile=$mnt/testfile e4compact=~/xfstests/src/e4compact rm -f $donorfile $testfile # reserve space for donor file, written by 0xaa and sync to disk to # avoid EBUSY on EXT4_IOC_MOVE_EXT xfs_io -fc "pwrite -S 0xaa 0 1m" -c "fsync" $donorfile # create test file written by 0xbb xfs_io -fc "pwrite -S 0xbb 0 1023" -c "fsync" $testfile # compute initial md5sum md5sum $testfile | tee md5sum.txt # drop cache, force e4compact to read data from disk echo 3 > /proc/sys/vm/drop_caches # test defrag echo "$testfile" | $e4compact -i -v -f $donorfile # check md5sum md5sum -c md5sum.txt Fix it by creating & mapping buffer heads only but not reading blocks from disk, because all the data in page is guaranteed to be up-to-date in mext_page_mkuptodate(). Cc: stable@vger.kernel.org Signed-off-by: Eryu Guan Signed-off-by: Theodore Ts'o fs/ext4/move_extent.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit 46901760b46064964b41015d00c140c83aa05bcf Author: Insu Yun Date: Fri Feb 12 01:15:59 2016 -0500 ext4: fix potential integer overflow Since sizeof(ext_new_group_data) > sizeof(ext_new_flex_group_data), integer overflow could be happened. Therefore, need to fix integer overflow sanitization. Cc: stable@vger.kernel.org Signed-off-by: Insu Yun Signed-off-by: Theodore Ts'o fs/ext4/resize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2a8d9cdcfee67469dc2a993f59a47467a5eb4adf Merge: 90a88d6 fb2d65d Author: James Bottomley Date: Thu Feb 11 21:50:48 2016 -0800 Merge remote-tracking branch 'mkp-scsi/4.5/scsi-fixes' into fixes commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b Author: James Bottomley Date: Wed Feb 10 08:03:26 2016 -0800 scsi: fix soft lockup in scsi_remove_target() on module removal This softlockup is currently happening: [ 444.088002] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/1:1:29] [ 444.088002] Modules linked in: lpfc(-) qla2x00tgt(O) qla2xxx_scst(O) scst_vdisk(O) scsi_transport_fc libcrc32c scst(O) dlm configfs nfsd lockd grace nfs_acl auth_rpcgss sunrpc ed d snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device dm_mod iTCO_wdt snd_hda_codec_realtek snd_hda_codec_generic gpio_ich iTCO_vendor_support ppdev snd_hda_intel snd_hda_codec snd_hda _core snd_hwdep tg3 snd_pcm snd_timer libphy lpc_ich parport_pc ptp acpi_cpufreq snd pps_core fjes parport i2c_i801 ehci_pci tpm_tis tpm sr_mod cdrom soundcore floppy hwmon sg 8250_ fintek pcspkr i915 drm_kms_helper uhci_hcd ehci_hcd drm fb_sys_fops sysimgblt sysfillrect syscopyarea i2c_algo_bit usbcore button video usb_common fan ata_generic ata_piix libata th ermal [ 444.088002] CPU: 1 PID: 29 Comm: kworker/1:1 Tainted: G O 4.4.0-rc5-2.g1e923a3-default #1 [ 444.088002] Hardware name: FUJITSU SIEMENS ESPRIMO E /D2164-A1, BIOS 5.00 R1.10.2164.A1 05/08/2006 [ 444.088002] Workqueue: fc_wq_4 fc_rport_final_delete [scsi_transport_fc] [ 444.088002] task: f6266ec0 ti: f6268000 task.ti: f6268000 [ 444.088002] EIP: 0060:[] EFLAGS: 00000286 CPU: 1 [ 444.088002] EIP is at _raw_spin_unlock_irqrestore+0x14/0x20 [ 444.088002] EAX: 00000286 EBX: f20d3800 ECX: 00000002 EDX: 00000286 [ 444.088002] ESI: f50ba800 EDI: f2146848 EBP: f6269ec8 ESP: f6269ec8 [ 444.088002] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 444.088002] CR0: 8005003b CR2: 08f96600 CR3: 363ae000 CR4: 000006d0 [ 444.088002] Stack: [ 444.088002] f6269eec c066b0f7 00000286 f2146848 f50ba808 f50ba800 f50ba800 f2146a90 [ 444.088002] f2146848 f6269f08 f8f0a4ed f3141000 f2146800 f2146a90 f619fa00 00000040 [ 444.088002] f6269f40 c026cb25 00000001 166c6392 00000061 f6757140 f6136340 00000004 [ 444.088002] Call Trace: [ 444.088002] [] scsi_remove_target+0x167/0x1c0 [ 444.088002] [] fc_rport_final_delete+0x9d/0x1e0 [scsi_transport_fc] [ 444.088002] [] process_one_work+0x155/0x3e0 [ 444.088002] [] worker_thread+0x37/0x490 [ 444.088002] [] kthread+0x9b/0xb0 [ 444.088002] [] ret_from_kernel_thread+0x21/0x40 What appears to be happening is that something has pinned the target so it can't go into STARGET_DEL via final release and the loop in scsi_remove_target spins endlessly until that happens. The fix for this soft lockup is to not keep looping over a device that we've called remove on but which hasn't gone into DEL state. This patch will retain a simplistic memory of the last target and not keep looping over it. Reported-by: Sebastian Herbszt Tested-by: Sebastian Herbszt Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38 Cc: stable@vger.kernel.org Signed-off-by: James Bottomley drivers/scsi/scsi_sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 802cf1f9f504e09f7118c9acc69ab3e825449e52 Author: Huaitong Han Date: Fri Feb 12 00:17:16 2016 -0500 ext4: add a line break for proc mb_groups display This patch adds a line break for proc mb_groups display. Signed-off-by: Huaitong Han Signed-off-by: Theodore Ts'o Reviewed-by: Andreas Dilger fs/ext4/mballoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fdde368e7c2963e319f919fa57908537060847fc Author: Anton Protopopov Date: Thu Feb 11 23:57:21 2016 -0500 ext4: ioctl: fix erroneous return value The ext4_ioctl_setflags() function which is used in the ioctls EXT4_IOC_SETFLAGS and EXT4_IOC_FSSETXATTR may return the positive value EPERM instead of -EPERM in case of error. This bug was introduced by a recent commit 9b7365fc. The following program can be used to illustrate the wrong behavior: #include #include #include #include #include #define FS_IOC_GETFLAGS _IOR('f', 1, long) #define FS_IOC_SETFLAGS _IOW('f', 2, long) #define FS_IMMUTABLE_FL 0x00000010 int main(void) { int fd; long flags; fd = open("file", O_RDWR|O_CREAT, 0600); if (fd < 0) err(1, "open"); if (ioctl(fd, FS_IOC_GETFLAGS, &flags) < 0) err(1, "ioctl: FS_IOC_GETFLAGS"); flags |= FS_IMMUTABLE_FL; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) < 0) err(1, "ioctl: FS_IOC_SETFLAGS"); warnx("ioctl returned no error"); return 0; } Running it gives the following result: $ strace -e ioctl ./test ioctl(3, FS_IOC_GETFLAGS, 0x7ffdbd8bfd38) = 0 ioctl(3, FS_IOC_SETFLAGS, 0x7ffdbd8bfd38) = 1 test: ioctl returned no error +++ exited with 0 +++ Running the program on a kernel with the bug fixed gives the proper result: $ strace -e ioctl ./test ioctl(3, FS_IOC_GETFLAGS, 0x7ffdd2768258) = 0 ioctl(3, FS_IOC_SETFLAGS, 0x7ffdd2768258) = -1 EPERM (Operation not permitted) test: ioctl: FS_IOC_SETFLAGS: Operation not permitted +++ exited with 1 +++ Signed-off-by: Anton Protopopov Signed-off-by: Theodore Ts'o fs/ext4/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 05145bd799e498ce4e3b5145894174ee881f02b0 Author: Jan Kara Date: Thu Feb 11 23:15:12 2016 -0500 ext4: fix scheduling in atomic on group checksum failure When block group checksum is wrong, we call ext4_error() while holding group spinlock from ext4_init_block_bitmap() or ext4_init_inode_bitmap() which results in scheduling while in atomic. Fix the issue by calling ext4_error() later after dropping the spinlock. CC: stable@vger.kernel.org Reported-by: Dmitry Vyukov Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Reviewed-by: Darrick J. Wong fs/ext4/balloc.c | 7 ++++--- fs/ext4/ialloc.c | 6 ++++-- 2 files changed, 8 insertions(+), 5 deletions(-) commit 6b44d1e9bf3b850b433694d654709b4cbc9bc00e Merge: 89140fd 58a66db Author: Greg Kroah-Hartman Date: Thu Feb 11 20:10:58 2016 -0800 Merge tag 'phy-for-4.5-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 4.5-rc *) Fix error handling code in phy core [phy_power_on()] *) phy-twl4030-usb fixes for unloading the module *) Restrict phy-hi6220-usb to HiSilicon arm64 Signed-off-by: Kishon Vijay Abraham I commit 1ecb4ae5f0aaf48b538b9e90b7b360215a2cf9ed Author: Andrew Morton Date: Thu Feb 11 16:13:20 2016 -0800 arch/x86/Kconfig: CONFIG_X86_UV should depend on CONFIG_EFI arch/x86/built-in.o: In function `uv_bios_call': (.text+0xeba00): undefined reference to `efi_call' Reported-by: kbuild test robot Suggested-by: "H. Peter Anvin" Cc: Ingo Molnar Reviewed-by: Matt Fleming Acked-by: Alex Thorlton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) commit db78c22230d0bcc8b27b81f05b39f104f08232c5 Author: Dan Williams Date: Thu Feb 11 16:13:17 2016 -0800 mm: fix pfn_t vs highmem The pfn_t type uses an unsigned long to store a pfn + flags value. On a 64-bit platform the upper 12 bits of an unsigned long are never used for storing the value of a pfn. However, this is not true on highmem platforms, all 32-bits of a pfn value are used to address a 44-bit physical address space. A pfn_t needs to store a 64-bit value. Link: https://bugzilla.kernel.org/show_bug.cgi?id=112211 Fixes: 01c8f1c44b83 ("mm, dax, gpu: convert vm_insert_mixed to pfn_t") Signed-off-by: Dan Williams Reported-by: Stuart Foster Reported-by: Julian Margetson Tested-by: Julian Margetson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/pfn.h | 2 +- include/linux/pfn_t.h | 19 +++++++++---------- kernel/memremap.c | 2 +- 3 files changed, 11 insertions(+), 12 deletions(-) commit 4a389810bc3cb0e73443104f0827e81e23cb1e12 Author: Andrew Morton Date: Thu Feb 11 16:13:14 2016 -0800 kernel/locking/lockdep.c: convert hash tables to hlists Mike said: : CONFIG_UBSAN_ALIGNMENT breaks x86-64 kernel with lockdep enabled, i. e : kernel with CONFIG_UBSAN_ALIGNMENT fails to load without even any error : message. : : The problem is that ubsan callbacks use spinlocks and might be called : before lockdep is initialized. Particularly this line in the : reserve_ebda_region function causes problem: : : lowmem = *(unsigned short *)__va(BIOS_LOWMEM_KILOBYTES); : : If i put lockdep_init() before reserve_ebda_region call in : x86_64_start_reservations kernel loads well. Fix this ordering issue permanently: change lockdep so that it uses hlists for the hash tables. Unlike a list_head, an hlist_head is in its initialized state when it is all-zeroes, so lockdep is ready for operation immediately upon boot - lockdep_init() need not have run. The patch will also save some memory. lockdep_init() and lockdep_initialized can be done away with now - a 4.6 patch has been prepared to do this. Reported-by: Mike Krinkin Suggested-by: Mike Krinkin Cc: Andrey Ryabinin Cc: Ingo Molnar Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/lockdep.h | 4 ++-- kernel/locking/lockdep.c | 42 +++++++++++++++++++----------------------- 2 files changed, 21 insertions(+), 25 deletions(-) commit 6b75d14912f2d89a3539c0b3a100519e1eec9a63 Author: Vineet Gupta Date: Thu Feb 11 16:13:11 2016 -0800 mm,thp: fix spellos in describing __HAVE_ARCH_FLUSH_PMD_TLB_RANGE [akpm@linux-foundation.org: s/threshhold/threshold/] Signed-off-by: Vineet Gupta Cc: Kirill A. Shutemov Cc: Aneesh Kumar K.V Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/pgtable-generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6a6ac72fd6ea32594b316513e1826c3f6db4cc93 Author: Vineet Gupta Date: Thu Feb 11 16:13:09 2016 -0800 mm,thp: khugepaged: call pte flush at the time of collapse This showed up on ARC when running LMBench bw_mem tests as Overlapping TLB Machine Check Exception triggered due to STLB entry (2M pages) overlapping some NTLB entry (regular 8K page). bw_mem 2m touches a large chunk of vaddr creating NTLB entries. In the interim khugepaged kicks in, collapsing the contiguous ptes into a single pmd. pmdp_collapse_flush()->flush_pmd_tlb_range() is called to flush out NTLB entries for the ptes. This for ARC (by design) can only shootdown STLB entries (for pmd). The stray NTLB entries cause the overlap with the subsequent STLB entry for collapsed page. So make pmdp_collapse_flush() call pte flush interface not pmd flush. Note that originally all thp flush call sites in generic code called flush_tlb_range() leaving it to architecture to implement the flush for pte and/or pmd. Commit 12ebc1581ad11454 changed this by calling a new opt-in API flush_pmd_tlb_range() which made the semantics more explicit but failed to distinguish the pte vs pmd flush in generic code, which is what this patch fixes. Note that ARC can fixed w/o touching the generic pmdp_collapse_flush() by defining a ARC version, but that defeats the purpose of generic version, plus sementically this is the right thing to do. Fixes STAR 9000961194: LMBench on AXS103 triggering duplicate TLB exceptions with super pages Fixes: 12ebc1581ad11454 ("mm,thp: introduce flush_pmd_tlb_range") Signed-off-by: Vineet Gupta Reviewed-by: Aneesh Kumar K.V Acked-by: Kirill A. Shutemov Cc: Andrea Arcangeli Cc: [4.4] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/pgtable-generic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 078c6c3a5e7dc53a9a23408cc32c83954abb5d0d Author: Rasmus Villemoes Date: Thu Feb 11 16:13:06 2016 -0800 mm/backing-dev.c: fix error path in wb_init() We need to use post-decrement to get percpu_counter_destroy() called on &wb->stat[0]. Moreover, the pre-decremebt would cause infinite out-of-bounds accesses if the setup code failed at i==0. Signed-off-by: Rasmus Villemoes Cc: Johannes Weiner Cc: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/backing-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b9116a652bd9e0e2994505cfaaa5f66deaa2a05 Author: Kirill A. Shutemov Date: Thu Feb 11 16:13:03 2016 -0800 mm, dax: check for pmd_none() after split_huge_pmd() DAX implements split_huge_pmd() by clearing pmd. This simple approach reduces memory overhead, as we don't need to deposit page table on huge page mapping to make split_huge_pmd() never-fail. PTE table can be allocated and populated later on page fault from backing store. But one side effect is that have to check if pmd is pmd_none() after split_huge_pmd(). In most places we do this already to deal with parallel MADV_DONTNEED. But I found two call sites which is not affected by MADV_DONTNEED (due down_write(mmap_sem)), but need to have the check to work with DAX properly. Signed-off-by: Kirill A. Shutemov Cc: Dan Williams Cc: Matthew Wilcox Cc: Andrea Arcangeli Cc: Ross Zwisler Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mprotect.c | 6 ++++-- mm/mremap.c | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) commit 7eb391299419a03cbe0fa5ab0e6b0932e42c7a36 Author: Jason A. Donenfeld Date: Thu Feb 11 16:13:00 2016 -0800 vsprintf: kptr_restrict is okay in IRQ when 2 The kptr_restrict flag, when set to 1, only prints the kernel address when the user has CAP_SYSLOG. When it is set to 2, the kernel address is always printed as zero. When set to 1, this needs to check whether or not we're in IRQ. However, when set to 2, this check is unneccessary, and produces confusing results in dmesg. Thus, only make sure we're not in IRQ when mode 1 is used, but not mode 2. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Jason A. Donenfeld Cc: Rasmus Villemoes Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/vsprintf.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 62eb320ab077890dbbcc28343fa6432a82a10c35 Author: Randy Dunlap Date: Thu Feb 11 16:12:58 2016 -0800 mm: fix filemap.c kernel doc warning Add missing kernel-doc notation for function parameter 'gfp_mask' to fix kernel-doc warning. mm/filemap.c:1898: warning: No description found for parameter 'gfp_mask' Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 1 + 1 file changed, 1 insertion(+) commit 7707535ab95e2231b6d7f2bfb4f27558e83c4dc2 Author: Yang Shi Date: Thu Feb 11 16:12:55 2016 -0800 ubsan: cosmetic fix to Kconfig text When enabling UBSAN_SANITIZE_ALL, the kernel image size gets increased significantly (~3x). So, it sounds better to have some note in Kconfig. And, fixed a typo. Signed-off-by: Yang Shi Acked-by: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/Kconfig.ubsan | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 5d589d81acf974d23af98044aac56c6339d659f8 Author: Robin Murphy Date: Tue Feb 9 11:04:45 2016 +0000 of/irq: Fix msi-map calculation for nonzero rid-base The existing msi-map code is fine for shifting the entire RID space upwards, but attempting finer-grained remapping reveals a bug. It turns out that we are mistakenly treating the msi-base part as an offset, not as a new base to remap onto, so things get squiffy when rid-base is nonzero. Fix this, and at the same time add a sanity check against having msi-map-mask clash with a nonzero rid-base, as that's another thing one can easily get wrong. CC: Signed-off-by: Robin Murphy Reviewed-by: Marc Zyngier Tested-by: Stuart Yoder Acked-by: Mark Rutland Acked-by: David Daney Signed-off-by: Rob Herring drivers/of/irq.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit ef2d4615c59efb312e531a5e949970f37ca1c841 Author: Keith Busch Date: Thu Feb 11 13:05:40 2016 -0700 NVMe: Allow request merges It is generally more efficient to submit larger IO. Signed-off-by: Keith Busch Reviewed-by: Johannes Thumshirn Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 1 - 1 file changed, 1 deletion(-) commit 4f76d0e49835d3da33aa54811157421f7061805e Author: Keith Busch Date: Thu Feb 11 13:05:39 2016 -0700 NVMe: Fix io incapable return values The function returns true when the controller can't handle IO. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Johannes Thumshirn Acked-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/nvme.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a59e0f5795fe52dad42a99c00287e3766153b312 Author: Keith Busch Date: Thu Feb 11 13:05:38 2016 -0700 blk-mq: End unstarted requests on dying queue Go directly to ending a request if it wasn't started. Previously, completing a request may invoke a driver callback for a request it didn't initialize. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Johannes Thumshirn Acked-by: Christoph Hellwig Signed-off-by: Jens Axboe block/blk-mq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 5f009d3f8e6685fe8c6215082c1696a08b411220 Author: Keith Busch Date: Wed Feb 10 16:52:47 2016 -0700 block: Initialize max_dev_sectors to 0 The new queue limit is not used by the majority of block drivers, and should be initialized to 0 for the driver's requested settings to be used. Signed-off-by: Keith Busch Acked-by: Martin K. Petersen Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe block/blk-settings.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c05235d50f681bf685e7290cae05ab3b4fa493f3 Merge: da2f912 6ec9249a Author: Linus Torvalds Date: Thu Feb 11 11:25:55 2016 -0800 Merge tag 'gpio-v4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: - Probe errorpath fix for the Altera - irqchip ofnode pointer added to the DaVinci driver - controller instance number correction for DaVinci * tag 'gpio-v4.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: davinci: Fix the number of controllers allocated gpio: davinci: Add the missing of-node pointer gpio: gpio-altera: Remove gpiochip on probe failure. commit da2f912aef1106144c43b75f8719807dfad121b3 Merge: 5de6ac7 b1d353a Author: Linus Torvalds Date: Thu Feb 11 11:17:19 2016 -0800 Merge tag 'platform-drivers-x86-v4.5-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86 Pull x86 platform driver fixes from Darren Hart: "Just two small fixes for the 4.5-rc cycle: intel_scu_ipcutil: - underflow in scu_reg_access() intel-hid: - fix incorrect entries in intel_hid_keymap" * tag 'platform-drivers-x86-v4.5-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86: intel_scu_ipcutil: underflow in scu_reg_access() intel-hid: fix incorrect entries in intel_hid_keymap commit 5de6ac75d928358063f37c874a91ca1ef28ac308 Merge: 721675f a1b14d2 Author: Linus Torvalds Date: Thu Feb 11 11:00:34 2016 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix BPF handling of branch offset adjustmnets on backjumps, from Daniel Borkmann. 2) Make sure selinux knows about SOCK_DESTROY netlink messages, from Lorenzo Colitti. 3) Fix openvswitch tunnel mtu regression, from David Wragg. 4) Fix ICMP handling of TCP sockets in syn_recv state, from Eric Dumazet. 5) Fix SCTP user hmacid byte ordering bug, from Xin Long. 6) Fix recursive locking in ipv6 addrconf, from Subash Abhinov Kasiviswanathan. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: bpf: fix branch offset adjustment on backjumps after patching ctx expansion vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices geneve: Relax MTU constraints vxlan: Relax MTU constraints flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen of: of_mdio: Add marvell, 88e1145 to whitelist of PHY compatibilities. selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables sctp: translate network order to host order when users get a hmacid enic: increment devcmd2 result ring in case of timeout tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs net:Add sysctl_max_skb_frags tcp: do not drop syn_recv on all icmp reports ipv6: fix a lockdep splat unix: correctly track in-flight fds in sending process user_struct update be2net maintainers' email addresses dwc_eth_qos: Reset hardware before PHY start ipv6: addrconf: Fix recursive spin lock call commit ee50aeac60ba5c4c7e072fbc0c9aa2043c8896e6 Author: Eran Ben Elisha Date: Thu Feb 11 10:24:42 2016 +0200 IB/core: Fix reading capability mask of the port info class When checking specific attribute from a bit mask, need to use bitwise AND and not logical AND, fixed that. Fixes: 145d9c541032 ('IB/core: Display extended counter set if available') Signed-off-by: Eran Ben Elisha Signed-off-by: Matan Barak Reviewed-by: Or Gerlitz Reviewed-by: Christoph Lameter Signed-off-by: Doug Ledford drivers/infiniband/core/sysfs.c