Commit Graph

648766 Commits

Author SHA1 Message Date
OGAWA Hirofumi 1c111b6c38 xhci: Fix race related to abort operation
Current abort operation has race.

    xhci_handle_command_timeout()
      xhci_abort_cmd_ring()
        xhci_write_64(CMD_RING_ABORT)
        xhci_handshake(5s)
	  do {
	    check CMD_RING_RUNNING
            udelay(1)
					 ...
					 COMP_CMD_ABORT event
					 COMP_CMD_STOP event
					 xhci_handle_stopped_cmd_ring()
					   restart cmd_ring
                                           CMD_RING_RUNNING become 1 again
	  } while ()
          return -ETIMEDOUT
        xhci_write_64(CMD_RING_ABORT)
        /* can abort random command */

To do abort operation correctly, we have to wait both of COMP_CMD_STOP
event and negation of CMD_RING_RUNNING.

But like above, while timeout handler is waiting negation of
CMD_RING_RUNNING, event handler can restart cmd_ring. So timeout
handler never be notice negation of CMD_RING_RUNNING, and retry of
CMD_RING_ABORT can abort random command (BTW, I guess retry of
CMD_RING_ABORT was workaround of this race).

To fix this race, this moves xhci_handle_stopped_cmd_ring() to
xhci_abort_cmd_ring().  And timeout handler waits COMP_CMD_STOP event.

At this point, timeout handler is owner of cmd_ring, and safely
restart cmd_ring by using xhci_handle_stopped_cmd_ring().

[FWIW, as bonus, this way would be easily extend to add CMD_RING_PAUSE
operation]

[locks edited as patch is rebased on other locking fixes -Mathias]
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
OGAWA Hirofumi cb4d5ce588 xhci: Use delayed_work instead of timer for command timeout
This is preparation to fix abort operation race (See "xhci: Fix race
related to abort operation"). To make timeout sleepable, use
delayed_work instead of timer.

[change a newly added pending timer fix to pending work -Mathias]
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Lu Baolu 4dea70778c usb: xhci: hold lock over xhci_abort_cmd_ring()
In command timer function, xhci_handle_command_timeout(), xhci->lock
is unlocked before call into xhci_abort_cmd_ring(). This might cause
race between the timer function and the event handler.

The xhci_abort_cmd_ring() function sets the CMD_RING_ABORT bit in the
command register and polling it until the setting takes effect. A stop
command ring event might be handled between writing the abort bit and
polling for it. The event handler will restart the command ring, which
causes the failure of polling, and we ever believed that we failed to
stop it.

As a bonus, this also fixes some issues of calling functions without
locking in xhci_handle_command_timeout().

Cc: <stable@vger.kernel.org> # 3.7+
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Mathias Nyman a5a1b95141 xhci: Handle command completion and timeout race
If we get a command completion event at the same time as the command
timeout work starts on another cpu we might end up aborting the wrong
command.

If the command completion takes the xhci lock before the timeout work, it
will handle the command, pick the next command, mark it as current_cmd, and
re-queue the timeout work. When the timeout work finally gets the lock
It will start aborting the wrong command.

This case can be resolved by checking if the timeout work is pending inside
the timeout function itself. A new timeout work can only be pending if the
command completed and a new command was queued.

If there are no more commands pending then command completion will set
the current_cmd to NULL, which is already handled in the timeout work.

Cc: <stable@vger.kernel.org>
Reported-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Baolin Wang 2a7cfdf37b usb: host: xhci: Fix possible wild pointer when handling abort command
When current command was supposed to be aborted, host will free the command
in handle_cmd_completion() function. But it might be still referenced by
xhci->current_cmd, which need to set NULL.

Cc: <stable@vger.kernel.org>
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Lu Baolu 2b98546737 usb: xhci: fix possible wild pointer
handle_cmd_completion() frees a command structure which might be still
referenced by xhci->current_cmd.
This might cause problem when xhci->current_cmd is accessed after that.

A real-life case could be like this. The host takes a very long time to
respond to a command, and the command timer is fired at the same time
when the command completion event arrives. The command completion
handler frees xhci->current_cmd before the timer function can grab
xhci->lock. Afterward, timer function grabs the lock and go ahead with
checking and setting members of xhci->current_cmd.

Cc: <stable@vger.kernel.org> # v3.16+
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Pan Bian 28bedb5ae4 usb: return error code when platform_get_irq fails
In function xhci_mtk_probe(), variable ret takes the return value. Its
value should be negative on failures. However, when the call to function
platform_get_irq() fails, it does not set the error code, and 0 will be
returned. 0 indicates no error. As a result, the callers of function
xhci_mtk_probe() will not be able to detect the error. This patch fixes
the bug by assigning the return value of platform_get_irq() to variable
ret if it fails.

CC: <stable@vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Lu Baolu 90797aee5d usb: xhci: fix return value of xhci_setup_device()
xhci_setup_device() should return failure with correct error number
when xhci host has died, removed or halted.

During usb device enumeration, if usb host is not accessible (died,
removed or halted), the hc_driver->address_device() should return
a corresponding error code to usb core. But current xhci driver just
returns success. This misleads usb core to continue the enumeration
by reading the device descriptor, which will result in failure, and
users will get a misleading message like "device descriptor read/8,
error -110".

Cc: <stable@vger.kernel.org> # v4.3+
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Mathias Nyman ee8665e28e xhci: free xhci virtual devices with leaf nodes first
the tt_info provided by a HS hub might be in use to by a child device
Make sure we free the devices in the correct order.

This is needed in special cases such as when xhci controller is
reset when resuming from hibernate, and all virt_devices are freed.

Also free the virt_devices starting from max slot_id as children
more commonly have higher slot_id than parent.

CC: <stable@vger.kernel.org>
Reported-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:37:32 +01:00
Florian Fainelli e7c9a3d9e4 staging: octeon: Call SET_NETDEV_DEV()
The Octeon driver calls into PHYLIB which now checks for
net_device->dev.parent, so make sure we do set it before calling into
any MDIO/PHYLIB related function.

Fixes: ec988ad78e ("phy: Don't increment MDIO bus refcount unless it's a different owner")
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: stable <stable@vger.kernel.org>  # 4.9+
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-03 17:11:50 +01:00
Reiter Wolfgang 3b48ab2248 drop_monitor: consider inserted data in genlmsg_end
Final nlmsg_len field update must reflect inserted net_dm_drop_point
data.

This patch depends on previous patch:
"drop_monitor: add missing call to genlmsg_end"

Signed-off-by: Reiter Wolfgang <wr0112358@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 11:09:44 -05:00
Sabrina Dubroca 096de2f83e benet: stricter vxlan offloading check in be_features_check
When VXLAN offloading is enabled, be_features_check() tries to check if
an encapsulated packet is indeed a VXLAN packet. The check is not strict
enough, and considers any UDP-encapsulated ethernet frame with a 8-byte
tunnel header as being VXLAN. Unfortunately, both GENEVE and VXLAN-GPE
have a 8-byte header, so they get through this check.

Force the UDP destination port to be the one that has been offloaded to
hardware.

Without this, GENEVE-encapsulated packets can end up having an incorrect
checksum when both a GENEVE and a VXLAN (offloaded) tunnel are
configured.

This is similar to commit a547224dce ("mlx4e: Do not attempt to
offload VXLAN ports that are unrecognized").

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 10:58:43 -05:00
Alexander Duyck 5350d54f6c ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules
In the case of custom rules being present we need to handle the case of the
LOCAL table being intialized after the new rule has been added.  To address
that I am adding a new check so that we can make certain we don't use an
alias of MAIN for LOCAL when allocating a new table.

Fixes: 0ddcf43d5d ("ipv4: FIB Local/MAIN table collapse")
Reported-by: Oliver Brunel <jjk@jjacky.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:38:34 -05:00
Bartosz Folta 515028fe29 net: macb: Updated resource allocation function calls to new version of API.
Changed function calls of resource allocation to new API. Changed way
of setting DMA mask. Removed unnecessary sanity check.
This patch is sent in regard to recently applied patch
Commit 83a77e9ec4
net: macb: Added PCI wrapper for Platform Driver.

Signed-off-by: Bartosz Folta <bfolta@cadence.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:35:42 -05:00
David S. Miller a2962b08f4 Merge branch 'dwmac-oxnas-leaks'
Johan Hovold says:

====================
net: stmmac: dwmac-oxnas: fix leaks and simplify pm

These patches fixes of-node and fixed-phydev leaks in the recently added
dwmac-oxnas driver, and ultimately switches over to using the generic pm
implementation as the required callbacks are now in place.

Note that this series has only been compile tested.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:33:00 -05:00
Johan Hovold a8de4d719d net: stmmac: dwmac-oxnas: use generic pm implementation
Now that we have an exit callback in place, add init as well and get rid
of the custom PM callbacks in favour of the generic ones.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:33:00 -05:00
Johan Hovold 6b4c212b95 net: stmmac: dwmac-oxnas: fix fixed-link-phydev leaks
Make sure to deregister and free any fixed-link phy registered during
probe on probe errors and on driver unbind by calling the new glue
helper function.

For driver unbind, use the generic stmmac-platform remove implementation
and add an exit callback to disable the clock.

Fixes: 5ed7414062 ("net: stmmac: Add OXNAS Glue Driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:33:00 -05:00
Johan Hovold 8f87e626b0 net: stmmac: dwmac-oxnas: fix of-node leak
Use the syscon lookup-by-phandle helper so that the reference taken by
of_parse_phandle() is released when done with the node.

Fixes: 5ed7414062 ("net: stmmac: Add OXNAS Glue Driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-03 09:33:00 -05:00
Ander Conselvan de Oliveira 0bf0230ea1 drm/i915: Initialize num_scalers for skl and glk too
After commit 1c74eeaf16 ("drm/i915: Move number of scalers initialization to
runtime init"), scalers are not initialized properly for skl and glk
since num_scalers is left as 0 for those platforms.

Fixes: 1c74eeaf16 ("drm/i915: Move number of scalers initialization to runtime init")
Cc: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk> (v2)
Cc: Ander Conselvan de Oliveira <conselvan2@gmail.com>
Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1483365281-10569-1-git-send-email-ander.conselvan.de.oliveira@intel.com
2017-01-03 15:39:59 +02:00
Shyam Saini f9751a60f1 xen: events: Replace BUG() with BUG_ON()
Replace BUG() with BUG_ON() using coccinelle

Signed-off-by: Shyam Saini <mayhs11saini@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
2017-01-03 14:37:39 +01:00
Greg Kroah-Hartman 8d6bbff677 usb: fixes for v4.10-rc3
The first set of fixes for v4.10-rc cycle. The most
 important of which is a big regression on dwc3-pci
 which prevents it from probing altogether.
 
 There's also a fix to avoid Overflow events on DWC3
 and another to make sure we don't starve DMA
 resources.
 
 Dummy HCD got some love after a long hiatus and DWC2
 got a couple fixes related to DMA usage. Other than
 these, we have a set of minor fixes here and there.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCAA7FiEElLzh7wn96CXwjh2IzL64meEamQYFAlhrnosdHGZlbGlwZS5i
 YWxiaUBsaW51eC5pbnRlbC5jb20ACgkQzL64meEamQZY6RAAnqW8t07zI8yjOvTD
 fMfob/ur54pIDzRxnCWMMQQmbnIWvpgE70s3OBBGog5GswOTfXP2OcKuMHkcbr89
 o66ANwITps41irHXNJG+NX3be3ChjbiqgOcxagfClPMuFDE+kkLNb31DyFXwP0u3
 UvP26js00LMpQ0TsesA+nWYbe0IEDC62eSTGKDee6Z+5DBIFXJGUC1cSI9VvD73b
 1u5Phtc4dsTnlNkbhMgdPChuNznD9TJTopsChUG5wZKu+jbUE+rgenPLhd7i+LS2
 8mqnnAqv80iiWB+Dz/MqsZH7iJmJiM2c5w7DduYnlRiVJAmWw3rPt22rSnywEfnb
 o2G4ptvZSWPLv/cnHt81i7BATdxpQSUEHtziZjQcCtaIEYYxpj2KXXeurANfS5Vw
 FK8eYFk5Ho53h1q0xPPOwc9uafxqWcbT69HHwdSHSYCqQT0rZsAQbKyDb+r7UtwS
 pWK8VEFK/mhNn/a2c3AzZWIk3vLpmL4/YppaBpzZO44K/1v9nLNX07eOSJq9Br2B
 Lp0eW+ZT0QBXAqodT54QWCRVG0YZX9iDU78R8Ru/7ahUmJ4KJZLDGuF4tGwyvMWk
 1wVAFnNrwT1i4OKL+KNFlm8OGSeMeuxNcQVxjVCbMAjFbG95dfqETIIBiAb2QgNF
 xAM71aAUJ8vyTQvEmA9BZpb15Jo=
 =uEVv
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v4.10-rc3

The first set of fixes for v4.10-rc cycle. The most
important of which is a big regression on dwc3-pci
which prevents it from probing altogether.

There's also a fix to avoid Overflow events on DWC3
and another to make sure we don't starve DMA
resources.

Dummy HCD got some love after a long hiatus and DWC2
got a couple fixes related to DMA usage. Other than
these, we have a set of minor fixes here and there.
2017-01-03 14:07:14 +01:00
David Lechner 43aef5c2ca usb: gadget: Fix copy/pasted error message
This fixes an error message that was probably copied and pasted. The same
message is used for both the in and out endpoints, so it makes it impossible
to know which one actually failed because both cases say "IN".

Make the out endpoint error message say "OUT".

Signed-off-by: David Lechner <david@lechnology.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-01-03 14:33:59 +02:00
Roger Quadros 9418ee15f7 usb: dwc3: gadget: Fix full speed mode
DCFG.DEVSPD == 0x3 is not valid and we need to set
DCFG.DEVSPD to 0x1 for full speed mode. Same goes for
DSTS.CONNECTSPD.

Old databooks had 0x3 for full speed in 48MHz mode for
USB1.1 transceivers which was never supported. Newer databooks
don't mention 0x3 at all.

Cc: John Youn <John.Youn@synopsys.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-01-03 14:33:48 +02:00
Chris Wilson c9efef7bd9 drm/i915: Update comment in vlv_set_rps_idle()
Ville explained that the wakelock was being acquired during set-idle in
order to flush the voltage change from the punit.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170102152845.32352-1-chris@chris-wilson.co.uk
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
2017-01-03 12:05:32 +00:00
Takashi Sakamoto 6b7e95d133 ALSA: firewire-lib: change structure member with proper type
The 'amdtp_stream' structure is initialized by a call of
'amdtp_stream_init()'. Although a parameter of this function is for bit
flags of packet attributes, its type is enumerator.

This commit changes the type so that it's proper for a bit flags.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-01-03 11:37:10 +01:00
Takashi Sakamoto 6a2a2f4556 ALSA: firewire-tascam: Fix to handle error from initialization of stream data
This module has a bug not to return error code in a case that data
structure for transmitted packets fails to be initialized.

This commit fixes the bug.

Fixes: 35efa5c489 ("ALSA: firewire-tascam: add streaming functionality")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-01-03 11:36:34 +01:00
Takashi Sakamoto e2eb31d721 ALSA: fireworks: fix asymmetric API call at unit removal
ALSA fireworks driver has a bug not to call an API to destroy
'cmp_connection' structure for input direction. Currently this causes no
issues because it just destroys 'mutex' structure, while it's better to
fix it for future work.

Fix: d23c2cc448 ("ALSA: fireworks/bebob/dice/oxfw: allow stream destructor after releasing runtime")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-01-03 11:36:13 +01:00
Michal Wajdeczko bae3fdce06 drm/i915/guc: Make intel_guc_recv static.
This function is only used by intel_guc_send() and it doesn't
need to be exposed outside of intel_uc.o file. Also when defined
as static, compiler will generate smaller code. Additionally let
it take guc param instead dev_priv to match function name.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161220115531.76120-1-michal.wajdeczko@intel.com
2017-01-03 10:16:12 +00:00
Chris Wilson 2471eb5fb6 drm/i915: Prevent timeline updates whilst performing reset
As the fence may be signaled concurrently from an interrupt on another
device, it is possible for the list of requests on the timeline to be
modified as we walk it. Take both (the context's timeline and the global
timeline) locks to prevent such modifications.

Fixes: 80b204bce8 ("drm/i915: Enable multiple timelines")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: <drm-intel-fixes@lists.freedesktop.org>
Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161223145804.6605-10-chris@chris-wilson.co.uk
(cherry picked from commit 00c25e3f40)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:57 +02:00
Chris Wilson 64d1461ce0 drm/i915: Silence allocation failure during sg_trim()
As trimming the sg table is merely an optimisation that gracefully fails
if we cannot allocate a new table, we do not need to report the failure
either.

Fixes: 0c40ce130e ("drm/i915: Trim the object sg table")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161223145804.6605-4-chris@chris-wilson.co.uk
(cherry picked from commit 8bfc478fa4)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:48 +02:00
Chris Wilson c3f923b554 drm/i915: Don't clflush before release phys object
When we teardown the backing storage for the phys object, we copy from
the coherent contiguous block back to the shmemfs object, clflushing as
we go. Trying to clflush the invalid sg beforehand just oops and would
be redundant (due to it already being coherent, and clflushed
afterwards).

Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: <drm-intel-fixes@lists.freedesktop.org>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161223145804.6605-3-chris@chris-wilson.co.uk
(cherry picked from commit e5facdf964)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:38 +02:00
Ville Syrjälä 9169757ae6 drm/i915: Fix oops in overlay due to frontbuffer tracking
The vma will be NULL if the overlay was previously off, so
dereferencing it will oops. Check for NULL before doing that.

Cc: stable@vger.kernel.org
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Fixes: 9b3b7841b8 ("drm/i915/overlay: Use VMA as the primary tracker for images")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1481131693-27993-2-git-send-email-ville.syrjala@linux.intel.com
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
(cherry picked from commit 4a15cdbbc5)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:28 +02:00
Ville Syrjälä b72eb5ffa6 drm/i915: Fix oopses in the overlay code due to i915_gem_active stuff
The i915_gem_active stuff doesn't like a NULL ->retire hook, but
the overlay code can set it to NULL. That obviously ends up oopsing.
Fix it by introducing a new helper to assign the retirement callback
that will switch out the NULL function pointer with
i915_gem_retire_noop.

Cc: stable@vger.kernel.org
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Fixes: 0d9bdd886f ("drm/i915: Convert intel_overlay to request tracking")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20161207175647.10018-1-chris@chris-wilson.co.uk
(cherry picked from commit ecd9caa052)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:17 +02:00
Ville Syrjälä a6d3e7d35d drm/i915: Initialize overlay->last_flip properly
Initialize overlay->last_flip properly instead of leaving it zeroed.

Cc: stable@vger.kernel.org
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Fixes: 0d9bdd886f ("drm/i915: Convert intel_overlay to request tracking")
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161221144547.27319-1-ville.syrjala@linux.intel.com
(cherry picked from commit 330afdb1df)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:41:05 +02:00
Ville Syrjälä 00b2b72882 drm/i915: Move the min_pixclk[] handling to the end of readout
Trying to determine the pixel rate of the pipe can't be done until we
know the clock, which means it can't be done until the encoder
.get_config() hooks have been called. So let's move the min_pixclk[]
stuff to the end of intel_modeset_readout_hw_state() when we actually
have gathered all the required infromation.

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Fixes: 565602d750 ("drm/i915: Do not acquire crtc state to check clock during modeset, v4.")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161220153902.15621-1-ville.syrjala@linux.intel.com
Reviewed-by: Ander Conselvan de Oliveira <conselvan2@gmail.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
(cherry picked from commit aca1ebf491)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:37:01 +02:00
Ville Syrjälä 8581f1b5ee drm/i915: Force VDD off on the new power seqeuencer before starting to use it
Apparently some VLV BIOSen like to leave the VDD force bit enabled
even for power seqeuncers that aren't properly hooked up to any
port. That will result in a imbalance in the AUX power domain
refcount when we stat to use said power sequencer as edp_panel_vdd_on()
will not grab the power domain reference if it sees that the VDD is
already on.

To fix this let's make sure we turn off the VDD force bit when we
initialize the power sequencer registers. That is, unless it's
being done from the init path since there we are actually
initializing the registers for the current power sequencer and
we don't want to turn VDD off needlessly as that would require
waiting for the power cycle delay before we turn it back on.

This fixes the following kind of warnings:
WARNING: CPU: 0 PID: 123 at ../drivers/gpu/drm/i915/intel_runtime_pm.c:1455 intel_display_power_put+0x13a/0x170 [i915]()
WARN_ON(!power_domains->domain_use_count[domain])
...

v2: Fix typos in comment (David)

Cc: stable@vger.kernel.org
Cc: Matwey V. Kornilov <matwey.kornilov@gmail.com>
Tested-by: Matwey V. Kornilov <matwey.kornilov@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98695
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161220165117.24801-1-ville.syrjala@linux.intel.com
Reviewed-by: David Weinehall <david.weinehall@linux.intel.com>
(cherry picked from commit 5d5ab2d26f)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2017-01-03 11:36:11 +02:00
Fabio Estevam 116dad7d43 ARM: dts: imx6: Disable "weim" node in the dtsi files
Commit 1be81ea586 ("ARM: dts: imx6: Add imx-weim parameters to
dtsi's") causes the following probe error when the weim node is not
present on the board dts (such as imx6q-sabresd):

imx-weim 21b8000.weim: Invalid 'ranges' configuration
imx-weim: probe of 21b8000.weim failed with error -22

There is no need to always enable the "weim" node on mx6. Do the same
as in the other i.MX dtsi files where "weim" is disabled and only gets
enabled on a per dts basis.

All the imx6 weim dts users explicitily provide 'status = "okay"', so
this change has no impact on current imx6 weim users.

If a board does not use the weim driver it will not describe its 'ranges'
property, so simply disable the 'weim' node in the imx6 dtsi files to
avoid such probe error message.

Fixes: 1be81ea586 ("ARM: dts: imx6: Add imx-weim parameters to dtsi's")
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2017-01-03 10:59:07 +08:00
Linus Torvalds c8b4ec8351 Two fscrypt bug fixes, one of which was unmasked by an update to the
crypto tree during the merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAlhrCIIACgkQ8vlZVpUN
 gaP0rAf8DehnxAXTdGwCDKJ76Xgkd4C0vYwNYsWrwbEsD6dMXPmfhDVA40ZefFWY
 4UQaPeoDSXQnIxw+6gi6LFCJeYs+dc9ZWHk++w5kEMclIUONomODDAQLMJbpG+5t
 pkEwOzjTaKbIQ5n4r3rMJtlBlrZX+ZVJmMt3sYAMWhIq7Bf7dRy6AC7+vyM5VTce
 AYvFpureLd7pJT0AcNvg5oPnXIFiPlKi6knlmAdJ32I4FQQO07aDA37mLPKdff4/
 uKs4PGKTa9MCGw+blMDJ/208kBQPPn8JZ7yGQCdGw16CUaoSXLregqu6SNs2MKaQ
 WjmBFyEUssScTeAq8rYJVlU7FYxwdQ==
 =VVfb
 -----END PGP SIGNATURE-----

Merge tag 'fscrypt-for-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt

Pull fscrypt fixes from Ted Ts'o:
 "Two fscrypt bug fixes, one of which was unmasked by an update to the
  crypto tree during the merge window"

* tag 'fscrypt-for-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt:
  fscrypt: fix renaming and linking special files
  fscrypt: fix the test_dummy_encryption mount option
2017-01-02 18:32:59 -08:00
Chanwoo Choi 32dd773169 PM / devfreq: exynos-bus: Fix the wrong return value
This patch fixes the wrong return value. If devfreq driver requires the wrong
and non-available governor, it is fail. So, this patch returns the error
insead of -EPROBE_DEFER.

Fixes: 403e0689d2 (PM / devfreq: exynos: Add support of bus frequency of sub-blocks using passive governor)
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-01-03 00:21:45 +01:00
Chanwoo Choi 73613b16cb PM / devfreq: Fix the bug of devfreq_add_device when governor is NULL
This patch fixes the bug of devfreq_add_device(). The devfreq device must
have the default governor. If find_devfreq_governor() returns error,
devfreq_add_device() fail to add the devfreq instance.

Fixes: 1b5c1be2c8 (PM / devfreq: map devfreq drivers to governor using name)
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-01-03 00:21:45 +01:00
Chanwoo Choi 9932ef3ca7 MAINTAINERS: Add myself as reviewer for DEVFREQ subsystem support
Add myself to the DEVFREQ entry as reviewer, I've been helping reviewing
and tesing the devfreq support patches for the couple of years. Also,
I'm going to contribute the improvement for devfreq subsystem. It would
be easier for me for review if I'm cc'ed for patches.

Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-01-03 00:21:45 +01:00
Rafael J. Wysocki 6e092c8c04 PM / docs: Drop confusing kernel-doc references from infrastructure.rst
The references to drivers/base/power/main.c and
drivers/acpi/scan.c from Documentation/driver-api/infrastructure.rst
are confusing.  They both cause descriptions of functions that are
not relevant to device drivers at all to be generated and none of
them is sufficient to cover the API in a meaningful way.

Drop them for now.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Jonathan Corbet <corbet@lwn.net>
2017-01-03 00:07:09 +01:00
Rafael J. Wysocki c2a6bbaf0c ACPI / scan: Prefer devices without _HID/_CID for _ADR matching
The way acpi_find_child_device() works currently is that, if there
are two (or more) devices with the same _ADR value in the same
namespace scope (which is not specifically allowed by the spec and
the OS behavior in that case is not defined), the first one of them
found to be present (with the help of _STA) will be returned.

This covers the majority of cases, but is not sufficient if some of
the devices in question have a _HID (or _CID) returning some valid
ACPI/PNP device IDs (which is disallowed by the spec) and the
ASL writers' expectation appears to be that the OS will match
devices without a valid ACPI/PNP device ID against a given bus
address first.

To cover this special case as well, modify find_child_checks()
to prefer devices without ACPI/PNP device IDs over devices that
have them.

Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
2017-01-02 22:21:59 +01:00
Alexander Alemayhu 4e5da369df Documentation/networking: fix typo in mpls-sysctl
s/utliziation/utilization

Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-02 15:49:08 -05:00
Linus Torvalds da28756736 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:

 - regression fix (caused by me applying a wrong version of patch) for
   sensor-hub driver, from Srinivas Pandruvada

 - hid-sony fixes (mostly related to DS4 device) from Roderick
   Colenbrander

 - three device-specific quirks-fixes from Alex Wood, Brendan McGrath
   and Marcel Hasler

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: sensor-hub: Move the memset to sensor_hub_get_feature()
  HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar.
  HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD
  HID: sony: Ignore DS4 dongle reports when no device is connected
  HID: sony: Use DS4 MAC address as unique identifier on USB
  HID: sony: Fix error handling bug when touchpad registration fails
  HID: asus: Fix keyboard support
2017-01-02 12:42:50 -08:00
Michael Walle e9572fdd13 hwmon: (lm90) fix temp1_max_alarm attribute
Since commit commit eb1c8f4325 ("hwmon: (lm90) Convert to use new hwmon
registration API") the temp1_max_alarm and temp1_crit_alarm attributes are
mapped to the same alarm bit. Fix the typo.

Fixes: eb1c8f4325 ("hwmon: (lm90) Convert to use new hwmon registration API")
Signed-off-by: Micehael Walle <michael@walle.cc>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2017-01-02 10:15:28 -08:00
Michal Tesar 7ababb7826 igmp: Make igmp group member RFC 3376 compliant
5.2. Action on Reception of a Query

 When a system receives a Query, it does not respond immediately.
 Instead, it delays its response by a random amount of time, bounded
 by the Max Resp Time value derived from the Max Resp Code in the
 received Query message.  A system may receive a variety of Queries on
 different interfaces and of different kinds (e.g., General Queries,
 Group-Specific Queries, and Group-and-Source-Specific Queries), each
 of which may require its own delayed response.

 Before scheduling a response to a Query, the system must first
 consider previously scheduled pending responses and in many cases
 schedule a combined response.  Therefore, the system must be able to
 maintain the following state:

 o A timer per interface for scheduling responses to General Queries.

 o A per-group and interface timer for scheduling responses to Group-
   Specific and Group-and-Source-Specific Queries.

 o A per-group and interface list of sources to be reported in the
   response to a Group-and-Source-Specific Query.

 When a new Query with the Router-Alert option arrives on an
 interface, provided the system has state to report, a delay for a
 response is randomly selected in the range (0, [Max Resp Time]) where
 Max Resp Time is derived from Max Resp Code in the received Query
 message.  The following rules are then used to determine if a Report
 needs to be scheduled and the type of Report to schedule.  The rules
 are considered in order and only the first matching rule is applied.

 1. If there is a pending response to a previous General Query
    scheduled sooner than the selected delay, no additional response
    needs to be scheduled.

 2. If the received Query is a General Query, the interface timer is
    used to schedule a response to the General Query after the
    selected delay.  Any previously pending response to a General
    Query is canceled.
--8<--

Currently the timer is rearmed with new random expiration time for
every incoming query regardless of possibly already pending report.
Which is not aligned with the above RFE.
It also might happen that higher rate of incoming queries can
postpone the report after the expiration time of the first query
causing group membership loss.

Now the per interface general query timer is rearmed only
when there is no pending report already scheduled on that interface or
the newly selected expiration time is before the already pending
scheduled report.

Signed-off-by: Michal Tesar <mtesar@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-02 13:01:03 -05:00
Ian Kumlien d0af683407 flow_dissector: Update pptp handling to avoid null pointer deref.
__skb_flow_dissect can be called with a skb or a data packet, either
can be NULL. All calls seems to have been moved to __skb_header_pointer
except the pptp handling which is still calling skb_header_pointer.

skb_header_pointer will use skb->data and thus:
[  109.556866] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
[  109.557102] IP: [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[  109.557263] PGD 0
[  109.557338]
[  109.557484] Oops: 0000 [#1] SMP
[  109.557562] Modules linked in: chaoskey
[  109.557783] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.0 #79
[  109.557867] Hardware name: Supermicro A1SRM-LN7F/LN5F/A1SRM-LN7F-2758, BIOS 1.0c 11/04/2015
[  109.557957] task: ffff94085c27bc00 task.stack: ffffb745c0068000
[  109.558041] RIP: 0010:[<ffffffff88dc02f8>]  [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[  109.558203] RSP: 0018:ffff94087fc83d40  EFLAGS: 00010206
[  109.558286] RAX: 0000000000000130 RBX: ffffffff8975bf80 RCX: ffff94084fab6800
[  109.558373] RDX: 0000000000000010 RSI: 000000000000000c RDI: 0000000000000000
[  109.558460] RBP: 0000000000000b88 R08: 0000000000000000 R09: 0000000000000022
[  109.558547] R10: 0000000000000008 R11: ffff94087fc83e04 R12: 0000000000000000
[  109.558763] R13: ffff94084fab6800 R14: ffff94087fc83e04 R15: 000000000000002f
[  109.558979] FS:  0000000000000000(0000) GS:ffff94087fc80000(0000) knlGS:0000000000000000
[  109.559326] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  109.559539] CR2: 0000000000000080 CR3: 0000000281809000 CR4: 00000000001026e0
[  109.559753] Stack:
[  109.559957]  000000000000000c ffff94084fab6822 0000000000000001 ffff94085c2b5fc0
[  109.560578]  0000000000000001 0000000000002000 0000000000000000 0000000000000000
[  109.561200]  0000000000000000 0000000000000000 0000000000000000 0000000000000000
[  109.561820] Call Trace:
[  109.562027]  <IRQ>
[  109.562108]  [<ffffffff88dfb4fa>] ? eth_get_headlen+0x7a/0xf0
[  109.562522]  [<ffffffff88c5a35a>] ? igb_poll+0x96a/0xe80
[  109.562737]  [<ffffffff88dc912b>] ? net_rx_action+0x20b/0x350
[  109.562953]  [<ffffffff88546d68>] ? __do_softirq+0xe8/0x280
[  109.563169]  [<ffffffff8854704a>] ? irq_exit+0xaa/0xb0
[  109.563382]  [<ffffffff8847229b>] ? do_IRQ+0x4b/0xc0
[  109.563597]  [<ffffffff8902d4ff>] ? common_interrupt+0x7f/0x7f
[  109.563810]  <EOI>
[  109.563890]  [<ffffffff88d57530>] ? cpuidle_enter_state+0x130/0x2c0
[  109.564304]  [<ffffffff88d57520>] ? cpuidle_enter_state+0x120/0x2c0
[  109.564520]  [<ffffffff8857eacf>] ? cpu_startup_entry+0x19f/0x1f0
[  109.564737]  [<ffffffff8848d55a>] ? start_secondary+0x12a/0x140
[  109.564950] Code: 83 e2 20 a8 80 0f 84 60 01 00 00 c7 04 24 08 00
00 00 66 85 d2 0f 84 be fe ff ff e9 69 fe ff ff 8b 34 24 89 f2 83 c2
04 66 85 c0 <41> 8b 84 24 80 00 00 00 0f 49 d6 41 8d 31 01 d6 41 2b 84
24 84
[  109.569959] RIP  [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[  109.570245]  RSP <ffff94087fc83d40>
[  109.570453] CR2: 0000000000000080

Fixes: ab10dccb11 ("rps: Inspect PPTP encapsulated by GRE to get flow hash")
Signed-off-by: Ian Kumlien <ian.kumlien@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-02 12:53:34 -05:00
David S. Miller 94ba998b63 A single fix to avoid loading an skb->cb pointer too early.
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABCgAGBQJYamWkAAoJEGt7eEactAAdVHwP/j12GsQyQQtJdGWW5e/mS5LD
 UMgPH93VQeSbSCobu2ik3zPQCB0A1k6RlOdeeoD+wnI6FDWQ7S5bkQCLJX1d4dJW
 XwAPTUoZaZ0Q50ETENtICs6eB+qq/F04+a+QGdISJTJhsUxOkmHeCnMh9veOcyEy
 qr+zXAMjwlCujk2Hye5kMh6dbYWVy2CoByCLp054OSPipXZgQKzME+YPaLZjSq85
 +/kC3IGKafrAkMPbZLbcXWuUOvdHqrmvC79xF/BfLpB7tKQyPVksnB294ptylAKa
 1XHDCKN8j/iVpNcAz4LBsFNz9aySRWwy3vdmpUKXo2wCV8LaGUAppALnlzeHnPWD
 6vJ0MfuaV5kEve6EBQOmnMR8sgaQzZd+zXush9Jk4V+vf85d6+URVdeV41fQQy7D
 9SpwbupbUEiYwqyAdT2xPjAIXijUmuLAAnX/h4LbuEM0YVWlhXD8KlMWLBmd6+2x
 WMKxygnzeEiYC3rEmcx4fcpw+62bpj7NpkfBRdoR/Zr8zqiW1lRPcjNXtycjpDan
 iQSqsEhAKwgadDitghxNgItX/ihu4rleyPovy2dElEP/CANtlPMUglMNmIUfmnGc
 D3tCIjqCWgbU9CHVZHfxr9mt/5XcbcDoU7TDSQboQTt80bqiaAqj8ZL03/ZUnVj6
 jzmNxfgm+GQq/GeU9dDl
 =EkBc
 -----END PGP SIGNATURE-----

Merge tag 'mac80211-for-davem-2017-01-02' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg says:

====================
A single fix to avoid loading an skb->cb pointer too early.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-02 12:28:00 -05:00
Linus Torvalds 74e5c265a4 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
 "Two bug fixes for 4.10-rc3"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/kbuild: enable modversions for symbols exported from asm
  s390/vtime: correct system time accounting
2017-01-02 09:08:45 -08:00