Commit graph

548335 commits

Author SHA1 Message Date
Christian Engelmayer
0f89abf56a btrfs: fix possible leak in btrfs_ioctl_balance()
Commit 8eb934591f ("btrfs: check unsupported filters in balance
arguments") adds a jump to exit label out_bargs in case the argument
check fails. At this point in addition to the bargs memory, the
memory for struct btrfs_balance_control has already been allocated.
Ownership of bctl is passed to btrfs_balance() in the good case,
thus the memory is not freed due to the introduced jump. Make sure
that the memory gets freed in any case as necessary. Detected by
Coverity CID 1328378.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
2015-10-21 18:10:02 -07:00
Dave Airlie
c50f13f911 Merge branch 'drm-fixes-4.3' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Just a crash fix for radeon and amdgpu if the user has forcibly disabled
dpm and tries to access the pwm sysfs controls.

* 'drm-fixes-4.3' of git://people.freedesktop.org/~agd5f/linux:
  drm/amdgpu: add missing dpm check for KV dpm late init
  drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled
  drm/radeon/dpm: don't add pwm attributes if DPM is disabled
2015-10-22 10:24:55 +10:00
Dave Airlie
c2a75586ff Merge tag 'drm-intel-fixes-2015-10-16' of git://anongit.freedesktop.org/drm-intel into drm-fixes
The revert dance could use some explanation: we had stuff fixed in
-next, and initially backported one commit to v4.3. Now, turns out we
need more fixes, and we could cherry-pick them all without conflicts if
we reverted the backported one first. So did that to not have to edit
and backport them all.

* tag 'drm-intel-fixes-2015-10-16' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Add primary plane to mask if it's visible
  drm/i915: Move sprite/cursor plane disable to intel_sanitize_crtc()
  drm/i915: Assign hwmode after encoder state readout
  Revert "drm/i915: Add primary plane to mask if it's visible"
  drm/i915: Deny wrapping an userptr into a framebuffer
  drm/i915: Enable DPLL VGA mode before P1/P2 divider write
  drm/i915: Restore lost DPLL register write on gen2-4
  drm/i915: Flush pipecontrol post-sync writes
  drm/i915: Fix kerneldoc for i915_gem_shrink_all
2015-10-22 10:24:21 +10:00
Vasant Hegde
8832317f66 powerpc/rtas: Validate rtas.entry before calling enter_rtas()
Currently we do not validate rtas.entry before calling enter_rtas(). This
leads to a kernel oops when user space calls rtas system call on a powernv
platform (see below). This patch adds code to validate rtas.entry before
making enter_rtas() call.

  Oops: Exception in kernel mode, sig: 4 [#1]
  SMP NR_CPUS=1024 NUMA PowerNV
  task: c000000004294b80 ti: c0000007e1a78000 task.ti: c0000007e1a78000
  NIP: 0000000000000000 LR: 0000000000009c14 CTR: c000000000423140
  REGS: c0000007e1a7b920 TRAP: 0e40   Not tainted  (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
  MSR: 1000000000081000 <HV,ME>  CR: 00000000  XER: 00000000
  CFAR: c000000000009c0c SOFTE: 0
  NIP [0000000000000000]           (null)
  LR [0000000000009c14] 0x9c14
  Call Trace:
  [c0000007e1a7bba0] [c00000000041a7f4] avc_has_perm_noaudit+0x54/0x110 (unreliable)
  [c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
  [c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98

Cc: stable@vger.kernel.org # v3.2+
Fixes: 55190f8878 ("powerpc: Add skeleton PowerNV platform")
Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Reword change log, trim oops, and add stable + fixes]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-10-22 11:03:25 +11:00
Dave Airlie
37363bc03e Merge branch 'linux-4.3' of git://anongit.freedesktop.org/nouveau/linux-2.6 into drm-fixes
Just one fix from Ilia to resolve various issues that have resulted from
buffer eviction.

* 'linux-4.3' of git://anongit.freedesktop.org/nouveau/linux-2.6:
  drm/nouveau/gem: return only valid domain when there's only one
2015-10-22 09:15:10 +10:00
Ilia Mirkin
2a6c521bb4 drm/nouveau/gem: return only valid domain when there's only one
On nv50+, we restrict the valid domains to just the one where the buffer
was originally created. However after the buffer is evicted to system
memory, we might move it back to a different domain that was not
originally valid. When sharing the buffer and retrieving its GEM_INFO
data, we still want the domain that will be valid for this buffer in a
pushbuf, not the one where it currently happens to be.

This resolves fdo#92504 and several others. These are due to suspend
evicting all buffers, making it more likely that they temporarily end up
in the wrong place.

Cc: stable@vger.kernel.org
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92504
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2015-10-22 09:10:52 +10:00
Adam Richter
30730c7f59 drm: fix mutex leak in drm_dp_get_mst_branch_device
In Linux 4.3-rc5, there is an error case in drm_dp_get_branch_device
that returns without releasing mgr->lock, resulting a spew of kernel
messages about a kernel work function possibly having leaked a mutex
and presumably more serious adverse consequences later.  This patch
changes the error to "goto out" to unlock the mutex before returning.

[airlied: grabbed from drm-next as it fixes something we've seen]

Signed-off-by: Adam J. Richter <adam_richter2004@yahoo.com>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-10-22 08:29:08 +10:00
Joerg Roedel
1228236de5 iommu: Move default domain allocation to iommu_group_get_for_dev()
Now that the iommu core support for iommu groups is not
pci-centric anymore, we can move default domain allocation
to the bus independent iommu_group_get_for_dev() function.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
391811e185 iommu: Remove is_pci_dev() fall-back from iommu_group_get_for_dev
All callers of iommu_group_get_for_dev() provide a
device_group call-back now, so this fall-back is no longer
needed.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
af65993224 iommu/arm-smmu: Switch to device_group call-back
This converts the ARM SMMU and the SMMUv3 driver to use the
new device_group call-back.

Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
d5e5829715 iommu/fsl: Convert to device_group call-back
Convert the fsl pamu driver to make use of the new
device_group call-back.

Cc: Varun Sethi <Varun.Sethi@freescale.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
a960fadbe6 iommu: Add device_group call-back to x86 iommu drivers
Set the device_group call-back to pci_device_group() for the
Intel VT-d and the AMD IOMMU driver.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
6eab556a40 iommu: Add generic_device_group() function
This function can be used as a device_group call-back and
just allocates one iommu-group per device.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
5e62292bad iommu: Export and rename iommu_group_get_for_pci_dev()
Rename that function to pci_device_group() and export it, so
that IOMMU drivers can use it as their device_group
call-back.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:49 +02:00
Joerg Roedel
46c6b2bc88 iommu: Revive device_group iommu-ops call-back
That call-back is currently unused, change it into a
call-back function for finding the right IOMMU group for a
device.
This is a first step to remove the hard-coded PCI dependency
in the iommu-group code.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-22 00:00:48 +02:00
Linus Torvalds
8a70dd2669 Merge tag 'for-linus-20151021' of git://git.infradead.org/intel-iommu
Pull intel-iommu bugfix from David Woodhouse:
 "This contains a single fix, for when the IOMMU API is used to overlay
  an existing mapping comprised of 4KiB pages, with a mapping that can
  use superpages.

  For the *first* superpage in the new mapping, we were correctly¹
  freeing the old bottom-level page table page and clearing the link to
  it, before installing the superpage.  For subsequent superpages,
  however, we weren't.  This causes a memory leak, and a warning about
  setting a PTE which is already set.

  ¹ Well, not *entirely* correctly.  We just free the page table pages
    right there and then, which is wrong.  In fact they should only be
    freed *after* the IOTLB is flushed so we know the hardware will no
    longer be looking at them....  and in fact I note that the IOTLB
    flush is completely missing from the intel_iommu_map() code path,
    although it needs to be there if it's permitted to overwrite
    existing mappings.

    Fixing those is somewhat more intrusive though, and will probably
    need to wait for 4.4 at this point"

* tag 'for-linus-20151021' of git://git.infradead.org/intel-iommu:
  iommu/vt-d: fix range computation when making room for large pages
2015-10-22 06:32:48 +09:00
Linus Torvalds
7f67786330 MMC core:
- Don't re-tune in the reset sequence to allow re-init of the card
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWJ028AAoJEP4mhCVzWIwpmFEQAKvyEdBCdIzf8U5jAnqmUBp2
 tF/6qKpHcyKcKopHH+fsx2mdZoCwq5my+UNnY6PsSbCLpNT7m7ea/cD/I1yWRWR0
 qXPqbZddM71xyJ0VLBbGubpgqbR9ofPa5Bg7V6JT74P/5EXORSt1wmLcy0QLeI4y
 WQlmdL9xzEk5MKHyAXFURiyexXZSmRyw8YUV6vOESwv1/O18sTeKo3NerQx9urc+
 DqyID9+uPvqesQ09IcboaZT5KtTpGAh0O52EiKl90Fv/4yLuXD3dV6DhsI4B1use
 jVnCFrCOdXT7cpugOGht7aDnP8Sga1k4jTBiWS97CusMykwc7kIF8Yty3LlKr510
 tglarnSvmhYSrY0uR1YGWugfwgg+8V5SrolZa+zMg+hHwSIvWLybnJkUtdaNSB1r
 k0Q97k0mKUT7hTAhd60U7XTMOrumb2w1VdY0/BRGtm8J6XwEhnjF+j8h7CRqCzIn
 HJuvZ7AhfUjr93ASMfzebNaSEFIt8I0G0fIv+YP0nu5WnkySfgC7Q4LZzwy/MC4/
 V9rqdq0iObHZmIyYEydgudmdXYkR5lSp1SenVQ3kBT/xE1Ygcj5ujdfEHxpVoz0C
 owqjaKL5zXOOVB7/bhKnyAXTu7f/lr/QPo0z8zoVVQqxEl+KP+5vyP1K/sN12zrj
 vz9c1MU7k7d7nSqlcOV5
 =LHs/
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v4.3-rc5' of git://git.linaro.org/people/ulf.hansson/mmc

Pull MMC bugfix from Ulf Hansson:
 "Here's yet another MMC fix intended for v4.3 rc7.  I don't expect to
  send any further pull requests for 4.3 rc[n].

  MMC core:
   - Don't re-tune in the reset sequence to allow re-init of the card"

* tag 'mmc-v4.3-rc5' of git://git.linaro.org/people/ulf.hansson/mmc:
  mmc: core: Fix init_card in 52Mhz
2015-10-22 06:31:27 +09:00
Doron Tsur
0ca81a2840 IB/cm: Fix rb-tree duplicate free and use-after-free
ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049dac ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur <doront@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2015-10-21 15:43:12 -04:00
Thomas Hellstrom
09dc1387c9 drm/vmwgfx: Stabilize the command buffer submission code
This commit addresses some stability problems with the command buffer
submission code recently introduced:

1) Make the vmw_cmdbuf_man_process() function handle reruns internally to
avoid losing interrupts if the caller forgets to rerun on -EAGAIN.
2) Handle default command buffer allocations using inline command buffers.
This avoids rare allocation deadlocks.
3) In case of command buffer errors we might lose fence submissions.
Therefore send a new fence after each command buffer error. This will help
avoid lengthy fence waits.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
2015-10-21 21:31:49 +02:00
Paolo Bonzini
ad355e383d A late round of KVM/ARM fixes for v4.3-rc7, fixing:
- A bug where level-triggered interrupts lowered from userspace
    are still routed to the guest
  - A memory leak an a failed initialization path
  - A build error under certain configurations
  - Several timer bugs introduced with moving the timer to the active
    state handling instead of the masking trick.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEbBAABAgAGBQJWJmf7AAoJEEtpOizt6ddy35UH+NCAt1AInvQajAB1rzXzFSYh
 v9PQ5zJ7ZlP8M3HFYjerSl0HrGbi2Cwij5KYE+UAQkXIzCTTdDeB9TUSI/GYQ82M
 axel8Ob3deELp03nS5I+gP1NGX3HPDz445grScg7yl1lMs3uDy4viDDM8Vm8+HUX
 zZWGpDRHNW3b0myS5NVJvOP7Sm5t7DqklsNScZ04Nut7V8gYEUqEu+ZNKerIZkKn
 LrJUVYqqZf33bf6pWle95QZuNQtg84kion3qwWaNl+/8jFkAA8CODyvzar9VMHpf
 xA0xUkK1ERZ+hw2n0/BIgCxI4lXvROAx0YpZKnSMgEU5E5p5gGZYqlHCw8r1Rw==
 =VQSu
 -----END PGP SIGNATURE-----

Merge tag 'kvm-arm-for-v4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master

A late round of KVM/ARM fixes for v4.3-rc7, fixing:
 - A bug where level-triggered interrupts lowered from userspace
   are still routed to the guest
 - A memory leak an a failed initialization path
 - A build error under certain configurations
 - Several timer bugs introduced with moving the timer to the active
   state handling instead of the masking trick.
2015-10-21 17:46:56 +02:00
Arnd Bergmann
55f4129757 mvebu fixes for 4.3 (part 2)
Fix wrong compatible for A385 DB AP preventing using suspend
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iEYEABECAAYFAlYhNEwACgkQCwYYjhRyO9XX9gCgnabcvdHrfFqAD3IFICLCgkOM
 U1AAnReiDUjcUhz6oTl6I2+e3PLHY7RO
 =BkFw
 -----END PGP SIGNATURE-----

Merge tag 'mvebu-fixes-4.3-2' of git://git.infradead.org/linux-mvebu into fixes

Merge "mvebu fixes for 4.3 (part 2)" from Gregory CLEMENT:

Fix wrong compatible for A385 DB AP preventing using suspend

* tag 'mvebu-fixes-4.3-2' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu: correct a385-db-ap compatible string
2015-10-21 17:03:37 +02:00
Arnd Bergmann
0690f4f2ef Samsung 2nd fixes for v4.3
- fix SOC detection of exynos thermal on exynos5260
 - fix audio card detection on Peach boards
 - fix double of_node_put() when parsing child power domains
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJWIYd6AAoJEA0Cl+kVi2xqgzAQAIoCxYnhMr8I1kiJwFaZ3AKT
 r28RFw1rAhD+u344/5uuMwkJdl15+ubXf/g0uCLSmXwSKeQgJdXfidYEhTpd4OUw
 iVT+F+J8U7z3SaIymEdHp3ACUiU3eb1cW3AfrCU5FPwdVfnvyE7Fp7XPdE9w7GX4
 fMs+qi5BbJP02jO+rHAc2HHHdylSQu5JH0HPIOgBCQVVLQzhs79E5LcrvF0DXc2d
 WmZ+14S/Hc+/heiqc6wGQ75fDdPOGMj8ISo5sx+G0TyCz0r2FXR+yDRrXwCESTtn
 DD7CeQ8GdHT5fUiylU7y0+75h8/i3mNav9+fqF33BcpnGe8LAcB9Q/rDemw9irWp
 baGArheUjeWsql8qVbb7SeOZdzxAHT8QUs+AAxcrxBmv+4yWGhBdvVQfMKVhVcoP
 glnYpxRs1FsODVSfQ4Wp25U4PY49iOB+oND86HkmOZdQI5VrnzxPH1i5nKKRbXB7
 ZjidX3IVuiJtXFcB2ybd5VLzD7Xe6mJE0jYG264u0oXm5IFXXh+dHnDy2fqCJ9OY
 Y0HZX/EOwbDh93H/E3xqItPnWKFW5pp17wG1kIV7pm07d1TQPDjT0D8SLcF37+TW
 X622hnU5D16+qa8mNq+CyG0DZQUteNAi4yf9WiKIswbmW2n581dlmRJpVjlfY90z
 l8AwHcVTybMV1/v8fAmb
 =J4IA
 -----END PGP SIGNATURE-----

Merge tag 'samsung-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes

Merge "Samsung 2nd fixes for v4.3" from Kukjin Kim:

- fix SOC detection of exynos thermal on exynos5260
- fix audio card detection on Peach boards
- fix double of_node_put() when parsing child power domains

* tag 'samsung-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  thermal: exynos: Fix register read in TMU
  ARM: dts: Fix audio card detection on Peach boards
  ARM: EXYNOS: Fix double of_node_put() when parsing child power domains
2015-10-21 17:02:13 +02:00
Arnd Bergmann
6701ef0318 Fixes for omaps for v4.3-rc cycle:
- Fix oops with LPAE and moew than 2GB of memory by enabling
   ZONE_DMA for LPAE. Probably no need for stable on this one as we
   only recently ran into this with the mainline kernel
 
 - Fix imprecise external abort caused by bogus SRAM init. This affects
   dm814x recently merged, so no need for stable on this one AFAIK
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWJnm9AAoJEBvUPslcq6VzJHMP/i8DVa6R3OwssmGS3Cp/XKPV
 m1GCXReauql0oUfFR0baiVnBKL6x8jEHW91iQeV3b3cUz+8l3jL7Q4yc+voPyjHz
 ud890cId4wP54PWtDo4lpzDKi3lQkGBI+zJVAyWLfNPt97xcTh1yXW2HdDQ2Hlf4
 nyksDKI1CE42h22l5odB9i0yf7Y/XXl8CYl0ZggHV1XReKSZGveTf8+Qcd1uME2s
 ovLoxEOHDsmxwERXxeSw7Vw4MwefCBdXhKZf1a6l++/pyD/HqWNpJqpS+VEX4yaw
 9ZGT5wmTZQXzzAx60bfO9kokFaKzKiae1UYZusR1aoEKKvFwh8+7ziTTv5q8Do+s
 PRaeczB0tJA9OniwZaZEHNyckMgLlReH3PH5mwYV9DNNnG4LWRDjsx8LWDZ7lcjL
 HxvDjbB6Ir51jGCxa4GVH0NZy0NZ+UHFTMv6bgiEc3uO4PMu35syDXfLws4VJWXZ
 jC4bR2ShUbrAaGQj8R4aYQFus2MzXu58eqwceDGqeuf9M+wn10IO0/OaAXg5oPhk
 TfqB/6+yC8GjyWyRaKV7PrgJKsqcm4S9P2WCuZL+lU5GgnfSrFTb1+OBQl4BQFXD
 89Mj/oYOoKQd3qQFmsk2ZKwRqT9kLixKvih0bvkos4saOJipW2aNpLBTwNpQEpRk
 N9J0CUyn/p1tQEBVCJj5
 =EP6s
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v4.3/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Merge "Fixes for omaps for v4.3-rc cycle" from Tony Lindgren:

- Fix oops with LPAE and moew than 2GB of memory by enabling
  ZONE_DMA for LPAE. Probably no need for stable on this one as we
  only recently ran into this with the mainline kernel

- Fix imprecise external abort caused by bogus SRAM init. This affects
  dm814x recently merged, so no need for stable on this one AFAIK

* tag 'omap-for-v4.3/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP2+: Fix imprecise external abort caused by bogus SRAM init
  ARM: OMAP2+: Fix oops with LPAE and more than 2GB of memory
2015-10-21 17:01:14 +02:00
Dan Carpenter
50010c2059 irda: precedence bug in irlmp_seq_hb_idx()
This is decrementing the pointer, instead of the value stored in the
pointer.  KASan detects it as an out of bounds reference.

Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:48:26 -07:00
Joe Jin
ca88ea1247 xen-netfront: update num_queues to real created
Sometimes xennet_create_queues() may failed to created all requested
queues, we need to update num_queues to real created to avoid NULL
pointer dereference.

Signed-off-by: Joe Jin <joe.jin@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: David S. Miller <davem@davemloft.net>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:45:39 -07:00
Gao feng
f6a835bb04 vsock: fix missing cleanup when misc_register failed
reset transport and unlock if misc_register failed.

Signed-off-by: Gao feng <omarapazanadi@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:41:06 -07:00
David S. Miller
10be15ff6c Merge branch 'mv643xx-fixes'
Philipp Kirchhofer says:

====================
net: mv643xx_eth: TSO TX data corruption fixes

as previously discussed [1] the mv643xx_eth driver has some
issues with data corruption when using TCP segmentation offload (TSO).

The following patch set improves this situation by fixing two data
corruption bugs in the TSO TX path.

Before applying the patches repeatedly accessing large files located on
a SMB share on my NSA325 NAS with TSO enabled resulted in different
hash sums, which confirmed that data corruption is happening during
file transfer. After applying the patches the hash sums were the same.

As this is my first patch submission please feel free to point out any
issues with the patch set.

[1] http://thread.gmane.org/gmane.linux.network/336530
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:36:51 -07:00
Philipp Kirchhofer
968200f322 net: mv643xx_eth: Defer writing the first TX descriptor when using TSO
To prevent a race between the TX DMA engine and the CPU the writing of the
first transmit descriptor must be deferred until all following descriptors
have been updated. The network card may otherwise start transmitting before
all packet descriptors are set up correctly, which leads to data corruption
or an aborted transmit operation.

This deferral is already done in the non-TSO TX path, implement it also in
the TSO TX path.

Signed-off-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:36:41 -07:00
Philipp Kirchhofer
91986fd3d3 net: mv643xx_eth: Ensure proper data alignment in TSO TX path
The TX DMA engine requires that buffers with a size of 8 bytes or smaller
must be 64 bit aligned. This requirement may be violated when doing TSO,
as in this case larger skb frags can be broken up and transmitted in small
parts with then inappropriate alignment.

Fix this by checking for proper alignment before handing a buffer to the
DMA engine. If the data is misaligned realign it by copying it into the
TSO header data area.

Signed-off-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 07:36:38 -07:00
Tejun Heo
e27c5b9d23 writeback: remove broken rbtree_postorder_for_each_entry_safe() usage in cgwb_bdi_destroy()
a20135ffbc ("writeback: don't drain bdi_writeback_congested on bdi
destruction") added rbtree_postorder_for_each_entry_safe() which is
used to remove all entries; however, according to Cody, the iterator
isn't safe against operations which may rebalance the tree.  Fix it by
switching to repeatedly removing rb_first() until empty.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Cody P Schafer <dev@codyps.com>
Fixes: a20135ffbc ("writeback: don't drain bdi_writeback_congested on bdi destruction")
Link: http://lkml.kernel.org/g/1443997973-1700-1-git-send-email-dev@codyps.com
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-10-21 08:17:29 -06:00
David S. Miller
f3c9f95056 Merge branch 'smsc-energy-detect'
Heiko Schocher says:

====================
net, phy, smsc: add posibility to disable energy detect mode

On some boards the energy enable detect mode leads in
trouble with some switches, so make the enabling of
this mode configurable through DT.
Therefore the property "smsc,disable-energy-detect" is
introduced.

Patch 1 introduces phy-handle support for the ti,cpsw
driver. This is needed now for the smsc phy.

Patch 2 adds the disable energy mode functionality
to the smsc phy

Changes in v2:
- add comments from Florian Fainelli
  - I did not change disable property name into enable
    because I fear to break existing behaviour
  - add smsc vendor prefix
  - remove CONFIG_OF and use __maybe_unused
  - introduce "phy-handle" ability into ti,cpsw
    driver, so I can remove bogus:
      if (!of_node && dev->parent->of_node)
          of_node = dev->parent->of_node;
    construct. Therefore new patch for the ti,cpsw
    driver is necessary.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 06:41:51 -07:00
Heiko Schocher
d88ecb373b net: phy: smsc: disable energy detect mode
On some boards the energy enable detect mode leads in
trouble with some switches, so make the enabling of
this mode configurable through DT.

Signed-off-by: Heiko Schocher <hs@denx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 06:41:44 -07:00
Heiko Schocher
9e42f71526 drivers: net: cpsw: add phy-handle parsing
add the ability to parse "phy-handle". This
is needed for phys, which have a DT node, and
need to parse DT properties.

Signed-off-by: Heiko Schocher <hs@denx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 06:41:42 -07:00
Simon Arlott
aebd99477f bcm63xx_enet: check 1000BASE-T advertisement configuration
If a gigabit ethernet PHY is connected to a fast ethernet MAC,
then it can detect 1000 support from the partner but not use it.

This results in a forced speed of 1000 and RX/TX failure.

Check for 1000BASE-T support and then check the advertisement
configuration before setting the MAC speed to 1000mbit.

Signed-off-by: Simon Arlott <simon@fire.lp0.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 06:36:38 -07:00
Bard Liao
f8f2dc4a71 ASoC: rt298: fix wrong setting of gpio2_en
The register value to enable gpio2 was incorrect. So fix it.

Signed-off-by: Bard Liao <bardliao@realtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2015-10-21 13:23:43 +01:00
Paul Mackerras
53c656c413 powerpc/powernv: Handle irq_happened flag correctly in off-line loop
This fixes a bug where it is possible for an off-line CPU to fail to go
into a low-power state (nap/sleep/winkle), and to become unresponsive to
requests from the KVM subsystem to wake up and run a VCPU. What can
happen is that a maskable interrupt of some kind (external, decrementer,
hypervisor doorbell, or HMI) after we have called local_irq_disable() at
the beginning of pnv_smp_cpu_kill_self() and before interrupts are
hard-disabled inside power7_nap/sleep/winkle(). In this situation, the
pending event is marked in the irq_happened flag in the PACA. This
pending event prevents power7_nap/sleep/winkle from going to the
requested low-power state; instead they return immediately. We don't
deal with any of these pending event flags in the off-line loop in
pnv_smp_cpu_kill_self() because power7_nap et al. return 0 in this case,
so we will have srr1 == 0, and none of the processing to clear
interrupts or doorbells will be done.

Usually, the most obvious symptom of this is that a KVM guest will fail
with a console message saying "KVM: couldn't grab cpu N".

This fixes the problem by making sure we handle the irq_happened flags
properly. First, we hard-disable before the off-line loop. Once we have
hard-disabled, the irq_happened flags can't change underneath us. We
unconditionally clear the DEC and HMI flags: there is no processing of
timer interrupts while off-line, and the necessary HMI processing is all
done in lower-level code. We leave the EE and DBELL flags alone for the
first iteration of the loop, so that we won't fail to respond to a
split-core request that came in just before hard-disabling. Within the
loop, we handle external interrupts if the EE bit is set in irq_happened
as well as if the low-power state was interrupted by an external
interrupt. (We don't need to do the msgclr for a pending doorbell in
irq_happened, because doorbells are edge-triggered and don't remain
pending in hardware.) Then we clear both the EE and DBELL flags, and
once clear, they cannot be set again (until this CPU comes online again,
that is).

This also fixes the debug check to not be done when we just ran a KVM
guest or when the sleep didn't happen because of a pending event in
irq_happened.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-10-21 20:52:49 +11:00
Paul Mackerras
23316316c1 powerpc: Revert "Use the POWER8 Micro Partition Prefetch Engine in KVM HV on POWER8"
This reverts commit 9678cdaae9 ("Use the POWER8 Micro Partition
Prefetch Engine in KVM HV on POWER8") because the original commit had
multiple, partly self-cancelling bugs, that could cause occasional
memory corruption.

In fact the logmpp instruction was incorrectly using register r0 as the
source of the buffer address and operation code, and depending on what
was in r0, it would either do nothing or corrupt the 64k page pointed to
by r0.

The logmpp instruction encoding and the operation code definitions could
be corrected, but then there is the problem that there is no clearly
defined way to know when the hardware has finished writing to the
buffer.

The original commit attempted to work around this by aborting the
write-out before starting the prefetch, but this is ineffective in the
case where the virtual core is now executing on a different physical
core from the one where the write-out was initiated.

These problems plus advice from the hardware designers not to use the
function (since the measured performance improvement from using the
feature was actually mostly negative), mean that reverting the code is
the best option.

Fixes: 9678cdaae9 ("Use the POWER8 Micro Partition Prefetch Engine in KVM HV on POWER8")
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-10-21 20:50:30 +11:00
Joerg Roedel
393c092a4d iommu/amd: Remove find_last_devid_on_pci()
The value read from the PCI header is not reliable, so
remove this code.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:33 +02:00
Joerg Roedel
226e889b20 iommu/amd: Remove first/last_device handling
The code is buggy and the values read from PCI are not
reliable anyway, so it is the best to just remove this code.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:33 +02:00
Joerg Roedel
d125941698 iommu/amd: Initialize amd_iommu_last_bdf for DEV_ALL
Also initialize the amd_iommu_last_bdf variable when a
IVHD_DEV_ALL entry is found in the ACPI table.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:33 +02:00
Joerg Roedel
f2c2db53b9 iommu/amd: Cleanup buffer allocation
Clean up the functions to allocate the command, event and
ppr-log buffers. Remove redundant code and change the return
value to int.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:33 +02:00
Joerg Roedel
deba4bce16 iommu/amd: Remove cmd_buf_size and evt_buf_size from struct amd_iommu
The driver always uses a constant size for these buffers
anyway, so there is no need to waste memory to store the
sizes.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:33 +02:00
Joerg Roedel
ca9cab3a5a iommu/amd: Align DTE flag definitions
No functional change.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:32 +02:00
Joerg Roedel
61289cbaf6 iommu/amd: Remove old alias handling code
This mostly removes the code to create dev_data structures
for alias device ids. They are not necessary anymore, as
they were only created for device ids which have no struct
pci_dev associated with it.  But these device ids are
handled in a simpler way now, so there is no need for this
code anymore.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:32 +02:00
Joerg Roedel
e25bfb56ea iommu/amd: Set alias DTE in do_attach/do_detach
With this we don't have to create dev_data entries for
non-existent devices (which only exist as request-ids).

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:30:32 +02:00
Joerg Roedel
272e4f99e9 iommu/amd: WARN when __[attach|detach]_device are called with irqs enabled
These functions rely on being called with IRQs disabled. Add
a WARN_ON to detect early when its not.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:29:27 +02:00
Joerg Roedel
f1dd0a8bcd iommu/amd: Don't disable IRQs in __detach_device
This function is already called with IRQs disabled already.
So no need to disable them again.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:29:27 +02:00
Joerg Roedel
150952f969 iommu/amd: Do not iterate over alias-list in __[attach|detach]_device
The alias list is handled aleady by iommu core code. No need
anymore to handle it in this part of the AMD IOMMU code

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:29:27 +02:00
Joerg Roedel
f34c73f55a iommu/amd: Do not BUG_ON in __detach_device()
The condition in the BUG_ON is an indicator of a BUG, but no
reason to kill the code path. Turn it into a WARN_ON and
bail out if it is hit.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:29:26 +02:00
Joerg Roedel
cbf3ccd09d iommu/amd: Don't clear DTE flags when modifying it
During device assignment/deassignment the flags in the DTE
get lost, which might cause spurious faults, for example
when the device tries to access the system management range.
Fix this by not clearing the flags with the rest of the DTE.

Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Tested-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-21 11:29:06 +02:00