30 Apr, 2014

1 commit

  • The recent commit (ca460f86521) changed the CORB RP reset procedure to
    follow the specification with a couple of sanity checks.
    Unfortunately, Nvidia controller chips seem not following this way,
    and spew the warning messages like:
    snd_hda_intel 0000:00:10.1: CORB reset timeout#1, CORBRP = 0

    This patch adds the workaround for such chips. It just skips the new
    reset procedure for the known broken chips.

    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

28 Apr, 2014

2 commits


23 Apr, 2014

5 commits

  • …ar', 'asoc/fix/tlv320aic31xx' and 'asoc/fix/tlv320aic3x' into asoc-linus

    Mark Brown
     
  • …/cs42l73' and 'asoc/fix/fsl-spdif' into asoc-linus

    Mark Brown
     
  • Mark Brown
     
  • Commit 0406a40a0 ("ASoC: jz4740: Use the generic dmaengine PCM driver")
    jz4740-pcm.c file, but neglected to remove the Makefile entries.

    Fixes: 0406a40a0 ("ASoC: jz4740: Use the generic dmaengine PCM driver")
    Reported-by: kbuild test robot
    Reported-by: Ralf Baechle
    Signed-off-by: Lars-Peter Clausen
    Signed-off-by: Mark Brown

    Lars-Peter Clausen
     
  • There were occasional ADSP crash during reboot testing:

    [ 11.883364] BUG: unable to handle kernel paging request at ffffc90121700000
    [ 11.883380] IP: [] sst_module_insert_fixed_block+0x24f/0x26d [snd_soc_sst_dsp]
    [ 11.883397] PGD 7800b067 PUD 0
    [ 11.883405] Oops: 0002 [#1] SMP
    [ 11.886418] gsmi: Log Shutdown Reason 0x03

    The virtual address, ffffc90121700000, was out of range. The virtual
    address is calculated by adding LPE base address with an offset:

    sst_memcpy32(dsp->addr.lpe + data->offset, data->data, data->size);

    The offset is calculated in sst_byt_parse_module, by subtraction of
    two virtual addresses dsp->addr.fw_ext and dsp->addr.lpe:

    block_data.offset = block->ram_offset + (dsp->addr.fw_ext - dsp->addr.lpe);

    These virtual addresses are assigned by kernel from ioremap:

    sst->addr.lpe = ioremap(pdata->lpe_base, pdata->lpe_size);
    sst->addr.fw_ext = ioremap(pdata->fw_base, pdata->fw_size);

    In current driver code, offset is defined as unsigned int32:

    struct sst_module_data {
    ...
    u32 offset; /* offset in FW file */
    };

    Most of the time kernel assigned virtual addresses with addr.fw_ext
    greater than addr.lpe. But sometimes it was the other way round.

    Fix the problem by declaring offset as signed int32_t.

    Signed-off-by: Wenkai Du
    Signed-off-by: Jarkko Nikula
    Signed-off-by: Mark Brown

    Wenkai Du
     

21 Apr, 2014

5 commits

  • Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable")
    is trying to free the widget it allocated by snd_soc_dapm_new_control()
    call in dapm_kcontrol_data_alloc() by adding kfree(data->widget) to
    dapm_kcontrol_free().

    This is causing a widget double free with auto-disabled DAPM kcontrols
    in sound card unregistration because widgets are already freed before
    dapm_kcontrol_free() is called.

    Reason for that is all widgets are added into dapm->card->widgets list
    in snd_soc_dapm_new_control() and freed in dapm_free_widgets() during
    execution of snd_soc_dapm_free().

    Now snd_soc_dapm_free() calls for different DAPM contexts happens before
    snd_card_free() call from where the call chain to dapm_kcontrol_free()
    begins:

    soc_cleanup_card_resources()
    soc_remove_dai_links()
    soc_remove_link_dais()
    snd_soc_dapm_free(&cpu_dai->dapm)
    soc_remove_link_components()
    soc_remove_platform()
    snd_soc_dapm_free(&platform->dapm)
    soc_remove_codec()
    snd_soc_dapm_free(&codec->dapm)
    snd_soc_dapm_free(&card->dapm)
    snd_card_free()
    snd_card_do_free()
    snd_device_free_all()
    snd_device_free()
    snd_ctl_dev_free()
    snd_ctl_remove()
    snd_ctl_free_one()
    dapm_kcontrol_free()

    This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for
    them.

    Fixes: 9e1fda4ae158 (ASoC: dapm: Implement mixer input auto-disable)
    Signed-off-by: Jarkko Nikula
    Acked-by: Lars-Peter Clausen
    Signed-off-by: Mark Brown
    Cc: stable@vger.kernel.org

    Jarkko Nikula
     
  • Linus Torvalds
     
  • Pull slave-dmaengine fixes from Vinod Koul:
    "Back from long weekend here in India and now the time to send fixes
    for slave dmaengine.
    - Dan's fix of sirf xlate code
    - Jean's fix for timberland
    - edma fixes by Sekhar for SG handling and Yuan for changing init
    call"

    * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
    dma: fix eDMA driver as a subsys_initcall
    dmaengine: sirf: off by one in of_dma_sirfsoc_xlate()
    platform: Fix timberdale dependencies
    dma: edma: fix incorrect SG list handling

    Linus Torvalds
     
  • Pull iommu fixes from Joerg Roedel:
    "Fixes for regressions:

    - fix wrong IOMMU enumeration causing some SCSI device drivers
    initialization failures
    - ARM-SMMU fixes for a panic condition and a wrong return value"

    * tag 'iommu-fixes-v3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
    iommu/arm-smmu: fix panic in arm_smmu_alloc_init_pte
    iommu/arm-smmu: Return 0 on unmap failure
    iommu/vt-d: fix bug in matching PCI devices with DRHD/RMRR descriptors
    iommu/vt-d: Fix get_domain_for_dev() handling of upstream PCIe bridges
    iommu/vt-d: fix memory leakage caused by commit ea8ea46

    Linus Torvalds
     
  • Pull perf tooling fixes from Ingo Molnar:
    "Three small tooling fixes"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf tools: Improve error reporting
    perf tools: Adjust symbols in VDSO
    perf kvm: Fix 'Min time' counting in report command

    Linus Torvalds
     

20 Apr, 2014

9 commits

  • …it/jolsa/perf into perf/urgent

    Pull perf/urgent fixes from Jiri Olsa:

    User visible changes:

    * Adjust symbols in VDSO to properly resolve its function names (Vladimir Nikulichev)

    * Improve error reporting for record session failure (Adrien BAK)

    * Fix 'Min time' counting in report command (Alexander Yarygin)

    Signed-off-by: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>

    Ingo Molnar
     
  • In the current version, when using perf record, if something goes
    wrong in tools/perf/builtin-record.c:375
    session = perf_session__new(file, false, NULL);

    The error message:
    "Not enough memory for reading per file header"

    is issued. This error message seems to be outdated and is not very
    helpful. This patch proposes to replace this error message by
    "Perf session creation failed"

    I believe this issue has been brought to lkml:
    https://lkml.org/lkml/2014/2/24/458
    although this patch only tackles a (small) part of the issue.

    Additionnaly, this patch improves error reporting in
    tools/perf/util/data.c open_file_write.

    Currently, if the call to open fails, the user is unaware of it.
    This patch logs the error, before returning the error code to
    the caller.

    Reported-by: Will Deacon
    Signed-off-by: Adrien BAK
    Link: http://lkml.kernel.org/r/1397786443.3093.4.camel@beast
    [ Reorganize the changelog into paragraphs ]
    [ Added empty line after fd declaration in open_file_write ]
    Signed-off-by: Jiri Olsa

    Adrien BAK
     
  • pert-report doesn't resolve function names in VDSO:

    $ perf report --stdio -g flat,0.0,15,callee --sort pid
    ...
    8.76%
    0x7fff6b1fe861
    __gettimeofday
    ACE_OS::gettimeofday()
    ...

    In this case symbol values should be adjusted the same way as for executables,
    relocatable objects and prelinked libraries.

    After fix:

    $ perf report --stdio -g flat,0.0,15,callee --sort pid
    ...
    8.76%
    __vdso_gettimeofday
    __gettimeofday
    ACE_OS::gettimeofday()

    Signed-off-by: Vladimir Nikulichev
    Tested-by: Namhyung Kim
    Reviewed-by: Adrian Hunter
    Link: http://lkml.kernel.org/r/969812.163009436-sendEmail@nvs
    Signed-off-by: Jiri Olsa

    Vladimir Nikulichev
     
  • Every event in the perf-kvm has a 'stats' structure, which contains
    max/min/average/etc times of handling this event.
    The problem is that the 'perf-kvm stat report' command always shows
    that 'min time' is 0us for every event. Example:

    # perf kvm stat report

    Analyze events for all VCPUs:

    VM-EXIT Samples Samples% Time% Min Time Max Time Avg time
    [..]
    0xB2 MSCH 12 0.07% 0.00% 0us 8us 7.31us ( +- 2.11% )
    0xB2 CHSC 12 0.07% 0.00% 0us 18us 9.39us ( +- 9.49% )
    0xB2 STPX 8 0.05% 0.00% 0us 2us 1.88us ( +- 7.18% )
    0xB2 STSI 7 0.04% 0.00% 0us 44us 16.49us ( +- 38.20% )
    [..]

    This happens because the 'stats' structure is not initialized and
    stats->min equals to 0. Lets initialize the structure for every
    event after its allocation using init_stats() function. This initializes
    stats->min to -1 and makes 'Min time' statistics counting work:

    # perf kvm stat report

    Analyze events for all VCPUs:

    VM-EXIT Samples Samples% Time% Min Time Max Time Avg time
    [..]
    0xB2 MSCH 12 0.07% 0.00% 6us 8us 7.31us ( +- 2.11% )
    0xB2 CHSC 12 0.07% 0.00% 7us 18us 9.39us ( +- 9.49% )
    0xB2 STPX 8 0.05% 0.00% 1us 2us 1.88us ( +- 7.18% )
    0xB2 STSI 7 0.04% 0.00% 1us 44us 16.49us ( +- 38.20% )
    [..]

    Signed-off-by: Alexander Yarygin
    Signed-off-by: Christian Borntraeger
    Reviewed-by: David Ahern
    Link: http://lkml.kernel.org/r/1397053319-2130-3-git-send-email-borntraeger@de.ibm.com
    [ Fixing the perf examples changelog output ]
    Signed-off-by: Jiri Olsa

    Alexander Yarygin
     
  • A va_list needs to be copied in case it needs to be used twice.

    Thanks to Hugh for debugging this issue, leading to various panics.

    Tested:

    lpq84:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern

    'produce_core' is simply : main() { *(int *)0 = 1;}

    lpq84:~# ./produce_core
    Segmentation fault (core dumped)
    lpq84:~# dmesg | tail -1
    [ 614.352947] Core dump to |/foobar12345 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 (null) pipe failed

    Notice the last argument was replaced by a NULL (we were lucky enough to
    not crash, but do not try this on your production machine !)

    After fix :

    lpq83:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern
    lpq83:~# ./produce_core
    Segmentation fault
    lpq83:~# dmesg | tail -1
    [ 740.800441] Core dump to |/foobar12345 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 pipe failed

    Fixes: 5fe9d8ca21cc ("coredump: cn_vprintf() has no reason to call vsnprintf() twice")
    Signed-off-by: Eric Dumazet
    Diagnosed-by: Hugh Dickins
    Acked-by: Oleg Nesterov
    Cc: Neil Horman
    Cc: Andrew Morton
    Cc: stable@vger.kernel.org # 3.11+
    Signed-off-by: Linus Torvalds

    Eric Dumazet
     
  • Pull x86 fix from Ingo Molnar:
    "This fixes the preemption-count imbalance crash reported by Owen
    Kibel"

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/mce: Fix CMCI preemption bugs

    Linus Torvalds
     
  • Pull scheduler fixes from Ingo Molnar:
    "Two fixes:

    - a SCHED_DEADLINE task selection fix
    - a sched/numa related lockdep splat fix"

    * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    sched: Check for stop task appearance when balancing happens
    sched/numa: Fix task_numa_free() lockdep splat

    Linus Torvalds
     
  • Pull perf fixes from Ingo Molnar:
    "Two kernel side fixes:

    - an Intel uncore PMU driver potential crash fix
    - a kprobes/perf-call-graph interaction fix"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf/x86/intel: Use rdmsrl_safe() when initializing RAPL PMU
    kprobes/x86: Fix page-fault handling logic

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "Unfortunately this contains no easter eggs, its a bit larger than I'd
    like, but I included a patch that just moves code from one file to
    another and I'd like to avoid merge conflicts with that later, so it
    makes it seem worse than it is,

    Otherwise:
    - radeon: fixes to use new microcode to stabilise some cards, use
    some common displayport code, some runtime pm fixes, pll regression
    fixes
    - i915: fix for some context oopses, a warn in a used path, backlight
    fixes
    - nouveau: regression fix
    - omap: a bunch of fixes"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (51 commits)
    drm: bochs: drop unused struct fields
    drm: bochs: add power management support
    drm: cirrus: add power management support
    drm: Split out drm_probe_helper.c from drm_crtc_helper.c
    drm/plane-helper: Don't fake-implement primary plane disabling
    drm/ast: fix value check in cbr_scan2
    drm/nouveau/bios: fix a bit shift error introduced by 457e77b
    drm/radeon/ci: make sure mc ucode is loaded before checking the size
    drm/radeon/si: make sure mc ucode is loaded before checking the size
    drm/radeon: improve PLL params if we don't match exactly v2
    drm/radeon: memory leak on bo reservation failure. v2
    drm/radeon: fix VCE fence command
    drm/radeon: re-enable mclk dpm on R7 260X asics
    drm/radeon: add support for newer mc ucode on CI (v2)
    drm/radeon: add support for newer mc ucode on SI (v2)
    drm/radeon: apply more strict limits for PLL params v2
    drm/radeon: update CI DPM powertune settings
    drm/radeon: fix runpm handling on APUs (v4)
    drm/radeon: disable mclk dpm on R7 260X
    drm/tegra: Remove gratuitous pad field
    ...

    Linus Torvalds
     

19 Apr, 2014

18 commits

  • Some i2c fixes over DisplayPort.

    * 'drm-next-3.15-wip' of git://people.freedesktop.org/~deathsimple/linux:
    drm/radeon: Improve vramlimit module param documentation
    drm/radeon: fix audio pin counts for DCE6+ (v2)
    drm/radeon/dp: switch to the common i2c over aux code
    drm/dp/i2c: Update comments about common i2c over dp assumptions (v3)
    drm/dp/i2c: send bare addresses to properly reset i2c connections (v4)
    drm/radeon/dp: handle zero sized i2c over aux transactions (v2)
    drm/i915: support address only i2c-over-aux transactions
    drm/tegra: dp: Support address-only I2C-over-AUX transactions

    Dave Airlie
     
  • Pull more networking fixes from David Miller:

    1) Fix mlx4_en_netpoll implementation, it needs to schedule a NAPI
    context, not synchronize it. From Chris Mason.

    2) Ipv4 flow input interface should never be zero, it should be
    LOOPBACK_IFINDEX instead. From Cong Wang and Julian Anastasov.

    3) Properly configure MAC to PHY connection in mvneta devices, from
    Thomas Petazzoni.

    4) sys_recv should use SYSCALL_DEFINE. From Jan Glauber.

    5) Tunnel driver ioctls do not use the correct namespace, fix from
    Nicolas Dichtel.

    6) Fix memory leak on seccomp filter attach, from Kees Cook.

    7) Fix lockdep warning for nested vlans, from Ding Tianhong.

    8) Crashes can happen in SCTP due to how the auth_enable value is
    managed, fix from Vlad Yasevich.

    9) Wireless fixes from John W Linville and co.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (45 commits)
    net: sctp: cache auth_enable per endpoint
    tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled
    vlan: Fix lockdep warning when vlan dev handle notification
    seccomp: fix memory leak on filter attach
    isdn: icn: buffer overflow in icn_command()
    ip6_tunnel: use the right netns in ioctl handler
    sit: use the right netns in ioctl handler
    ip_tunnel: use the right netns in ioctl handler
    net: use SYSCALL_DEFINEx for sys_recv
    net: mdio-gpio: Add support for separate MDI and MDO gpio pins
    net: mdio-gpio: Add support for active low gpio pins
    net: mdio-gpio: Use devm_ functions where possible
    ipv4, route: pass 0 instead of LOOPBACK_IFINDEX to fib_validate_source()
    ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif
    mlx4_en: don't use napi_synchronize inside mlx4_en_netpoll
    net: mvneta: properly configure the MAC PHY connection in all situations
    net: phy: add minimal support for QSGMII PHY
    sfc:On MCDI timeout, issue an FLR (and mark MCDI to fail-fast)
    mwifiex: fix hung task on command timeout
    mwifiex: process event before command response
    ...

    Linus Torvalds
     
  • Pull cifs fixes from Steve French:
    "A set of 5 small cifs fixes"

    * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
    cif: fix dead code
    cifs: fix error handling cifs_user_readv
    fs: cifs: remove unused variable.
    Return correct error on query of xattr on file with empty xattrs
    cifs: Wait for writebacks to complete before attempting write.

    Linus Torvalds
     
  • Pull char/misc driver fixes from Greg KH:
    "Here are a few driver fixes for char/misc drivers that resolve
    reported issues.

    All have been in linux-next successfully for a few days"

    * tag 'char-misc-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
    Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts
    Tools: hv: Handle the case when the target file exists correctly
    vme_tsi148: Utilize to_pci_dev() macro
    vme_tsi148: Fix PCI address mapping assumption
    vme_tsi148: Fix typo in tsi148_slave_get()
    w1: avoid recursive device_add
    w1: fix netlink refcnt leak on error path
    misc: Grammar s/addition/additional/
    drivers: mcb: fix memory leak in chameleon_parse_cells() error path
    mei: ignore client writing state during cb completion
    mei: me: do not load the driver if the FW doesn't support MEI interface
    GenWQE: Increase driver version number
    GenWQE: Fix multithreading problems
    GenWQE: Ensure rc is not returning an uninitialized value
    GenWQE: Add wmb before DDCB is started
    GenWQE: Enable access to VPD flash area

    Linus Torvalds
     
  • Pull driver core fixes from Greg KH:
    "Here are some driver core fixes for 3.15-rc2. Also in here are some
    documentation updates, as well as an API removal that had to wait for
    after -rc1 due to the cleanups coming into you from multiple developer
    trees (this one and the PPC tree.)

    All have been in linux next successfully"

    * tag 'driver-core-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
    drivers/base/dd.c incorrect pr_debug() parameters
    Documentation: Update stable address in Chinese and Japanese translations
    topology: Fix compilation warning when not in SMP
    Chinese: add translation of io_ordering.txt
    stable_kernel_rules: spelling/word usage
    sysfs, driver-core: remove unused {sysfs|device}_schedule_callback_owner()
    kernfs: protect lazy kernfs_iattrs allocation with mutex
    fs: Don't return 0 from get_anon_bdev

    Linus Torvalds
     
  • Pull staging driver fixes from Greg KH:
    "Here are a few staging driver fixes for issues that have been reported
    for 3.15-rc2.

    Also dominating the diffstat for the pull request is the removal of
    the rtl8187se driver. It's no longer needed in staging as a "real"
    driver for this hardware is now merged in the tree in the "correct"
    location in drivers/net/

    All of these patches have been tested in linux-next"

    * tag 'staging-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: r8188eu: Fix case where ethtype was never obtained and always be checked against 0
    staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
    staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL
    staging: comedi: fix circular locking dependency in comedi_mmap()
    staging: r8723au: Add missing initialization of change_inx in sort algorithm
    Staging: unisys: use after free in list_for_each()
    staging: unisys: use after free in error messages
    staging: speakup: fix misuse of kstrtol() in handle_goto()
    staging: goldfish: Call free_irq in error path
    staging: delete rtl8187se wireless driver
    staging: rtl8723au: Fix buffer overflow in rtw_get_wfd_ie()
    staging: gs_fpgaboot: remove __TIMESTAMP__ macro
    staging: vme: fix memory leak in vme_user_probe()
    staging: fpgaboot: clean up Makefile
    staging/usbip: fix store_attach() sscanf return value check
    staging/usbip: userspace - fix usbipd SIGSEGV from refresh_exported_devices()
    staging: rtl8188eu: remove spaces, correct counts to unbreak P2P ioctls
    staging/rtl8821ae: Fix OOM handling in _rtl_init_deferred_work()

    Linus Torvalds
     
  • Pull tty/serial driver fixes from Greg KH:
    "Here are a number of small tty/serial driver fixes for 3.15-rc2. Also
    in here are some Documentation file removals for drivers that we
    removed a long time ago, no need to keep it around any longer.

    All of these have been in linux-next for a bit"

    * tag 'tty-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    Revert "serial: 8250, disable "too much work" messages"
    serial: amba-pl011: fix regression, causing an Oops on rmmod
    tty: Fix help text of SYNCLINK_CS
    tty: fix memleak in alloc_pid
    ttyprintk: Allow built as a module
    ttyprintk: Fix wrong tty_unregister_driver() call in the error path
    serial: 8250, disable "too much work" messages
    Documentation/serial: Delete obsolete driver documentation
    serial: omap: Fix missing pm_runtime_resume handling by simplifying code
    serial_core: Fix pm imbalance on unbind
    serial: pl011: change Rx burst size to half of trigger level
    serial: timberdale: Depend on X86_32
    serial: st-asc: Fix SysRq char handling
    Revert "serial: clps711x: Give a chance to perform useful tasks during wait loop"
    serial_core: Fix conditional start_tx on ring buffer not empty
    serial: efm32: use $vendor,$device scheme for compatible string
    serial: omap: free the wakeup settings in remove

    Linus Torvalds
     
  • Pull USB fixes from Greg KH:
    "Here are a number of tiny USB fixes and new device ids for 3.15-rc2.
    Nothing major, just issues some people have reported.

    All of these have been in linux-next"

    * tag 'usb-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
    uas: fix deadlocky memory allocations
    uas: fix error handling during scsi_scan()
    uas: fix GFP_NOIO under spinlock
    uwb: adds missing error handling
    USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver
    USB: ohci-jz4740: FEAT_POWER is a port feature, not a hub feature
    USB: ohci-jz4740: Fix uninitialized variable warning
    USB: EHCI: tegra: set txfill_tuning
    usb: ehci-platform: Return immediately from suspend if ehci_suspend fails
    usb: ehci-exynos: Return immediately from suspend if ehci_suspend fails
    USB: fix crash during hotplug of PCI USB controller card
    USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate()
    usb: usb-common: fix typo for usb_state_string
    USB: usb_wwan: fix handling of missing bulk endpoints
    USB: pl2303: add ids for Hewlett-Packard HP POS pole displays
    USB: cp210x: Add 8281 (Nanotec Plug & Drive)
    usb: option driver, add support for Telit UE910v2
    Revert "USB: serial: add usbid for dell wwan card to sierra.c"
    USB: serial: ftdi_sio: add id for Brainboxes serial cards

    Linus Torvalds
     
  • Merge misc fixes from Andrew Morton:
    "13 fixes"

    * emailed patches from Andrew Morton :
    thp: close race between split and zap huge pages
    mm: fix new kernel-doc warning in filemap.c
    mm: fix CONFIG_DEBUG_VM_RB description
    mm: use paravirt friendly ops for NUMA hinting ptes
    mips: export flush_icache_range
    mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()
    wait: explain the shadowing and type inconsistencies
    Shiraz has moved
    Documentation/vm/numa_memory_policy.txt: fix wrong document in numa_memory_policy.txt
    powerpc/mm: fix ".__node_distance" undefined
    kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()
    init/Kconfig: move the trusted keyring config option to general setup
    vmscan: reclaim_clean_pages_from_list() must use mod_zone_page_state()

    Linus Torvalds
     
  • Sasha Levin has reported two THP BUGs[1][2]. I believe both of them
    have the same root cause. Let's look to them one by one.

    The first bug[1] is "kernel BUG at mm/huge_memory.c:1829!". It's
    BUG_ON(mapcount != page_mapcount(page)) in __split_huge_page(). From my
    testing I see that page_mapcount() is higher than mapcount here.

    I think it happens due to race between zap_huge_pmd() and
    page_check_address_pmd(). page_check_address_pmd() misses PMD which is
    under zap:

    CPU0 CPU1
    zap_huge_pmd()
    pmdp_get_and_clear()
    __split_huge_page()
    anon_vma_interval_tree_foreach()
    __split_huge_page_splitting()
    page_check_address_pmd()
    mm_find_pmd()
    /*
    * We check if PMD present without taking ptl: no
    * serialization against zap_huge_pmd(). We miss this PMD,
    * it's not accounted to 'mapcount' in __split_huge_page().
    */
    pmd_present(pmd) == 0

    BUG_ON(mapcount != page_mapcount(page)) // CRASH!!!

    page_remove_rmap(page)
    atomic_add_negative(-1, &page->_mapcount)

    The second bug[2] is "kernel BUG at mm/huge_memory.c:1371!".
    It's VM_BUG_ON_PAGE(!PageHead(page), page) in zap_huge_pmd().

    This happens in similar way:

    CPU0 CPU1
    zap_huge_pmd()
    pmdp_get_and_clear()
    page_remove_rmap(page)
    atomic_add_negative(-1, &page->_mapcount)
    __split_huge_page()
    anon_vma_interval_tree_foreach()
    __split_huge_page_splitting()
    page_check_address_pmd()
    mm_find_pmd()
    pmd_present(pmd) == 0 /* The same comment as above */
    /*
    * No crash this time since we already decremented page->_mapcount in
    * zap_huge_pmd().
    */
    BUG_ON(mapcount != page_mapcount(page))

    /*
    * We split the compound page here into small pages without
    * serialization against zap_huge_pmd()
    */
    __split_huge_page_refcount()
    VM_BUG_ON_PAGE(!PageHead(page), page); // CRASH!!!

    So my understanding the problem is pmd_present() check in mm_find_pmd()
    without taking page table lock.

    The bug was introduced by me commit with commit 117b0791ac42. Sorry for
    that. :(

    Let's open code mm_find_pmd() in page_check_address_pmd() and do the
    check under page table lock.

    Note that __page_check_address() does the same for PTE entires
    if sync != 0.

    I've stress tested split and zap code paths for 36+ hours by now and
    don't see crashes with the patch applied. Before it took
    [2] https://lkml.kernel.org/g/

    Signed-off-by: Kirill A. Shutemov
    Reported-by: Sasha Levin
    Tested-by: Sasha Levin
    Cc: Bob Liu
    Cc: Andrea Arcangeli
    Cc: Rik van Riel
    Cc: Mel Gorman
    Cc: Michel Lespinasse
    Cc: Dave Jones
    Cc: Vlastimil Babka
    Cc: [3.13+]

    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kirill A. Shutemov
     
  • Fix new kernel-doc warning in mm/filemap.c:

    Warning(mm/filemap.c:2600): Excess function parameter 'ppos' description in '__generic_file_aio_write'

    Signed-off-by: Randy Dunlap
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Randy Dunlap
     
  • This appears to be a copy/paste error. Update the description to
    reflect extra rbtree debug and checks for the config option instead of
    duplicating CONFIG_DEBUG_VM.

    Signed-off-by: Davidlohr Bueso
    Cc: Aswin Chandramouleeswaran
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Davidlohr Bueso
     
  • David Vrabel identified a regression when using automatic NUMA balancing
    under Xen whereby page table entries were getting corrupted due to the
    use of native PTE operations. Quoting him

    Xen PV guest page tables require that their entries use machine
    addresses if the preset bit (_PAGE_PRESENT) is set, and (for
    successful migration) non-present PTEs must use pseudo-physical
    addresses. This is because on migration MFNs in present PTEs are
    translated to PFNs (canonicalised) so they may be translated back
    to the new MFN in the destination domain (uncanonicalised).

    pte_mknonnuma(), pmd_mknonnuma(), pte_mknuma() and pmd_mknuma()
    set and clear the _PAGE_PRESENT bit using pte_set_flags(),
    pte_clear_flags(), etc.

    In a Xen PV guest, these functions must translate MFNs to PFNs
    when clearing _PAGE_PRESENT and translate PFNs to MFNs when setting
    _PAGE_PRESENT.

    His suggested fix converted p[te|md]_[set|clear]_flags to using
    paravirt-friendly ops but this is overkill. He suggested an alternative
    of using p[te|md]_modify in the NUMA page table operations but this is
    does more work than necessary and would require looking up a VMA for
    protections.

    This patch modifies the NUMA page table operations to use paravirt
    friendly operations to set/clear the flags of interest. Unfortunately
    this will take a performance hit when updating the PTEs on
    CONFIG_PARAVIRT but I do not see a way around it that does not break
    Xen.

    Signed-off-by: Mel Gorman
    Acked-by: David Vrabel
    Tested-by: David Vrabel
    Cc: Ingo Molnar
    Cc: Peter Anvin
    Cc: Fengguang Wu
    Cc: Linus Torvalds
    Cc: Steven Noonan
    Cc: Rik van Riel
    Cc: Peter Zijlstra
    Cc: Andrea Arcangeli
    Cc: Dave Hansen
    Cc: Srikar Dronamraju
    Cc: Cyrill Gorcunov
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mel Gorman
     
  • The lkdtm module performs tests against executable memory ranges, so it
    needs to flush the icache for proper behaviors. Other architectures
    already export this, so do the same for MIPS.

    [akpm@linux-foundation.org: relocate export sites]
    Signed-off-by: Kees Cook
    Cc: Paul Gortmaker
    Cc: Ralf Baechle
    Cc: Sanjay Lal
    Cc: John Crispin
    Cc: Sergei Shtylyov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kees Cook
     
  • soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm:
    hugetlb: fix softlockup when a large number of hugepages are freed." can
    happen in return_unused_surplus_pages(), so let's fix it.

    Signed-off-by: Masayoshi Mizuma
    Signed-off-by: Naoya Horiguchi
    Cc: Joonsoo Kim
    Cc: Michal Hocko
    Cc: Aneesh Kumar
    Cc: KOSAKI Motohiro
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mizuma, Masayoshi
     
  • Stick in a comment before someone else tries to fix the sparse warning
    this generates.

    Suggested-by: Andrew Morton
    Signed-off-by: Peter Zijlstra
    Link: http://lkml.kernel.org/n/tip-o2ro6f3vkxklni0bc8f7m68s@git.kernel.org
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Peter Zijlstra
     
  • shiraz.hashim@st.com email-id doesn't exist anymore as he has left the
    company. Replace ST's id with shiraz.linux.kernel@gmail.com.

    It also updates .mailmap file to fix address for 'git shortlog'.

    Signed-off-by: Viresh Kumar
    Cc: Shiraz Hashim
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Viresh Kumar
     
  • In document numa_memory_policy.txt, the following examples for flag
    MPOL_F_RELATIVE_NODES are incorrect.

    For example, consider a task that is attached to a cpuset with
    mems 2-5 that sets an Interleave policy over the same set with
    MPOL_F_RELATIVE_NODES. If the cpuset's mems change to 3-7, the
    interleave now occurs over nodes 3,5-6. If the cpuset's mems
    then change to 0,2-3,5, then the interleave occurs over nodes
    0,3,5.

    According to the comment of the patch adding flag MPOL_F_RELATIVE_NODES,
    the nodemasks the user specifies should be considered relative to the
    current task's mems_allowed.

    (https://lkml.org/lkml/2008/2/29/428)

    And according to numa_memory_policy.txt, if the user's nodemask includes
    nodes that are outside the range of the new set of allowed nodes, then
    the remap wraps around to the beginning of the nodemask and, if not
    already set, sets the node in the mempolicy nodemask.

    So in the example, if the user specifies 2-5, for a task whose
    mems_allowed is 3-7, the nodemasks should be remapped the third, fourth,
    fifth, sixth node in mems_allowed. like the following:

    mems_allowed: 3 4 5 6 7

    relative index: 0 1 2 3 4
    5

    So the nodemasks should be remapped to 3,5-7, but not 3,5-6.

    And for a task whose mems_allowed is 0,2-3,5, the nodemasks should be
    remapped to 0,2-3,5, but not 0,3,5.

    mems_allowed: 0 2 3 5

    relative index: 0 1 2 3
    4 5

    Signed-off-by: Tang Chen
    Cc: Randy Dunlap
    Acked-by: David Rientjes
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tang Chen