01 Jun, 2014

1 commit

  • Pull drm fixes from Dave Airlie:
    "Mostly quiet now:

    i915:
    fixing userspace visiblie issues, all stable marked

    radeon:
    one more pll fix, two crashers, one suspend/resume regression"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm/radeon: Resume fbcon last
    drm/radeon: only allocate necessary size for vm bo list
    drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission
    drm/radeon: avoid crash if VM command submission isn't available
    drm/radeon: lower the ref * post PLL maximum once more
    drm/i915: Prevent negative relocation deltas from wrapping
    drm/i915: Only copy back the modified fields to userspace from execbuffer
    drm/i915: Fix dynamic allocation of physical handles

    Linus Torvalds
     

31 May, 2014

4 commits

  • So a few people complained that

    commit 177cf92de4aa97ec1435987e91696ed8b5023130
    Author: Daniel Vetter
    Date: Tue Apr 1 22:14:59 2014 +0200

    drm/crtc-helpers: fix dpms on logic

    which was merged into 3.15-rc1, broke resume on radeons. Strangely git
    bisect lead everyone to

    commit 25f397a429dfa43f22c278d0119a60a343aa568f
    Author: Daniel Vetter
    Date: Fri Jul 19 18:57:11 2013 +0200

    drm/crtc-helper: explicit DPMS on after modeset

    which was merged long ago and actually part of 3.14.

    Digging deeper I've noticed (again) that the call to
    drm_helper_resume_force_mode in the radeon resume handlers was a no-op
    previously because everything gets shut down on suspend. radeon does
    this with explicit calls to drm_helper_connector_dpms with DPMS_OFF.
    But with 177c we now force the dpms state to ON, so suddenly
    resume_force_mode actually forced the crtcs back on.

    This is the intention of the change after all, the problem is that
    radeon resumes the fbdev console layer _before_ restoring the display,
    through calling fb_set_suspend. And fbcon does an immediate ->set_par,
    which in turn causes the same forced mode restore to happen.

    Two concurrent modeset operations didn't lead to happiness. Fix this
    by delaying the fbcon resume until the end of the readeon resum
    functions.

    v2: Fix up a bit of the spelling fail.

    References: https://lkml.org/lkml/2014/5/29/1043
    References: https://lkml.org/lkml/2014/5/2/388
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=74751
    Tested-by: Ken Moffat
    Cc: Alex Deucher
    Cc: Ken Moffat
    Signed-off-by: Daniel Vetter
    Signed-off-by: Dave Airlie

    Daniel Vetter
     
  • Pull input subsystem fixes from Dmitry Torokhov:
    "A couple of driver/build fixups and also redone quirk for Synaptics
    touchpads on Lenovo boxes (now using PNP IDs instead of DMI data to
    limit number of quirks)"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
    Input: synaptics - change min/max quirk table to pnp-id matching
    Input: synaptics - add a matches_pnp_id helper function
    Input: synaptics - T540p - unify with other LEN0034 models
    Input: synaptics - add min/max quirk for the ThinkPad W540
    Input: ambakmi - request a shared interrupt for AMBA KMI devices
    Input: pxa27x-keypad - fix generating scancode
    Input: atmel-wm97xx - only build for AVR32
    Input: fix ps2/serio module dependency

    Linus Torvalds
     
  • Pull firewire fix from Stefan Richter:
    "A regression fix for the IEEE 1394 subsystem: re-enable IRQ-based
    asynchronous request reception at addresses below 128 TB"

    * tag 'firewire-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
    firewire: revert to 4 GB RDMA, fix protocols using Memory Space

    Linus Torvalds
     
  • Pull device-mapper fixes from Mike Snitzer:
    "A dm-cache stable fix to split discards on cache block boundaries
    because dm-cache cannot yet handle discards that span cache blocks.

    Really fix a dm-mpath LOCKDEP warning that was introduced in -rc1.

    Add a 'no_space_timeout' control to dm-thinp to restore the ability to
    queue IO indefinitely when no data space is available. This fixes a
    change in behavior that was introduced in -rc6 where the timeout
    couldn't be disabled"

    * tag 'dm-3.15-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
    dm mpath: really fix lockdep warning
    dm cache: always split discards on cache block boundaries
    dm thin: add 'no_space_timeout' dm-thin-pool module param

    Linus Torvalds
     

30 May, 2014

6 commits


29 May, 2014

1 commit

  • Undo a feature introduced in v3.14 by commit fcd46b34425d
    "firewire: Enable remote DMA above 4 GB". That change raised the
    minimum address at which protocol drivers and user programs can register
    for request reception from 0x0001'0000'0000 to 0x8000'0000'0000.
    It turned out that at least one vendor-specific protocol exists which
    uses lower addresses: https://bugzilla.kernel.org/show_bug.cgi?id=76921

    For the time being, revert most of commit fcd46b34425d so that affected
    protocols work like with kernel v3.13 and before. Just keep the valid
    documentation parts from the regressing commit, and the ability to
    identify controllers which could be programmed to accept >32 bit
    physical DMA addresses. The rest of fcd46b34425d should probably be
    brought back as an optional instead of default feature.

    Reported-by: Fabien Spindler
    Cc: # 3.14+
    Signed-off-by: Stefan Richter

    Stefan Richter
     

28 May, 2014

5 commits


27 May, 2014

10 commits

  • lockdep complains about a circular locking. And indeed, we need to
    release the lock before calling dm_table_run_md_queue_async().

    As such, commit 4cdd2ad ("dm mpath: fix lock order inconsistency in
    multipath_ioctl") must also be reverted in addition to fixing the
    lock order in the other dm_table_run_md_queue_async() callers.

    Reported-by: Bart van Assche
    Tested-by: Bart van Assche
    Signed-off-by: Hannes Reinecke
    Signed-off-by: Mike Snitzer

    Hannes Reinecke
     
  • When there isn't enough vring descriptor for adding to vq,
    blk-mq will be put as stopped state until some of pending
    descriptors are completed & freed.

    Unfortunately, the vq's interrupt may come just before
    blk-mq's BLK_MQ_S_STOPPED flag is set, so the blk-mq will
    still be kept as stopped even though lots of descriptors
    are completed and freed in the interrupt handler. The worst
    case is that all pending descriptors are freed in the
    interrupt handler, and the queue is kept as stopped forever.

    This patch fixes the problem by starting/stopping blk-mq
    with holding vq_lock.

    Cc: Jens Axboe
    Cc: Rusty Russell
    Signed-off-by: Ming Lei
    Cc: stable@kernel.org
    Signed-off-by: Jens Axboe

    Conflicts:
    drivers/block/virtio_blk.c

    Ming Lei
     
  • The DM cache target cannot cope with discards that span multiple cache
    blocks, so each discard bio that spans more than one cache block must
    get split by the DM core.

    Signed-off-by: Heinz Mauelshagen
    Acked-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org # v3.9+

    Heinz Mauelshagen
     
  • This is pure evil. Userspace, I'm looking at you SNA, repacks batch
    buffers on the fly after generation as they are being passed to the
    kernel for execution. These batches also contain self-referenced
    relocations as a single buffer encompasses the state commands, kernels,
    vertices and sampler. During generation the buffers are placed at known
    offsets within the full batch, and then the relocation deltas (as passed
    to the kernel) are tweaked as the batch is repacked into a smaller buffer.
    This means that userspace is passing negative relocations deltas, which
    subsequently wrap to large values if the batch is at a low address. The
    GPU hangs when it then tries to use the large value as a base for its
    address offsets, rather than wrapping back to the real value (as one
    would hope). As the GPU uses positive offsets from the base, we can
    treat the relocation address as the minimum address read by the GPU.
    For the upper bound, we trust that userspace will not read beyond the
    end of the buffer.

    So, how do we fix negative relocations from wrapping? We can either
    check that every relocation looks valid when we write it, and then
    position each object such that we prevent the offset wraparound, or we
    just special-case the self-referential behaviour of SNA and force all
    batches to be above 256k. Daniel prefers the latter approach.

    This fixes a GPU hang when it tries to use an address (relocation +
    offset) greater than the GTT size. The issue would occur quite easily
    with full-ppgtt as each fd gets its own VM space, so low offsets would
    often be handed out. However, with the rearrangement of the low GTT due
    to capturing the BIOS framebuffer, it is already affecting kernels 3.15
    onwards. I think only IVB+ is susceptible to this bug, but the workaround
    should only kick in rarely, so it seems sensible to always apply it.

    v3: Use a bias for batch buffers to prevent small negative delta relocations
    from wrapping.

    v4 from Daniel:
    - s/BIAS/BATCH_OFFSET_BIAS/
    - Extract eb_vma_misplaced/i915_vma_misplaced since the conditions
    were growing rather cumbersome.
    - Add a comment to eb_get_batch explaining why we do this.
    - Apply the batch offset bias everywhere but mention that we've only
    observed it on gen7 gpus.
    - Drop PIN_OFFSET_FIX for now, that slipped in from a feature patch.

    v5: Add static to eb_get_batch, spotted by 0-day tester.

    Testcase: igt/gem_bad_reloc
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78533
    Signed-off-by: Chris Wilson (v3)
    Cc: stable@vger.kernel.org
    Signed-off-by: Daniel Vetter

    Chris Wilson
     
  • We only want to modifiy a single field in the userspace view of the
    execbuffer command buffer, so explicitly change that rather than copy
    everything back again.

    This serves two purposes:

    1. The single fields are much cheaper to copy (constant size so the
    copy uses special case code) and much smaller than the whole array.

    2. We modify the array for internal use that need to be masked from
    the user.

    Note: We need this backported since without it the next bugfix will
    blow up when userspace recycles batchbuffers and relocations.

    Signed-off-by: Chris Wilson
    Cc: Daniel Vetter
    Cc: stable@vger.kernel.org
    Signed-off-by: Daniel Vetter

    Chris Wilson
     
  • A single object may be referenced by multiple registers fundamentally
    breaking the static allotment of ids in the current design. When the
    object is used the second time, the physical address of the first
    assignment is relinquished and a second one granted. However, the
    hardware is still reading (and possibly writing) to the old physical
    address now returned to the system. Eventually hilarity will ensue, but
    in the short term, it just means that cursors are broken when using more
    than one pipe.

    v2: Fix up leak of pci handle when handling an error during attachment,
    and avoid a double kmap/kunmap. (Ville)
    Rebase against -fixes.

    v3: And fix the error handling added in v2 (Ville)

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77351
    Signed-off-by: Chris Wilson
    Cc: Ville Syrjälä
    Cc: Jani Nikula
    Cc: stable@vger.kernel.org
    Reviewed-by: Ville Syrjälä
    Signed-off-by: Daniel Vetter

    Chris Wilson
     
  • Most of the affected models share pnp-ids for the touchpad. So switching
    to pnp-ids give us 2 advantages:
    1) It shrinks the quirk list
    2) It will lower the new quirk addition frequency, ie the recently added W540
    quirk would not have been necessary since it uses the same LEN0034 pnp ids
    as other models already added before it

    As an added bonus it actually puts the quirk on the actual psmouse, rather
    then on the machine, which is technically more correct.

    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede
    Signed-off-by: Dmitry Torokhov

    Hans de Goede
     
  • This is a preparation patch for simplifying the min/max quirk table.

    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede
    Signed-off-by: Dmitry Torokhov

    Hans de Goede
     
  • The T540p has a touchpad with pnp-id LEN0034, all the models with this
    pnp-id have the same min/max values, except the T540p where the values are
    slightly off. Fix them to be identical.

    This is a preparation patch for simplifying the quirk table.

    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede
    Signed-off-by: Dmitry Torokhov

    Hans de Goede
     
  • * pm-cpufreq:
    cpufreq: cpu0: drop wrong devm usage
    cpufreq: remove race while accessing cur_policy

    * acpi-thermal:
    ACPI / thermal: fix workqueue destroy order

    Rafael J. Wysocki
     

26 May, 2014

3 commits


25 May, 2014

2 commits

  • The mapping from OF device IDs to platform device IDs is wrong.
    TYPE_NCPXXWB473 is 0, TYPE_NCPXXWL333 is 1, so
    ntc_thermistor_id[TYPE_NCPXXWB473] is { "ncp15wb473", TYPE_NCPXXWB473 }
    while
    ntc_thermistor_id[TYPE_NCPXXWL333] is { "ncp18wb473", TYPE_NCPXXWB473 }.

    So the name is wrong for all but the "ntc,ncp15wb473" entry, and the
    type is wrong for the "ntc,ncp15wl333" entry.

    So map the entries by index, it is neither elegant nor robust but at
    least it is correct.

    Signed-off-by: Jean Delvare
    Fixes: 9e8269de hwmon: (ntc_thermistor) Add DT with IIO support to NTC thermistor driver
    Reviewed-by: Guenter Roeck
    Cc: Naveen Krishna Chatradhi
    Cc: Doug Anderson

    Jean Delvare
     
  • In commit 9e8269de, support was added for ntc_thermistor devices being
    declared in the device tree and implemented on top of IIO. With that
    change, a dependency was added to the ntc_thermistor driver:

    depends on (!OF && !IIO) || (OF && IIO)

    This construct has the drawback that the driver can no longer be
    selected when OF is set and IIO isn't, nor when IIO is set and OF is
    not. This is a regression for the original users of the driver.

    As the new code depends on IIO and is useless without OF, include it
    only if both are enabled, and set the dependencies accordingly. This
    is clearer, more simple and more correct.

    Signed-off-by: Jean Delvare
    Fixes: 9e8269de hwmon: (ntc_thermistor) Add DT with IIO support to NTC thermistor driver
    Reviewed-by: Guenter Roeck
    Cc: Naveen Krishna Chatradhi
    Cc: Doug Anderson

    Jean Delvare
     

24 May, 2014

4 commits

  • Pull dmaengine fixes from Dan Williams:
    "Two fixes for -stable:

    - async_mult() sometimes maps less buffers than initially requested.
    We end up freeing dmaengine_unmap_data on an invalid pool.

    - mv_xor: register write ordering fix"

    * tag 'dmaengine-fixes-3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine:
    dmaengine: fix dmaengine_unmap failure
    dma: mv_xor: Flush descriptors before activating a channel

    Linus Torvalds
     
  • Pull networking fixes from David Miller:
    "It looks like a sizeble collection but this is nearly 3 weeks of bug
    fixing while you were away.

    1) Fix crashes over IPSEC tunnels with NAT, the latter can reroute
    the packet through a non-IPSEC protected path and the code has to
    be able to handle SKBs attached to routes lacking an attached xfrm
    state. From Steffen Klassert.

    2) Fix OOPSs in ipv4 and ipv6 ipsec layers for unsupported
    sub-protocols, also from Steffen Klassert.

    3) Set local_df on fragmented netfilter skbs otherwise we won't be
    able to forward successfully, from Florian Westphal.

    4) cdc_mbim ipv6 neighbour code does __vlan_find_dev_deep without
    holding RCU lock, from Bjorn Mork.

    5) local_df test in ip_may_fragment is inverted, from Florian
    Westphal.

    6) jme driver doesn't check for DMA mapping failures, from Neil
    Horman.

    7) qlogic driver doesn't calculate number of TX queues properly, from
    Shahed Shaikh.

    8) fib_info_cnt can drift irreversibly positive if we fail to
    allocate the fi->fib_metrics array, from Sergey Popovich.

    9) Fix use after free in ip6_route_me_harder(), also from Sergey
    Popovich.

    10) When SYSCTL is disabled, we don't handle local_port_range and
    ping_group_range defaults properly at all, from Cong Wang.

    11) Unaccelerated VLAN tagged frames improperly handled by cdc_mbim
    driver, fix from Bjorn Mork.

    12) cassini driver needs nested lock annotations for TX locking, from
    Emil Goode.

    13) On init error ipv6 VTI driver can unregister pernet ops twice,
    oops. Fix from Mahtias Krause.

    14) If macvlan device is down, don't propagate IFF_ALLMULTI changes,
    from Peter Christensen.

    15) Missing NULL pointer check while parsing netlink config options in
    ip6_tnl_validate(). From Susant Sahani.

    16) Fix handling of neighbour entries during ipv6 router reachability
    probing, from Duan Jiong.

    17) x86 and s390 JIT address randomization has some address
    calculation bugs leading to crashes, from Alexei Starovoitov and
    Heiko Carstens.

    18) Clear up those uglies with nop patching and net_get_random_once(),
    from Hannes Frederic Sowa.

    19) Option length miscalculated in ip6_append_data(), fix also from
    Hannes Frederic Sowa.

    20) A while ago we fixed a race during device unregistry when a
    namespace went down, turns out there is a second place that needs
    similar protection. From Cong Wang.

    21) In the new Altera TSE driver multicast filtering isn't working,
    disable it and just use promisc mode until the cause is found.
    From Vince Bridgers.

    22) When we disable router enabling in ipv6 we have to flush the
    cached routes explicitly, from Duan Jiong.

    23) NBMA tunnels should not cache routes on the tunnel object because
    the key is variable, from Timo Teräs.

    24) With stacked devices GRO information in skb->cb[] can be not setup
    properly, make sure it is in all code paths. From Eric Dumazet.

    25) Really fix stacked vlan locking, multiple levels of nesting with
    intervening non-vlan devices are possible. From Vlad Yasevich.

    26) Fallback ipip tunnel device's mtu is not setup properly, from
    Steffen Klassert.

    27) The packet scheduler's tcindex filter can crash because we
    structure copy objects with list_head's inside, oops. From Cong
    Wang.

    28) Fix CHECKSUM_COMPLETE handling for ipv6 GRE tunnels, from Eric
    Dumazet.

    29) In some configurations 'itag' in __mkroute_input() can end up
    being used uninitialized because of how fib_validate_source()
    works. Fix it by explitly initializing itag to zero like all the
    other fib_validate_source() callers do, from Li RongQing"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
    batman: fix a bogus warning from batadv_is_on_batman_iface()
    ipv4: initialise the itag variable in __mkroute_input
    bonding: Send ALB learning packets using the right source
    bonding: Don't assume 802.1Q when sending alb learning packets.
    net: doc: Update references to skb->rxhash
    stmmac: Remove unbalanced clk_disable call
    ipv6: gro: fix CHECKSUM_COMPLETE support
    net_sched: fix an oops in tcindex filter
    can: peak_pci: prevent use after free at netdev removal
    ip_tunnel: Initialize the fallback device properly
    vlan: Fix build error wth vlan_get_encap_level()
    can: c_can: remove obsolete STRICT_FRAME_ORDERING Kconfig option
    MAINTAINERS: Pravin Shelar is Open vSwitch maintainer.
    bnx2x: Convert return 0 to return rc
    bonding: Fix alb mode to only use first level vlans.
    bonding: Fix stacked device detection in arp monitoring
    macvlan: Fix lockdep warnings with stacked macvlan devices
    vlan: Fix lockdep warning with stacked vlan devices.
    net: Allow for more then a single subclass for netif_addr_lock
    net: Find the nesting level of a given device by type.
    ...

    Linus Torvalds
     
  • When it fails to allocate div, gate should be free'd before return

    Signed-off-by: Valentin Ilie
    Signed-off-by: Mike Turquette

    Valentin Ilie
     
  • Commit 1d9fe6b97 ("clk: divider: Fix best div calculation for power-of-two and
    table dividers") introduces a regression in its _table_round_up function.

    When the divider passed to this function is greater than the max divider
    available in the table, this function returns table's max divider.
    Problem is that it causes an infinite loop in clk_divider_bestdiv() because
    _next_div() will never return a value greater than maxdiv.

    Instead of returning table's max divider, this patch returns INT_MAX.

    Reported-by: Fabio Estevam
    Reported-by: Shawn Guo
    Tested-by: Fabio Estevam
    Tested-by: Shawn Guo
    Signed-off-by: Maxime Coquelin
    Signed-off-by: Mike Turquette

    Maxime COQUELIN
     

23 May, 2014

4 commits

  • The recent change in sysfs, bcdde7e221a8750f9b62b6d0bd31b72ea4ad9309
    "sysfs: make __sysfs_remove_dir() recursive" revealed an asymmetric
    rphy device creation/deletion sequence in scsi_transport_sas:

    modprobe mpt2sas
    sas_rphy_add
    device_add A rphy->dev
    device_add B sas_device transport class
    device_add C sas_end_device transport class
    device_add D bsg class

    rmmod mpt2sas
    sas_rphy_delete
    sas_rphy_remove
    device_del B
    device_del C
    device_del A
    sysfs_remove_group recursive sysfs dir removal
    sas_rphy_free
    device_del D warning

    where device A is the parent of B, C, and D.

    When sas_rphy_free tries to unregister the bsg request queue (device D
    above), the ensuing sysfs cleanup discovers that its sysfs group has
    already been removed and emits a warning, "sysfs group... not found for
    kobject 'end_device-X:0'".

    Since bsg creation is a side effect of sas_rphy_add, move its
    complementary removal call into sas_rphy_remove. This imposes the
    following tear-down order for the devices above: D, B, C, A.

    Note the sas_device and sas_end_device transport class devices (B and C
    above) are created and destroyed both via the list match traversal in
    attribute_container_device_trigger, so the order in which they are
    handled is fixed. This is fine as long as they are deleted before their
    parent device.

    Signed-off-by: Joe Lawrence
    Acked-by: Dan Williams
    Signed-off-by: James Bottomley

    Joe Lawrence
     
  • Current code only touches the direction register when setting direction
    to output, which breaks logic like

    echo high > /sys/class/gpio/gpio0/direction

    which is expected to also set the value. This patch also adds a call
    to update the value register when setting direction to output.

    Signed-off-by: Alexey Charkov
    Acked-by: Tony Prisk
    Signed-off-by: Linus Walleij

    Alexey Charkov
     
  • ALB learning packets are currentlyalways sent using the slave mac
    address for all vlans configured on top of bond. This is not always
    correct, as vlans may change their mac address.
    This patch introduced a concept of strict matching where the
    source of learning packets can either strictly match the address
    passed in, or it can determine a more correct address to use.

    There are 3 casese to consider:
    1) Switchover. In this case, we have a new active slave and we need
    tell the switch about all addresses available on the slave.
    2) Monitor. We'll periodically refresh learning info for all slaves.
    In this case, we refresh all addresses for current active, and just
    the slave address for other slaves.
    3) Teaching of disabled adddress. This happens as part of the
    failover and in this case, we alwyas to use just the address
    provided.

    CC: Jay Vosburgh
    CC: Veaceslav Falico
    CC: Andy Gospodarek
    Signed-off-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Vlad Yasevich
     
  • TLB/ALB learning packets always assume 802.1Q vlan protocol, but
    that is no longer the case since we now have support for Q-in-Q
    on top of bonding. Pass the vlan protocol to alb_send_lp_vid()
    so that the packets are properly tagged.

    CC: Jay Vosburgh
    CC: Veaceslav Falico
    CC: Andy Gospodarek
    Signed-off-by: Vlad Yasevich
    Acked-by: Veaceslav Falico
    Signed-off-by: David S. Miller

    Vlad Yasevich