summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-12-10dm verity: clean up duplicate hashing codeSami Tolvanen
Handle dm-verity salting in one place to simplify the code. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm btree: factor out need_insert() helperMike Snitzer
Eliminates code duplication within insert(). Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm bufio: use BUG_ON instead of conditional call to BUGAnup Limbu
Signed-off-by: Anup Limbu <anuplimbu14@gmail.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm bufio: store stacktrace in buffers to help find buffer leaksMikulas Patocka
The option DM_DEBUG_BLOCK_STACK_TRACING is moved from persistent-data directory to device mapper directory because it will now be used by persistent-data and bufio. When the option is enabled, each bufio buffer stores the stacktrace of the last dm_bufio_get(), dm_bufio_read() or dm_bufio_new() call that increased the hold count to 1. The buffer's stacktrace is printed if the buffer was not released before the bufio client is destroyed. When DM_DEBUG_BLOCK_STACK_TRACING is enabled, any bufio buffer leaks are considered warnings - i.e. the kernel continues afterwards. If not enabled, buffer leaks are considered BUGs and the kernel with crash. Reasoning on this disposition is: if we only ever warned on buffer leaks users would generally ignore them and the problematic code would never get fixed. Successfully used to find source of bufio leaks fixed with commit fce079f63c3 ("dm btree: fix bufio buffer leaks in dm_btree_del() error path"). Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm bufio: return NULL to improve code clarityMikulas Patocka
A small code cleanup in new_read() - return NULL instead of b (although b is NULL at this point). This function is not returning pointer to the buffer, it is returning a pointer to the bufffer's data, thus it makes no sense to return the variable b. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm block manager: cleanup code that prints stacktraceMikulas Patocka
There is no need to record stack trace and immediately print it. Just use dump_stack() to print the current stack. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm: don't save and restore bi_privateMikulas Patocka
Device mapper used the field bi_private to point to dm_target_io. However, since kernel 3.15, the bi_private field is unused, and so the targets do not need to save and restore this field. This patch removes code that saves and restores bi_private from dm-cache, dm-snapshot and dm-verity. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm thin metadata: make dm_thin_find_mapped_range() atomicJoe Thornber
Refactor dm_thin_find_mapped_range() so that it takes the read lock on the metadata's lock; rather than relying on finer grained locking that is pushed down inside dm_thin_find_next_mapped_block() and dm_thin_find_block(). Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm thin metadata: speed up discard of partially mapped volumesJoe Thornber
Use dm_btree_lookup_next() to more quickly discard partially mapped volumes. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-12-10dm btree: fix bufio buffer leaks in dm_btree_del() error pathJoe Thornber
If dm_btree_del()'s call to push_frame() fails, e.g. due to btree_node_validator finding invalid metadata, the dm_btree_del() error path must unlock all frames (which have active dm-bufio buffers) that were pushed onto the del_stack. Otherwise, dm_bufio_client_destroy() will BUG_ON() because dm-bufio buffers have leaked, e.g.: device-mapper: bufio: leaked buffer 3, hold count 1, list 0 Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-12-10pinctrl: atlas7: add pulse conter pin group without direction pinGuoying Zhang
DR needs use the pulse counter direction pin as common gpio function. Signed-off-by: Guoying Zhang <Guoying.Zhang@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: atlas7: adjust vip pin groups for atlas7Wei Chen
The vip low 8bit mode and vip high 8 bit mode pin groups had missed 3 pins:vip_vsync, vip_hsync and vip_pxclk. Without these 3 pins, the vip could not work properly. Now we add these 3 pins into these two pin groups. Signed-off-by: Wei Chen <Wei.Chen@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: atlas7: adjust pin groups of atlas7 nanddiskWei Chen
Remove write-protect and chip-selector pins from nand pin group. And then create two separate pin groups for these two pin. So the nand driver can choose correct pin groups as board desgin: For example: 1. nand without wp&cs: nand@17050000 { pinctrl-0 = <&nd_df_basic_pmx>; }; 2. nand with wp nand@17050000 { pinctrl-0 = <&nd_df_basic_pmx &nd_df_wp_pmx>; }; 3. nand with cs: nand@17050000 { pinctrl-0 = <&nd_df_basic_pmx &nd_df_cs_pmx>; }; 4. nand with wp&cs: nand@17050000 { pinctrl-0 = <&nd_df_basic_pmx &nd_df_wp_pmx &nd_df_cs_pmx>; }; Signed-off-by: Wei Chen <Wei.Chen@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: altas7: add sd9 function mux supportYonghui Zhang
The sd9 pin mux with sd3 and it is selected by SYS2PCI_SDIO9SEL. This makes the codes ugly since the register is not in pinctrl module. Signed-off-by: Yonghui Zhang <yonghui.zhang@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: atlas7: add cs line for atlas7 nandWei Chen
The nand in atlas7 has two chip select line. But in most time, the nand only has one chip, so only one chip select line is enough. The nand driver select this new pin group can free one chip select line for other modules to avoid pin conflict. Signed-off-by: Wei Chen <Wei.Chen@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: activate pxa architectureRobert Jarzmik
As the pxa architecture, at least for pxa27x, supports pin control, activate it in the pinctrl tree. Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: pxa: add pxa27x architectureRobert Jarzmik
Add the pxa27x architecture, which is a pxa2xx with 128 pins. The registers spacing, and pins logic is common to pxa2xx, only the pins and their alternate function are specific to pxa27x. Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: pxa: pxa2xx: add pin configuration supportRobert Jarzmik
Add pin configuration for pxa2xx architectures. PXA doesn't provide any bias, push, pull capabilities. The only capability is to set a state for the pins when the platform enter sleep or deep sleep mode. The state of a pin is set by : - whether the GPIO direction was input or output - if it is output, a register set programs whether the pin should be held to ground or VccIO Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: pxa: pxa2xx: add pin muxingRobert Jarzmik
The driver is inspired from the sunxi driver. The pxa architecture specificities leading to the driver are : - each pin has 8 possible alternate functions - 4 of these are output kind - 4 of these are input kind - there is always a "gpio input" and "gpio output" function - the function matrix is very scattered : - some functions can be found on 5 different pads - the number of functions is greater than the number of pins - there is no "topology" grouping of pins (such as all SPI in one corner of the die) Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10pinctrl: pxa: pxa2xx: add pin control skeletonRobert Jarzmik
Add a pincontrol driver for pxa2xx architecture, encompassing all pxa25x and pxa27x variants. This is only the pin muxing part of the driver. One specific consideration is also the memory space (MMIO), which is intertwined with the GPIO registers. To make things worse, the GPIO direction register also affect pin muxing, as it chooses the "kind" of pin, ie. the 4 output functions or 4 input functions. The mapping between pinctrl notions and PXA Technical Reference Manual is as follows : - a pin is obviously a pin - a group is also a pin, ie. group P101 is the pin 101 - a mux function is an alternate function (ie. gpio-in, gpio-out, MMCLK, BTRTS, etc ...) The individual architecture (pxa27x, pxa25x) instantiate a pin control by providing a table of pins, each pin being provided a list of PXA_FUNCTION (alternate functions). Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10MAINTAINERS: add to pxa files pinctrlRobert Jarzmik
Add the pinctrl pxa drivers to the pxa maintained files. Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-10Merge branch 'sh-pfc-for-v4.5' of ↵Linus Walleij
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel
2015-12-10netfilter: nfnetlink: avoid recurrent netns lookups in call_batchPablo Neira Ayuso
Pass the net pointer to the call_batch callback functions so we can skip recurrent lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
2015-12-10arm64: don't call C code with el0's fp registerJames Morse
On entry from el0, we save all the registers on the kernel stack, and restore them before returning. x29 remains unchanged when we call out to C code, which will store x29 as the frame-pointer on the stack. Instead, write 0 into x29 after entry from el0, to avoid any risk of tracing into user space. Signed-off-by: James Morse <james.morse@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-12-10arm64: when walking onto the task stack, check sp & fp are in current->stackJames Morse
When unwind_frame() reaches the bottom of the irq_stack, the last fp points to the original task stack. unwind_frame() uses IRQ_STACK_TO_TASK_STACK() to find the sp value. If either values is wrong, we may end up walking a corrupt stack. Check these values are sane by testing if they are both on the stack pointed to by current->stack. Signed-off-by: James Morse <james.morse@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-12-10arm64: Add this_cpu_ptr() assembler macro for use in entry.SJames Morse
irq_stack is a per_cpu variable, that needs to be access from entry.S. Use an assembler macro instead of the unreadable details. Signed-off-by: James Morse <james.morse@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-12-10btrfs: fix misleading warning when space cache failed to loadHolger Hoffstätte
When an inconsistent space cache is detected during loading we log a warning that users frequently mistake as instruction to invalidate the cache manually, even though this is not required. Fix the message to indicate that the cache will be rebuilt automatically. Signed-off-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com> Acked-by: Filipe Manana <fdmanana@suse.com>
2015-12-10drm/i915: Do a better job at disabling primary plane in the noatomic case.Maarten Lankhorst
When disable_noatomic is called plane_mask is not correct yet, and plane_state->visible = true is left as true after disabling the primary plane. Other planes are already disabled as part of crtc sanitization, only the primary is left active. But the plane_mask is not updated here. It gets updated during fb takeover in modeset_gem_init, or set to the new value on resume. This means that to disable the primary plane 1 << drm_plane_index(primary) needs to be used. Afterwards because the crtc is no longer active it's forbidden to keep plane_state->visible set, or a WARN_ON in intel_plane_atomic_calc_changes triggers. There are other code points that rely on accurate plane_state->visible too, so make sure the bool is cleared. The other planes are already disabled in intel_sanitize_crtc, so they don't have to be handled here. Cc: stable@vger.kernel.org #v4.3, v4.2? Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92655 Tested-by: Tomas Mezzadra <tmezzadra@gmail.com> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/5652DB88.9070208@linux.intel.com (cherry picked from commit 54a4196188eab82e6f0a5f05716626e9f18b8fb6) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-10Btrfs: fix transaction handle leak in balanceFilipe Manana
If we fail to allocate a new data chunk, we were jumping to the error path without release the transaction handle we got before. Fix this by always releasing it before doing the jump. Fixes: 2c9fe8355258 ("btrfs: Fix lost-data-profile caused by balance bg") Signed-off-by: Filipe Manana <fdmanana@suse.com>
2015-12-10Btrfs: fix unprotected list move from unused_bgs to deleted_bgs listFilipe Manana
As of my previous change titled "Btrfs: fix scrub preventing unused block groups from being deleted", the following warning at extent-tree.c:btrfs_delete_unused_bgs() can be hit when we mount the a filesysten with "-o discard": 10263 void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info) 10264 { (...) 10405 if (trimming) { 10406 WARN_ON(!list_empty(&block_group->bg_list)); 10407 spin_lock(&trans->transaction->deleted_bgs_lock); 10408 list_move(&block_group->bg_list, 10409 &trans->transaction->deleted_bgs); 10410 spin_unlock(&trans->transaction->deleted_bgs_lock); 10411 btrfs_get_block_group(block_group); 10412 } (...) This happens because scrub can now add back the block group to the list of unused block groups (fs_info->unused_bgs). This is dangerous because we are moving the block group from the unused block groups list to the list of deleted block groups without holding the lock that protects the source list (fs_info->unused_bgs_lock). The following diagram illustrates how this happens: CPU 1 CPU 2 cleaner_kthread() btrfs_delete_unused_bgs() sees bg X in list fs_info->unused_bgs deletes bg X from list fs_info->unused_bgs scrub_enumerate_chunks() searches device tree using its commit root finds device extent for block group X gets block group X from the tree fs_info->block_group_cache_tree (via btrfs_lookup_block_group()) sets bg X to RO (again) scrub_chunk(bg X) sets bg X back to RW mode adds bg X to the list fs_info->unused_bgs again, since it's still unused and currently not in that list sets bg X to RO mode btrfs_remove_chunk(bg X) --> discard is enabled and bg X is in the fs_info->unused_bgs list again so the warning is triggered --> we move it from that list into the transaction's delete_bgs list, but we can have another task currently manipulating the first list (fs_info->unused_bgs) Fix this by using the same lock (fs_info->unused_bgs_lock) to protect both the list of unused block groups and the list of deleted block groups. This makes it safe and there's not much worry for more lock contention, as this lock is seldom used and only the cleaner kthread adds elements to the list of deleted block groups. The warning goes away too, as this was previously an impossible case (and would have been better a BUG_ON/ASSERT) but it's not impossible anymore. Reproduced with fstest btrfs/073 (using MOUNT_OPTIONS="-o discard"). Signed-off-by: Filipe Manana <fdmanana@suse.com>
2015-12-10rfkill: copy the name into the rfkill structJohannes Berg
Some users of rfkill, like NFC and cfg80211, use a dynamic name when allocating rfkill, in those cases dev_name(). Therefore, the pointer passed to rfkill_alloc() might not be valid forever, I specifically found the case that the rfkill name was quite obviously an invalid pointer (or at least garbage) when the wiphy had been renamed. Fix this by making a copy of the rfkill name in rfkill_alloc(). Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-10Merge tag 'perf-core-for-mingo' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes: User visible changes: - Change default selection TUI background color to yellow (Ingo Molnar) Infrastructure changes: - Start paving the way to reuse some cmdline functions with other tools/ living utilities (Josh Poimboeuf) - Reference count fixes using the refcount debugger, unleaking some objects (Masami Hiramatsu) Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-12-10dmaengine: at_xdmac: fix at_xdmac_prep_dma_memcpy()Cyrille Pitchen
This patch fixes at_xdmac_prep_dma_memcpy(). Indeed the data width field of the Channel Configuration register was not updated properly in the loop: the bits of the dwidth field were not cleared before adding their new value. Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com> Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com> Fixes: e1f7c9eee70 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Cc: stable@vger.kernel.org #4.1 and later Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-12-10Merge branch 'fix/edma' into fixesVinod Koul
2015-12-10dmaengine: edma: DT: Change reserved slot array from 16bit to 32bit typePeter Ujfalusi
This change makes the DT file to be easier to read since the reserved slots array does not need the '/bits/ 16' to be specified, which might confuse some people. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Rob Herring <robh@kernel.org> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-12-10dmaengine: edma: DT: Change memcpy channel array from 16bit to 32bit typePeter Ujfalusi
This change makes the DT file to be easier to read since the memcpy channels array does not need the '/bits/ 16' to be specified, which might confuse some people. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Rob Herring <robh@kernel.org> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-12-09Merge tag 'vfio-v4.4-rc5' of git://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO fixes from Alex Williamson: - Various fixes for removing redundancy, const'ifying structs, avoiding stack usage, fixing WARN usage (Krzysztof Kozlowski, Julia Lawall, Kees Cook, Dan Carpenter) - Revert No-IOMMU mode as the intended user has not emerged (Alex Williamson) * tag 'vfio-v4.4-rc5' of git://github.com/awilliam/linux-vfio: Revert: "vfio: Include No-IOMMU mode" vfio: fix a warning message vfio: platform: remove needless stack usage vfio-pci: constify pci_error_handlers structures vfio: Drop owner assignment from platform_driver
2015-12-09ARM: dts: am4372: fix clock source for arm twd and global timersGrygorii Strashko
ARM TWD and Global timer are clocked by PERIPHCLK which is MPU_CLK/2. But now they are clocked by dpll_mpu_m2_ck == MPU_CLK and, as result. Timekeeping core misbehaves. For example, execution of command "sleep 5" will take 10 sec instead of 5. Hence, fix it by adding mpu_periphclk ("fixed-factor-clock") and use it for clocking ARM TWD and Global timer (same way as on OMAP4). Cc: Tony Lindgren <tony@atomide.com> Cc: Felipe Balbi <balbi@ti.com> Cc: Tero Kristo <t-kristo@ti.com> Fixes:commit 8cbd4c2f6a99 ("arm: boot: dts: am4372: add ARM timers and SCU nodes") Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Reviewed-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2015-12-09Merge tag 'devicetree-fixes-for-4.4-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull DT fixes from Rob Herring: "I think this should be all for 4.4: - Fix incorrect warning about overlapping memory regions - Export of_irq_find_parent again which was made static in 4.4, but has users pending for 4.5. - Fix of_msi_map_rid declaration location - Fix re-entrancy for of_fdt_unflatten_tree - Clean-up of phys_addr_t printks" * tag 'devicetree-fixes-for-4.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/irq: move of_msi_map_rid declaration to the correct ifdef section of/irq: Export of_irq_find_parent again of/fdt: Add mutex protection for calls to __unflatten_device_tree() of/address: fix typo in comment block of of_translate_one() of: do not use 0x in front of %pa of: Fix comparison of reserved memory regions
2015-12-10PM / Domains: Allow runtime PM callbacks to be re-used during system PMUlf Hansson
A runtime PM centric subsystem/driver may typically use the runtime PM helpers, pm_runtime_force_suspend|resume() in the system PM path. This means the genpd's runtime PM callbacks might be invoked even when runtime PM has been disabled for the device. To properly cope with these and similar scenarios when these helper functions are used, change genpd to skip validating and measuring the device PM QOS latency. This is needed because otherwise genpd may prevent the device to be put into low power state. If this occurs during system PM, it causes the sequence to be aborted as a device's system PM callback returns -EBUSY. Fixes: ba2bbfbf6307 (PM / Domains: Remove intermediate states from the power off sequence) Reported-by: Cao Minh Hiep <cm-hiep@jinso.co.jp> Reported-by: Harunaga <nx-truong@jinso.co.jp> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Cc: 4.3+ <stable@vger.kernel.org> # 4.3+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-09Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "One small build fix, a couple do_div() fixes, and a fix for the gpio basic clock type are the major changes here. There's also a couple fixes for the TI, sunxi, and scpi clock drivers" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi: pll2: Fix clock running too fast clk: scpi: add missing of_node_put clk: qoriq: fix memory leak imx/clk-pllv2: fix wrong do_div() usage imx/clk-pllv1: fix wrong do_div() usage clk: mmp: add linux/clk.h includes clk: ti: drop locking code from mux/divider drivers clk: ti816x: Add missing dmtimer clkdev entries clk: ti: fapll: fix wrong do_div() usage clk: ti: clkt_dpll: fix wrong do_div() usage clk: gpio: Get parent clk names in of_gpio_clk_setup()
2015-12-10KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSRPaul Mackerras
Currently it is possible for userspace (e.g. QEMU) to set a value for the MSR for a guest VCPU which has both of the TS bits set, which is an illegal combination. The result of this is that when we execute a hrfid (hypervisor return from interrupt doubleword) instruction to enter the guest, the CPU will take a TM Bad Thing type of program interrupt (vector 0x700). Now, if PR KVM is configured in the kernel along with HV KVM, we actually handle this without crashing the host or giving hypervisor privilege to the guest; instead what happens is that we deliver a program interrupt to the guest, with SRR0 reflecting the address of the hrfid instruction and SRR1 containing the MSR value at that point. If PR KVM is not configured in the kernel, then we try to run the host's program interrupt handler with the MMU set to the guest context, which almost certainly causes a host crash. This closes the hole by making kvmppc_set_msr_hv() check for the illegal combination and force the TS field to a safe value (00, meaning non-transactional). Cc: stable@vger.kernel.org # v3.9+ Signed-off-by: Paul Mackerras <paulus@samba.org>
2015-12-09ASoC: es8328: Fix deemphasis valuesJohn Keeping
This is using completely the wrong mask and value when updating the register. Since the correct values are already defined in the header, switch to using a table with explicit constants rather than shifting the array index. Signed-off-by: John Keeping <john@metanate.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-12-09regmap: cache: Add 64-bit mode supportXiubo Li
Since the mmio has support the 64-bit has been supported for the 64-bit platform, so should the regcache core too. Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-12-09regmap: cache: To suppress the noise of checkpatchXiubo Li
There will be some warning like the following when checking new patches near this code: "WARNING: Missing a blank line after declarations" This patch will suppress this warning. Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-12-09Merge tag 'for-linus-4.4-1' of git://git.code.sf.net/p/openipmi/linux-ipmiLinus Torvalds
Pull IPMI fix from Corey Minyard: "Fix an Oops if an interrupt occurs at startup. This can happen on some hardware" * tag 'for-linus-4.4-1' of git://git.code.sf.net/p/openipmi/linux-ipmi: ipmi: move timer init to before irq is setup
2015-12-09ipmi: move timer init to before irq is setupJan Stancek
We encountered a panic on boot in ipmi_si on a dell per320 due to an uninitialized timer as follows. static int smi_start_processing(void *send_info, ipmi_smi_t intf) { /* Try to claim any interrupts. */ if (new_smi->irq_setup) new_smi->irq_setup(new_smi); --> IRQ arrives here and irq handler tries to modify uninitialized timer which triggers BUG_ON(!timer->function) in __mod_timer(). Call Trace: <IRQ> [<ffffffffa0532617>] start_new_msg+0x47/0x80 [ipmi_si] [<ffffffffa053269e>] start_check_enables+0x4e/0x60 [ipmi_si] [<ffffffffa0532bd8>] smi_event_handler+0x1e8/0x640 [ipmi_si] [<ffffffff810f5584>] ? __rcu_process_callbacks+0x54/0x350 [<ffffffffa053327c>] si_irq_handler+0x3c/0x60 [ipmi_si] [<ffffffff810efaf0>] handle_IRQ_event+0x60/0x170 [<ffffffff810f245e>] handle_edge_irq+0xde/0x180 [<ffffffff8100fc59>] handle_irq+0x49/0xa0 [<ffffffff8154643c>] do_IRQ+0x6c/0xf0 [<ffffffff8100ba53>] ret_from_intr+0x0/0x11 /* Set up the timer that drives the interface. */ setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi); The following patch fixes the problem. To: Openipmi-developer@lists.sourceforge.net To: Corey Minyard <minyard@acm.org> CC: linux-kernel@vger.kernel.org Signed-off-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Tony Camuso <tcamuso@redhat.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org # Applies cleanly to 3.10-, needs small rework before
2015-12-09bitops.h: correctly handle rol32 with 0 byte shiftSasha Levin
ROL on a 32 bit integer with a shift of 32 or more is undefined and the result is arch-dependent. Avoid this by handling the trivial case of roling by 0 correctly. The trivial solution of checking if shift is 0 breaks gcc's detection of this code as a ROL instruction, which is unacceptable. This bug was reported and fixed in GCC (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157): The standard rotate idiom, (x << n) | (x >> (32 - n)) is recognized by gcc (for concreteness, I discuss only the case that x is an uint32_t here). However, this is portable C only for n in the range 0 < n < 32. For n == 0, we get x >> 32 which gives undefined behaviour according to the C standard (6.5.7, Bitwise shift operators). To portably support n == 0, one has to write the rotate as something like (x << n) | (x >> ((-n) & 31)) And this is apparently not recognized by gcc. Note that this is broken on older GCCs and will result in slower ROL. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-12-09dm space map metadata: fix ref counting bug when bootstrapping a new space mapJoe Thornber
When applying block operations (BOPs) do not remove them from the uncommitted BOP ring-buffer until after they've been applied -- in case we recurse. Also, perform BOP_INC operation, in dm_sm_metadata_create() and sm_metadata_extend(), in terms of the uncommitted BOP ring-buffer rather than using direct calls to sm_ll_inc(). Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-12-09dm thin metadata: fix bug when taking a metadata snapshotJoe Thornber
When you take a metadata snapshot the btree roots for the mapping and details tree need to have their reference counts incremented so they persist for the lifetime of the metadata snap. The roots being incremented were those currently written in the superblock, which could possibly be out of date if concurrent IO is triggering new mappings, breaking of sharing, etc. Fix this by performing a commit with the metadata lock held while taking a metadata snapshot. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org