Fixes: ee6c750761 (ARM: dts: dra7 clock data)
On DRA7x, For DPLL_IVA, the ref clock(CLKINP) is connected to sys_clk1 and
the bypass input(CLKINPULOW) is connected to iva_dpll_hs_clk_div clock.
But the bypass input is not directly routed to bypass clkout instead
both CLKINP and CLKINPULOW are connected to bypass clkout via a mux.
This mux is controlled by the bit - CM_CLKSEL_DPLL_IVA[23]:DPLL_BYP_CLKSEL
and it's POR value is zero which selects the CLKINP as bypass clkout.
which means iva_dpll_hs_clk_div is not the bypass clock for dpll_iva_ck
Fix this by adding another mux clock as parent in bypass mode.
This design is common to most of the PLLs and the rest have only one bypass
clock. Below is a list of the DPLLs that need this fix:
DPLL_IVA, DPLL_DDR,
DPLL_DSP, DPLL_EVE,
DPLL_GMAC, DPLL_PER,
DPLL_USB and DPLL_CORE
Signed-off-by: Ravikumar Kattekola <rk@ti.com>
Acked-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
A few driver specific fixes here, none of them earth shattering in
themselves, that have accumliated since the opening of the merge window.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJU96stAAoJECTWi3JdVIfQLfUH/jBYQqxrPp8qm7Lt9LOuwC4U
SOi0ERIVhLSKZMo7G4wHmbEapx2FBgH+wxqh9kNLaISvOIH4odFS4Fr1XYE70cY9
97M46uzLqdaKCDgvkXdx1NLA0zubEGWLOtdVYlrMAzin0FXNH+KYhxkRQbJ6f0LE
yKmNemnHHtJ4gDl/kMED7bc+mkYSOpwUE/8HLOEA8bcE3luDnj7rvQwOhPIYq0Tz
Ij4GM8HSfWPp/k3YmZVcF8GA6icN3LG5Jg7DOu6S19fMYimTDaHQDCw0AoLfiIOQ
DykyHg7ay/I3B6zUz4JikLIW5KjFxZfeQ818YE0GQ4PgePfb0GSIFt0LnNmq4Oo=
=GIb7
-----END PGP SIGNATURE-----
Merge tag 'asoc-fix-v4.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v4.0
A few driver specific fixes here, none of them earth shattering in
themselves, that have accumliated since the opening of the merge window.
Using the pvops kernel a NULL pointer dereference was detected on a
large machine (144 processors) when booting as dom0 in
evtchn_fifo_unmask() during assignment of a pirq.
The event channel in question was the first to need a new entry in
event_array[] in events_fifo.c. Unfortunately xen_irq_info_pirq_setup()
is called with evtchn being 0 for a new pirq and the real event channel
number is assigned to the pirq only during __startup_pirq().
It is mandatory to call xen_evtchn_port_setup() after assigning the
event channel number to the pirq to make sure all memory needed for the
event channel is allocated.
Signed-off-by: Juergen Gross <jgross@suse.com>
Cc: <stable@vger.kernel.org> # 3.14+
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
There is a missing lower bound check on "pitchbend" so it means we can
read up to 6 elements before the start of the opl3_note_table[] array.
Thanks to Clemens Ladisch for his help with this patch.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When CONFIG_DEBUG_SET_MODULE_RONX is enabled, the sizes of
module sections are aligned up so appropriate permissions can
be applied. Adjusting for the symbol table may cause them to
become unaligned. Make sure to re-align the sizes afterward.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The set_memory_* functions currently only support module
addresses. The addresses are validated using is_module_addr.
That function is special though and relies on internal state
in the module subsystem to work properly. At the time of
module initialization and calling set_memory_*, it's too early
for is_module_addr to work properly so it always returns
false. Rather than be subject to the whims of the module state,
just bounds check against the module virtual address range.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
When DMA descriptor allocation fails we should not try to assign any fields in
the bad descriptor. The patch adds the necessary checks for that.
Fixes: 7063c0d942 (spi/dw_spi: add DMA support)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
In xgene_pcie_map_bus(), we neglected to add in the register offset when
calculating the config space address. This means all config accesses
operated on the first four bytes of config space.
Add the register offset to the config space base address.
Also correct the xgene_pcie_map_bus() prototype to fix a compiler warning.
[bhelgaas: changelog]
Fixes: 350f8be5bb ("PCI: xgene: Convert to use generic config accessors")
Posting: http://lkml.kernel.org/r/1424214840-26498-1-git-send-email-fkan@apm.com
Signed-off-by: Feng Kan <fkan@apm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Tanmay Inamdar <tinamdar@apm.com>
Acked-by: Rob Herring <robh@kernel.org>
With some mss values, it is possible tcp_xmit_size_goal() puts
one segment more in TSO packet than tcp_tso_autosize().
We send then one TSO packet followed by one single MSS.
It is not a serious bug, but we can do slightly better, especially
for drivers using netif_set_gso_max_size() to lower gso_max_size.
Using same formula avoids these corner cases and makes
tcp_xmit_size_goal() a bit faster.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 605ad7f184 ("tcp: refine TSO autosizing")
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When the driver is removed (e.g. using unbind through sysfs), the
clocks get disabled twice, once on fec_enet_close and once on
fec_drv_remove. Since the clocks are enabled only once, this leads
to a warning:
WARNING: CPU: 0 PID: 402 at drivers/clk/clk.c:992 clk_core_disable+0x64/0x68()
Remove the call to fec_enet_clk_enable in fec_drv_remove to balance
the clock enable/disable calls again. This has been introduce by
e8fcfcd568 ("net: fec: optimize the clock management to save power").
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The latest spec "I-IPA01-0266-USR Rev 10" limit the MID field length to 12 bit
value. For previous versions it is 16 bit value.
This change will not break the backward compatibility as the latest ID value is
7 and with in the 12 bit value limit.
Signed-off-by: Punnaiah Choudary Kalluri <punnaia@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
eTSEC of-nodes may have children which are not queue-group nodes. For
example new-style fixed-phy declarations. These where incorrectly
assumed to be additional queue-groups.
Change the search to filter out any nodes which are not queue-groups,
or have been disabled.
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes for net
The following patchset contains Netfilter/IPVS fixes for your net tree,
they are:
1) Don't truncate ethernet protocol type to u8 in nft_compat, from
Arturo Borrero.
2) Fix several problems in the addition/deletion of elements in nf_tables.
3) Fix module refcount leak in ip_vs_sync, from Julian Anastasov.
4) Fix a race condition in the abort path in the nf_tables transaction
infrastructure. Basically aborted rules can show up as active rules
until changes are unrolled, oneliner from Patrick McHardy.
5) Check for overflows in the data area of the rule, also from Patrick.
6) Fix off-by-one in the per-rule user data size field. This introduces
a new nft_userdata structure that is placed at the beginning of the
user data area that contains the length to save some bits from the
rule and we only need one bit to indicate its presence, from Patrick.
7) Fix rule replacement error path, the replaced rule is deleted on
error instead of leaving it in place. This has been fixed by relying
on the abort path to undo the incomplete replacement.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
ip_check_defrag() may be used by af_packet to defragment outgoing packets.
skb_network_offset() of af_packet's outgoing packets is not zero.
Signed-off-by: Alexander Drozdov <al.drozdov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
bcmgenet_set_wol() correctly sets MPD_PW_EN when a password is specified
to match magic packets against, however, when we switch from a
password-matching to a matching without password we would leave this bit
turned on, and GENET would only match magic packets with passwords.
This can be reproduced using the following sequence:
ethtool -s eth0 wol g
ethtool -s eth0 wol s sopass 00:11:22:33:44:55
ethtool -s eth0 wol g
The simple fix is to clear the MPD_PWD_EN bit when WAKE_MAGICSECURE is
not set.
Fixes: c51de7f397 ("net: bcmgenet: add Wake-on-LAN support code")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Improper arithmetics when calculting the address of the extended ref could
lead to an out of bounds memory read and kernel panic.
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
cc: stable@vger.kernel.org # v3.7+
Signed-off-by: Chris Mason <clm@fb.com>
When using the fast file fsync code path we can miss the fact that new
writes happened since the last file fsync and therefore return without
waiting for the IO to finish and write the new extents to the fsync log.
Here's an example scenario where the fsync will miss the fact that new
file data exists that wasn't yet durably persisted:
1. fs_info->last_trans_committed == N - 1 and current transaction is
transaction N (fs_info->generation == N);
2. do a buffered write;
3. fsync our inode, this clears our inode's full sync flag, starts
an ordered extent and waits for it to complete - when it completes
at btrfs_finish_ordered_io(), the inode's last_trans is set to the
value N (via btrfs_update_inode_fallback -> btrfs_update_inode ->
btrfs_set_inode_last_trans);
4. transaction N is committed, so fs_info->last_trans_committed is now
set to the value N and fs_info->generation remains with the value N;
5. do another buffered write, when this happens btrfs_file_write_iter
sets our inode's last_trans to the value N + 1 (that is
fs_info->generation + 1 == N + 1);
6. transaction N + 1 is started and fs_info->generation now has the
value N + 1;
7. transaction N + 1 is committed, so fs_info->last_trans_committed
is set to the value N + 1;
8. fsync our inode - because it doesn't have the full sync flag set,
we only start the ordered extent, we don't wait for it to complete
(only in a later phase) therefore its last_trans field has the
value N + 1 set previously by btrfs_file_write_iter(), and so we
have:
inode->last_trans <= fs_info->last_trans_committed
(N + 1) (N + 1)
Which made us not log the last buffered write and exit the fsync
handler immediately, returning success (0) to user space and resulting
in data loss after a crash.
This can actually be triggered deterministically and the following excerpt
from a testcase I made for xfstests triggers the issue. It moves a dummy
file across directories and then fsyncs the old parent directory - this
is just to trigger a transaction commit, so moving files around isn't
directly related to the issue but it was chosen because running 'sync' for
example does more than just committing the current transaction, as it
flushes/waits for all file data to be persisted. The issue can also happen
at random periods, since the transaction kthread periodicaly commits the
current transaction (about every 30 seconds by default).
The body of the test is:
_scratch_mkfs >> $seqres.full 2>&1
_init_flakey
_mount_flakey
# Create our main test file 'foo', the one we check for data loss.
# By doing an fsync against our file, it makes btrfs clear the 'needs_full_sync'
# bit from its flags (btrfs inode specific flags).
$XFS_IO_PROG -f -c "pwrite -S 0xaa 0 8K" \
-c "fsync" $SCRATCH_MNT/foo | _filter_xfs_io
# Now create one other file and 2 directories. We will move this second file
# from one directory to the other later because it forces btrfs to commit its
# currently open transaction if we fsync the old parent directory. This is
# necessary to trigger the data loss bug that affected btrfs.
mkdir $SCRATCH_MNT/testdir_1
touch $SCRATCH_MNT/testdir_1/bar
mkdir $SCRATCH_MNT/testdir_2
# Make sure everything is durably persisted.
sync
# Write more 8Kb of data to our file.
$XFS_IO_PROG -c "pwrite -S 0xbb 8K 8K" $SCRATCH_MNT/foo | _filter_xfs_io
# Move our 'bar' file into a new directory.
mv $SCRATCH_MNT/testdir_1/bar $SCRATCH_MNT/testdir_2/bar
# Fsync our first directory. Because it had a file moved into some other
# directory, this made btrfs commit the currently open transaction. This is
# a condition necessary to trigger the data loss bug.
$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir_1
# Now fsync our main test file. If the fsync succeeds, we expect the 8Kb of
# data we wrote previously to be persisted and available if a crash happens.
# This did not happen with btrfs, because of the transaction commit that
# happened when we fsynced the parent directory.
$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/foo
# Simulate a crash/power loss.
_load_flakey_table $FLAKEY_DROP_WRITES
_unmount_flakey
_load_flakey_table $FLAKEY_ALLOW_WRITES
_mount_flakey
# Now check that all data we wrote before are available.
echo "File content after log replay:"
od -t x1 $SCRATCH_MNT/foo
status=0
exit
The expected golden output for the test, which is what we get with this
fix applied (or when running against ext3/4 and xfs), is:
wrote 8192/8192 bytes at offset 0
XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
wrote 8192/8192 bytes at offset 8192
XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
File content after log replay:
0000000 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
*
0020000 bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb
*
0040000
Without this fix applied, the output shows the test file does not have
the second 8Kb extent that we successfully fsynced:
wrote 8192/8192 bytes at offset 0
XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
wrote 8192/8192 bytes at offset 8192
XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
File content after log replay:
0000000 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
*
0020000
So fix this by skipping the fsync only if we're doing a full sync and
if the inode's last_trans is <= fs_info->last_trans_committed, or if
the inode is already in the log. Also remove setting the inode's
last_trans in btrfs_file_write_iter since it's useless/unreliable.
Also because btrfs_file_write_iter no longer sets inode->last_trans to
fs_info->generation + 1, don't set last_trans to 0 if we bail out and don't
bail out if last_trans is 0, otherwise something as simple as the following
example wouldn't log the second write on the last fsync:
1. write to file
2. fsync file
3. fsync file
|--> btrfs_inode_in_log() returns true and it set last_trans to 0
4. write to file
|--> btrfs_file_write_iter() no longers sets last_trans, so it
remained with a value of 0
5. fsync
|--> inode->last_trans == 0, so it bails out without logging the
second write
A test case for xfstests will be sent soon.
CC: <stable@vger.kernel.org>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
With certain restrictions it is possible for a wakeup device to share
an IRQ with an IRQF_NO_SUSPEND user, and the warnings introduced by
commit cab303be91 are spurious. The new
IRQF_COND_SUSPEND flag allows drivers to tell the core when these
restrictions are met, allowing spurious warnings to be silenced.
This patch documents how IRQF_COND_SUSPEND is expected to be used,
updating some of the text now made invalid by its addition.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The IRQ line connected to the DBGU UART is often shared with a timer device
which request the IRQ with IRQF_NO_SUSPEND.
Since the UART driver is correctly disabling IRQs when entering suspend
we can safely request the IRQ with IRQF_COND_SUSPEND so that irq core
will not complain about mixing IRQF_NO_SUSPEND and !IRQF_NO_SUSPEND.
Rework the interrupt handler to wake the system up when an interrupt
happens on the DEBUG_UART while the system is suspended.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The watchdog interrupt (only used when activating software watchdog)
shouldn't be suspended when entering suspend mode, because it is shared
with a timer device (which request the line with IRQF_NO_SUSPEND) and once
the watchdog "Mode Register" has been written, it cannot be changed (which
means we cannot disable the watchdog interrupt when entering suspend).
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
* suspend-to-idle:
cpuidle / sleep: Use broadcast timer for states that stop local timer
cpuidle: Clean up fallback handling in cpuidle_idle_call()
cpuidle / sleep: Do sanity checks in cpuidle_enter_freeze() too
idle / sleep: Avoid excessive disabling and enabling interrupts
* acpi-resources:
x86/PCI/ACPI: Relax ACPI resource descriptor checks to work around BIOS bugs
x86/PCI/ACPI: Ignore resources consumed by host bridge itself
PCI: versatile: Update for list_for_each_entry() API change
Commit 3810631332 (PM / sleep: Re-implement suspend-to-idle handling)
overlooked the fact that entering some sufficiently deep idle states
by CPUs may cause their local timers to stop and in those cases it
is necessary to switch over to a broadcast timer prior to entering
the idle state. If the cpuidle driver in use does not provide
the new ->enter_freeze callback for any of the idle states, that
problem affects suspend-to-idle too, but it is not taken into account
after the changes made by commit 3810631332.
Fix that by changing the definition of cpuidle_enter_freeze() and
re-arranging of the code in cpuidle_idle_call(), so the former does
not call cpuidle_enter() any more and the fallback case is handled
by cpuidle_idle_call() directly.
Fixes: 3810631332 (PM / sleep: Re-implement suspend-to-idle handling)
Reported-and-tested-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Commit de7b5b3d79 ("net: eth: xgene: change APM X-Gene SoC platform
ethernet to support ACPI") breaks booting with devicetree with UEFI
firmware. In that case, I get:
Unhandled fault: synchronous external abort (0x96000010) at 0xfffffc0000620010
Internal error: : 96000010 [#1] SMP
Modules linked in: vfat fat xfs libcrc32c ahci_xgene libahci_platform libahci
CPU: 7 PID: 634 Comm: NetworkManager Not tainted 4.0.0-rc1+ #4
Hardware name: AppliedMicro Mustang/Mustang, BIOS 1.1.0-rh-0.14 Mar 1 2015
task: fffffe03d4c7e100 ti: fffffe03d4e24000 task.ti: fffffe03d4e24000
PC is at xgene_enet_rd_mcx_mac.isra.11+0x58/0xd4
LR is at xgene_gmac_tx_enable+0x2c/0x50
pc : [<fffffe000069d6fc>] lr : [<fffffe000069dcc4>] pstate: 80000145
sp : fffffe03d4e27590
x29: fffffe03d4e27590 x28: 0000000000000000
x27: fffffe03d4e277c0 x26: fffffe03da8fda10
x25: fffffe03d4e2760c x24: fffffe03d49e28c0
x23: fffffc0000620004 x22: 0000000000000000
x21: fffffc0000620000 x20: fffffc0000620010
x19: 000000000000000b x18: 000003ffd4a96020
x17: 000003ff7fc1f7a0 x16: fffffe000079b9cc
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: fffffe03d4e24000
x11: fffffe03d4e27da0 x10: 0000000000000001
x9 : 0000000000000000 x8 : fffffe03d4e27a20
x7 : 0000000000000000 x6 : 00000000ffffffef
x5 : fffffe000105f7d0 x4 : fffffe00007ca8c8
x3 : fffffe03d4e2760c x2 : 0000000000000000
x1 : fffffc0000620000 x0 : 0000000040000000
Process NetworkManager (pid: 634, stack limit = 0xfffffe03d4e24028)
Stack: (0xfffffe03d4e27590 to 0xfffffe03d4e28000)
...
Call trace:
[<fffffe000069d6fc>] xgene_enet_rd_mcx_mac.isra.11+0x58/0xd4
[<fffffe000069dcc0>] xgene_gmac_tx_enable+0x28/0x50
[<fffffe00006a112c>] xgene_enet_open+0x2c/0x130
[<fffffe00007b9254>] __dev_open+0xc8/0x148
[<fffffe00007b956c>] __dev_change_flags+0x90/0x158
[<fffffe00007b9664>] dev_change_flags+0x30/0x70
[<fffffe00007c8ab8>] do_setlink+0x278/0x870
[<fffffe00007c95bc>] rtnl_newlink+0x404/0x6a8
[<fffffe00007c8040>] rtnetlink_rcv_msg+0x98/0x218
[<fffffe00007e78e4>] netlink_rcv_skb+0xe0/0xf8
[<fffffe00007c7f94>] rtnetlink_rcv+0x30/0x44
[<fffffe00007e6f2c>] netlink_unicast+0xfc/0x210
[<fffffe00007e75b8>] netlink_sendmsg+0x498/0x5ac
[<fffffe00007990b8>] do_sock_sendmsg+0xa4/0xcc
[<fffffe000079a958>] ___sys_sendmsg+0x1fc/0x208
[<fffffe000079b984>] __sys_sendmsg+0x4c/0x94
[<fffffe000079b9f8>] SyS_sendmsg+0x2c/0x3c
The problem here is that the enet hw clocks are not getting
initialized because of a test to avoid the initialization if
UEFI is used to boot. This is an incorrect test. When booting
with UEFI and devicetree, the kernel must still initialize
the enet hw clocks. If booting with ACPI, the clock hw is
not exposed to the kernel and it is that case where we want
to avoid initializing clocks.
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: Feng Kan <fkan@apm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
EEH recovery for bnx2x based adapters is not reliable on all Power
systems using the default hot reset, which can result in an
unrecoverable EEH error. Forcing the use of fundamental reset
during EEH recovery fixes this.
Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David Vrabel says:
====================
xen-netback: fix ethtool stats and memory leak
A couple of bug fixes for netback:
- make ethool stats to report the correct values.
- don't leak 1 MiB every time a VIF is destroyed.
Changes in v2:
- Split 2nd patch into leak fix and refactor patches
====================
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When handling a from-guest frag list, xenvif_handle_frag_list()
replaces the frags before calling the destructor to clean up the
original (foreign) frags. Whilst this is safe (the destructor doesn't
actually use the frags), it looks odd.
Reorder the function to be less confusing.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Every time a VIF is destroyed up to 256 pages may be leaked if packets
with more than MAX_SKB_FRAGS frags were transmitted from the guest.
Even worse, if another user of ballooned pages allocated one of these
ballooned pages it would not handle the unexpectedly >1 page count
(e.g., gntdev would deadlock when unmapping a grant because the page
count would never reach 1).
When handling a from-guest skb with a frag list, unref the frags
before releasing them so they are freed correctly when the VIF is
destroyed.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Use correct pointer arithmetic to get the pointer to each stat.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pull x86 fixes from Ingo Molnar:
"Misc fixes: EFI fixes, an Intel Quark fix, an asm fix and an FPU
handling fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/fpu/xsaves: Fix improper uses of __ex_table
x86/intel/quark: Select COMMON_CLK
x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization
firmware: dmi_scan: Fix dmi_len type
efi/libstub: Fix boundary checking in efi_high_alloc()
firmware: dmi_scan: Fix dmi scan to handle "End of Table" structure
Here are some fixups/improvements for
commit 658b6eda20 ("KVM: s390: add cpu model support")
commit 9d8d578605 ("KVM: s390: use facilities and cpu_id per KVM")
commit a374e892c3 ("KVM: s390/cpacf: Enable/disable protected key
functions for kvm guest")
commit 45c9b47c58 ("KVM: s390/CPACF: Choose crypto control block format")
which all have been merged during the merge window for 4.0.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
iQIcBAABAgAGBQJU9ucxAAoJEBF7vIC1phx8OOoP/iJhd73h4QsjjU/ZaXSNW+65
pwgOhD3eSXdUkGNsKUMp9nsyDo89puSZdUo9+5hvtbal5P89BpLx2VQxryZY0SAU
21D/AjaaxJ6YcL5mfT6lyp1W5jznOobZLl8wSHoIAWyKrmqv0hLG1M/Ip5TxmdE0
7rSeABHJyQNcTnOLL9Iq/uut8Qaf8ApD2rxzNfZILjlyQveS1I+l2qRAyi4MYTU0
E3wZAOirzzNZfhbe049hvyNYd086GfOucwf1wsezvhbVJeqi2MNRf61yCGpedRdw
2V5ce6LefMSx+sdqBOoKCYziO/vnTMdQjBfsm9315fTMHlGVBY0PgPWLQFVe77pI
2enB20/T4hTJ203Nwaa0jBkQ2IyunSrE1rP6M+E7g90ZgiXrR9TsURAfl+u5EzE4
QZe7BcQRJ+Wrj1lrM7W67Mr+hzIlRvWeEJjKsHa/q8BPD4mbQRacPN2OKW2zcbrx
Ye4Vr0Fanom5nyZqPDbMl5dWlN0xuboFksSMkdaR7KDp5fb4WMITOl0WeOZPRAn9
16TTO6Mr19I3uCCuJFhZaI1HPyUQPJja2JZqB/HUcribTcp+GGPt8od0Yxvd07kP
B4T5OlpiYbOIimIIkukGvbdNIBOcfvyiInq3offrE1S/q4PWo3uWf2HyeQE+/G8V
d9gCVWo+st4Sj5UVRCm0
=ZaGi
-----END PGP SIGNATURE-----
Merge tag 'kvm-s390-master-20150303' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux
KVM: s390: Fixups for changes in merge window for 4.0
Here are some fixups/improvements for
commit 658b6eda20 ("KVM: s390: add cpu model support")
commit 9d8d578605 ("KVM: s390: use facilities and cpu_id per KVM")
commit a374e892c3 ("KVM: s390/cpacf: Enable/disable protected key
functions for kvm guest")
commit 45c9b47c58 ("KVM: s390/CPACF: Choose crypto control block format")
which all have been merged during the merge window for 4.0.
Commit:
f31a9f7c71 ("x86/xsaves: Use xsaves/xrstors to save and restore xsave area")
introduced alternative instructions for XSAVES/XRSTORS and commit:
adb9d526e9 ("x86/xsaves: Add xsaves and xrstors support for booting time")
added support for the XSAVES/XRSTORS instructions at boot time.
Unfortunately both failed to properly protect them against faulting:
The 'xstate_fault' macro will use the closest label named '1'
backward and that ends up in the .altinstr_replacement section
rather than in .text. This means that the kernel will never find
in the __ex_table the .text address where this instruction might
fault, leading to serious problems if userspace manages to
trigger the fault.
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: Jamie Iles <jamie.iles@oracle.com>
[ Improved the changelog, fixed some whitespace noise. ]
Acked-by: Borislav Petkov <bp@alien8.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Cc: Allan Xavier <mr.a.xavier@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: adb9d526e9 ("x86/xsaves: Add xsaves and xrstors support for booting time")
Fixes: f31a9f7c71 ("x86/xsaves: Use xsaves/xrstors to save and restore xsave area")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Fix the dmaengine complaint about missing slave caps :
- declare the available bus widths
- declare the available transfer types
- declare the residue calculation type
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
The commit 8bbc2a135b ("x86/intel/quark: Add Intel Quark
platform support") introduced a minimal support of Intel Quark
SoC. That allows to use core parts of the SoC. However, the SPI,
I2C, and GPIO drivers can't be selected by kernel configuration
because they depend on COMMON_CLK. The patch adds a COMMON_CLK
selection to the platfrom definition to allow user choose the drivers.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Ong, Boon Leong <boon.leong.ong@intel.com>
Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Cc: Darren Hart <dvhart@linux.intel.com>
Fixes: 8bbc2a135b ("x86/intel/quark: Add Intel Quark platform support")
Link: http://lkml.kernel.org/r/1425569044-2867-1-git-send-email-andriy.shevchenko@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Avoid the warning below triggered during dmaengine async device
registration.
WARNING: CPU: 1 PID: 1 at linux/drivers/dma/dmaengine.c:863
dma_async_device_register+0x2a8/0x4b8()
this driver doesn't support generic slave capabilities reporting
To do that fill mandatory .directions bit mask,
.src/dst_addr_widths and .residue_granularity dma_device fields
with appropriate values.
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Here are a few fixes for reported problems including a usb-debug device
buffer overflow, potential use-after-free on failed probe, and a couple
of issues with the USB console.
Some new device IDs are also added.
Signed-off-by: Johan Hovold <johan@kernel.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABAgAGBQJU+Fy4AAoJEEEN5E/e4bSVxSIQAM/ekC0n6/v2BqF+RJ+1YmGs
pELjhVxgiUJ+TqgncxhFkbSVVKhBJ7JN8qOj2wV9r55WX8OgoGVoqFopz+PHeHWC
2JvPYkGi0UhCxCLto/XFnS8KYT+ODCqDF3E9CJKZEl6X3TGmQJ0Lyka953vYRWO3
0g3DwHGVdAHCH1ZZFJB4R/45i6ACLWd5A7zlyfvjrDYWfTgfONIFbaOjNATJFjre
3FyUXM2TP/AZNAcPYt8IUrbrUIriKptmQJk0F2gZEyLvYwlmJvtutpMLUL+Xs0Hx
rbQVsQfKt7Plo2nkUkJ+1B/Q15+0aTyA5dqdXeYG77R6O5Y9v1c6fpc5Jr+fIPI/
jMP9LBeAUqQpKsLvtN4LG93a19r+0lJfdZtNTComLmSvQXYIiqRPNBlLmrBUN+Tq
KG7TYHCoDsxw6jgMRPNLGn3lMEHxWej1lhI3UYSAXks1qixHLm+5+hVcqbKqMeaQ
2gX/xEHIFgaHNvfl9Hr1ke2vMxHB/tSt7DcrQVgBsBQgEP6PgvG+fQajoIZ7YQJC
K+ElAwUiGeYq2Kqp8ljqVd+q1LyQo0w9B3eJSG5URnmLkxzQ4PPVf2tnVxy+xq3q
N10cp/6vKLFATF4+Gu2dMGuSbK5LsNvOAGpjr6VDAqb2wAFmaT+MaQKQlgo/6TQH
L/Cj0mx7uyGwhtPBZES6
=0CrX
-----END PGP SIGNATURE-----
Merge tag 'usb-serial-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.0-rc3
Here are a few fixes for reported problems including a usb-debug device
buffer overflow, potential use-after-free on failed probe, and a couple
of issues with the USB console.
Some new device IDs are also added.
Signed-off-by: Johan Hovold <johan@kernel.org>
cancel[_delayed]_work_sync() are implemented using
__cancel_work_timer() which grabs the PENDING bit using
try_to_grab_pending() and then flushes the work item with PENDING set
to prevent the on-going execution of the work item from requeueing
itself.
try_to_grab_pending() can always grab PENDING bit without blocking
except when someone else is doing the above flushing during
cancelation. In that case, try_to_grab_pending() returns -ENOENT. In
this case, __cancel_work_timer() currently invokes flush_work(). The
assumption is that the completion of the work item is what the other
canceling task would be waiting for too and thus waiting for the same
condition and retrying should allow forward progress without excessive
busy looping
Unfortunately, this doesn't work if preemption is disabled or the
latter task has real time priority. Let's say task A just got woken
up from flush_work() by the completion of the target work item. If,
before task A starts executing, task B gets scheduled and invokes
__cancel_work_timer() on the same work item, its try_to_grab_pending()
will return -ENOENT as the work item is still being canceled by task A
and flush_work() will also immediately return false as the work item
is no longer executing. This puts task B in a busy loop possibly
preventing task A from executing and clearing the canceling state on
the work item leading to a hang.
task A task B worker
executing work
__cancel_work_timer()
try_to_grab_pending()
set work CANCELING
flush_work()
block for work completion
completion, wakes up A
__cancel_work_timer()
while (forever) {
try_to_grab_pending()
-ENOENT as work is being canceled
flush_work()
false as work is no longer executing
}
This patch removes the possible hang by updating __cancel_work_timer()
to explicitly wait for clearing of CANCELING rather than invoking
flush_work() after try_to_grab_pending() fails with -ENOENT.
Link: http://lkml.kernel.org/g/20150206171156.GA8942@axis.com
v3: bit_waitqueue() can't be used for work items defined in vmalloc
area. Switched to custom wake function which matches the target
work item and exclusive wait and wakeup.
v2: v1 used wake_up() on bit_waitqueue() which leads to NULL deref if
the target bit waitqueue has wait_bit_queue's on it. Use
DEFINE_WAIT_BIT() and __wake_up_bit() instead. Reported by Tomeu
Vizoso.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Rabin Vincent <rabin.vincent@axis.com>
Cc: Tomeu Vizoso <tomeu.vizoso@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Jesper Nilsson <jesper.nilsson@axis.com>
Tested-by: Rabin Vincent <rabin.vincent@axis.com>
The usages of clamp() macro in sound/usb/line6/playback.c are just
wrong, the low and high values are swapped.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Because writing the MOR register requires the PASSWD(0x37),
if missed, the write operation will be aborted.
Signed-off-by: Patrice Vilchez <patrice.vilchez@atmel.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
lcdck takes mck (not smd) as its parent. It is also assigned id 3 and not 4.
Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
[nicolas.ferre@atmel.com: squashed 2 related patches]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Rename lcd_clk into lcdc_clk to be consistent with sama5d3 clock
definitions.
Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Linux may be used without MMU on atmel SoCs, fix debug in this configuration.
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
BDX-DE IOATDMA reports incorrect DMACAP register for PQ related
ops. Ignoring those bits.
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
