* [PATCH 4.11 066/197] proc: Fix unbalanced hard link numbers
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tristan Ye, Takashi Iwai,
Eric W. Biederman
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d66bb1607e2d8d384e53f3d93db5c18483c8c4f7 upstream.
proc_create_mount_point() forgot to increase the parent's nlink, and
it resulted in unbalanced hard link numbers, e.g. /proc/fs shows one
less than expected.
Fixes: eb6d38d5427b ("proc: Allow creating permanently empty directories...")
Reported-by: Tristan Ye <tristan.ye@suse.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -472,6 +472,7 @@ struct proc_dir_entry *proc_create_mount
ent->data = NULL;
ent->proc_fops = NULL;
ent->proc_iops = NULL;
+ parent->nlink++;
if (proc_register(parent, ent) < 0) {
kfree(ent);
parent->nlink--;
^ permalink raw reply
* [PATCH 4.9 009/164] ARM: tegra: paz00: Mark panel regulator as enabled on boot
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Dietrich, Misha Komarovskiy,
Thierry Reding
In-Reply-To: <20170523200907.297534241@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Dietrich <marvin24@gmx.de>
commit 0c18927f51f4d390abdcf385bff5f995407ee732 upstream.
Current U-Boot enables the display already. Marking the regulator as
enabled on boot fixes sporadic panel initialization failures.
Signed-off-by: Marc Dietrich <marvin24@gmx.de>
Tested-by: Misha Komarovskiy <zombah@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/tegra20-paz00.dts | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/tegra20-paz00.dts
+++ b/arch/arm/boot/dts/tegra20-paz00.dts
@@ -569,6 +569,7 @@
regulator-name = "+3VS,vdd_pnl";
regulator-min-microvolt = <3300000>;
regulator-max-microvolt = <3300000>;
+ regulator-boot-on;
gpio = <&gpio TEGRA_GPIO(A, 4) GPIO_ACTIVE_HIGH>;
enable-active-high;
};
^ permalink raw reply
* [PATCH 4.9 008/164] ALSA: hda: Fix cpu lockup when stopping the cmd dmas
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marta Lofstedt, Takashi Iwai,
Jeeja KP, Vinod Koul
In-Reply-To: <20170523200907.297534241@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeeja KP <jeeja.kp@intel.com>
commit 960013762df0a214b57f2fce655422fb52bdfd2c upstream.
Using jiffies in hdac_wait_for_cmd_dmas() to determine when to time out
when interrupts are off (snd_hdac_bus_stop_cmd_io()/spin_lock_irq())
causes hard lockup so unlock while waiting using jiffies.
---<-snip->---
<0>[ 1211.603046] NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
<4>[ 1211.603047] Modules linked in: snd_hda_intel i915 vgem
<4>[ 1211.603053] irq event stamp: 13366
<4>[ 1211.603053] hardirqs last enabled at (13365):
...
<4>[ 1211.603059] Call Trace:
<4>[ 1211.603059] ? delay_tsc+0x3d/0xc0
<4>[ 1211.603059] __delay+0xa/0x10
<4>[ 1211.603060] __const_udelay+0x31/0x40
<4>[ 1211.603060] snd_hdac_bus_stop_cmd_io+0x96/0xe0 [snd_hda_core]
<4>[ 1211.603060] ? azx_dev_disconnect+0x20/0x20 [snd_hda_intel]
<4>[ 1211.603061] snd_hdac_bus_stop_chip+0xb1/0x100 [snd_hda_core]
<4>[ 1211.603061] azx_stop_chip+0x9/0x10 [snd_hda_codec]
<4>[ 1211.603061] azx_suspend+0x72/0x220 [snd_hda_intel]
<4>[ 1211.603061] pci_pm_suspend+0x71/0x140
<4>[ 1211.603062] dpm_run_callback+0x6f/0x330
<4>[ 1211.603062] ? pci_pm_freeze+0xe0/0xe0
<4>[ 1211.603062] __device_suspend+0xf9/0x370
<4>[ 1211.603062] ? dpm_watchdog_set+0x60/0x60
<4>[ 1211.603063] async_suspend+0x1a/0x90
<4>[ 1211.603063] async_run_entry_fn+0x34/0x160
<4>[ 1211.603063] process_one_work+0x1f4/0x6d0
<4>[ 1211.603063] ? process_one_work+0x16e/0x6d0
<4>[ 1211.603064] worker_thread+0x49/0x4a0
<4>[ 1211.603064] kthread+0x107/0x140
<4>[ 1211.603064] ? process_one_work+0x6d0/0x6d0
<4>[ 1211.603065] ? kthread_create_on_node+0x40/0x40
<4>[ 1211.603065] ret_from_fork+0x2e/0x40
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100419
Fixes: 38b19ed7f81ec ("ALSA: hda: fix to wait for RIRB & CORB DMA to set")
Reported-by: Marta Lofstedt <marta.lofstedt@intel.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/hdac_controller.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -106,7 +106,11 @@ void snd_hdac_bus_stop_cmd_io(struct hda
/* disable ringbuffer DMAs */
snd_hdac_chip_writeb(bus, RIRBCTL, 0);
snd_hdac_chip_writeb(bus, CORBCTL, 0);
+ spin_unlock_irq(&bus->reg_lock);
+
hdac_wait_for_cmd_dmas(bus);
+
+ spin_lock_irq(&bus->reg_lock);
/* disable unsolicited responses */
snd_hdac_chip_updatel(bus, GCTL, AZX_GCTL_UNSOL, 0);
spin_unlock_irq(&bus->reg_lock);
^ permalink raw reply
* [PATCH 4.11 064/197] cxl: Force context lock during EEH flow
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Donnellan, Vaibhav Jain,
Frederic Barrat, Matthew R. Ochs, Uma Krishnan, Michael Ellerman
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
commit ea9a26d117cf0637c71d3e0076f4a124bf5859df upstream.
During an eeh event when the cxl card is fenced and card sysfs attr
perst_reloads_same_image is set following warning message is seen in the
kernel logs:
Adapter context unlocked with 0 active contexts
------------[ cut here ]------------
WARNING: CPU: 12 PID: 627 at
../drivers/misc/cxl/main.c:325 cxl_adapter_context_unlock+0x60/0x80 [cxl]
Even though this warning is harmless, it clutters the kernel log
during an eeh event. This warning is triggered as the EEH callback
cxl_pci_error_detected doesn't obtain a context-lock before forcibly
detaching all active context and when context-lock is released during
call to cxl_configure_adapter from cxl_pci_slot_reset, a warning in
cxl_adapter_context_unlock is triggered.
To fix this warning, we acquire the adapter context-lock via
cxl_adapter_context_lock() in the eeh callback
cxl_pci_error_detected() once all the virtual AFU PHBs are notified
and their contexts detached. The context-lock is released in
cxl_pci_slot_reset() after the adapter is successfully reconfigured
and before the we call the slot_reset callback on slice attached
device-drivers.
Fixes: 70b565bbdb91 ("cxl: Prevent adapter reset if an active context exists")
Reported-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Reviewed-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Tested-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/cxl/pci.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1496,8 +1496,6 @@ static int cxl_configure_adapter(struct
if ((rc = cxl_native_register_psl_err_irq(adapter)))
goto err;
- /* Release the context lock as adapter is configured */
- cxl_adapter_context_unlock(adapter);
return 0;
err:
@@ -1596,6 +1594,9 @@ static struct cxl *cxl_pci_init_adapter(
if ((rc = cxl_sysfs_adapter_add(adapter)))
goto err_put1;
+ /* Release the context lock as adapter is configured */
+ cxl_adapter_context_unlock(adapter);
+
return adapter;
err_put1:
@@ -1895,6 +1896,13 @@ static pci_ers_result_t cxl_pci_error_de
cxl_ops->afu_deactivate_mode(afu, afu->current_mode);
pci_deconfigure_afu(afu);
}
+
+ /* should take the context lock here */
+ if (cxl_adapter_context_lock(adapter) != 0)
+ dev_warn(&adapter->dev,
+ "Couldn't take context lock with %d active-contexts\n",
+ atomic_read(&adapter->contexts_num));
+
cxl_deconfigure_adapter(adapter);
return result;
@@ -1913,6 +1921,13 @@ static pci_ers_result_t cxl_pci_slot_res
if (cxl_configure_adapter(adapter, pdev))
goto err;
+ /*
+ * Unlock context activation for the adapter. Ideally this should be
+ * done in cxl_pci_resume but cxlflash module tries to activate the
+ * master context as part of slot_reset callback.
+ */
+ cxl_adapter_context_unlock(adapter);
+
for (i = 0; i < adapter->slices; i++) {
afu = adapter->afu[i];
^ permalink raw reply
* [PATCH 4.9 006/164] USB: core: replace %p with %pK
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vamsi Krishna Samavedam
In-Reply-To: <20170523200907.297534241@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.
Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.
echo 0 > /proc/sys/kernel/kptr_restrict
[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/devio.c | 14 +++++++-------
drivers/usb/core/hcd.c | 4 ++--
drivers/usb/core/urb.c | 2 +-
3 files changed, 10 insertions(+), 10 deletions(-)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -481,11 +481,11 @@ static void snoop_urb(struct usb_device
if (userurb) { /* Async */
if (when == SUBMIT)
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"length %u\n",
userurb, ep, t, d, length);
else
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"actual_length %u status %d\n",
userurb, ep, t, d, length,
timeout_or_status);
@@ -1905,7 +1905,7 @@ static int proc_reapurb(struct usb_dev_s
if (as) {
int retval;
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl(as, (void __user * __user *)arg);
free_async(as);
return retval;
@@ -1922,7 +1922,7 @@ static int proc_reapurbnonblock(struct u
as = async_getcompleted(ps);
if (as) {
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl(as, (void __user * __user *)arg);
free_async(as);
} else {
@@ -2053,7 +2053,7 @@ static int proc_reapurb_compat(struct us
if (as) {
int retval;
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl_compat(as, (void __user * __user *)arg);
free_async(as);
return retval;
@@ -2070,7 +2070,7 @@ static int proc_reapurbnonblock_compat(s
as = async_getcompleted(ps);
if (as) {
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl_compat(as, (void __user * __user *)arg);
free_async(as);
} else {
@@ -2499,7 +2499,7 @@ static long usbdev_do_ioctl(struct file
#endif
case USBDEVFS_DISCARDURB:
- snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+ snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
ret = proc_unlinkurb(ps, p);
break;
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1722,7 +1722,7 @@ int usb_hcd_unlink_urb (struct urb *urb,
if (retval == 0)
retval = -EINPROGRESS;
else if (retval != -EIDRM && retval != -EBUSY)
- dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+ dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
urb, retval);
usb_put_dev(udev);
}
@@ -1889,7 +1889,7 @@ rescan:
/* kick hcd */
unlink1(hcd, urb, -ESHUTDOWN);
dev_dbg (hcd->self.controller,
- "shutdown urb %p ep%d%s%s\n",
+ "shutdown urb %pK ep%d%s%s\n",
urb, usb_endpoint_num(&ep->desc),
is_in ? "in" : "out",
({ char *s;
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -333,7 +333,7 @@ int usb_submit_urb(struct urb *urb, gfp_
if (!urb || !urb->complete)
return -EINVAL;
if (urb->hcpriv) {
- WARN_ONCE(1, "URB %p submitted while active\n", urb);
+ WARN_ONCE(1, "URB %pK submitted while active\n", urb);
return -EBUSY;
}
^ permalink raw reply
* [PATCH 4.11 062/197] cdc-acm: fix possible invalid access when processing notification
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tobias Herzog, Oliver Neukum
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Herzog <t-herzog@gmx.de>
commit 1bb9914e1730417d530de9ed37e59efdc647146b upstream.
Notifications may only be 8 bytes long. Accessing the 9th and
10th byte of unimplemented/unknown notifications may be insecure.
Also check the length of known notifications before accessing anything
behind the 8th byte.
Signed-off-by: Tobias Herzog <t-herzog@gmx.de>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -323,6 +323,12 @@ static void acm_ctrl_irq(struct urb *urb
break;
case USB_CDC_NOTIFY_SERIAL_STATE:
+ if (le16_to_cpu(dr->wLength) != 2) {
+ dev_dbg(&acm->control->dev,
+ "%s - malformed serial state\n", __func__);
+ break;
+ }
+
newctrl = get_unaligned_le16(data);
if (!acm->clocal && (acm->ctrlin & ~newctrl & ACM_CTRL_DCD)) {
@@ -359,11 +365,10 @@ static void acm_ctrl_irq(struct urb *urb
default:
dev_dbg(&acm->control->dev,
- "%s - unknown notification %d received: index %d "
- "len %d data0 %d data1 %d\n",
+ "%s - unknown notification %d received: index %d len %d\n",
__func__,
- dr->bNotificationType, dr->wIndex,
- dr->wLength, data[0], data[1]);
+ dr->bNotificationType, dr->wIndex, dr->wLength);
+
break;
}
exit:
^ permalink raw reply
* [PATCH 4.9 005/164] char: lp: fix possible integer overflow in lp_setup()
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roee Hay, Ben Hutchings,
Willy Tarreau
In-Reply-To: <20170523200907.297534241@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <w@1wt.eu>
commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream.
The lp_setup() code doesn't apply any bounds checking when passing
"lp=none", and only in this case, resulting in an overflow of the
parport_nr[] array. All versions in Git history are affected.
Reported-By: Roee Hay <roee.hay@hcl.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/lp.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
} else if (!strcmp(str, "auto")) {
parport_nr[0] = LP_PARPORT_AUTO;
} else if (!strcmp(str, "none")) {
- parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+ if (parport_ptr < LP_NO)
+ parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+ else
+ printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+ str);
} else if (!strcmp(str, "reset")) {
reset = 1;
}
^ permalink raw reply
* [PATCH 4.11 061/197] gpio: omap: return error if requested debounce time is not possible
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Rivshin, Grygorii Strashko,
Linus Walleij
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rivshin <DRivshin@allworx.com>
commit 83977443938122baeed28dc9f078db3da9855f7c upstream.
omap_gpio_debounce() does not validate that the requested debounce
is within a range it can handle. Instead it lets the register value
wrap silently, and always returns success.
This can lead to all sorts of unexpected behavior, such as gpio_keys
asking for a too-long debounce, but getting a very short debounce in
practice.
Fix this by returning -EINVAL if the requested value does not fit into
the register field. If there is no debounce clock available at all,
return -ENOTSUPP.
Fixes: e85ec6c3047b ("gpio: omap: fix omap2_set_gpio_debounce")
Signed-off-by: David Rivshin <drivshin@allworx.com>
Acked-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-omap.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -208,9 +208,11 @@ static inline void omap_gpio_dbck_disabl
* OMAP's debounce time is in 31us steps
* <debounce time> = (GPIO_DEBOUNCINGTIME[7:0].DEBOUNCETIME + 1) x 31
* so we need to convert and round up to the closest unit.
+ *
+ * Return: 0 on success, negative error otherwise.
*/
-static void omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset,
- unsigned debounce)
+static int omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset,
+ unsigned debounce)
{
void __iomem *reg;
u32 val;
@@ -218,11 +220,12 @@ static void omap2_set_gpio_debounce(stru
bool enable = !!debounce;
if (!bank->dbck_flag)
- return;
+ return -ENOTSUPP;
if (enable) {
debounce = DIV_ROUND_UP(debounce, 31) - 1;
- debounce &= OMAP4_GPIO_DEBOUNCINGTIME_MASK;
+ if ((debounce & OMAP4_GPIO_DEBOUNCINGTIME_MASK) != debounce)
+ return -EINVAL;
}
l = BIT(offset);
@@ -255,6 +258,8 @@ static void omap2_set_gpio_debounce(stru
bank->context.debounce = debounce;
bank->context.debounce_en = val;
}
+
+ return 0;
}
/**
@@ -964,14 +969,20 @@ static int omap_gpio_debounce(struct gpi
{
struct gpio_bank *bank;
unsigned long flags;
+ int ret;
bank = gpiochip_get_data(chip);
raw_spin_lock_irqsave(&bank->lock, flags);
- omap2_set_gpio_debounce(bank, offset, debounce);
+ ret = omap2_set_gpio_debounce(bank, offset, debounce);
raw_spin_unlock_irqrestore(&bank->lock, flags);
- return 0;
+ if (ret)
+ dev_info(chip->parent,
+ "Could not set line %u debounce to %u microseconds (%d)",
+ offset, debounce, ret);
+
+ return ret;
}
static int omap_gpio_set_config(struct gpio_chip *chip, unsigned offset,
^ permalink raw reply
* [PATCH 4.11 060/197] drm/nouveau/tmr: handle races with hw when updating the next alarm time
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 1b0f84380b10ee97f7d2dd191294de9017e94d1d upstream.
If the time to the next alarm is short enough, we could race with HW and
end up with an ~4 second delay until it triggers.
Fix this by checking again after we update HW.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 26 ++++++++++++++---------
1 file changed, 16 insertions(+), 10 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -36,23 +36,29 @@ nvkm_timer_alarm_trigger(struct nvkm_tim
unsigned long flags;
LIST_HEAD(exec);
- /* move any due alarms off the pending list */
+ /* Process pending alarms. */
spin_lock_irqsave(&tmr->lock, flags);
list_for_each_entry_safe(alarm, atemp, &tmr->alarms, head) {
- if (alarm->timestamp <= nvkm_timer_read(tmr))
- list_move_tail(&alarm->head, &exec);
+ /* Have we hit the earliest alarm that hasn't gone off? */
+ if (alarm->timestamp > nvkm_timer_read(tmr)) {
+ /* Schedule it. If we didn't race, we're done. */
+ tmr->func->alarm_init(tmr, alarm->timestamp);
+ if (alarm->timestamp > nvkm_timer_read(tmr))
+ break;
+ }
+
+ /* Move to completed list. We'll drop the lock before
+ * executing the callback so it can reschedule itself.
+ */
+ list_move_tail(&alarm->head, &exec);
}
- /* reschedule interrupt for next alarm time */
- if (!list_empty(&tmr->alarms)) {
- alarm = list_first_entry(&tmr->alarms, typeof(*alarm), head);
- tmr->func->alarm_init(tmr, alarm->timestamp);
- } else {
+ /* Shut down interrupt if no more pending alarms. */
+ if (list_empty(&tmr->alarms))
tmr->func->alarm_fini(tmr);
- }
spin_unlock_irqrestore(&tmr->lock, flags);
- /* execute any pending alarm handlers */
+ /* Execute completed callbacks. */
list_for_each_entry_safe(alarm, atemp, &exec, head) {
list_del_init(&alarm->head);
alarm->func(alarm);
^ permalink raw reply
* [PATCH 4.9 004/164] watchdog: pcwd_usb: fix NULL-deref at probe
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Guenter Roeck,
Wim Van Sebroeck
In-Reply-To: <20170523200907.297534241@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/pcwd_usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_int
return -ENODEV;
}
+ if (iface_desc->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
/* check out the endpoint: it has to be Interrupt & IN */
endpoint = &iface_desc->endpoint[0].desc;
^ permalink raw reply
* [PATCH 4.11 059/197] drm/nouveau/tmr: avoid processing completed alarms when adding a new one
From: Greg Kroah-Hartman @ 2017-05-23 20:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 330bdf62fe6a6c5b99a647f7bf7157107c9348b3 upstream.
The idea here was to avoid having to "manually" program the HW if there's
a new earliest alarm. This was lazy and bad, as it leads to loads of fun
races between inter-related callers (ie. therm).
Turns out, it's not so difficult after all. Go figure ;)
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -80,12 +80,22 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,
if (list->timestamp > alarm->timestamp)
break;
}
+
list_add_tail(&alarm->head, &list->head);
+
+ /* Update HW if this is now the earliest alarm. */
+ list = list_first_entry(&tmr->alarms, typeof(*list), head);
+ if (list == alarm) {
+ tmr->func->alarm_init(tmr, alarm->timestamp);
+ /* This shouldn't happen if callers aren't stupid.
+ *
+ * Worst case scenario is that it'll take roughly
+ * 4 seconds for the next alarm to trigger.
+ */
+ WARN_ON(alarm->timestamp <= nvkm_timer_read(tmr));
+ }
}
spin_unlock_irqrestore(&tmr->lock, flags);
-
- /* process pending alarms */
- nvkm_timer_alarm_trigger(tmr);
}
void
^ permalink raw reply
* [PATCH 4.11 056/197] drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit e6db95799b1b870aae15682a6d0898df9e9dfb38 upstream.
The DRM core used to only call prepare_fb/cleanup_fb() when a plane's
framebuffer changed, which achieved the desired effect.
It's apparently now up to the driver to decide on its own.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nv50_display.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1113,9 +1113,13 @@ static void
nv50_curs_prepare(struct nv50_wndw *wndw, struct nv50_head_atom *asyh,
struct nv50_wndw_atom *asyw)
{
- asyh->curs.handle = nv50_disp(wndw->plane.dev)->mast.base.vram.handle;
- asyh->curs.offset = asyw->image.offset;
- asyh->set.curs = asyh->curs.visible;
+ u32 handle = nv50_disp(wndw->plane.dev)->mast.base.vram.handle;
+ u32 offset = asyw->image.offset;
+ if (asyh->curs.handle != handle || asyh->curs.offset != offset) {
+ asyh->curs.handle = handle;
+ asyh->curs.offset = offset;
+ asyh->set.curs = asyh->curs.visible;
+ }
}
static void
^ permalink raw reply
* [PATCH 4.9 000/164] 4.9.30-stable review
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, stable
This is the start of the stable review cycle for the 4.9.30 release.
There are 164 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.30-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.9.30-rc1
Chris Wilson <chris@chris-wilson.co.uk>
drm/i915/gvt: Disable access to stolen memory as a guest
Julius Werner <jwerner@chromium.org>
drivers: char: mem: Check for address space wraparound with mmap()
J. Bruce Fields <bfields@redhat.com>
nfsd: encoders mustn't use unitialized values in error cases
Ari Kauppi <ari@synopsys.com>
nfsd: fix undefined behavior in nfsd4_layout_verify
Benjamin Coddington <bcodding@redhat.com>
NFS: Use GFP_NOIO for two allocations in writeback
Fred Isaman <fred.isaman@gmail.com>
NFS: Fix use after free in write error path
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4: Fix a hang in OPEN related to server reboot
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
Alexander Couzens <lynxis@fe80.eu>
mtd: nand: add ooblayout for old hamming layout
Roger Quadros <rogerq@ti.com>
mtd: nand: omap2: Fix partition creation via cmdline mtdparts
Simon Baatz <gmbnomis@gmail.com>
mtd: nand: orion: fix clk handling
Lukas Wunner <lukas@wunner.de>
PCI: Freeze PME scan before suspending devices
David Woodhouse <dwmw@amazon.co.uk>
PCI: Only allow WC mmap on prefetchable resources
David Woodhouse <dwmw@amazon.co.uk>
PCI: Fix another sanity check bug in /proc/pci mmap
David Woodhouse <dwmw@amazon.co.uk>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
K. Y. Srinivasan <kys@microsoft.com>
PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
K. Y. Srinivasan <kys@microsoft.com>
PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
Thomas Gleixner <tglx@linutronix.de>
tracing/kprobes: Enforce kprobes teardown after testing
Masami Hiramatsu <mhiramat@kernel.org>
um: Fix to call read_initrd after init_bootmem
Al Viro <viro@zeniv.linux.org.uk>
osf_wait4(): fix infoleak
Huacai Chen <chenhc@lemote.com>
MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
Jon Derrick <jonathan.derrick@intel.com>
nvme: unmap CMB and remove sysfs file in reset path
Thomas Gleixner <tglx@linutronix.de>
genirq: Fix chained interrupt data ordering
Johan Hovold <johan@kernel.org>
uwb: fix device quirk on big-endian hosts
Daniel Micay <danielmicay@gmail.com>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Check access_ok in strncpy_from_user
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Fix access_ok()
KarimAllah Ahmed <karahmed@amazon.de>
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: GetTs Fix invalid TID 7 warning.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: documentation: document tagged pointer stack constraints
Mark Rutland <mark.rutland@arm.com>
arm64: uaccess: ensure extension of access_ok() addr
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated: ensure extension of addr
Mark Rutland <mark.rutland@arm.com>
arm64: ensure extension of smp_store_release value
Mark Rutland <mark.rutland@arm.com>
arm64: xchg: hazard against entire exchange variable
Daniel Lezcano <daniel.lezcano@linaro.org>
arm64: dts: hi6220: Reset the mmc hosts
Leonard Crestez <leonard.crestez@nxp.com>
ARM: dts: imx6sx-sdb: Remove OPP override
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: fix ADC vref
Vladimir Murzin <vladimir.murzin@arm.com>
ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
Ard Biesheuvel <ard.biesheuvel@linaro.org>
ARM: 8662/1: module: split core and init PLT sections
Zhichao Huang <zhichao.huang@linaro.org>
KVM: arm: plug potential guest hardware debug leakage
Marc Zyngier <marc.zyngier@arm.com>
KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <marc.zyngier@arm.com>
KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <marc.zyngier@arm.com>
arm: KVM: Do not use stack-protector to compile HYP code
Marc Zyngier <marc.zyngier@arm.com>
arm64: KVM: Do not use stack-protector to compile EL2 code
Michael Neuling <mikey@neuling.org>
powerpc/tm: Fix FP and VMX register corruption
LiuHailong <liu.hailong6@zte.com.cn>
powerpc/64e: Fix hang when debugging programs with relocated kernel
Alexey Kardashevskiy <aik@ozlabs.ru>
powerpc/iommu: Do not call PageTransHuge() on tail pages
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
powerpc/book3s/mce: Move add_taint() later in virtual mode
Russell Currey <ruscur@russell.cc>
powerpc/eeh: Avoid use after free in eeh_handle_special_event()
David Gibson <david@gibson.dropbear.id.au>
powerpc/mm: Ensure IRQs are off in switch_mm()
Johan Hovold <johan@kernel.org>
cx231xx-cards: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix init error path
Alyssa Milburn <amilburn@zall.org>
dw2102: limit messages to buffer size
Alyssa Milburn <amilburn@zall.org>
digitv: limit messages to buffer size
Daniel Scheller <d.scheller@gmx.net>
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
Alyssa Milburn <amilburn@zall.org>
zr364xx: enforce minimum size when reading header
Johan Hovold <johan@kernel.org>
dib0700: fix NULL-deref at probe
Marek Szyprowski <m.szyprowski@samsung.com>
s5p-mfc: Fix unbalanced call to clock management
Johan Hovold <johan@kernel.org>
gspca: konica: add missing endpoint sanity check
Marek Szyprowski <m.szyprowski@samsung.com>
s5p-mfc: Fix race between interrupt routine and device functions
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
iio: hid-sensor: Store restore poll and hysteresis on S3
Matt Ranostay <matt.ranostay@konsulko.com>
iio: proximity: as3935: fix as3935_write
Dan Carpenter <dan.carpenter@oracle.com>
ipx: call ipxitf_put() in ioctl error path
Johan Hovold <johan@kernel.org>
USB: hub: fix non-SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: hub: fix SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: serial: io_ti: fix div-by-zero in set_termios
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix big-endian baud-rate handling
Bjørn Mork <bjorn@mork.no>
USB: serial: qcserial: add more Lenovo EM74xx device IDs
Daniele Palmas <dnlplm@gmail.com>
usb: serial: option: add Telit ME910 support
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix info ioctl on big-endian hosts
Tony Lindgren <tony@atomide.com>
usb: musb: Fix trying to suspend while active for OTG configurations
Peter Ujfalusi <peter.ujfalusi@ti.com>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: gadget: Prevent losing events in event cache
Ben Hutchings <ben@decadent.org.uk>
dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
Alyssa Milburn <amilburn@zall.org>
ttusb2: limit messages to buffer size
Johan Hovold <johan@kernel.org>
mceusb: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
usbvision: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
net: irda: irda-usb: fix firmware name on big-endian hosts
Peter Chen <peter.chen@nxp.com>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
usb: host: xhci-plat: propagate return value of platform_get_irq()
Matthias Lange <matthias.lange@kernkonzept.com>
xhci: remove GFP_DMA flag from allocation
Toshi Kani <toshi.kani@hpe.com>
libnvdimm: fix clear length of nvdimm_forget_poison()
Eric Biggers <ebiggers@google.com>
fscrypt: avoid collisions when presenting long encrypted filenames
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: check entire encrypted bigname when finding a dentry
Johan Hovold <johan@kernel.org>
USB: chaoskey: fix Alea quirk on big-endian hosts
Andrey Korolyov <andrey@xdel.ru>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
Anthony Mallet <anthony.mallet@laas.fr>
USB: serial: ftdi_sio: fix setting latency for unprivileged users
Kirill Tkhai <ktkhai@virtuozzo.com>
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
Eric W. Biederman <ebiederm@xmission.com>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
Michael J. Ruhl <michael.j.ruhl@intel.com>
IB/hfi1: Fix a subcontext memory leak
Michael J. Ruhl <michael.j.ruhl@intel.com>
IB/hfi1: Return an error on memory allocation failure
Andreas Klinger <ak@it-klinger.de>
IIO: bmp280-core.c: fix error in humidity calculation
Pavel Roskin <plroskin@gmail.com>
iio: dac: ad7303: fix channel description
Bryant G. Ly <bryantly@linux.vnet.ibm.com>
ibmvscsis: Do not send aborted task response
Johan Hovold <johan@kernel.org>
of: fdt: add missing allocation-failure check
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
Rob Herring <robh@kernel.org>
of: fix sparse warning in of_pci_range_parser_one
Takashi Iwai <tiwai@suse.de>
proc: Fix unbalanced hard link numbers
Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
cxl: Route eeh events to all drivers in cxl_pci_error_detected()
Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
cxl: Force context lock during EEH flow
Gerd Hoffmann <kraxel@redhat.com>
ohci-pci: add qemu quirk
Tobias Herzog <t-herzog@gmx.de>
cdc-acm: fix possible invalid access when processing notification
David Rivshin <DRivshin@allworx.com>
gpio: omap: return error if requested debounce time is not possible
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: handle races with hw when updating the next alarm time
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: ack interrupt before processing alarms
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Make display watermark calculations more accurate
Johan Hovold <johan@kernel.org>
ath9k_htc: fix NULL-deref at probe
Dmitry Tunin <hanipouspilot@gmail.com>
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
Martin Schwidefsky <schwidefsky@de.ibm.com>
s390/cputime: fix incorrect system time
Michael Holzheu <holzheu@linux.vnet.ibm.com>
s390/kdump: Add final note
Richard Cochran <rcochran@linutronix.de>
regulator: tps65023: Fix inverted core enable logic.
Wadim Egorov <w.egorov@phytec.de>
regulator: rk808: Fix RK818 LDO2
Linus Torvalds <torvalds@linux-foundation.org>
x86: fix 32-bit case of __get_user_asm_u64()
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: x86: Fix potential preemption when get the current kvmclock timestamp
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: x86: Fix load damaged SSEx MXCSR register
Daniel Glöckner <dg@emlix.com>
ima: accept previously set IMA_NEW_FILE
Brian Norris <briannorris@chromium.org>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Brian Norris <briannorris@chromium.org>
mwifiex: MAC randomization should not be persistent
Larry Finger <Larry.Finger@lwfinger.net>
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
NeilBrown <neilb@suse.com>
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
Dennis Yang <dennisyang@qnap.com>
md: update slab_cache before releasing new stripes when stripes resizing
Joe Thornber <ejt@redhat.com>
dm space map disk: fix some book keeping in the disk space map
Joe Thornber <ejt@redhat.com>
dm thin metadata: call precommit before saving the roots
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: make the parameter "retain_bytes" unsigned long
Mike Snitzer <snitzer@redhat.com>
dm cache metadata: fail operations if fail_io mode has been established
Bart Van Assche <bart.vanassche@sandisk.com>
dm mpath: split and rename activate_path() to prepare for its expanded use
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: check new buffer allocation watermark every 30 seconds
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: avoid a possible ABBA deadlock
Mikulas Patocka <mpatocka@redhat.com>
dm raid: select the Kconfig option CONFIG_MD_RAID0
Vinothkumar Raja <vinraja@cs.stonybrook.edu>
dm btree: fix for dm_btree_find_lowest_key()
Paolo Abeni <pabeni@redhat.com>
infiniband: call ipv6 route lookup via the stub interface
Sagi Grimberg <sagi@grimberg.me>
mlx5: Fix mlx5_ib_map_mr_sg mr length
Alexander Sverdlin <alexander.sverdlin@gmail.com>
ASoC: cs4271: configure reset GPIO as output
Jerry Snitselaar <jsnitsel@redhat.com>
tpm_crb: check for bad response size
Nayna Jain <nayna@linux.vnet.ibm.com>
tpm: add sleep only for retry in i2c_nuvoton_write_status()
Nayna Jain <nayna@linux.vnet.ibm.com>
tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Add small delay after last transfer
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Check correct byte for wait state indicator
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Abort transfer when too many wait states are signaled
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Use single function to transfer data
Amir Goldstein <amir73il@gmail.com>
fanotify: don't expose EOPENSTALE to userspace
Marc Dietrich <marvin24@gmx.de>
ARM: tegra: paz00: Mark panel regulator as enabled on boot
Jeeja KP <jeeja.kp@intel.com>
ALSA: hda: Fix cpu lockup when stopping the cmd dmas
Alexander Steffen <Alexander.Steffen@infineon.com>
tpm_tis_core: Choose appropriate timeout for reading burstcount
Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
USB: core: replace %p with %pK
Willy Tarreau <w@1wt.eu>
char: lp: fix possible integer overflow in lp_setup()
Johan Hovold <johan@kernel.org>
watchdog: pcwd_usb: fix NULL-deref at probe
Alan Stern <stern@rowland.harvard.edu>
USB: ene_usb6250: fix DMA to the stack
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix memory leak
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix buffers on stack
-------------
Diffstat:
Documentation/arm64/tagged-pointers.txt | 62 ++++++--
Makefile | 4 +-
arch/alpha/kernel/osf_sys.c | 6 +-
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +-
arch/arm/boot/dts/imx6sx-sdb.dts | 17 ---
arch/arm/boot/dts/tegra20-paz00.dts | 1 +
arch/arm/include/asm/kvm_coproc.h | 3 +-
arch/arm/include/asm/module.h | 9 +-
arch/arm/kernel/module-plts.c | 87 +++++++----
arch/arm/kernel/module.lds | 1 +
arch/arm/kvm/coproc.c | 77 +++++++---
arch/arm/kvm/handle_exit.c | 4 +-
arch/arm/kvm/hyp/Makefile | 2 +
arch/arm/kvm/hyp/switch.c | 4 +-
arch/arm/mm/proc-v7m.S | 4 +-
arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 +
arch/arm64/include/asm/barrier.h | 20 ++-
arch/arm64/include/asm/cmpxchg.h | 2 +-
arch/arm64/include/asm/uaccess.h | 3 +-
arch/arm64/kernel/armv8_deprecated.c | 3 +-
arch/arm64/kvm/hyp/Makefile | 2 +
arch/metag/include/asm/uaccess.h | 49 ++++---
arch/mips/Kconfig | 1 +
arch/powerpc/include/asm/mmu_context.h | 17 ++-
arch/powerpc/kernel/eeh_driver.c | 19 ++-
arch/powerpc/kernel/exceptions-64e.S | 12 ++
arch/powerpc/kernel/mce.c | 2 +
arch/powerpc/kernel/process.c | 19 +++
arch/powerpc/kernel/traps.c | 4 +-
arch/powerpc/mm/mmu_context_iommu.c | 4 +-
arch/powerpc/platforms/pseries/dlpar.c | 1 -
arch/s390/kernel/crash_dump.c | 15 ++
arch/s390/kernel/entry.S | 21 ++-
arch/um/kernel/initrd.c | 4 +-
arch/um/kernel/um_arch.c | 6 +
arch/x86/include/asm/uaccess.h | 6 +-
arch/x86/kernel/fpu/init.c | 1 +
arch/x86/kvm/x86.c | 43 ++++--
drivers/char/lp.c | 6 +-
drivers/char/mem.c | 5 +
drivers/char/tpm/tpm_crb.c | 3 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 24 ++--
drivers/char/tpm/tpm_tis_core.c | 6 +-
drivers/char/tpm/tpm_tis_spi.c | 160 +++++++++------------
drivers/gpio/gpio-omap.c | 23 ++-
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++--
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++--
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 36 ++---
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++--
drivers/gpu/drm/drm_edid.c | 8 ++
drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 +++++---
drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +-
.../iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++-
.../iio/common/hid-sensors/hid-sensor-trigger.c | 20 ++-
drivers/iio/dac/ad7303.c | 6 +-
drivers/iio/pressure/bmp280-core.c | 11 +-
drivers/iio/proximity/as3935.c | 3 +-
drivers/infiniband/core/addr.c | 4 +-
drivers/infiniband/hw/hfi1/file_ops.c | 5 +-
drivers/infiniband/hw/hfi1/init.c | 1 +
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++--
drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 +
drivers/infiniband/hw/mlx5/mr.c | 2 +-
drivers/iommu/intel-iommu.c | 5 +-
drivers/md/Kconfig | 1 +
drivers/md/dm-bufio.c | 35 +++--
drivers/md/dm-cache-metadata.c | 12 +-
drivers/md/dm-mpath.c | 17 ++-
drivers/md/dm-thin-metadata.c | 4 +-
drivers/md/md.c | 5 +
drivers/md/persistent-data/dm-btree.c | 8 +-
drivers/md/persistent-data/dm-space-map-disk.c | 15 +-
drivers/md/raid5.c | 6 +-
drivers/media/dvb-frontends/cxd2841er.c | 4 +-
drivers/media/platform/s5p-mfc/s5p_mfc.c | 13 +-
drivers/media/rc/mceusb.c | 4 +-
drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++--
drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++-
drivers/media/usb/dvb-usb/dib0700_core.c | 3 +
drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 +
drivers/media/usb/dvb-usb/digitv.c | 3 +
drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++
drivers/media/usb/dvb-usb/ttusb2.c | 19 +++
drivers/media/usb/gspca/konica.c | 3 +
drivers/media/usb/usbvision/usbvision-video.c | 9 +-
drivers/media/usb/zr364xx/zr364xx.c | 8 ++
drivers/misc/cxl/pci.c | 34 +++--
drivers/mtd/nand/nand_base.c | 70 ++++++++-
drivers/mtd/nand/omap2.c | 9 ++
drivers/mtd/nand/orion_nand.c | 42 +++---
drivers/net/irda/irda-usb.c | 2 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 7 +
.../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 +++++++++++++---
.../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 +
drivers/nvdimm/bus.c | 5 +-
drivers/nvme/host/pci.c | 7 +-
drivers/of/address.c | 2 +-
drivers/of/fdt.c | 3 +
drivers/of/of_numa.c | 2 +
drivers/pci/host/pci-hyperv.c | 13 +-
drivers/pci/pci-sysfs.c | 10 +-
drivers/pci/pci.c | 9 +-
drivers/pci/proc.c | 21 ++-
drivers/regulator/rk808-regulator.c | 2 +-
drivers/regulator/tps65023-regulator.c | 3 +-
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 +++++++++++----
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 +
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 24 ++--
drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 +-
drivers/usb/class/cdc-acm.c | 13 +-
drivers/usb/core/devio.c | 14 +-
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/hub.c | 19 ++-
drivers/usb/core/urb.c | 2 +-
drivers/usb/dwc3/gadget.c | 9 ++
drivers/usb/host/ohci-hcd.c | 3 +-
drivers/usb/host/ohci-pci.c | 16 +++
drivers/usb/host/ohci.h | 1 +
drivers/usb/host/xhci-mem.c | 4 +-
drivers/usb/host/xhci-pci.c | 7 +-
drivers/usb/host/xhci-plat.c | 2 +-
drivers/usb/misc/chaoskey.c | 2 +-
drivers/usb/misc/iowarrior.c | 2 +-
drivers/usb/misc/legousbtower.c | 38 +++--
drivers/usb/musb/musb_host.c | 9 +-
drivers/usb/musb/tusb6010_omap.c | 13 +-
drivers/usb/serial/ftdi_sio.c | 10 +-
drivers/usb/serial/ftdi_sio_ids.h | 2 +
drivers/usb/serial/io_ti.c | 5 +-
drivers/usb/serial/mct_u232.c | 2 +-
drivers/usb/serial/option.c | 8 ++
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/storage/ene_ub6250.c | 90 +++++++-----
drivers/uwb/i1480/dfu/usb.c | 5 +-
drivers/watchdog/pcwd_usb.c | 3 +
fs/crypto/fname.c | 2 +-
fs/ext4/namei.c | 4 +-
fs/f2fs/dir.c | 37 ++---
fs/f2fs/f2fs.h | 3 +-
fs/f2fs/hash.c | 7 +-
fs/f2fs/inline.c | 4 +-
fs/nfs/nfs4proc.c | 4 +-
fs/nfs/pagelist.c | 15 +-
fs/nfs/write.c | 2 +-
fs/nfsd/nfs4proc.c | 3 +-
fs/nfsd/nfs4xdr.c | 8 +-
fs/notify/fanotify/fanotify_user.c | 26 ++--
fs/proc/generic.c | 1 +
include/linux/hid-sensor-hub.h | 2 +
include/linux/kprobes.h | 4 +-
kernel/fork.c | 10 +-
kernel/irq/chip.c | 2 +-
kernel/kprobes.c | 2 +-
kernel/pid_namespace.c | 2 +-
kernel/trace/trace_kprobe.c | 5 +
net/ipx/af_ipx.c | 5 +-
security/integrity/ima/ima_appraise.c | 5 +-
sound/hda/hdac_controller.c | 4 +
sound/soc/codecs/cs4271.c | 2 +-
virt/kvm/arm/vgic/vgic-v2.c | 7 +
virt/kvm/arm/vgic/vgic-v3.c | 7 +
168 files changed, 1665 insertions(+), 723 deletions(-)
^ permalink raw reply
* [PATCH 4.11 055/197] drm/nouveau/kms/nv50: fix source-rect-only plane updates
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 36601c2b36e27435d9be33cfa092120ff69914eb upstream.
This "optimisation" (which was originally meant to skip updating cursor
settings in the core channel on position-only updates) turned out to be
pointless in the final design of the code before it was merged.
Remove it completely, as it breaks other cases.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nv50_display.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -906,11 +906,9 @@ nv50_wndw_atomic_check(struct drm_plane
if (memcmp(&armw->point, &asyw->point, sizeof(asyw->point)))
asyw->set.point = true;
- if (!varm || asym || armw->state.fb != asyw->state.fb) {
- ret = nv50_wndw_atomic_check_acquire(wndw, asyw, asyh);
- if (ret)
- return ret;
- }
+ ret = nv50_wndw_atomic_check_acquire(wndw, asyw, asyh);
+ if (ret)
+ return ret;
} else
if (varm) {
nv50_wndw_atomic_check_release(wndw, asyw, harm);
^ permalink raw reply
* [PATCH 4.11 054/197] drm/nouveau/therm: remove ineffective workarounds for alarm bugs
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit e4311ee51d1e2676001b2d8fcefd92bdd79aad85 upstream.
These were ineffective due to touching the list without the alarm lock,
but should no longer be required.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
@@ -146,7 +146,7 @@ nvkm_therm_update(struct nvkm_therm *the
poll = false;
}
- if (list_empty(&therm->alarm.head) && poll)
+ if (poll)
nvkm_timer_alarm(tmr, 1000000000ULL, &therm->alarm);
spin_unlock_irqrestore(&therm->lock, flags);
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c
@@ -83,7 +83,7 @@ nvkm_fan_update(struct nvkm_fan *fan, bo
spin_unlock_irqrestore(&fan->lock, flags);
/* schedule next fan update, if not at target speed already */
- if (list_empty(&fan->alarm.head) && target != duty) {
+ if (target != duty) {
u16 bump_period = fan->bios.bump_period;
u16 slow_down_period = fan->bios.slow_down_period;
u64 delay;
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c
@@ -53,7 +53,7 @@ nvkm_fantog_update(struct nvkm_fantog *f
duty = !nvkm_gpio_get(gpio, 0, DCB_GPIO_FAN, 0xff);
nvkm_gpio_set(gpio, 0, DCB_GPIO_FAN, 0xff, duty);
- if (list_empty(&fan->alarm.head) && percent != (duty * 100)) {
+ if (percent != (duty * 100)) {
u64 next_change = (percent * fan->period_us) / 100;
if (!duty)
next_change = fan->period_us - next_change;
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c
@@ -185,7 +185,7 @@ alarm_timer_callback(struct nvkm_alarm *
spin_unlock_irqrestore(&therm->sensor.alarm_program_lock, flags);
/* schedule the next poll in one second */
- if (therm->func->temp_get(therm) >= 0 && list_empty(&alarm->head))
+ if (therm->func->temp_get(therm) >= 0)
nvkm_timer_alarm(tmr, 1000000000ULL, alarm);
}
^ permalink raw reply
* [PATCH 4.11 053/197] drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mario Kleiner, Alex Deucher
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit effaf848b957fbf72a3b6a1ad87f5e031eda0b75 upstream.
This apparently got lost when implementing the new DCE-6 support
and would cause failures in pageflip scheduling and timestamping.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -979,7 +979,7 @@ static void dce_v6_0_program_watermarks(
u32 priority_a_mark = 0, priority_b_mark = 0;
u32 priority_a_cnt = PRIORITY_OFF;
u32 priority_b_cnt = PRIORITY_OFF;
- u32 tmp, arb_control3;
+ u32 tmp, arb_control3, lb_vblank_lead_lines = 0;
fixed20_12 a, b, c;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
@@ -1091,6 +1091,8 @@ static void dce_v6_0_program_watermarks(
c.full = dfixed_div(c, a);
priority_b_mark = dfixed_trunc(c);
priority_b_cnt |= priority_b_mark & PRIORITY_MARK_MASK;
+
+ lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
}
/* select wm A */
@@ -1120,6 +1122,9 @@ static void dce_v6_0_program_watermarks(
/* save values for DPM */
amdgpu_crtc->line_time = line_time;
amdgpu_crtc->wm_high = latency_watermark_a;
+
+ /* Save number of lines the linebuffer leads before the scanout */
+ amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines;
}
/* watermark setup */
^ permalink raw reply
* [PATCH 4.11 051/197] drm/amdgpu: Make display watermark calculations more accurate
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher, Mario Kleiner
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit d63c277dc672e0c568481af043359420fa9d4736 upstream.
Avoid big roundoff errors in scanline/hactive durations for
high pixel clocks, especially for >= 500 Mhz, and thereby
program more accurate display fifo watermarks.
Implemented here for DCE 6,8,10,11.
Successfully tested on DCE 10 with AMD R9 380 Tonga.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 10 +++++-----
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 10 +++++-----
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 10 +++++-----
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 10 +++++-----
4 files changed, 20 insertions(+), 20 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1214,14 +1214,14 @@ static void dce_v10_0_program_watermarks
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce10_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1236,7 +1236,7 @@ static void dce_v10_0_program_watermarks
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1275,7 +1275,7 @@ static void dce_v10_0_program_watermarks
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1183,14 +1183,14 @@ static void dce_v11_0_program_watermarks
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce10_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1205,7 +1205,7 @@ static void dce_v11_0_program_watermarks
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1244,7 +1244,7 @@ static void dce_v11_0_program_watermarks
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -986,7 +986,7 @@ static void dce_v6_0_program_watermarks(
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce6_wm_params wm_low, wm_high;
u32 dram_channels;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 priority_a_mark = 0, priority_b_mark = 0;
@@ -996,8 +996,8 @@ static void dce_v6_0_program_watermarks(
fixed20_12 a, b, c;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
priority_a_cnt = 0;
priority_b_cnt = 0;
@@ -1016,7 +1016,7 @@ static void dce_v6_0_program_watermarks(
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1043,7 +1043,7 @@ static void dce_v6_0_program_watermarks(
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1098,14 +1098,14 @@ static void dce_v8_0_program_watermarks(
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce8_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1120,7 +1120,7 @@ static void dce_v8_0_program_watermarks(
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1159,7 +1159,7 @@ static void dce_v8_0_program_watermarks(
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
^ permalink raw reply
* [PATCH 4.11 050/197] ath9k_htc: fix NULL-deref at probe
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Kalle Valo
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ebeb36670ecac36c179b5fb5d5c88ff03ba191ec upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: 36bcce430657 ("ath9k_htc: Handle storage devices")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1220,6 +1220,9 @@ static int send_eject_command(struct usb
u8 bulk_out_ep;
int r;
+ if (iface_desc->desc.bNumEndpoints < 2)
+ return -ENODEV;
+
/* Find bulk out endpoint */
for (r = 1; r >= 0; r--) {
endpoint = &iface_desc->endpoint[r].desc;
^ permalink raw reply
* [PATCH 4.11 049/197] ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Tunin, Kalle Valo
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 16ff1fb0e32f76a5d285a6f23b82d21aa52813c6 upstream.
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=ff MxPS=64 #Cfgs= 1
P: Vendor=1eda ProdID=2315 Rev=01.08
S: Manufacturer=ATHEROS
S: Product=USB2.0 WLAN
S: SerialNumber=12345
C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 6 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -37,6 +37,7 @@ static struct usb_device_id ath9k_hif_us
{ USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */
{ USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */
{ USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */
+ { USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */
{ USB_DEVICE(0x0cf3, 0x7015),
.driver_info = AR9287_USB }, /* Atheros */
^ permalink raw reply
* [PATCH 4.11 045/197] regulator: rk808: Fix RK818 LDO2
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wadim Egorov, Mark Brown
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <w.egorov@phytec.de>
commit 75f88115391156b3f0fecbbae76bf870c89bcab8 upstream.
Set the correct voltage select register for LDO2.
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/rk808-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -519,7 +519,7 @@ static const struct regulator_desc rk818
RK818_LDO1_ON_VSEL_REG, RK818_LDO_VSEL_MASK, RK818_LDO_EN_REG,
BIT(0), 400),
RK8XX_DESC(RK818_ID_LDO2, "LDO_REG2", "vcc6", 1800, 3400, 100,
- RK818_LDO1_ON_VSEL_REG, RK818_LDO_VSEL_MASK, RK818_LDO_EN_REG,
+ RK818_LDO2_ON_VSEL_REG, RK818_LDO_VSEL_MASK, RK818_LDO_EN_REG,
BIT(1), 400),
{
.name = "LDO_REG3",
^ permalink raw reply
* [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64()
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Al Viro, Benjamin LaHaise,
Ingo Molnar, Linus Torvalds
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 33c9e9729033387ef0521324c62e7eba529294af upstream.
The code to fetch a 64-bit value from user space was entirely buggered,
and has been since the code was merged in early 2016 in commit
b2f680380ddf ("x86/mm/32: Add support for 64-bit __get_user() on 32-bit
kernels").
Happily the buggered routine is almost certainly entirely unused, since
the normal way to access user space memory is just with the non-inlined
"get_user()", and the inlined version didn't even historically exist.
The normal "get_user()" case is handled by external hand-written asm in
arch/x86/lib/getuser.S that doesn't have either of these issues.
There were two independent bugs in __get_user_asm_u64():
- it still did the STAC/CLAC user space access marking, even though
that is now done by the wrapper macros, see commit 11f1a4b9755f
("x86: reorganize SMAP handling in user space accesses").
This didn't result in a semantic error, it just means that the
inlined optimized version was hugely less efficient than the
allegedly slower standard version, since the CLAC/STAC overhead is
quite high on modern Intel CPU's.
- the double register %eax/%edx was marked as an output, but the %eax
part of it was touched early in the asm, and could thus clobber other
inputs to the asm that gcc didn't expect it to touch.
In particular, that meant that the generated code could look like
this:
mov (%eax),%eax
mov 0x4(%eax),%edx
where the load of %edx obviously was _supposed_ to be from the 32-bit
word that followed the source of %eax, but because %eax was
overwritten by the first instruction, the source of %edx was
basically random garbage.
The fixes are trivial: remove the extraneous STAC/CLAC entries, and mark
the 64-bit output as early-clobber to let gcc know that no inputs should
alias with the output register.
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/uaccess.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -324,10 +324,10 @@ do { \
#define __get_user_asm_u64(x, ptr, retval, errret) \
({ \
__typeof__(ptr) __ptr = (ptr); \
- asm volatile(ASM_STAC "\n" \
+ asm volatile("\n" \
"1: movl %2,%%eax\n" \
"2: movl %3,%%edx\n" \
- "3: " ASM_CLAC "\n" \
+ "3:\n" \
".section .fixup,\"ax\"\n" \
"4: mov %4,%0\n" \
" xorl %%eax,%%eax\n" \
@@ -336,7 +336,7 @@ do { \
".previous\n" \
_ASM_EXTABLE(1b, 4b) \
_ASM_EXTABLE(2b, 4b) \
- : "=r" (retval), "=A"(x) \
+ : "=r" (retval), "=&A"(x) \
: "m" (__m(__ptr)), "m" __m(((u32 *)(__ptr)) + 1), \
"i" (errret), "0" (retval)); \
})
^ permalink raw reply
* [PATCH 4.11 038/197] mwifiex: MAC randomization should not be persistent
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brian Norris, Kalle Valo
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
commit 7e2f18f06408ff56d7f75e68de8064777137b319 upstream.
nl80211 provides the NL80211_SCAN_FLAG_RANDOM_ADDR for every scan
request that should be randomized; the absence of such a flag means we
should not randomize. However, mwifiex was stashing the latest
randomization request and *always* using it for future scans, even those
that didn't set the flag.
Let's zero out the randomization info whenever we get a scan request
without NL80211_SCAN_FLAG_RANDOM_ADDR. I'd prefer to remove
priv->random_mac entirely (and plumb the randomization MAC properly
through the call sequence), but the spaghetti is a little difficult to
unravel here for me.
Fixes: c2a8f0ff9c6c ("mwifiex: support random MAC address for scanning")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2528,9 +2528,11 @@ mwifiex_cfg80211_scan(struct wiphy *wiph
priv->random_mac[i] |= get_random_int() &
~(request->mac_addr_mask[i]);
}
+ ether_addr_copy(user_scan_cfg->random_mac, priv->random_mac);
+ } else {
+ eth_zero_addr(priv->random_mac);
}
- ether_addr_copy(user_scan_cfg->random_mac, priv->random_mac);
user_scan_cfg->num_ssids = request->n_ssids;
user_scan_cfg->ssid_list = request->ssids;
^ permalink raw reply
* [PATCH 4.11 037/197] rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxim Samoylov, Larry Finger,
Yan-Hsuan Chuang, Pkshih, Birming Chiu, Shaofu, Steven Ting,
Kalle Valo
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 46cfa2148e7371c537efff1a1c693e58f523089d upstream.
Current channel switch implementation sets 8812ae RFE reg value assuming
that device always has type 2.
Extend possible RFE types set and write corresponding reg values.
Source for new code is
http://dlcdnet.asus.com/pub/ASUS/wireless/PCE-AC51/DR_PCE_AC51_20232801152016.zip
Signed-off-by: Maxim Samoylov <max7255@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Yan-Hsuan Chuang <yhchuang@realtek.com>
Cc: Pkshih <pkshih@realtek.com>
Cc: Birming Chiu <birming@realtek.com>
Cc: Shaofu <shaofu@realtek.com>
Cc: Steven Ting <steventing@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 ++++++++++++++++---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1
2 files changed, 107 insertions(+), 16 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
@@ -358,6 +358,107 @@ bool rtl8821ae_phy_rf_config(struct ieee
return rtl8821ae_phy_rf6052_config(hw);
}
+static void _rtl8812ae_phy_set_rfe_reg_24g(struct ieee80211_hw *hw)
+{
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+ u8 tmp;
+
+ switch (rtlhal->rfe_type) {
+ case 3:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x54337770);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x54337770);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, 0x900, 0x00000303, 0x1);
+ break;
+ case 4:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77777777);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x001);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x001);
+ break;
+ case 5:
+ rtl_write_byte(rtlpriv, RA_RFE_PINMUX + 2, 0x77);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777);
+ tmp = rtl_read_byte(rtlpriv, RA_RFE_INV + 3);
+ rtl_write_byte(rtlpriv, RA_RFE_INV + 3, tmp & ~0x1);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000);
+ break;
+ case 1:
+ if (rtlpriv->btcoexist.bt_coexistence) {
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, 0xffffff, 0x777777);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD,
+ 0x77777777);
+ rtl_set_bbreg(hw, RA_RFE_INV, 0x33f00000, 0x000);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000);
+ break;
+ }
+ case 0:
+ case 2:
+ default:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77777777);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x000);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000);
+ break;
+ }
+}
+
+static void _rtl8812ae_phy_set_rfe_reg_5g(struct ieee80211_hw *hw)
+{
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+ u8 tmp;
+
+ switch (rtlhal->rfe_type) {
+ case 0:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77337717);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337717);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010);
+ break;
+ case 1:
+ if (rtlpriv->btcoexist.bt_coexistence) {
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, 0xffffff, 0x337717);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD,
+ 0x77337717);
+ rtl_set_bbreg(hw, RA_RFE_INV, 0x33f00000, 0x000);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000);
+ } else {
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD,
+ 0x77337717);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD,
+ 0x77337717);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x000);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000);
+ }
+ break;
+ case 3:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x54337717);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x54337717);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, 0x900, 0x00000303, 0x1);
+ break;
+ case 5:
+ rtl_write_byte(rtlpriv, RA_RFE_PINMUX + 2, 0x33);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337777);
+ tmp = rtl_read_byte(rtlpriv, RA_RFE_INV + 3);
+ rtl_write_byte(rtlpriv, RA_RFE_INV + 3, tmp | 0x1);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010);
+ break;
+ case 2:
+ case 4:
+ default:
+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77337777);
+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337777);
+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010);
+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010);
+ break;
+ }
+}
+
u32 phy_get_tx_swing_8812A(struct ieee80211_hw *hw, u8 band,
u8 rf_path)
{
@@ -552,14 +653,9 @@ void rtl8821ae_phy_switch_wirelessband(s
/* 0x82C[1:0] = 2b'00 */
rtl_set_bbreg(hw, 0x82c, 0x3, 0);
}
- if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
- rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD,
- 0x77777777);
- rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD,
- 0x77777777);
- rtl_set_bbreg(hw, RA_RFE_INV, 0x3ff00000, 0x000);
- rtl_set_bbreg(hw, RB_RFE_INV, 0x3ff00000, 0x000);
- }
+
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE)
+ _rtl8812ae_phy_set_rfe_reg_24g(hw);
rtl_set_bbreg(hw, RTXPATH, 0xf0, 0x1);
rtl_set_bbreg(hw, RCCK_RX, 0x0f000000, 0x1);
@@ -614,14 +710,8 @@ void rtl8821ae_phy_switch_wirelessband(s
/* 0x82C[1:0] = 2'b00 */
rtl_set_bbreg(hw, 0x82c, 0x3, 1);
- if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
- rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD,
- 0x77337777);
- rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD,
- 0x77337777);
- rtl_set_bbreg(hw, RA_RFE_INV, 0x3ff00000, 0x010);
- rtl_set_bbreg(hw, RB_RFE_INV, 0x3ff00000, 0x010);
- }
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE)
+ _rtl8812ae_phy_set_rfe_reg_5g(hw);
rtl_set_bbreg(hw, RTXPATH, 0xf0, 0);
rtl_set_bbreg(hw, RCCK_RX, 0x0f000000, 0xf);
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h
@@ -2424,6 +2424,7 @@
#define BMASKH4BITS 0xf0000000
#define BMASKOFDM_D 0xffc00000
#define BMASKCCK 0x3f3f3f3f
+#define BMASKRFEINV 0x3ff00000
#define BRFREGOFFSETMASK 0xfffff
^ permalink raw reply
* [PATCH 4.11 036/197] md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, NeilBrown, Zhilong Liu, Shaohua Li
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit 065e519e71b2c1f41936cce75b46b5ab34adb588 upstream.
if called md_set_readonly and set MD_CLOSING bit, the mddev cannot
be opened any more due to the MD_CLOING bit wasn't cleared. Thus it
needs to be cleared in md_ioctl after any call to md_set_readonly()
or do_md_stop().
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes: af8d8e6f0315 ("md: changes for MD_STILL_CLOSED flag")
Signed-off-by: Zhilong Liu <zlliu@suse.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6776,6 +6776,7 @@ static int md_ioctl(struct block_device
void __user *argp = (void __user *)arg;
struct mddev *mddev = NULL;
int ro;
+ bool did_set_md_closing = false;
if (!md_ioctl_valid(cmd))
return -ENOTTY;
@@ -6865,7 +6866,9 @@ static int md_ioctl(struct block_device
err = -EBUSY;
goto out;
}
+ WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
set_bit(MD_CLOSING, &mddev->flags);
+ did_set_md_closing = true;
mutex_unlock(&mddev->open_mutex);
sync_blockdev(bdev);
}
@@ -7058,6 +7061,8 @@ unlock:
mddev->hold_active = 0;
mddev_unlock(mddev);
out:
+ if(did_set_md_closing)
+ clear_bit(MD_CLOSING, &mddev->flags);
return err;
}
#ifdef CONFIG_COMPAT
^ permalink raw reply
* [PATCH 4.11 034/197] dm space map disk: fix some book keeping in the disk space map
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream.
When decrementing the reference count for a block, the free count wasn't
being updated if the reference count went to zero.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_s
static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b)
{
+ int r;
+ uint32_t old_count;
enum allocation_event ev;
struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
- return sm_ll_dec(&smd->ll, b, &ev);
+ r = sm_ll_dec(&smd->ll, b, &ev);
+ if (!r && (ev == SM_FREE)) {
+ /*
+ * It's only free if it's also free in the last
+ * transaction.
+ */
+ r = sm_ll_lookup(&smd->old_ll, b, &old_count);
+ if (!r && !old_count)
+ smd->nr_allocated_this_transaction--;
+ }
+
+ return r;
}
static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox