6 years agoMAINTAINERS: Update email address for aacraid
Dave Carroll [Wed, 15 Jun 2016 17:27:17 +0000 (11:27 -0600)]
MAINTAINERS: Update email address for aacraid

Update the email address for aacraid from Adaptec to Microsemi.

Signed-off-by: Dave Carroll <>
Signed-off-by: Martin K. Petersen <>
6 years agoscsi_debug: fix sleep in invalid context
Douglas Gilbert [Tue, 31 May 2016 21:15:07 +0000 (17:15 -0400)]
scsi_debug: fix sleep in invalid context

In this post: the
author shows some kernel infrastructure complaining about a sleep in an
invalid context. Remove offending call to vmalloc().  Instead of using
kzalloc() which reviewers didn't like, use a bucket system (64 bytes on
the stack) and potentially multiple calls to sg_pcopy_from_buffer() to
construct the 'data-in' buffer for the SCSI REPORT LUNS command.

Signed-off-by: Douglas Gilbert <>
Acked-by: Christoph Hellwig <>
Reviewed-by: Bart Van Assche <>
Signed-off-by: Martin K. Petersen <>
6 years agolibfc: Update rport reference counting
Hannes Reinecke [Tue, 24 May 2016 06:11:58 +0000 (08:11 +0200)]
libfc: Update rport reference counting

Originally libfc would just be initializing the refcount to '1', and
using the disc_mutex to synchronize if and when the final put should be
happening.  This has a race condition as the mutex might be delayed,
causing other threads to access an invalid structure.  This patch
updates the rport reference counting to increase the reference every
time 'rport_lookup' is called, and decreases the reference
correspondingly.  This removes the need to hold 'disc_mutex' when
removing the structure, and avoids the above race condition.

Signed-off-by: Hannes Reinecke <>
Acked-by: Vasu Dev <>
Reviewed-by: Johannes Thumshirn <>
Signed-off-by: Martin K. Petersen <>
6 years agoscsi: ultrastor.c depends on ISA_DMA_API
Randy Dunlap [Thu, 19 May 2016 17:57:31 +0000 (10:57 -0700)]
scsi: ultrastor.c depends on ISA_DMA_API

Fix build when CONFIG_ISA_DMA_API is not enabled. Fixes these build
errors (on x86_64):

../drivers/scsi/ultrastor.c: In function 'ultrastor_14f_detect':
../drivers/scsi/ultrastor.c:519:5: error: implicit declaration of function 'request_dma' [-Werror=implicit-function-declaration]
     if (config.dma_channel && request_dma(config.dma_channel,"Ultrastor")) {
../drivers/scsi/ultrastor.c: In function 'ultrastor_release':
../drivers/scsi/ultrastor.c:658:3: error: implicit declaration of function 'free_dma' [-Werror=implicit-function-declaration]

Signed-off-by: Randy Dunlap <>
Signed-off-by: Martin K. Petersen <>
6 years agobnx2i: fix spelling mistake "complection" -> "completion"
Colin Ian King [Sat, 4 Jun 2016 19:14:30 +0000 (20:14 +0100)]
bnx2i: fix spelling mistake "complection" -> "completion"

Trivial fix to spelling mistake in printk message.

Signed-off-by: Colin Ian King <>
Reviewed-by: Laurence Oberman <>
Signed-off-by: Martin K. Petersen <>
6 years agohisi_sas: update driver version to 1.5
John Garry [Tue, 31 May 2016 12:38:51 +0000 (20:38 +0800)]
hisi_sas: update driver version to 1.5

Signed-off-by: John Garry <>
Signed-off-by: Martin K. Petersen <>
6 years agohisi_sas: fix the inconsistent lock issue reported by CONFIG_PROVE_LOCKING
John Garry [Tue, 31 May 2016 12:38:50 +0000 (20:38 +0800)]
hisi_sas: fix the inconsistent lock issue reported by CONFIG_PROVE_LOCKING

It is not necessary to surround call to
notify_port_event(, PORTE_BROADCAST_RCVD) by spin_lock_irqsave(),
so remove.
This was causing a warn, as below:

    [ INFO: inconsistent lock state ]
    4.4.8+ #12 Not tainted
    inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
    kworker/u64:1/168 [HC0[0]:SC0[0]:HE1:SE1] takes:
     (&(&hisi_hba->lock)->rlock){?.....}, at: [<ffffffc00052c708>] alloc_dev_quirk_v2_hw+0x48/0xec
    {IN-HARDIRQ-W} state was registered at:
      [<ffffffc0000fc764>] mark_lock+0x19c/0x6a0
      [<ffffffc0000fdc14>] __lock_acquire+0xa2c/0x1d00
      [<ffffffc0000ff654>] lock_acquire+0x58/0x7c
      [<ffffffc0008b609c>] _raw_spin_lock_irqsave+0x54/0x6c
      [<ffffffc00052d3c0>] int_chnl_int_v2_hw+0x1c4/0x248
      [<ffffffc0001098e8>] handle_irq_event_percpu+0x9c/0x144
      [<ffffffc0001099d4>] handle_irq_event+0x44/0x74
      [<ffffffc00010cd68>] handle_fasteoi_irq+0xb4/0x188
      [<ffffffc000108ea8>] generic_handle_irq+0x24/0x38
      [<ffffffc0001091fc>] __handle_domain_irq+0x60/0xac
      [<ffffffc00008261c>] gic_handle_irq+0xcc/0x168
      [<ffffffc0000855ac>] el1_irq+0x6c/0xe0
      [<ffffffc0000f7414>] default_idle_call+0x1c/0x34
      [<ffffffc0000f7654>] cpu_startup_entry+0x1d4/0x228
      [<ffffffc0008aecd8>] rest_init+0x150/0x160
      [<ffffffc000c4b95c>] start_kernel+0x3a4/0x3b8
      [<00000000008bb000>] 0x8bb000
    irq event stamp: 32661
    hardirqs last  enabled at (32661): [<ffffffc0008b41a8>] __mutex_unlock_slowpath+0x108/0x18c
    hardirqs last disabled at (32660): [<ffffffc0008b40e4>] __mutex_unlock_slowpath+0x44/0x18c
    softirqs last  enabled at (25114): [<ffffffc0000bde68>] __do_softirq+0x210/0x27c
    softirqs last disabled at (25095): [<ffffffc0000be224>] irq_exit+0x9c/0xe8

    other info that might help us debug this:
     Possible unsafe locking scenario:


     *** DEADLOCK ***

    2 locks held by kworker/u64:1/168:
     #0:  ("%s"shost->work_q_name){++++.+}, at: [<ffffffc0000d2980>] process_one_work+0x134/0x3cc
     #1:  ((&sw->work)#2){+.+.+.}, at: [<ffffffc0000d2980>] process_one_work+0x134/0x3cc

    stack backtrace:
    CPU: 4 PID: 168 Comm: kworker/u64:1 Not tainted 4.4.8+ #12
    Hardware name: Huawei Technologies Co., Ltd. D03/D03, BIOS 1.12 01/01/1900
    Workqueue: scsi_wq_1 sas_discover_domain
    Call trace:
    [<ffffffc000089988>] dump_backtrace+0x0/0x114
    [<ffffffc000089ab0>] show_stack+0x14/0x1c
    [<ffffffc00035ac50>] dump_stack+0xb4/0xf0
    [<ffffffc0000fc524>] print_usage_bug+0x210/0x2b4
    [<ffffffc0000fcbc4>] mark_lock+0x5fc/0x6a0
    [<ffffffc0000fd9e8>] __lock_acquire+0x800/0x1d00
    [<ffffffc0000ff654>] lock_acquire+0x58/0x7c
    [<ffffffc0008b5edc>] _raw_spin_lock+0x44/0x58
    [<ffffffc00052c708>] alloc_dev_quirk_v2_hw+0x48/0xec
    [<ffffffc000528214>] hisi_sas_dev_found+0x48/0x1b8
    [<ffffffc00051a9b8>] sas_notify_lldd_dev_found+0x34/0xe0
    [<ffffffc00051e5e8>] sas_discover_root_expander+0x58/0x128
    [<ffffffc00051b38c>] sas_discover_domain+0x4bc/0x564
    [<ffffffc0000d29ec>] process_one_work+0x1a0/0x3cc
    [<ffffffc0000d2d50>] worker_thread+0x138/0x438
    [<ffffffc0000d9494>] kthread+0xdc/0xf0
    [<ffffffc000085c50>] ret_from_fork+0x10/0x40

Signed-off-by: Wei Xu <>
Signed-off-by: John Garry <>
Reviewed-by: Zhangfei Gao <>
Signed-off-by: Martin K. Petersen <>
6 years agohisi_sas: add v2 hw ACPI support
John Garry [Tue, 31 May 2016 12:38:49 +0000 (20:38 +0800)]
hisi_sas: add v2 hw ACPI support

Add support in v2 hw driver for ACPI.

A check on whether an ACPI handle is available for the device is used to
decide on whether to use ACPI reset handler or syscon for hw reset.

Signed-off-by: John Garry <>
Signed-off-by: Wei Xu <>
Reviewed-by: Zhangfei Gao <>
Signed-off-by: Martin K. Petersen <>
6 years agoscsi: storvsc: Filter out storvsc messages CD-ROM medium not present
Cathy Avery [Mon, 23 May 2016 14:29:17 +0000 (10:29 -0400)]
scsi: storvsc: Filter out storvsc messages CD-ROM medium not present

When a virtual scsi DVD device is present with no image file
attached the storvsc driver logs all resulting unnecessary sense errors
whenever IO is issued to the device.

[storvsc] Sense Key : Not Ready [current]
[storvsc] Add. Sense: Medium not present - tray closed

[mkp: Fixed whitespace]

Signed-off-by: Cathy Avery <>
Reviewed-by: K. Y. Srinivasan <>
Signed-off-by: Martin K. Petersen <>
6 years agobnx2fc: replace printk() with BNX2FC_IO_DBG()
Maurizio Lombardi [Mon, 30 May 2016 08:41:01 +0000 (10:41 +0200)]
bnx2fc: replace printk() with BNX2FC_IO_DBG()

The "fcp_rsp_code = %d" message isn't an error, it's meant to be
informative only.  This patch prevents a flood of such messages in some

Signed-off-by: Maurizio Lombardi <>
Tested-by: Laurence Oberman <>
Reviewed-by: Johannes Thumshirn <>
Acked-by: Chad Dupuis <>
Signed-off-by: Martin K. Petersen <>
6 years agompt3sas: avoid mpt3sas_transport_port_add NULL parent_dev
Joe Lawrence [Wed, 25 May 2016 19:14:29 +0000 (15:14 -0400)]
mpt3sas: avoid mpt3sas_transport_port_add NULL parent_dev

If _scsih_sas_host_add's call to mpt3sas_config_get_sas_iounit_pg0
fails, ioc->sas_hba.parent_dev may be left uninitialized.  A later
device probe could invoke mpt3sas_transport_port_add which will call
sas_port_alloc_num [scsi_transport_sas] with a NULL parent_dev pointer.

Signed-off-by: Joe Lawrence <>
Acked-by: Sreekanth Reddy <>
Signed-off-by: Martin K. Petersen <>
6 years agompt3sas: set num_phys after allocating phy[] space
Joe Lawrence [Wed, 25 May 2016 19:14:28 +0000 (15:14 -0400)]
mpt3sas: set num_phys after allocating phy[] space

In _scsih_sas_host_add, the number of HBA phys are determined and then
later used to allocate an array of struct _sas_phy's.  If the routine
sets ioc->sas_hba.num_phys, but then fails to allocate the
ioc->sas_hba.phy array (by kcalloc error or other intermediate
error/exit path), ioc->sas_hba is left in a dangerous state: all readers
of ioc->sas_hba.phy[] do so by indexing it from 0..ioc->sas_hba.num_phys
without checking that the space was ever allocated.

Modify _scsih_sas_host_add to set ioc->sas_hba.num_phys only after
successfully allocating ioc->sas_hba.phy[].

Signed-off-by: Joe Lawrence <>
Acked-by: Sreekanth Reddy <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: Adding license info do tc-dwc-g210 and ufshcd-dwc to enable loadable module
Joao Pinto [Mon, 23 May 2016 09:18:07 +0000 (10:18 +0100)]
ufs: Adding license info do tc-dwc-g210 and ufshcd-dwc to enable loadable module

This patch adds license info to the tc-dwc-g210 and ufshcd-dwc files in
order for them to have access to some ufshcd symbols when all are built
as modules.

Signed-off-by: Joao Pinto <>
Signed-off-by: Martin K. Petersen <>
6 years agoMAINTAINERS: Add file patterns for scsi device tree bindings
Geert Uytterhoeven [Sun, 22 May 2016 09:06:19 +0000 (11:06 +0200)]
MAINTAINERS: Add file patterns for scsi device tree bindings

Submitters of device tree binding documentation may forget to CC the
subsystem maintainer if this is missing.

Signed-off-by: Geert Uytterhoeven <>
Cc: James E.J. Bottomley <>
Cc: Martin K. Petersen <>
Signed-off-by: Martin K. Petersen <>
6 years agoaacraid: use kmemdup
Muhammad Falak R Wani [Thu, 19 May 2016 14:08:33 +0000 (19:38 +0530)]
aacraid: use kmemdup

Use kmemdup when some other buffer is immediately copied into allocated
region. It replaces call to allocation followed by memcpy, by a single
call to kmemdup.

Signed-off-by: Muhammad Falak R Wani <>
Reviewed-by: Raghava Aditya Renukunta <>
Signed-off-by: Martin K. Petersen <>
6 years agopm8001: fix typo
Julia Lawall [Tue, 17 May 2016 14:38:44 +0000 (16:38 +0200)]
pm8001: fix typo

firmare -> firmware

Signed-off-by: Julia Lawall <>
Acked-by: Jack Wang <>
Signed-off-by: Martin K. Petersen <>
6 years agosnic: fix typo
Julia Lawall [Tue, 17 May 2016 14:38:40 +0000 (16:38 +0200)]
snic: fix typo

firmare -> firmware

Signed-off-by: Julia Lawall <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add TC G210 pci driver
Joao Pinto [Wed, 11 May 2016 11:21:33 +0000 (12:21 +0100)]
ufs: add TC G210 pci driver

This patch adds a glue pci driver for the Synopsys G210 Test Chip.

[mkp: Fixed Kconfig depends and module name]

Signed-off-by: Joao Pinto <>
Reviewed-by: Hannes Reinicke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add TC G210 platform driver
Joao Pinto [Wed, 11 May 2016 11:21:32 +0000 (12:21 +0100)]
ufs: add TC G210 platform driver

This patch adds a glue platform driver for the Synopsys G210 Test Chip.

Signed-off-by: Joao Pinto <>
Reviewed-by: Hannes Reinicke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add support for Synopsys G210 Test Chip
Joao Pinto [Wed, 11 May 2016 11:21:31 +0000 (12:21 +0100)]
ufs: add support for Synopsys G210 Test Chip

This patch adds support for Synopsys G210 Test Chip.

Signed-off-by: Joao Pinto <>
Reviewed-by: Hannes Reinicke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add support for DesignWare Controller
Joao Pinto [Wed, 11 May 2016 11:21:30 +0000 (12:21 +0100)]
ufs: add support for DesignWare Controller

This patch has the goal to add support for DesignWare UFS Controller
specific operations.

Signed-off-by: Joao Pinto <>
Reviewed-by: Hannes Reinicke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add link status to ufshci
Joao Pinto [Wed, 11 May 2016 11:21:29 +0000 (12:21 +0100)]
ufs: add link status to ufshci

Add link status to ufshci.

Signed-off-by: Joao Pinto <>
Acked-by: Tomas Winkler <>
Reviewed-by: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add unipro attributes
Joao Pinto [Wed, 11 May 2016 11:21:28 +0000 (12:21 +0100)]
ufs: add unipro attributes

Add unipro attributes.

Signed-off-by: Joao Pinto <>
Acked-by: Tomas Winkler <>
Reviewed-by: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add UFS 2.0 capabilities
Joao Pinto [Wed, 11 May 2016 11:21:27 +0000 (12:21 +0100)]
ufs: add UFS 2.0 capabilities

Add UFS 2.0 support to the UFS core driver.

Signed-off-by: Joao Pinto <>
Acked-by: Arnd Bergmann <>
Acked-by: Tomas Winkler <>
Reviewed-by: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: add UFS 2.0 to ufshcd-pltfrm bindings
Joao Pinto [Wed, 11 May 2016 11:21:26 +0000 (12:21 +0100)]
ufs: add UFS 2.0 to ufshcd-pltfrm bindings

Add UFS 2.0 to the ufshcd-pltfrm devicetree binding.

Signed-off-by: Joao Pinto <>
Acked-by: Rob Herring <>
Acked-by: Tomas Winkler <>
Reviewed-by: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
6 years agoufs: fixed typo in ufshcd-pltfrm
Joao Pinto [Wed, 11 May 2016 11:21:25 +0000 (12:21 +0100)]
ufs: fixed typo in ufshcd-pltfrm

Fixed typo in ufshcd-pltfrm.

Signed-off-by: Joao Pinto <>
Acked-by: Arnd Bergmann <>
Acked-by: Tomas Winkler <>
Reviewed-by: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
6 years agoMerge tag 'qcom-smd-list-voltage' of git://
Linus Torvalds [Tue, 12 Jul 2016 19:22:16 +0000 (04:22 +0900)]
Merge tag 'qcom-smd-list-voltage' of git://git./linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "Fix qcom-smd list voltage issues for msm8974

  This commit looks like a cleanup but in fact by causing the core to go
  down some simplified code paths for noop regulators it avoids a boot
  time crash for msm8974 platforms which was introduced in v4.7.  It has
  been in -next for a while, the issues in mainline for these platforms
  weren't flagged up to me until yesterday (I think it took some time to
  figure out what was going wrong)"

* tag 'qcom-smd-list-voltage' of git://
  regulator: qcom_smd: Remove list_voltage callback for rpm_smps_ldo_ops_fixed

6 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 12 Jul 2016 07:49:01 +0000 (16:49 +0900)]
Merge branch 'for-linus' of git://git./linux/kernel/git/viro/vfs

Pull vfs fixes from Al Viro.

* 'for-linus' of git://
  posix_acl: de-union a_refcount and a_rcu
  nfs_atomic_open(): prevent parallel nfs_lookup() on a negative hashed
  Use the right predicate in ->atomic_open() instances

6 years agoposix_acl: de-union a_refcount and a_rcu
Jeff Layton [Mon, 11 Jul 2016 13:10:06 +0000 (09:10 -0400)]
posix_acl: de-union a_refcount and a_rcu

Currently the two are unioned together, but I don't think that's safe.

It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two

Fixes: b8a7a3a66747 (posix_acl: Inode acl caching fixes)
Signed-off-by: Jeff Layton <>
Signed-off-by: Al Viro <>
6 years agoLinux 4.7-rc7 v4.7-rc7
Linus Torvalds [Mon, 11 Jul 2016 03:24:59 +0000 (20:24 -0700)]
Linux 4.7-rc7

6 years agotmpfs: fix regression hang in fallocate undo
Hugh Dickins [Sun, 10 Jul 2016 23:46:32 +0000 (16:46 -0700)]
tmpfs: fix regression hang in fallocate undo

The well-spotted fallocate undo fix is good in most cases, but not when
fallocate failed on the very first page.  index 0 then passes lend -1
to shmem_undo_range(), and that has two bad effects: (a) that it will
undo every fallocation throughout the file, unrestricted by the current
range; but more importantly (b) it can cause the undo to hang, because
lend -1 is treated as truncation, which makes it keep on retrying until
every page has gone, but those already fully instantiated will never go
away.  Big thank you to xfstests generic/269 which demonstrates this.

Fixes: b9b4bb26af01 ("tmpfs: don't undo fallocate past its last page")
Signed-off-by: Hugh Dickins <>
Signed-off-by: Linus Torvalds <>
6 years agoMerge branch 'upstream' of git://
Linus Torvalds [Sun, 10 Jul 2016 16:13:02 +0000 (09:13 -0700)]
Merge branch 'upstream' of git://

Pull MIPS fix from Ralf Baechle:
 "Another week with just a single 4.7 fix.

  This fixes a possible 'loss' of the huge page bit from pmd on
  permission change"

* 'upstream' of git://
  MIPS: Fix page table corruption on THP permission changes.

6 years agoMerge tag 'scsi-fixes' of git://
Linus Torvalds [Sat, 9 Jul 2016 01:59:46 +0000 (18:59 -0700)]
Merge tag 'scsi-fixes' of git://git./linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Three fixes.  One is the qla24xx MSI regression, one is a theoretical
  problem over blacklist matching, which would bite USB badly if it ever
  triggered and one is a system hang with a particular type of IPR

* tag 'scsi-fixes' of git://
  qla2xxx: Fix NULL pointer deref in QLA interrupt
  SCSI: fix new bug in scsi_dev_info_list string matching
  ipr: Clear interrupt on croc/crocodile when running with LSI

6 years agoMerge tag 'ecryptfs-4.7-rc7-fixes' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:48:28 +0000 (09:48 -0700)]
Merge tag 'ecryptfs-4.7-rc7-fixes' of git://git./linux/kernel/git/tyhicks/ecryptfs

Pull eCryptfs fixes from Tyler Hicks:
 "Provide a more concise fix for CVE-2016-1583:
   - Additionally fixes linux-stable regressions caused by the
     cherry-picking of the original fix

  Some very minor changes that have queued up:
   - Fix typos in code comments
   - Remove unnecessary check for NULL before destroying kmem_cache"

* tag 'ecryptfs-4.7-rc7-fixes' of git://
  ecryptfs: don't allow mmap when the lower fs doesn't support it
  Revert "ecryptfs: forbid opening files without mmap handler"
  ecryptfs: fix spelling mistakes
  eCryptfs: fix typos in comment
  ecryptfs: drop null test before destroy functions

6 years agoMerge tag 'iommu-fixes-v4.7-rc6' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:35:23 +0000 (09:35 -0700)]
Merge tag 'iommu-fixes-v4.7-rc6' of git://git./linux/kernel/git/joro/iommu

Pull IOMMU fixes from Joerg Roedel:
 "Two Fixes:

   - Intel VT-d fix for a suspend/resume issue, introduced with the
     scalability improvements in this cycle.

   - AMD IOMMU fix for systems that have unity mappings defined.  There
     was a race where translation got enabled before the unity mappings
     were in place.  This issue was seen on some HP servers"

* tag 'iommu-fixes-v4.7-rc6' of git://
  iommu/amd: Fix unity mapping initialization race
  iommu/vt-d: Fix infinite loop in free_all_cpu_cached_iovas

6 years agoMerge tag 'for-linus-4.7b-rc6-tag' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:12:41 +0000 (09:12 -0700)]
Merge tag 'for-linus-4.7b-rc6-tag' of git://git./linux/kernel/git/xen/tip

Pull xen bug fixes from David Vrabel:

 - Fix two bugs in the handling of xenbus transactions.

 - Make the xen acpi driver compatible with Xen 4.7.

* tag 'for-linus-4.7b-rc6-tag' of git://
  xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
  xenbus: simplify xenbus_dev_request_and_reply()
  xenbus: don't bail early from xenbus_dev_request_and_reply()
  xenbus: don't BUG() on user mode induced condition

6 years agoMerge tag 'arm64-fixes' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:08:27 +0000 (09:08 -0700)]
Merge tag 'arm64-fixes' of git://git./linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "A couple of late fixes here, but one that we've been sitting on for a
  few weeks while the details were worked out.  Specifically, we now
  enforce USER_DS on taking exceptions whilst in the kernel, which
  avoids leaking kernel data to userspace through things like perf.  The
  other patch is an update to a workaround for a hardware erratum on
  some Cavium SoCs.


   - Enforce USER_DS on exception entry from EL1

   - Apply workaround for Cavium errata #27456 on Thunderx-81xx parts"

* tag 'arm64-fixes' of git://
  arm64: Enable workaround for Cavium erratum 27456 on thunderx-81xx
  arm64: kernel: Save and restore UAO and addr_limit on exception entry

6 years agoMerge branch 'x86-urgent-for-linus' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:06:52 +0000 (09:06 -0700)]
Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "Three fixes:

   - A boot crash fix with certain configs
   - a MAINTAINERS entry update
   - Documentation typo fixes"

* 'x86-urgent-for-linus' of git://
  x86/Documentation: Fix various typos in Documentation/x86/ files
  x86/amd_nb: Fix boot crash on non-AMD systems
  MAINTAINERS: Update the Calgary IOMMU entry

6 years agoMerge branch 'sched-urgent-for-linus' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:04:34 +0000 (09:04 -0700)]
Merge branch 'sched-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:
 "Two load-balancing fixes for cgroups-intense workloads"

* 'sched-urgent-for-linus' of git://
  sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
  sched/fair: Fix effective_load() to consistently use smoothed load

6 years agoMerge branch 'perf-urgent-for-linus' of git://
Linus Torvalds [Fri, 8 Jul 2016 16:02:16 +0000 (09:02 -0700)]
Merge branch 'perf-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull perf fixes from Ingo Molnar:
 "Various fixes:

   - 32-bit callgraph bug fix
   - suboptimal event group scheduling bug fix
   - event constraint fixes for Broadwell/Skylake
   - RAPL module name collision fix"

* 'perf-urgent-for-linus' of git://
  perf/core: Fix pmu::filter_match for SW-led groups
  x86/perf/intel/rapl: Fix module name collision with powercap intel-rapl
  perf/x86: Fix 32-bit perf user callgraph collection
  perf/x86/intel: Update event constraints when HT is off

6 years agoMerge branch 'irq-urgent-for-linus' of git://
Linus Torvalds [Fri, 8 Jul 2016 15:59:33 +0000 (08:59 -0700)]
Merge branch 'irq-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:
 "Two MIPS-GIC irqchip driver fixes to unbreak certain MIPS boards"

* 'irq-urgent-for-linus' of git://
  irqchip/mips-gic: Match IPI IRQ domain by bus token only
  irqchip/mips-gic: Map to VPs using HW VPNum

6 years agoMerge tag 'gpio-v4.7-5' of git://
Linus Torvalds [Fri, 8 Jul 2016 15:57:03 +0000 (08:57 -0700)]
Merge tag 'gpio-v4.7-5' of git://git./linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "I don't like to toss in last minute patches, but these are all for
  things that are broken, and have bitten people for real.  Two of them
  go into stable.  Maybe all of them if the compile test problem is a
  pain in the ass also for stable folks.

  Final (hopefully) GPIO fixes for v4.7:

   - Fix an oops on the Asus Eee PC 1201

   - Revert a patch trying to split GPIO parsing and GPIO configuration

   - Revert a too liberal compile testing thing"

* tag 'gpio-v4.7-5' of git://
  Revert "gpio: gpiolib-of: Allow compile testing"
  Revert "gpiolib: Split GPIO flags parsing and GPIO configuration"
  gpio: sch: Fix Oops on module load on Asus Eee PC 1201

6 years agoMerge tag 'drm-fixes-for-v4.7-rc7' of git://
Linus Torvalds [Fri, 8 Jul 2016 15:55:27 +0000 (08:55 -0700)]
Merge tag 'drm-fixes-for-v4.7-rc7' of git://

Pull drm fixes from Dave Airlie:
 "One nouveau fix, and a few AMD Polaris fixes and some Allwinner fixes.

  I've got some vmware fixes that I might send separate over the
  weekend, they fix some black screens, but I'm still debating them"

* tag 'drm-fixes-for-v4.7-rc7' of git://
  drm/amd/powerplay: Update CKS on/ CKS off voltage offset calculation.
  drm/amd/powerplay: fix bug that get wrong polaris evv voltage.
  drm/amd/powerplay: incorrectly use of the function return value
  drm/amd/powerplay: fix incorrect voltage table value for tonga
  drm/amd/powerplay: fix incorrect voltage table value for polaris10
  drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
  gpu: drm: sun4i_drv: add missing of_node_put after calling of_parse_phandle
  drm/sun4i: Send vblank event when the CRTC is disabled
  drm/sun4i: Report proper vblank

6 years agoecryptfs: don't allow mmap when the lower fs doesn't support it
Jeff Mahoney [Tue, 5 Jul 2016 21:32:30 +0000 (17:32 -0400)]
ecryptfs: don't allow mmap when the lower fs doesn't support it

There are legitimate reasons to disallow mmap on certain files, notably
in sysfs or procfs.  We shouldn't emulate mmap support on file systems
that don't offer support natively.


Signed-off-by: Jeff Mahoney <>
[tyhicks: clean up f_op check by using ecryptfs_file_to_lower()]
Signed-off-by: Tyler Hicks <>
6 years agoxen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
Jan Beulich [Fri, 8 Jul 2016 12:15:07 +0000 (06:15 -0600)]
xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7

As of Xen 4.7 PV CPUID doesn't expose either of CPUID[1].ECX[7] and
CPUID[0x80000007].EDX[7] anymore, causing the driver to fail to load on
both Intel and AMD systems. Doing any kind of hardware capability
checks in the driver as a prerequisite was wrong anyway: With the
hypervisor being in charge, all such checking should be done by it. If
ACPI data gets uploaded despite some missing capability, the hypervisor
is free to ignore part or all of that data.

Ditch the entire check_prereq() function, and do the only valid check
(xen_initial_domain()) in the caller in its place.

Signed-off-by: Jan Beulich <>
Cc: <>
Signed-off-by: David Vrabel <>
6 years agoxenbus: simplify xenbus_dev_request_and_reply()
Jan Beulich [Thu, 7 Jul 2016 07:32:35 +0000 (01:32 -0600)]
xenbus: simplify xenbus_dev_request_and_reply()

No need to retain a local copy of the full request message, only the
type is really needed.

Signed-off-by: Jan Beulich <>
Signed-off-by: David Vrabel <>
6 years agoxenbus: don't bail early from xenbus_dev_request_and_reply()
Jan Beulich [Thu, 7 Jul 2016 07:32:04 +0000 (01:32 -0600)]
xenbus: don't bail early from xenbus_dev_request_and_reply()

xenbus_dev_request_and_reply() needs to track whether a transaction is
open.  For XS_TRANSACTION_START messages it calls transaction_start()
and for XS_TRANSACTION_END messages it calls transaction_end().

If sending an XS_TRANSACTION_START message fails or responds with an
an error, the transaction is not open and transaction_end() must be

If sending an XS_TRANSACTION_END message fails, the transaction is
still open, but if an error response is returned the transaction is

Commit 027bd7e89906 ("xen/xenbus: Avoid synchronous wait on XenBus
stalling shutdown/restart") introduced a regression where failed
XS_TRANSACTION_START messages were leaving the transaction open.  This
can cause problems with suspend (and migration) as all transactions
must be closed before suspending.

It appears that the problematic change was added accidentally, so just
remove it.

Signed-off-by: Jan Beulich <>
Cc: Konrad Rzeszutek Wilk <>
Cc: <>
Signed-off-by: David Vrabel <>
6 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 8 Jul 2016 03:56:09 +0000 (20:56 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/linux-security

Pull apparmor fix from James Morris.

* 'for-linus' of git://
  apparmor: fix oops, validate buffer size in apparmor_setprocattr()

6 years agoMerge tag 'acpi-4.7-rc7' of git://
Linus Torvalds [Fri, 8 Jul 2016 03:49:41 +0000 (20:49 -0700)]
Merge tag 'acpi-4.7-rc7' of git://git./linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "All of these fix recent regressions in ACPICA, in the ACPI PCI IRQ
  management code and in the ACPI AML debugger.


   - Fix a lock ordering issue in ACPICA introduced by a recent commit
     that attempted to fix a deadlock in the dynamic table loading code
     which in turn appeared after changes related to the handling of
     module-level AML also made in this cycle (Lv Zheng).

   - Fix a recent regression in the ACPI IRQ management code that may
     cause PCI drivers to be unable to register an IRQ if that IRQ
     happens to be shared with a device on the ISA bus, like the
     parallel port, by reverting one commit entirely and restoring the
     previous behavior in two other places (Sinan Kaya).

   - Fix a recent regression in the ACPI AML debugger introduced by the
     commit that removed incorrect usage of IS_ERR_VALUE() from multiple
     places (Lv Zheng)"

* tag 'acpi-4.7-rc7' of git://
  ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal
  ACPICA: Namespace: Fix namespace/interpreter lock ordering
  ACPI,PCI,IRQ: separate ISA penalty calculation
  Revert "ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()"
  ACPI,PCI,IRQ: factor in PCI possible

6 years agoMerge tag 'pm-4.7-rc7' of git://
Linus Torvalds [Fri, 8 Jul 2016 03:46:48 +0000 (20:46 -0700)]
Merge tag 'pm-4.7-rc7' of git://git./linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "One fix for a recent cpuidle core change that, against all odds,
  introduced a functional regression on Power systems and the fix for
  the crash during resume from hibernation on x86-64 that has been in
  the works for the last few weeks (it actually was ready last week, but
  I wanted to allow the reporters to test if for some more time).


   - Fix a recent performance regression on Power systems (powernv and
     pseries) introduced by a core cpuidle commit that decreased the
     precision of the last_residency conversion from nano- to
     microseconds, which should not matter in theory, but turned out to
     play not-so-well with the special "snooze" idle state on Power
     (Shreyas B Prabhu).

   - Fix a crash during resume from hibernation on x86-64 caused by
     possible corruption of the kernel text part of page tables in the
     last phase of image restoration exposed by a security-related
     change during the 4.3 development cycle (Rafael Wysocki)"

* tag 'pm-4.7-rc7' of git://
  cpuidle: Fix last_residency division
  x86/power/64: Fix kernel text mapping corruption during image restoration

6 years agoMerge tag 'sunxi-drm-fixes-for-4.7-2' of
Dave Airlie [Fri, 8 Jul 2016 03:29:11 +0000 (13:29 +1000)]
Merge tag 'sunxi-drm-fixes-for-4.7-2' of https://git./linux/kernel/git/mripard/linux into drm-fixes

Allwinner DRM driver fixes for 4.7, take 2

A new set of fixes for the sun4i driver, mostly related to vblank handling,
and a minor fix to release a reference on the device tree nodes we're
parsing in the probe logic.

* tag 'sunxi-drm-fixes-for-4.7-2' of
  gpu: drm: sun4i_drv: add missing of_node_put after calling of_parse_phandle
  drm/sun4i: Send vblank event when the CRTC is disabled
  drm/sun4i: Report proper vblank

6 years agoapparmor: fix oops, validate buffer size in apparmor_setprocattr()
Vegard Nossum [Thu, 7 Jul 2016 20:41:11 +0000 (13:41 -0700)]
apparmor: fix oops, validate buffer size in apparmor_setprocattr()

When proc_pid_attr_write() was changed to use memdup_user apparmor's
(interface violating) assumption that the setprocattr buffer was always
a single page was violated.

The size test is not strictly speaking needed as proc_pid_attr_write()
will reject anything larger, but for the sake of robustness we can keep
it in.

SMACK and SELinux look safe to me, but somebody else should probably
have a look just in case.

Based on original patch from Vegard Nossum <>
modified for the case that apparmor provides null termination.

Fixes: bb646cdb12e75d82258c2f2e7746d5952d3e321a
Reported-by: Vegard Nossum <>
Cc: Al Viro <>
Cc: John Johansen <>
Cc: Paul Moore <>
Cc: Stephen Smalley <>
Cc: Eric Paris <>
Cc: Casey Schaufler <>
Signed-off-by: John Johansen <>
Reviewed-by: Tyler Hicks <>
Signed-off-by: James Morris <>
6 years agoRevert "ecryptfs: forbid opening files without mmap handler"
Jeff Mahoney [Tue, 5 Jul 2016 21:32:29 +0000 (17:32 -0400)]
Revert "ecryptfs: forbid opening files without mmap handler"

This reverts commit 2f36db71009304b3f0b95afacd8eba1f9f046b87.

It fixed a local root exploit but also introduced a dependency on
the lower file system implementing an mmap operation just to open a file,
which is a bit of a heavy hammer.  The right fix is to have mmap depend
on the existence of the mmap handler instead.

Signed-off-by: Jeff Mahoney <>
Signed-off-by: Tyler Hicks <>
6 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 7 Jul 2016 22:34:09 +0000 (15:34 -0700)]
Merge branch 'for-linus' of git://

Pull block IO fixes from Jens Axboe:
 "Three small fixes that have been queued up and tested for this series:

   - A bug fix for xen-blkfront from Bob Liu, fixing an issue with
     incomplete requests during migration.

   - A fix for an ancient issue in retrieving the IO priority of a
     different PID than self, preventing that task from going away while
     we access it.  From Omar.

   - A writeback fix from Tahsin, fixing a case where we'd call ihold()
     with a zero ref count inode"

* 'for-linus' of git://
  block: fix use-after-free in sys_ioprio_get()
  writeback: inode cgroup wb switch should not call ihold()
  xen-blkfront: save uncompleted reqs in blkfront_resume()

6 years agoMerge tag 'configfs-for-4.7' of git://
Linus Torvalds [Thu, 7 Jul 2016 22:32:17 +0000 (15:32 -0700)]
Merge tag 'configfs-for-4.7' of git://

Pull configfs fix from Christoph Hellwig:
 "A fix from Marek for ppos handling in configfs_write_bin_file, which
  was introduced in Linux 4.5, but didn't have any users until recently"

* tag 'configfs-for-4.7' of git://
  configfs: Remove ppos increment in configfs_write_bin_file

6 years agoMerge branches 'acpica-fixes', 'acpi-pci-fixes' and 'acpi-debug-fixes'
Rafael J. Wysocki [Thu, 7 Jul 2016 21:37:37 +0000 (23:37 +0200)]
Merge branches 'acpica-fixes', 'acpi-pci-fixes' and 'acpi-debug-fixes'

* acpica-fixes:
  ACPICA: Namespace: Fix namespace/interpreter lock ordering

* acpi-pci-fixes:
  ACPI,PCI,IRQ: separate ISA penalty calculation
  Revert "ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()"
  ACPI,PCI,IRQ: factor in PCI possible

* acpi-debug-fixes:
  ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal

6 years agoMerge branches 'pm-cpuidle-fixes' and 'pm-sleep-fixes'
Rafael J. Wysocki [Thu, 7 Jul 2016 21:17:20 +0000 (23:17 +0200)]
Merge branches 'pm-cpuidle-fixes' and 'pm-sleep-fixes'

* pm-cpuidle-fixes:
  cpuidle: Fix last_residency division

* pm-sleep-fixes:
  x86/power/64: Fix kernel text mapping corruption during image restoration

6 years agoarm64: Enable workaround for Cavium erratum 27456 on thunderx-81xx
Ganapatrao Kulkarni [Thu, 7 Jul 2016 04:48:17 +0000 (10:18 +0530)]
arm64: Enable workaround for Cavium erratum 27456 on thunderx-81xx

Cavium erratum 27456 commit 104a0c02e8b1
("arm64: Add workaround for Cavium erratum 27456")
is applicable for thunderx-81xx pass1.0 SoC as well.
Adding code to enable to 81xx.

Signed-off-by: Ganapatrao Kulkarni <>
Reviewed-by: Andrew Pinski <>
Signed-off-by: Will Deacon <>
6 years agoarm64: kernel: Save and restore UAO and addr_limit on exception entry
James Morse [Mon, 20 Jun 2016 17:28:01 +0000 (18:28 +0100)]
arm64: kernel: Save and restore UAO and addr_limit on exception entry

If we take an exception while at EL1, the exception handler inherits
the original context's addr_limit and PSTATE.UAO values. To be consistent
always reset addr_limit and PSTATE.UAO on (re-)entry to EL1. This
prevents accidental re-use of the original context's addr_limit.

Based on a similar patch for arm from Russell King.

Cc: <> # 4.6-
Acked-by: Will Deacon <>
Reviewed-by: Mark Rutland <>
Signed-off-by: James Morse <>
Signed-off-by: Will Deacon <>
6 years agoxenbus: don't BUG() on user mode induced condition
Jan Beulich [Thu, 7 Jul 2016 07:23:57 +0000 (01:23 -0600)]
xenbus: don't BUG() on user mode induced condition

Inability to locate a user mode specified transaction ID should not
lead to a kernel crash. For other than XS_TRANSACTION_START also
don't issue anything to xenbus if the specified ID doesn't match that
of any active transaction.

Signed-off-by: Jan Beulich <>
Cc: <>
Signed-off-by: David Vrabel <>
6 years agoperf/core: Fix pmu::filter_match for SW-led groups
Mark Rutland [Tue, 14 Jun 2016 15:10:41 +0000 (16:10 +0100)]
perf/core: Fix pmu::filter_match for SW-led groups

The following commit:

  66eb579e66ec ("perf: allow for PMU-specific event filtering")

added the pmu::filter_match() callback. This was intended to
avoid HW constraints on events from resulting in extremely
pessimistic scheduling.

However, pmu::filter_match() is only called for the leader of each event
group. When the leader is a SW event, we do not filter the groups, and
may fail at pmu::add() time, and when this happens we'll give up on
scheduling any event groups later in the list until they are rotated
ahead of the failing group.

This can result in extremely sub-optimal event scheduling behaviour,
e.g. if running the following on a big.LITTLE platform:

$ taskset -c 0 ./perf stat \
 -e 'a57{context-switches,armv8_cortex_a57/config=0x11/}' \
 -e 'a53{context-switches,armv8_cortex_a53/config=0x11/}' \

     <not counted>      context-switches                                              (0.00%)
     <not counted>      armv8_cortex_a57/config=0x11/                                 (0.00%)
                24      context-switches                                              (37.36%)
          57589154      armv8_cortex_a53/config=0x11/                                 (37.36%)

Here the 'a53' event group was always eligible to be scheduled, but
the 'a57' group never eligible to be scheduled, as the task was always
affine to a Cortex-A53 CPU. The SW (group leader) event in the 'a57'
group was eligible, but the HW event failed at pmu::add() time,
resulting in ctx_flexible_sched_in giving up on scheduling further
groups with HW events.

One way of avoiding this is to check pmu::filter_match() on siblings
as well as the group leader. If any of these fail their
pmu::filter_match() call, we must skip the entire group before
attempting to add any events.

Signed-off-by: Mark Rutland <>
Signed-off-by: Peter Zijlstra (Intel) <>
Cc: Alexander Shishkin <>
Cc: Arnaldo Carvalho de Melo <>
Cc: Arnaldo Carvalho de Melo <>
Cc: Jiri Olsa <>
Cc: Linus Torvalds <>
Cc: Peter Zijlstra <>
Cc: Thomas Gleixner <>
Cc: Will Deacon <>
Fixes: 66eb579e66ec ("perf: allow for PMU-specific event filtering")
[ Small readability edits. ]
Signed-off-by: Ingo Molnar <>
6 years agoMerge branch 'linux-4.7' of git:// into drm-fixes
Dave Airlie [Thu, 7 Jul 2016 02:40:12 +0000 (12:40 +1000)]
Merge branch 'linux-4.7' of git:// into drm-fixes

Just one fix for a stupid thinko in a DP training pattern commit.

* 'linux-4.7' of git://
  drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern

6 years agoMerge branch 'drm-fixes-4.7' of git:// into drm...
Dave Airlie [Thu, 7 Jul 2016 02:37:42 +0000 (12:37 +1000)]
Merge branch 'drm-fixes-4.7' of git:// into drm-fixes

Just a couple of fixes for amdgpu for 4.7:
- 2 small tonga powerplay fixes
- Additional Polaris fixes

* 'drm-fixes-4.7' of git://
  drm/amd/powerplay: Update CKS on/ CKS off voltage offset calculation.
  drm/amd/powerplay: fix bug that get wrong polaris evv voltage.
  drm/amd/powerplay: incorrectly use of the function return value
  drm/amd/powerplay: fix incorrect voltage table value for tonga
  drm/amd/powerplay: fix incorrect voltage table value for polaris10

6 years agoinit/Kconfig: keep Expert users menu together
Randy Dunlap [Wed, 6 Jul 2016 23:06:53 +0000 (16:06 -0700)]
init/Kconfig: keep Expert users menu together

The "expert" menu was broken (split) such that all entries in it after
KALLSYMS were displayed in the "General setup" area instead of in the
"Expert users" area.  Fix this by adding one kconfig dependency.

Yes, the Expert users menu is fragile.  Problems like this have happened
several times in the past.  I will attempt to isolate the Expert users
menu if there is interest in that.

Fixes: 4d5d5664c900 ("x86: kallsyms: disable absolute percpu symbols on !SMP")
Signed-off-by: Randy Dunlap <>
Cc: Ard Biesheuvel <>
Cc: # 4.6
Signed-off-by: Linus Torvalds <>
6 years agodrm/amd/powerplay: Update CKS on/ CKS off voltage offset calculation.
Rex Zhu [Tue, 28 Jun 2016 20:55:52 +0000 (16:55 -0400)]
drm/amd/powerplay: Update CKS on/ CKS off voltage offset calculation.

As get the right evv voltage, update them to latest coefficients to
align with BB.

agd: squash in Slava's 32 bit build fix

Signed-off-by: Rex Zhu <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Alex Deucher <>
6 years agodrm/amd/powerplay: fix bug that get wrong polaris evv voltage.
Rex Zhu [Wed, 29 Jun 2016 08:37:35 +0000 (16:37 +0800)]
drm/amd/powerplay: fix bug that get wrong polaris evv voltage.

value is 32 bits for polaris, not 16.

Signed-off-by: Rex Zhu <>
Reviewed-by: Ken Wang <>
Signed-off-by: Alex Deucher <>
6 years agodrm/amd/powerplay: incorrectly use of the function return value
Rex Zhu [Tue, 5 Jul 2016 05:11:47 +0000 (13:11 +0800)]
drm/amd/powerplay: incorrectly use of the function return value

'0' means true.

Signed-off-by: Rex Zhu <>
Reviewed-by: Michel Dänzer <>
Signed-off-by: Alex Deucher <>
6 years agodrm/amd/powerplay: fix incorrect voltage table value for tonga
Huang Rui [Wed, 6 Jul 2016 01:32:24 +0000 (09:32 +0800)]
drm/amd/powerplay: fix incorrect voltage table value for tonga

Signed-off-by: Huang Rui <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Alex Deucher <>
6 years agodrm/amd/powerplay: fix incorrect voltage table value for polaris10
Huang Rui [Wed, 6 Jul 2016 01:31:35 +0000 (09:31 +0800)]
drm/amd/powerplay: fix incorrect voltage table value for polaris10

Signed-off-by: Huang Rui <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Alex Deucher <>
6 years agoMerge git://
Linus Torvalds [Wed, 6 Jul 2016 16:42:43 +0000 (09:42 -0700)]
Merge git://git./linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) All users of AF_PACKET's fanout feature want a symmetric packet
    header hash for load balancing purposes, so give it to them.

 2) Fix vlan state synchronization in e1000e, from Jarod Wilson.

 3) Use correct socket pointer in ip_skb_dst_mtu(), from Shmulik

 4) mlx5 bug fixes from Mohamad Haj Yahia, Daniel Jurgens, Matthew
    Finlay, Rana Shahout, and Shaker Daibes.  Mostly to do with
    operation timeouts and PCI error handling.

 5) Fix checksum handling in mirred packet action, from WANG Cong.

 6) Set skb->dev correctly when transmitting in !protect_frames case of
    macsec driver, from Daniel Borkmann.

 7) Fix MTU calculation in geneve driver, from Haishuang Yan.

 8) Missing netif_napi_del() in unregister path of qeth driver, from
    Ursula Braun.

 9) Handle malformed route netlink messages in decnet properly, from
    Vergard Nossum.

10) Memory leak of percpu data in ipv6 routing code, from Martin KaFai

* git:// (41 commits)
  ipv6: Fix mem leak in rt6i_pcpu
  net: fix decnet rtnexthop parsing
  cxgb4: update latest firmware version supported
  net/mlx5: Avoid setting unused var when modifying vport node GUID
  bonding: fix enslavement slave link notifications
  r8152: fix runtime function for RTL8152
  qeth: delete napi struct when removing a qeth device
  Revert "fsl/fman: fix error handling"
  fsl/fman: fix error handling
  cdc_ncm: workaround for EM7455 "silent" data interface
  RDS: fix rds_tcp_init() error path
  geneve: fix max_mtu setting
  net: phy: dp83867: Fix initialization of PHYCR register
  enc28j60: Fix race condition in enc28j60 driver
  net: stmmac: Fix null-function call in ISR on stmmac1000
  tipc: fix nl compat regression for link statistics
  net: bcmsysport: Device stats are unsigned long
  macsec: set actual real device for xmit when !protect_frames
  net_sched: fix mirrored packets checksum
  packet: Use symmetric hash for PACKET_FANOUT_HASH.

6 years agoMerge tag 'sound-4.7-rc7' of git://
Linus Torvalds [Wed, 6 Jul 2016 16:12:43 +0000 (09:12 -0700)]
Merge tag 'sound-4.7-rc7' of git://git./linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Here are a collection of small fixes: at this time, we've got a
  slightly high amount, but all small and trivial fixes, and nothing
  scary can be seen there"

* tag 'sound-4.7-rc7' of git:// (21 commits)
  ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
  ALSA: timer: Fix negative queue usage by racy accesses
  ASoC: rt5645: fix reg-2f default value.
  ASoC: fsl_ssi: Fix number of words per frame for I2S-slave mode
  ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
  ALSA: hda - Add PCI ID for Kabylake-H
  ALSA: echoaudio: Fix memory allocation
  ASoC: Intel: atom: fix missing breaks that would cause the wrong operation to execute
  ALSA: hda - fix read before array start
  ASoC: cx20442: set tty->receiver_room in v253_open
  ASoC: ak4613: Enable cache usage to fix crashes on resume
  ASoC: wm8940: Enable cache usage to fix crashes on resume
  ASoC: Intel: Skylake: Initialize module list for Broxton
  ASoC: wm5102: Correct supported channels on trace compressed DAI
  ASoC: wm5110: Add missing route from OUT3R to SYSCLK
  ASoC: rt5670: fix HP Playback Volume control
  ASoC: hdmi-codec: select CONFIG_HDMI
  ASoC: davinci-mcasp: Fix dra7 DMA offset when using CFG port
  ASoC: hdac_hdmi: Fix potential NULL dereference
  ASoC: ak4613: Remove owner assignment from platform_driver

6 years agoMerge tag 'chrome-fixes' of git://
Linus Torvalds [Wed, 6 Jul 2016 16:07:23 +0000 (09:07 -0700)]
Merge tag 'chrome-fixes' of git://git./linux/kernel/git/olof/chrome-platform

Pull chrome platform fix from Olof Johansson:
 "A single fix this time, closing a window where ioctl args are fetched

* tag 'chrome-fixes' of git://
  platform/chrome: cros_ec_dev - double fetch bug in ioctl

6 years agoiommu/amd: Fix unity mapping initialization race
Joerg Roedel [Fri, 1 Jul 2016 14:42:55 +0000 (16:42 +0200)]
iommu/amd: Fix unity mapping initialization race

There is a race condition in the AMD IOMMU init code that
causes requested unity mappings to be blocked by the IOMMU
for a short period of time. This results on boot failures
and IO_PAGE_FAULTs on some machines.

Fix this by making sure the unity mappings are installed
before all other DMA is blocked.

Fixes: aafd8ba0ca74 ('iommu/amd: Implement add_device and remove_device')
Cc: # v4.2+
Signed-off-by: Joerg Roedel <>
6 years agoMerge branch 'jejb-fixes' into fixes
James Bottomley [Wed, 6 Jul 2016 14:25:55 +0000 (07:25 -0700)]
Merge branch 'jejb-fixes' into fixes

6 years agoMIPS: Fix page table corruption on THP permission changes.
David Daney [Thu, 16 Jun 2016 22:50:31 +0000 (15:50 -0700)]
MIPS: Fix page table corruption on THP permission changes.

When the core THP code is modifying the permissions of a huge page it
calls pmd_modify(), which unfortunately was clearing the _PAGE_HUGE bit
of the page table entry.  The result can be kernel messages like:

mm/memory.c:397: bad pmd 000000040080004d.
mm/memory.c:397: bad pmd 00000003ff00004d.
mm/memory.c:397: bad pmd 000000040100004d.


------------[ cut here ]------------
WARNING: at mm/mmap.c:3200 exit_mmap+0x150/0x158()
Modules linked in: ipv6 at24 octeon3_ethernet octeon_srio_nexus m25p80
CPU: 12 PID: 1295 Comm: pmderr Not tainted 3.10.87-rt80-Cavium-Octeon #4
Stack : 0000000040808000 0000000014009ce1 0000000000400004 ffffffff81076ba0
          0000000000000000 0000000000000000 ffffffff85110000 0000000000000119
          0000000000000004 0000000000000000 0000000000000119 43617669756d2d4f
          0000000000000000 ffffffff850fda40 ffffffff85110000 0000000000000000
          0000000000000000 0000000000000009 ffffffff809207a0 0000000000000c80
          ffffffff80f1bf20 0000000000000001 000000ffeca36828 0000000000000001
          0000000000000000 0000000000000001 000000ffeca7e700 ffffffff80886924
          80000003fd7a0000 80000003fd7a39b0 80000003fdea8000 ffffffff80885780
          80000003fdea8000 ffffffff80f12218 000000000000000c 000000000000050f
          0000000000000000 ffffffff80865c4c 0000000000000000 0000000000000000
Call Trace:
[<ffffffff80865c4c>] show_stack+0x6c/0xf8
[<ffffffff80885780>] warn_slowpath_common+0x78/0xa8
[<ffffffff809207a0>] exit_mmap+0x150/0x158
[<ffffffff80882d44>] mmput+0x5c/0x110
[<ffffffff8088b450>] do_exit+0x230/0xa68
[<ffffffff8088be34>] do_group_exit+0x54/0x1d0
[<ffffffff8088bfc0>] __wake_up_parent+0x0/0x18

---[ end trace c7b38293191c57dc ]---
BUG: Bad rss-counter state mm:80000003fa168000 idx:1 val:1536

Fix by not clearing _PAGE_HUGE bit.

Signed-off-by: David Daney <>
Tested-by: Aaro Koskinen <>
Signed-off-by: Ralf Baechle <>
6 years agox86/perf/intel/rapl: Fix module name collision with powercap intel-rapl
Ville Syrjälä [Thu, 23 Jun 2016 15:06:49 +0000 (18:06 +0300)]
x86/perf/intel/rapl: Fix module name collision with powercap intel-rapl

Since commit 4b6e2571bf00 the rapl perf module calls itself intel-rapl. That
name was already in use by the rapl powercap driver, which now fails to load
if the perf module is loaded. Fix the problem by renaming the perf module to
intel-rapl-perf, so that both modules can coexist.

Fixes: 4b6e2571bf00 ("x86/perf/intel/rapl: Make the Intel RAPL PMU driver modular")
Signed-off-by: Ville Syrjälä <>
Cc: Vince Weaver <>
Cc: Alexander Shishkin <>
Cc: Kan Liang <>
Cc: Stephane Eranian <>
Cc: Arnaldo Carvalho de Melo <>
Cc: Linus Torvalds <>
Cc: Peter Zijlstra <>
Cc: Jiri Olsa <>
Signed-off-by: Thomas Gleixner <>
6 years agoipv6: Fix mem leak in rt6i_pcpu
Martin KaFai Lau [Tue, 5 Jul 2016 19:10:23 +0000 (12:10 -0700)]
ipv6: Fix mem leak in rt6i_pcpu

It was first reported and reproduced by Petr (thanks!) in

free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().

However, after fixing a deadlock bug in
commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"),
free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.

It is worth to note that rt6i_pcpu is protected by table->tb6_lock.

kmemleak somehow did not report it.  We nailed it down by
observing the pcpu entries in /proc/vmallocinfo (first suggested
by Hannes, thanks!).

Signed-off-by: Martin KaFai Lau <>
Fixes: 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt")
Reported-by: Petr Novopashenniy <>
Tested-by: Petr Novopashenniy <>
Acked-by: Hannes Frederic Sowa <>
Cc: Hannes Frederic Sowa <>
Cc: Petr Novopashenniy <>
Signed-off-by: David S. Miller <>
6 years agonet: fix decnet rtnexthop parsing
Vegard Nossum [Tue, 5 Jul 2016 19:12:53 +0000 (21:12 +0200)]
net: fix decnet rtnexthop parsing

dn_fib_count_nhs() could enter an infinite loop if nhp->rtnh_len == 0
(i.e. if userspace passes a malformed netlink message).

Let's use the helpers from net/nexthop.h which take care of all this
stuff. We can do exactly the same as e.g. fib_count_nexthops() and
fib_get_nhs() from net/ipv4/fib_semantics.c.

This fixes the softlockup for me.

Cc: Thomas Graf <>
Signed-off-by: Vegard Nossum <>
Signed-off-by: David S. Miller <>
6 years agoACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal
Lv Zheng [Tue, 5 Jul 2016 11:18:07 +0000 (19:18 +0800)]
ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal

The FIFO unlocking mechanism in acpi_dbg has been broken by the
following commit:

  Commit: 287980e49ffc0f6d911601e7e352a812ed27768e
  Subject: remove lots of IS_ERR_VALUE abuses

It converted !IS_ERR_VALUE(ret) into !ret which was not entirely
correct. Fix the regression by taking ret > 0 into account too as

Fixes: 287980e49ffc (remove lots of IS_ERR_VALUE abuses)
Signed-off-by: Lv Zheng <>
[ rjw: Simplifications, changelog & subject massage ]
Signed-off-by: Rafael J. Wysocki <>
6 years agoplatform/chrome: cros_ec_dev - double fetch bug in ioctl
Dan Carpenter [Tue, 21 Jun 2016 13:58:46 +0000 (16:58 +0300)]
platform/chrome: cros_ec_dev - double fetch bug in ioctl

We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls.  Otherwise it could lead to a buffer overflow.

Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.

Reported-by: Pengfei Wang <>
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter <>
Reviewed-by: Kees Cook <>
Tested-by: Gwendal Grignou <>
Cc: <> # v4.2+
Signed-off-by: Olof Johansson <>
6 years agodrm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
Ben Skeggs [Tue, 5 Jul 2016 20:50:36 +0000 (06:50 +1000)]
drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern

Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both
links use the same training register".

Signed-off-by: Ben Skeggs <>
6 years agoACPICA: Namespace: Fix namespace/interpreter lock ordering
Lv Zheng [Tue, 5 Jul 2016 05:53:12 +0000 (13:53 +0800)]
ACPICA: Namespace: Fix namespace/interpreter lock ordering

There is a lock order issue in acpi_load_tables(). The namespace lock
is held before holding the interpreter lock.

With ACPI_MUTEX_DEBUG enabled in the kernel, this is printed to the
log during boot:

  [    0.885699] ACPI Error: Invalid acquire order: Thread 405884224 owns [ACPI_MTX_Namespace], wants [ACPI_MTX_Interpreter] (20160422/utmutex-263)
  [    0.885881] ACPI Error: Could not acquire AML Interpreter mutex (20160422/exutils-95)
  [    0.893846] ACPI Error: Mutex [0x0] is not acquired, cannot release (20160422/utmutex-326)
  [    0.894019] ACPI Error: Could not release AML Interpreter mutex (20160422/exutils-133)

The issue has been introduced by the following commit:

  Commit: 2f38b1b16d9280689e5cfa47a4c50956bf437f0d
  ACPICA Commit: bfe03ffcde8ed56a7eae38ea0b188aeb12f9c52e
  Subject: ACPICA: Namespace: Fix a regression that MLC support triggers
           dead lock in dynamic table loading

Which fixed a deadlock issue for acpi_ns_load_table() in
acpi_ex_add_table() but didn't take care of the lock order in
acpi_ns_load_table() correctly.

Originally (before the above commit), ACPICA used the
namespace/interpreter locks in the following 2 key code

 1. Table loading:
 2. Object evaluation:

During runtime, while acpi_ns_evaluate is called, the lock order is
always Interpreter -> Namespace.

In turn, the problematic commit acquires the locks in the following

 3. Table loading:

To fix the lock order issue, move the interpreter lock to
acpi_ns_load_table() to ensure the lock order correctness:

 4. Table loading:

However, this doesn't fix the current design issues related to the
namespace lock. For example, we can notice that in acpi_ns_evaluate(),
outside of acpi_ns_load_table(), the namespace objects may be created
by the named object creation control methods. And the creation of
the method-owned namespace objects are not locked by the namespace
lock. This patch doesn't try to fix such kind of existing issues.

Fixes: 2f38b1b16d92 (ACPICA: Namespace: Fix a regression that MLC support triggers dead lock in dynamic table loading)
Signed-off-by: Lv Zheng <>
Signed-off-by: Rafael J. Wysocki <>
6 years agonfs_atomic_open(): prevent parallel nfs_lookup() on a negative hashed
Al Viro [Tue, 5 Jul 2016 13:49:21 +0000 (09:49 -0400)]
nfs_atomic_open(): prevent parallel nfs_lookup() on a negative hashed

Signed-off-by: Al Viro <>
6 years agoUse the right predicate in ->atomic_open() instances
Al Viro [Tue, 5 Jul 2016 13:44:53 +0000 (09:44 -0400)]
Use the right predicate in ->atomic_open() instances

->atomic_open() can be given an in-lookup dentry *or* a negative one
found in dcache.  Use d_in_lookup() to tell one from another, rather
than d_unhashed().

Signed-off-by: Al Viro <>
6 years agoqla2xxx: Fix NULL pointer deref in QLA interrupt
Bruno Prémont [Thu, 30 Jun 2016 15:00:32 +0000 (17:00 +0200)]
qla2xxx: Fix NULL pointer deref in QLA interrupt

In qla24xx_process_response_queue() rsp->msix->cpuid may trigger NULL
pointer dereference when rsp->msix is NULL:

[    5.622457] NULL pointer dereference at 0000000000000050
[    5.622457] IP: [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457] PGD 0
[    5.622457] Oops: 0000 [#1] SMP
[    5.622457] Modules linked in:
[    5.622457] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.6.3-x86_64 #1
[    5.622457] Hardware name: HP ProLiant DL360 G5, BIOS P58 05/02/2011
[    5.622457] task: ffff8801a88f3740 ti: ffff8801a8954000 task.ti: ffff8801a8954000
[    5.622457] RIP: 0010:[<ffffffff8155e614>]  [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457] RSP: 0000:ffff8801afb03de8  EFLAGS: 00010002
[    5.622457] RAX: 0000000000000000 RBX: 0000000000000032 RCX: 00000000ffffffff
[    5.622457] RDX: 0000000000000002 RSI: ffff8801a79bf8c8 RDI: ffff8800c8f7e7c0
[    5.622457] RBP: ffff8801afb03e68 R08: 0000000000000000 R09: 0000000000000000
[    5.622457] R10: 00000000ffff8c47 R11: 0000000000000002 R12: ffff8801a79bf8c8
[    5.622457] R13: ffff8800c8f7e7c0 R14: ffff8800c8f60000 R15: 0000000000018013
[    5.622457] FS:  0000000000000000(0000) GS:ffff8801afb00000(0000) knlGS:0000000000000000
[    5.622457] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.622457] CR2: 0000000000000050 CR3: 0000000001e07000 CR4: 00000000000006e0
[    5.622457] Stack:
[    5.622457]  ffff8801afb03e30 ffffffff810c0f2d 0000000000000086 0000000000000002
[    5.622457]  ffff8801afb03e28 ffffffff816570e1 ffff8800c8994628 0000000000000002
[    5.622457]  ffff8801afb03e60 ffffffff816772d4 b47c472ad6955e68 0000000000000032
[    5.622457] Call Trace:
[    5.622457]  <IRQ>
[    5.622457]  [<ffffffff810c0f2d>] ? __wake_up_common+0x4d/0x80
[    5.622457]  [<ffffffff816570e1>] ? usb_hcd_resume_root_hub+0x51/0x60
[    5.622457]  [<ffffffff816772d4>] ? uhci_hub_status_data+0x64/0x240
[    5.622457]  [<ffffffff81560d00>] qla24xx_intr_handler+0xf0/0x2e0
[    5.622457]  [<ffffffff810d569e>] ? get_next_timer_interrupt+0xce/0x200
[    5.622457]  [<ffffffff810c89b4>] handle_irq_event_percpu+0x64/0x100
[    5.622457]  [<ffffffff810c8a77>] handle_irq_event+0x27/0x50
[    5.622457]  [<ffffffff810cb965>] handle_edge_irq+0x65/0x140
[    5.622457]  [<ffffffff8101a498>] handle_irq+0x18/0x30
[    5.622457]  [<ffffffff8101a276>] do_IRQ+0x46/0xd0
[    5.622457]  [<ffffffff817f8fff>] common_interrupt+0x7f/0x7f
[    5.622457]  <EOI>
[    5.622457]  [<ffffffff81020d38>] ? mwait_idle+0x68/0x80
[    5.622457]  [<ffffffff8102114a>] arch_cpu_idle+0xa/0x10
[    5.622457]  [<ffffffff810c1b97>] default_idle_call+0x27/0x30
[    5.622457]  [<ffffffff810c1d3b>] cpu_startup_entry+0x19b/0x230
[    5.622457]  [<ffffffff810324c6>] start_secondary+0x136/0x140
[    5.622457] Code: 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 47 58 a8 02 0f 84 c5 00 00 00 48 8b 46 50 49 89 f4 65 8b 15 34 bb aa 7e <39> 50 50 74 11 89 50 50 48 8b 46 50 8b 40 50 41 89 86 60 8b 00
[    5.622457] RIP  [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457]  RSP <ffff8801afb03de8>
[    5.622457] CR2: 0000000000000050
[    5.622457] ---[ end trace fa2b19c25106d42b ]---
[    5.622457] Kernel panic - not syncing: Fatal exception in interrupt

The affected code was introduced by commit cdb898c52d1dfad4b4800b83a58b3fe5d352edde
(qla2xxx: Add irq affinity notification).

Only dereference rsp->msix when it has been set so the machine can boot
fine. Possibly rsp->msix is unset because:
[    3.479679] qla2xxx [0000:00:00.0]-0005: : QLogic Fibre Channel HBA Driver:
[    3.481839] qla2xxx [0000:13:00.0]-001d: : Found an ISP2432 irq 17 iobase 0xffffc90000038000.
[    3.484081] qla2xxx [0000:13:00.0]-0035:0: MSI-X; Unsupported ISP2432 (0x2, 0x3).
[    3.485804] qla2xxx [0000:13:00.0]-0037:0: Falling back-to MSI mode -258.
[    3.890145] scsi host0: qla2xxx
[    3.891956] qla2xxx [0000:13:00.0]-00fb:0: QLogic QLE2460 - PCI-Express Single Channel 4Gb Fibre Channel HBA.
[    3.894207] qla2xxx [0000:13:00.0]-00fc:0: ISP2432: PCIe (2.5GT/s x4) @ 0000:13:00.0 hdma+ host#=0 fw=7.03.00 (9496).
[    5.714774] qla2xxx [0000:13:00.0]-500a:0: LOOP UP detected (4 Gbps).

Signed-off-by: Bruno Prémont <>
Acked-by: Quinn Tran <>
CC: <> # 4.5+
Fixes: cdb898c52d1dfad4b4800b83a58b3fe5d352edde
Signed-off-by: James Bottomley <>
6 years agocxgb4: update latest firmware version supported
Ganesh Goudar [Tue, 5 Jul 2016 12:37:24 +0000 (18:07 +0530)]
cxgb4: update latest firmware version supported

Change t4fw_version.h to update latest firmware version number

Signed-off-by: Ganesh Goudar <>
Signed-off-by: David S. Miller <>
6 years agonet/mlx5: Avoid setting unused var when modifying vport node GUID
Or Gerlitz [Tue, 5 Jul 2016 09:17:12 +0000 (12:17 +0300)]
net/mlx5: Avoid setting unused var when modifying vport node GUID

GCC complains on unused-but-set-variable, clean this up.

Fixes: 23898c763f4a ('net/mlx5: E-Switch, Modify node guid on vf set MAC')
Signed-off-by: Or Gerlitz <>
Acked-by: Saeed Mahameed <>
Signed-off-by: David S. Miller <>
6 years agobonding: fix enslavement slave link notifications
Aviv Heller [Tue, 5 Jul 2016 09:09:47 +0000 (12:09 +0300)]
bonding: fix enslavement slave link notifications

Currently, link notifications are not sent by
bond_set_slave_link_state() upon enslavement if
the slave is enslaved when up.

This happens because slave->link default init value
is 0, which is the same as BOND_LINK_UP, resulting
in bond_set_slave_link_state() ignoring this transition.

This patch sets the default value of slave->link to
BOND_LINK_NOCHANGE, assuring it will count as a state
transition and thus trigger notification logic.

Signed-off-by: Aviv Heller <>
Reviewed-by: Jiri Pirko <>
Signed-off-by: Saeed Mahameed <>
Signed-off-by: David S. Miller <>
6 years agor8152: fix runtime function for RTL8152
hayeswang [Tue, 5 Jul 2016 08:11:46 +0000 (16:11 +0800)]
r8152: fix runtime function for RTL8152

The RTL8152 doesn't have U1U2 and U2P3 features, so use different
runtime functions for RTL812 and RTL8153 by adding autosuspend_en()
to rtl_ops.

Signed-off-by: Hayes Wang <>
Signed-off-by: David S. Miller <>
6 years agoRevert "gpio: gpiolib-of: Allow compile testing"
Linus Walleij [Tue, 5 Jul 2016 06:46:43 +0000 (08:46 +0200)]
Revert "gpio: gpiolib-of: Allow compile testing"

This reverts commit 1e4a80640338924b9f9fd7a121ac31d08134410a.

This creates more problems than it solves right now. Compile
testing needs to go in with patches fixing the problems it

Signed-off-by: Linus Walleij <>
6 years agoirqchip/mips-gic: Match IPI IRQ domain by bus token only
Paul Burton [Tue, 5 Jul 2016 13:26:00 +0000 (14:26 +0100)]
irqchip/mips-gic: Match IPI IRQ domain by bus token only

Commit fbde2d7d8290 ("MIPS: Add generic SMP IPI support") introduced
code which calls irq_find_matching_host with a NULL node parameter in
order to discover IPI IRQ domains which are not associated with the DT
root node's interrupt parent. This suggests that implementations of IPI
IRQ domains should effectively ignore the node parameter if it is NULL
and search purely based upon the bus token. Commit 2af70a962070
("irqchip/mips-gic: Add a IPI hierarchy domain") did not do this when
implementing the GIC IPI IRQ domain, and on MIPS Boston boards this
leads to no IPI domain being discovered and a NULL pointer dereference
when attempting to send an IPI:

  CPU 0 Unable to handle kernel paging request at virtual address 0000000000000040, epc == ffffffff8016e70c, ra == ffffffff8010ff5c
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.7.0-rc6-00223-gad0d1b6 #945
  task: a8000000ff066fc0 ti: a8000000ff068000 task.ti: a8000000ff068000
  $ 0   : 0000000000000000 0000000000000001 ffffffff80730000 0000000000000003
  $ 4   : 0000000000000000 ffffffff8057e5b0 a800000001e3ee00 0000000000000000
  $ 8   : 0000000000000000 0000000000000023 0000000000000001 0000000000000001
  $12   : 0000000000000000 ffffffff803323d0 0000000000000000 0000000000000000
  $16   : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
  $20   : 0000000000000000 ffffffff8057e5b0 0000000000000001 0000000000000000
  $24   : 0000000000000000 ffffffff8012de28
  $28   : a8000000ff068000 a8000000ff06fbc0 0000000000000000 ffffffff8010ff5c
  Hi    : ffffffff8014c174
  Lo    : a800000001e1e140
  epc   : ffffffff8016e70c __ipi_send_mask+0x24/0x11c
  ra    : ffffffff8010ff5c mips_smp_send_ipi_mask+0x68/0x178
  Status: 140084e2        KX SX UX KERNEL EXL
  Cause : 00800008 (ExcCode 02)
  BadVA : 0000000000000040
  PrId  : 0001a920 (MIPS I6400)
  Process swapper/0 (pid: 1, threadinfo=a8000000ff068000, task=a8000000ff066fc0, tls=0000000000000000)
  Stack : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
            0000000000000000 ffffffff8057e5b0 0000000000000001 ffffffff8010ff5c
            0000000000000001 0000000000000020 0000000000000000 0000000000000000
            0000000000000000 ffffffff801108fc 0000000000000000 0000000000000001
            0000000000000001 0000000000000000 0000000000000000 ffffffff801865e8
            a8000000ff0c7500 a8000000ff06fc90 0000000000000001 0000000000000002
            ffffffff801108fc ffffffff801868b8 0000000000000000 ffffffff801108fc
            0000000000000000 0000000000000003 ffffffff8068c700 0000000000000001
            ffffffff80730000 0000000000000001 a8000000ff00a290 ffffffff80110c50
            0000000000000003 a800000001e48308 0000000000000003 0000000000000008
  Call Trace:
  [<ffffffff8016e70c>] __ipi_send_mask+0x24/0x11c
  [<ffffffff8010ff5c>] mips_smp_send_ipi_mask+0x68/0x178
  [<ffffffff801865e8>] generic_exec_single+0x150/0x170
  [<ffffffff801868b8>] smp_call_function_single+0x108/0x160
  [<ffffffff80110c50>] cps_boot_secondary+0x328/0x394
  [<ffffffff80110534>] __cpu_up+0x38/0x90
  [<ffffffff8012de4c>] bringup_cpu+0x24/0xac
  [<ffffffff8012df40>] cpuhp_up_callbacks+0x58/0xdc
  [<ffffffff8012e648>] cpu_up+0x118/0x18c
  [<ffffffff806dc158>] smp_init+0xbc/0xe8
  [<ffffffff806d4c18>] kernel_init_freeable+0xa0/0x228
  [<ffffffff8056c908>] kernel_init+0x10/0xf0
  [<ffffffff80105098>] ret_from_kernel_thread+0x14/0x1c

Fix this by allowing the GIC IPI IRQ domain to match purely based upon
the bus token if the node provided is NULL.

Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
Signed-off-by: Paul Burton <>
Cc: Jason Cooper <>
Cc: Qais Yousef <>
Cc: Ralf Baechle <>
Cc: Marc Zyngier <>
Signed-off-by: Thomas Gleixner <>
6 years agoirqchip/mips-gic: Map to VPs using HW VPNum
Paul Burton [Tue, 5 Jul 2016 13:25:59 +0000 (14:25 +0100)]
irqchip/mips-gic: Map to VPs using HW VPNum

When mapping an interrupt to a VP(E) we must use the identifier for the
VP that the hardware expects, and this does not always match up with the
Linux CPU number. Commit d46812bb0bef ("irqchip: mips-gic: Use HW IDs
for VPE_OTHER_ADDR") corrected this for the cases that existed at the
time it was written, but commit 2af70a962070 ("irqchip/mips-gic: Add a
IPI hierarchy domain") added another case before the former patch was
merged. This leads to incorrectly using Linux CPU numbers when mapping
interrupts to VPs, which breaks on certain systems such as those with
multi-core I6400 CPUs. Fix by adding the appropriate call to
mips_cm_vp_id() to retrieve the expected VP identifier.

Fixes: d46812bb0bef ("irqchip: mips-gic: Use HW IDs for VPE_OTHER_ADDR")
Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
Signed-off-by: Paul Burton <>
Cc: Jason Cooper <>
Cc: Qais Yousef <>
Cc: Ralf Baechle <>
Cc: Marc Zyngier <>
Signed-off-by: Thomas Gleixner <>
6 years agoALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
Torsten Hilbrich [Tue, 5 Jul 2016 08:40:22 +0000 (10:40 +0200)]
ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup

This solves the issue that a headphone is not working on the docking

Signed-off-by: Torsten Hilbrich <>
Cc: <>
Signed-off-by: Takashi Iwai <>
6 years agogpu: drm: sun4i_drv: add missing of_node_put after calling of_parse_phandle
Peter Chen [Tue, 5 Jul 2016 02:04:53 +0000 (10:04 +0800)]
gpu: drm: sun4i_drv: add missing of_node_put after calling of_parse_phandle

of_node_put needs to be called when the device node which is got
from of_parse_phandle has finished using.

Cc: Maxime Ripard <>
Cc: Chen-Yu Tsai <>
Signed-off-by: Peter Chen <>
Signed-off-by: Maxime Ripard <>
6 years agoqeth: delete napi struct when removing a qeth device
Ursula Braun [Mon, 4 Jul 2016 12:07:16 +0000 (14:07 +0200)]
qeth: delete napi struct when removing a qeth device

A qeth_card contains a napi_struct linked to the net_device during
device probing. This struct must be deleted when removing the qeth
device, otherwise Panic on oops can occur when qeth devices are
repeatedly removed and added.

Fixes: a1c3ed4c9ca ("qeth: NAPI support for l2 and l3 discipline")
Cc: # v2.6.37+
Signed-off-by: Ursula Braun <>
Tested-by: Alexander Klein <>
Signed-off-by: David S. Miller <>
6 years agoRevert "fsl/fman: fix error handling"
David S. Miller [Tue, 5 Jul 2016 00:16:41 +0000 (17:16 -0700)]
Revert "fsl/fman: fix error handling"

This reverts commit a788a4a040e003574b8ad17115706ab1601ec572.

This patch is wrong, the type returned doesn't fit
what the error pointer macros expect.

Signed-off-by: David S. Miller <>
6 years agofsl/fman: fix error handling
Christophe Jaillet [Mon, 4 Jul 2016 05:46:42 +0000 (07:46 +0200)]
fsl/fman: fix error handling

This is likely that checking 'fman->fifo_offset' instead of
'fman->cam_offset' is expected here.

Signed-off-by: Christophe JAILLET <>
Signed-off-by: David S. Miller <>
6 years agocdc_ncm: workaround for EM7455 "silent" data interface
Bjørn Mork [Sun, 3 Jul 2016 20:24:50 +0000 (22:24 +0200)]
cdc_ncm: workaround for EM7455 "silent" data interface

Several Lenovo users have reported problems with their Sierra
Wireless EM7455 modem. The driver has loaded successfully and
the MBIM management channel has appeared to work, including
establishing a connection to the mobile network. But no frames
have been received over the data interface.

The problem affects all EM7455 and MC7455, and is assumed to
affect other modems based on the same Qualcomm chipset and
baseband firmware.

Testing narrowed the problem down to what seems to be a
firmware timing bug during initialization. Adding a short sleep
while probing is sufficient to make the problem disappear.
Experiments have shown that 1-2 ms is too little to have any
effect, while 10-20 ms is enough to reliably succeed.

Reported-by: Stefan Armbruster <>
Reported-by: Ralph Plawetzki <>
Reported-by: Andreas Fett <>
Reported-by: Rasmus Lerdorf <>
Reported-by: Samo Ratnik <>
Reported-and-tested-by: Aleksander Morgado <>
Signed-off-by: Bjørn Mork <>
Signed-off-by: David S. Miller <>
6 years agoRDS: fix rds_tcp_init() error path
Vegard Nossum [Sun, 3 Jul 2016 08:54:54 +0000 (10:54 +0200)]
RDS: fix rds_tcp_init() error path

If register_pernet_subsys() fails, we shouldn't try to call

Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
Cc: Sowmini Varadhan <>
Cc: David S. Miller <>
Signed-off-by: Vegard Nossum <>
Acked-by: Sowmini Varadhan <>
Acked-by: Santosh Shilimkar <>
Signed-off-by: David S. Miller <>
6 years agogeneve: fix max_mtu setting
Haishuang Yan [Sat, 2 Jul 2016 07:02:48 +0000 (15:02 +0800)]
geneve: fix max_mtu setting

For ipv6+udp+geneve encapsulation data, the max_mtu should subtract
sizeof(ipv6hdr), instead of sizeof(iphdr).

Signed-off-by: Haishuang Yan <>
Signed-off-by: David S. Miller <>