1. 01 Jun, 2017 10 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 9ea15a59
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Many small x86 bug fixes: SVM segment registers access rights, nested
        VMX, preempt notifiers, LAPIC virtual wire mode, NMI injection"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Fix nmi injection failure when vcpu got blocked
        KVM: SVM: do not zero out segment attributes if segment is unusable or not present
        KVM: SVM: ignore type when setting segment registers
        KVM: nVMX: fix nested_vmx_check_vmptr failure paths under debugging
        KVM: x86: Fix virtual wire mode
        KVM: nVMX: Fix handling of lmsw instruction
        KVM: X86: Fix preempt the preemption timer cancel
      9ea15a59
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 0bb23039
      Linus Torvalds authored
      Pull Reiserfs and GFS2 fixes from Jan Kara:
       "Fixes to GFS2 & Reiserfs for the fallout of the recent WRITE_FUA
        cleanup from Christoph.
      
        Fixes for other filesystems were already merged by respective
        maintainers."
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        reiserfs: Make flush bios explicitely sync
        gfs2: Make flush bios explicitely sync
      0bb23039
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 393bcfae
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "Here are the target-pending fixes for v4.12-rc4:
      
         - ibmviscsis ABORT_TASK handling fixes that missed the v4.12 merge
           window. (Bryant Ly and Michael Cyr)
      
         - Re-add a target-core check enforcing WRITE overflow reject that was
           relaxed in v4.3, to avoid unsupported iscsi-target immediate data
           overflow. (nab)
      
         - Fix a target-core-user OOPs during device removal. (MNC + Bryant
           Ly)
      
         - Fix a long standing iscsi-target potential issue where kthread exit
           did not wait for kthread_should_stop(). (Jiang Yi)
      
         - Fix a iscsi-target v3.12.y regression OOPs involving initial login
           PDU processing during asynchronous TCP connection close. (MNC +
           nab)
      
        This is a little larger than usual for an -rc4, primarily due to the
        iscsi-target v3.12.y regression OOPs bug-fix.
      
        However, it's an important patch as MNC + Hannes where both able to
        trigger it using a reduced iscsi initiator login timeout combined with
        a backend taking a long time to complete I/Os during iscsi login
        driven session reinstatement"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iscsi-target: Always wait for kthread_should_stop() before kthread exit
        iscsi-target: Fix initial login PDU asynchronous socket close OOPs
        tcmu: fix crash during device removal
        target: Re-add check to reject control WRITEs with overflow data
        ibmvscsis: Fix the incorrect req_lim_delta
        ibmvscsis: Clear left-over abort_cmd pointers
      393bcfae
    • ZhuangYanying's avatar
      KVM: x86: Fix nmi injection failure when vcpu got blocked · 47a66eed
      ZhuangYanying authored
      
      
      When spin_lock_irqsave() deadlock occurs inside the guest, vcpu threads,
      other than the lock-holding one, would enter into S state because of
      pvspinlock. Then inject NMI via libvirt API "inject-nmi", the NMI could
      not be injected into vm.
      
      The reason is:
      1 It sets nmi_queued to 1 when calling ioctl KVM_NMI in qemu, and sets
      cpu->kvm_vcpu_dirty to true in do_inject_external_nmi() meanwhile.
      2 It sets nmi_queued to 0 in process_nmi(), before entering guest, because
      cpu->kvm_vcpu_dirty is true.
      
      It's not enough just to check nmi_queued to decide whether to stay in
      vcpu_block() or not. NMI should be injected immediately at any situation.
      Add checking nmi_pending, and testing KVM_REQ_NMI replaces nmi_queued
      in vm_vcpu_has_events().
      
      Do the same change for SMIs.
      Signed-off-by: default avatarZhuang Yanying <ann.zhuangyanying@huawei.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      47a66eed
    • Roman Pen's avatar
      KVM: SVM: do not zero out segment attributes if segment is unusable or not present · d9c1b543
      Roman Pen authored
      This is a fix for the problem [1], where VMCB.CPL was set to 0 and interrupt
      was taken on userspace stack.  The root cause lies in the specific AMD CPU
      behaviour which manifests itself as unusable segment attributes on SYSRET.
      The corresponding work around for the kernel is the following:
      
      61f01dd9
      
       ("x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue")
      
      In other turn virtualization side treated unusable segment incorrectly and
      restored CPL from SS attributes, which were zeroed out few lines above.
      
      In current patch it is assured only that P bit is cleared in VMCB.save state
      and segment attributes are not zeroed out if segment is not presented or is
      unusable, therefore CPL can be safely restored from DPL field.
      
      This is only one part of the fix, since QEMU side should be fixed accordingly
      not to zero out attributes on its side.  Corresponding patch will follow.
      
      [1] Message id: CAJrWOzD6Xq==b-zYCDdFLgSRMPM-NkNuTSDFEtX=7MreT45i7Q@mail.gmail.com
      Signed-off-by: default avatarRoman Pen <roman.penyaev@profitbricks.com>
      Signed-off-by: default avatarMikhail Sennikovskii <mikhail.sennikovskii@profitbricks.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim KrÄmář <rkrcmar@redhat.com>
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      d9c1b543
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux · a3748463
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This is the main set of fixes for rc4, one amdgpu fix, some exynos
        regression fixes, some msm fixes and some i915 and GVT fixes.
      
        I've got a second regression fix for some DP chips that might be a
        bit large, but I think we'd like to land it now, I'll send it along
        tomorrow, once you are happy with this set"
      
      * tag 'drm-fixes-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux: (24 commits)
        drm/amdgpu: Program ring for vce instance 1 at its register space
        drm/exynos: clean up description of exynos_drm_crtc
        drm/exynos: dsi: Remove bridge node reference in removal
        drm/exynos: dsi: Fix the parse_dt function
        drm/exynos: Merge pre/postclose hooks
        drm/msm: Fix the check for the command size
        drm/msm: Take the mutex before calling msm_gem_new_impl
        drm/msm: for array in-fences, check if all backing fences are from our own context before waiting
        drm/msm: constify irq_domain_ops
        drm/msm/mdp5: release hwpipe(s) for unused planes
        drm/msm: Reuse dma_fence_release.
        drm/msm: Expose our reservation object when exporting a dmabuf.
        drm/msm/gpu: check legacy clk names in get_clocks()
        drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state()
        drm/msm: select PM_OPP
        drm/i915: Stop pretending to mask/unmask LPE audio interrupts
        drm/i915/selftests: Silence compiler warning in igt_ctx_exec
        Revert "drm/i915: Restore lost "Initialized i915" welcome message"
        drm/i915/gvt: clean up unsubmited workloads before destroying kmem cache
        drm/i915/gvt: Disable compression workaround for Gen9
        ...
      a3748463
    • Dave Airlie's avatar
      Merge tag 'exynos-drm-fixes-for-v4.12' of... · 400129f0
      Dave Airlie authored
      Merge tag 'exynos-drm-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes
      
      - Fix a regression to description of exynos_drm_crtc
      - Remove preclose hook of Exynos
        . This was a exynos change of the patch series[1] merged already.
      - Fix one dt broken issue
      - Make sure to release bridge_node of Exynos MIPI-DSI driver.
      
      [1] https://lists.freedesktop.org/archives/dri-devel/2017-March/135111.html
      
      * tag 'exynos-drm-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
        drm/exynos: clean up description of exynos_drm_crtc
        drm/exynos: dsi: Remove bridge node reference in removal
        drm/exynos: dsi: Fix the parse_dt function
        drm/exynos: Merge pre/postclose hooks
      400129f0
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 8ef6fcc8
      Dave Airlie authored
      * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu: Program ring for vce instance 1 at its register space
      8ef6fcc8
    • Dave Airlie's avatar
      Merge branch 'msm-fixes-4.12-rc4' of git://people.freedesktop.org/~robclark/linux into drm-fixes · 58b58f6e
      Dave Airlie authored
      a few fixes for 4.12..
      
      * 'msm-fixes-4.12-rc4' of git://people.freedesktop.org/~robclark/linux:
        drm/msm: Fix the check for the command size
        drm/msm: Take the mutex before calling msm_gem_new_impl
        drm/msm: for array in-fences, check if all backing fences are from our own context before waiting
        drm/msm: constify irq_domain_ops
        drm/msm/mdp5: release hwpipe(s) for unused planes
        drm/msm: Reuse dma_fence_release.
        drm/msm: Expose our reservation object when exporting a dmabuf.
        drm/msm/gpu: check legacy clk names in get_clocks()
        drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state()
        drm/msm: select PM_OPP
      58b58f6e
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2017-05-29' of... · 25f480e8
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2017-05-29' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
      
      drm/i915 fixes for v4.12-rc4
      
      * tag 'drm-intel-fixes-2017-05-29' of git://anongit.freedesktop.org/git/drm-intel:
        drm/i915: Stop pretending to mask/unmask LPE audio interrupts
        drm/i915/selftests: Silence compiler warning in igt_ctx_exec
        Revert "drm/i915: Restore lost "Initialized i915" welcome message"
        drm/i915/gvt: clean up unsubmited workloads before destroying kmem cache
        drm/i915/gvt: Disable compression workaround for Gen9
        drm/i915: set initialised only when init_context callback is NULL
        drm/i915: Fix new -Wint-in-bool-context gcc compiler warning
        drm/i915: use vma->size for appgtt allocate_va_range
        drm/i915: Do not sync RCU during shrinking
      25f480e8
  2. 31 May, 2017 4 commits
    • Jiang Yi's avatar
      iscsi-target: Always wait for kthread_should_stop() before kthread exit · 5e0cf5e6
      Jiang Yi authored
      
      
      There are three timing problems in the kthread usages of iscsi_target_mod:
      
       - np_thread of struct iscsi_np
       - rx_thread and tx_thread of struct iscsi_conn
      
      In iscsit_close_connection(), it calls
      
       send_sig(SIGINT, conn->tx_thread, 1);
       kthread_stop(conn->tx_thread);
      
      In conn->tx_thread, which is iscsi_target_tx_thread(), when it receive
      SIGINT the kthread will exit without checking the return value of
      kthread_should_stop().
      
      So if iscsi_target_tx_thread() exit right between send_sig(SIGINT...)
      and kthread_stop(...), the kthread_stop() will try to stop an already
      stopped kthread.
      
      This is invalid according to the documentation of kthread_stop().
      
      (Fix -ECONNRESET logout handling in iscsi_target_tx_thread and
       early iscsi_target_rx_thread failure case - nab)
      Signed-off-by: default avatarJiang Yi <jiangyilism@gmail.com>
      Cc: <stable@vger.kernel.org> # v3.12+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      5e0cf5e6
    • Nicholas Bellinger's avatar
      iscsi-target: Fix initial login PDU asynchronous socket close OOPs · 25cdda95
      Nicholas Bellinger authored
      This patch fixes a OOPs originally introduced by:
      
         commit bb048357
      
      
         Author: Nicholas Bellinger <nab@linux-iscsi.org>
         Date:   Thu Sep 5 14:54:04 2013 -0700
      
         iscsi-target: Add sk->sk_state_change to cleanup after TCP failure
      
      which would trigger a NULL pointer dereference when a TCP connection
      was closed asynchronously via iscsi_target_sk_state_change(), but only
      when the initial PDU processing in iscsi_target_do_login() from iscsi_np
      process context was blocked waiting for backend I/O to complete.
      
      To address this issue, this patch makes the following changes.
      
      First, it introduces some common helper functions used for checking
      socket closing state, checking login_flags, and atomically checking
      socket closing state + setting login_flags.
      
      Second, it introduces a LOGIN_FLAGS_INITIAL_PDU bit to know when a TCP
      connection has dropped via iscsi_target_sk_state_change(), but the
      initial PDU processing within iscsi_target_do_login() in iscsi_np
      context is still running.  For this case, it sets LOGIN_FLAGS_CLOSED,
      but doesn't invoke schedule_delayed_work().
      
      The original NULL pointer dereference case reported by MNC is now handled
      by iscsi_target_do_login() doing a iscsi_target_sk_check_close() before
      transitioning to FFP to determine when the socket has already closed,
      or iscsi_target_start_negotiation() if the login needs to exchange
      more PDUs (eg: iscsi_target_do_login returned 0) but the socket has
      closed.  For both of these cases, the cleanup up of remaining connection
      resources will occur in iscsi_target_start_negotiation() from iscsi_np
      process context once the failure is detected.
      
      Finally, to handle to case where iscsi_target_sk_state_change() is
      called after the initial PDU procesing is complete, it now invokes
      conn->login_work -> iscsi_target_do_login_rx() to perform cleanup once
      existing iscsi_target_sk_check_close() checks detect connection failure.
      For this case, the cleanup of remaining connection resources will occur
      in iscsi_target_do_login_rx() from delayed workqueue process context
      once the failure is detected.
      Reported-by: default avatarMike Christie <mchristi@redhat.com>
      Reviewed-by: default avatarMike Christie <mchristi@redhat.com>
      Tested-by: default avatarMike Christie <mchristi@redhat.com>
      Cc: Mike Christie <mchristi@redhat.com>
      Reported-by: default avatarHannes Reinecke <hare@suse.com>
      Cc: Hannes Reinecke <hare@suse.com>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Cc: Varun Prakash <varun@chelsio.com>
      Cc: <stable@vger.kernel.org> # v3.12+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      25cdda95
    • Leo Liu's avatar
      drm/amdgpu: Program ring for vce instance 1 at its register space · 45cc6586
      Leo Liu authored
      
      
      We need program ring buffer on instance 1 register space domain,
      when only if instance 1 available, with two instances or instance 0,
      and we need only program instance 0 regsiter space domain for ring.
      Signed-off-by: default avatarLeo Liu <leo.liu@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      45cc6586
    • Linus Torvalds's avatar
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · d602fb68
      Linus Torvalds authored
      Pull overlayfs fixes from Miklos Szeredi:
       "Fix regressions:
      
         - missing CONFIG_EXPORTFS dependency
      
         - failure if upper fs doesn't support xattr
      
         - bad error cleanup
      
        This also adds the concept of "impure" directories complementing the
        "origin" marking introduced in -rc1. Together they enable getting
        consistent st_ino and d_ino for directory listings.
      
        And there's a bug fix and a cleanup as well"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: filter trusted xattr for non-admin
        ovl: mark upper merge dir with type origin entries "impure"
        ovl: mark upper dir with type origin entries "impure"
        ovl: remove unused arg from ovl_lookup_temp()
        ovl: handle rename when upper doesn't support xattr
        ovl: don't fail copy-up if upper doesn't support xattr
        ovl: check on mount time if upper fs supports setting xattr
        ovl: fix creds leak in copy up error path
        ovl: select EXPORTFS
      d602fb68
  3. 30 May, 2017 3 commits
    • Linus Torvalds's avatar
      "Yes, people use FOLL_FORCE ;)" · f511c0b1
      Linus Torvalds authored
      This effectively reverts commit 8ee74a91
      
       ("proc: try to remove use
      of FOLL_FORCE entirely")
      
      It turns out that people do depend on FOLL_FORCE for the /proc/<pid>/mem
      case, and we're talking not just debuggers. Talking to the affected people, the use-cases are:
      
      Keno Fischer:
       "We used these semantics as a hardening mechanism in the julia JIT. By
        opening /proc/self/mem and using these semantics, we could avoid
        needing RWX pages, or a dual mapping approach. We do have fallbacks to
        these other methods (though getting EIO here actually causes an assert
        in released versions - we'll updated that to make sure to take the
        fall back in that case).
      
        Nevertheless the /proc/self/mem approach was our favored approach
        because it a) Required an attacker to be able to execute syscalls
        which is a taller order than getting memory write and b) didn't double
        the virtual address space requirements (as a dual mapping approach
        would).
      
        I think in general this feature is very useful for anybody who needs
        to precisely control the execution of some other process. Various
        debuggers (gdb/lldb/rr) certainly fall into that category, but there's
        another class of such processes (wine, various emulators) which may
        want to do that kind of thing.
      
        Now, I suspect most of these will have the other process under ptrace
        control, so maybe allowing (same_mm || ptraced) would be ok, but at
        least for the sandbox/remote-jit use case, it would be perfectly
        reasonable to not have the jit server be a ptracer"
      
      Robert O'Callahan:
       "We write to readonly code and data mappings via /proc/.../mem in lots
        of different situations, particularly when we're adjusting program
        state during replay to match the recorded execution.
      
        Like Julia, we can add workarounds, but they could be expensive."
      
      so not only do people use FOLL_FORCE for both reads and writes, but they
      use it for both the local mm and remote mm.
      
      With these comments in mind, we likely also cannot add the "are we
      actively ptracing" check either, so this keeps the new code organization
      and does not do a real revert that would add back the original comment
      about "Maybe we should limit FOLL_FORCE to actual ptrace users?"
      Reported-by: default avatarKeno Fischer <keno@juliacomputing.com>
      Reported-by: default avatarRobert O'Callahan <robert@ocallahan.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Eric Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f511c0b1
    • Gioh Kim's avatar
      KVM: SVM: ignore type when setting segment registers · 8eae9570
      Gioh Kim authored
      Commit 19bca6ab
      
       ("KVM: SVM: Fix cross vendor migration issue with
      unusable bit") added checking type when setting unusable.
      So unusable can be set if present is 0 OR type is 0.
      According to the AMD processor manual, long mode ignores the type value
      in segment descriptor. And type can be 0 if it is read-only data segment.
      Therefore type value is not related to unusable flag.
      
      This patch is based on linux-next v4.12.0-rc3.
      Signed-off-by: default avatarGioh Kim <gi-oh.kim@profitbricks.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      8eae9570
    • Radim Krčmář's avatar
      KVM: nVMX: fix nested_vmx_check_vmptr failure paths under debugging · cbf71279
      Radim Krčmář authored
      
      
      kvm_skip_emulated_instruction() will return 0 if userspace is
      single-stepping the guest.
      
      kvm_skip_emulated_instruction() uses return status convention of exit
      handler: 0 means "exit to userspace" and 1 means "continue vm entries".
      The problem is that nested_vmx_check_vmptr() return status means
      something else: 0 is ok, 1 is error.
      
      This means we would continue executing after a failure.  Static checker
      noticed it because vmptr was not initialized.
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Fixes: 6affcbed
      
       ("KVM: x86: Add kvm_skip_emulated_instruction and use it.")
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      cbf71279
  4. 29 May, 2017 9 commits
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 3f173bde
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Here is an overdue pull request for pin control fixes, the most
        prominent feature is to make Intel Chromebooks (and I suspect any
        other Cherryview-based Intel thing) happy again, which we really want
        to see.
      
        There is a patch hitting drivers/firmware/* that I was uncertain to
        who actually manages, but I got Andy Shevchenko's and Dmitry Torokov's
        review tags on it and I trust them both 100% to do the right thing for
        Intel platform drivers.
      
        Summary:
      
         - Make a few Intel Chromebooks with Cherryview DMI firmware work
           smoothly.
      
         - A fix for some bogus allocations in the generic group management
           code.
      
         - Some GPIO descriptor lookup table stubs. Merged through the pin
           control tree for administrative reasons.
      
         - Revert the "bi-directional" and "output-enable" generic properties:
           we need more discussions around this. It seems other SoCs are using
           input/output gate enablement and these terms are not correct.
      
         - Fix mux and drive strength atomically in the MXS driver.
      
         - Fix the SPDIF function on sunxi A83T.
      
         - OF table terminators and other small fixes"
      
      * tag 'pinctrl-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: sunxi: Fix SPDIF function name for A83T
        pinctrl: mxs: atomically switch mux and drive strength config
        pinctrl: cherryview: Extend the Chromebook DMI quirk to Intel_Strago systems
        firmware: dmi: Add DMI_PRODUCT_FAMILY identification string
        pinctrl: core: Fix warning by removing bogus code
        gpiolib: Add stubs for gpiod lookup table interface
        Revert "pinctrl: generic: Add bi-directional and output-enable"
        pinctrl: cherryview: Add terminate entry for dmi_system_id tables
      3f173bde
    • Vegard Nossum's avatar
      kthread: fix boot hang (regression) on MIPS/OpenRISC · b0f5a8f3
      Vegard Nossum authored
      This fixes a regression in commit 4d6501dc where I didn't notice
      that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to
      NULL after our initialisation in copy_process().
      
      We can simply get rid of the arch-specific initialisation here since it
      is now always done in copy_process() before hitting copy_thread{,_tls}().
      
      Review notes:
      
       - As far as I can tell, copy_process() is the only user of
         copy_thread_tls(), which is the only caller of copy_thread() for
         architectures that don't implement copy_thread_tls().
      
       - After this patch, there is no arch-specific code touching
         p->set_child_tid or p->clear_child_tid whatsoever.
      
       - It may look like MIPS/OpenRISC wanted to always have these fields be
         NULL, but that's not true, as copy_process() would unconditionally
         set them again _after_ calling copy_thread_tls() before commit
         4d6501dc.
      
      Fixes: 4d6501dc
      
       ("kthread: Fix use-after-free if kthread fork fails")
      Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Tested-by: Guenter Roeck <linux@roeck-us.net> # MIPS only
      Acked-by: default avatarStafford Horne <shorne@gmail.com>
      Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
      Cc: openrisc@lists.librecores.org
      Cc: Jamie Iles <jamie.iles@oracle.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b0f5a8f3
    • Miklos Szeredi's avatar
      ovl: filter trusted xattr for non-admin · a082c6f6
      Miklos Szeredi authored
      
      
      Filesystems filter out extended attributes in the "trusted." domain for
      unprivlieged callers.
      
      Overlay calls underlying filesystem's method with elevated privs, so need
      to do the filtering in overlayfs too.
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      a082c6f6
    • Amir Goldstein's avatar
      ovl: mark upper merge dir with type origin entries "impure" · f3a15685
      Amir Goldstein authored
      
      
      An upper dir is marked "impure" to let ovl_iterate() know that this
      directory may contain non pure upper entries whose d_ino may need to be
      read from the origin inode.
      
      We already mark a non-merge dir "impure" when moving a non-pure child
      entry inside it, to let ovl_iterate() know not to iterate the non-merge
      dir directly.
      
      Mark also a merge dir "impure" when moving a non-pure child entry inside
      it and when copying up a child entry inside it.
      
      This can be used to optimize ovl_iterate() to perform a "pure merge" of
      upper and lower directories, merging the content of the directories,
      without having to read d_ino from origin inodes.
      Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      f3a15685
    • Inki Dae's avatar
      drm/exynos: clean up description of exynos_drm_crtc · e379cbee
      Inki Dae authored
      This patch removes unnecessary descriptions on
      exynos_drm_crtc structure and adds one description
      which specifies what pipe_clk member does.
      
      pipe_clk support had been added by below patch without any description,
      	 drm/exynos: add support for pipeline clock to the framework
      		Commit-id : f26b9343
      
      Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
      e379cbee
    • Hoegeun Kwon's avatar
      drm/exynos: dsi: Remove bridge node reference in removal · 70505c2e
      Hoegeun Kwon authored
      
      
      Since bridge node is referenced during in the probe, it should be
      released on removal.
      Suggested-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
      Signed-off-by: default avatarHoegeun Kwon <hoegeun.kwon@samsung.com>
      Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
      70505c2e
    • Hoegeun Kwon's avatar
      drm/exynos: dsi: Fix the parse_dt function · f2921d8c
      Hoegeun Kwon authored
      
      
      The dsi + panel is a parental relationship, so OF grpah is not needed.
      Therefore, the current dsi_parse_dt function will throw an error,
      because there is no linked OF graph for the case fimd + dsi + panel.
      
      Parse the Pll burst and esc clock frequency properties in dsi_parse_dt()
      and create a bridge_node only if there is an OF graph associated with dsi.
      Signed-off-by: default avatarHoegeun Kwon <hoegeun.kwon@samsung.com>
      Reviewed-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
      Reviewed-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
      f2921d8c
    • Daniel Vetter's avatar
      drm/exynos: Merge pre/postclose hooks · 4013ef48
      Daniel Vetter authored
      
      
      Again no apparent explanation for the split except hysterical raisins.
      
      Cc: Inki Dae <inki.dae@samsung.com>
      Cc: Joonyoung Shim <jy0922.shim@samsung.com>
      Cc: Seung-Woo Kim <sw0312.kim@samsung.com>
      Cc: Kyungmin Park <kyungmin.park@samsung.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
      4013ef48
    • Linus Torvalds's avatar
      Linux 4.12-rc3 · 5ed02dbb
      Linus Torvalds authored
      5ed02dbb
  5. 28 May, 2017 1 commit
  6. 27 May, 2017 13 commits
    • Jordan Crouse's avatar
      drm/msm: Fix the check for the command size · d72fea53
      Jordan Crouse authored
      
      
      The overrun check for the size of submitted commands is off by one.
      It should allow the offset plus the size to be equal to the
      size of the memory object when the command stream is very tightly
      constructed.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      d72fea53
    • Jordan Crouse's avatar
      drm/msm: Take the mutex before calling msm_gem_new_impl · 90dd57de
      Jordan Crouse authored
      
      
      Amongst its other duties, msm_gem_new_impl adds the newly created
      GEM object to the shared inactive list which may also be actively
      modifiying the list during submission.  All the paths to modify
      the list are protected by the mutex except for the one through
      msm_gem_import which can end up causing list corruption.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      [add extra WARN_ON(!mutex_is_locked(&dev->struct_mutex))]
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      90dd57de
    • Philipp Zabel's avatar
      drm/msm: for array in-fences, check if all backing fences are from our own context before waiting · 3cfac69c
      Philipp Zabel authored
      
      
      Use the dma_fence_match_context helper to check if all backing fences
      are from our own context, in which case we don't have to wait.
      Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: Gustavo Padovan <gustavo.padovan@collabora.com>
      [rebased on code-motion]
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      3cfac69c
    • Tobias Klauser's avatar
      drm/msm: constify irq_domain_ops · c43dd227
      Tobias Klauser authored
      
      
      struct irq_domain_ops is not modified, so it can be made const.
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      c43dd227
    • Rob Clark's avatar
      drm/msm/mdp5: release hwpipe(s) for unused planes · adcbae31
      Rob Clark authored
      
      
      Otherwise, if userspace doesn't re-use a given plane, it's hwpipe(s)
      could stay permanently assigned.
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      adcbae31
    • Eric Anholt's avatar
      drm/msm: Reuse dma_fence_release. · 3c30cc41
      Eric Anholt authored
      
      
      If we follow the typical pattern of the base class being the first
      member, we can use the default dma_fence_free function.
      Signed-off-by: default avatarEric Anholt <eric@anholt.net>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      3c30cc41
    • Eric Anholt's avatar
      drm/msm: Expose our reservation object when exporting a dmabuf. · 43523eba
      Eric Anholt authored
      
      
      Without this, polling on the dma-buf (and presumably other devices
      synchronizing against our rendering) would return immediately, even
      while the BO was busy.
      Signed-off-by: default avatarEric Anholt <eric@anholt.net>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Cc: stable@vger.kernel.org
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      43523eba
    • Rob Clark's avatar
      drm/msm/gpu: check legacy clk names in get_clocks() · 134ccada
      Rob Clark authored
      Otherwise if someone was using old bindings with "core_clk" instead of
      "core" as the clock name, we'd never find it and gpu would be stuck at
      27MHz (or whatever it's slowest rate is).
      
      Fixes: 98db803f
      
       ("msm/drm: gpu: Dynamically locate the clocks from the device tree")
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      134ccada
    • Rob Clark's avatar
      drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state() · 786813c3
      Rob Clark authored
      Somehow the helper was never retrofitted for mdp5.  Which meant when
      plane_state->fence was added, it could get copied into new state in
      mdp5_plane_duplicate_state().
      
      If an update to disable the plane (for example on rmfb) managed to sneak
      in after an nonblock update had swapped state, but before it was
      committed, we'd get a splat:
      
          WARNING: CPU: 1 PID: 69 at ../drivers/gpu/drm/drm_atomic_helper.c:1061 drm_atomic_helper_wait_for_fences+0xe0/0xf8
         Modules linked in:
      
         CPU: 1 PID: 69 Comm: kworker/1:1 Tainted: G        W       4.11.0-rc8+ #1187
         Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
         Workqueue: events drm_mode_rmfb_work_fn
         task: ffffffc036560d00 task.stack: ffffffc036550000
         PC is at drm_atomic_helper_wait_for_fences+0xe0/0xf8
         LR is at complete_commit.isra.1+0x44/0x1c0
         pc : [<ffffff80084f6040>] lr : [<ffffff800854176c>] pstate: 20000145
         sp : ffffffc036553b60
         x29: ffffffc036553b60 x28: ffffffc0264e6a00
         x27: ffffffc035659000 x26: 0000000000000000
         x25: ffffffc0240e8000 x24: 0000000000000038
         x23: 0000000000000000 x22: ffffff800858f200
         x21: ffffffc0240e8000 x20: ffffffc02f56a800
         x19: 0000000000000000 x18: 0000000000000000
         x17: 0000000000000000 x16: 0000000000000000
         x15: 0000000000000000 x14: ffffffc00a192700
         x13: 0000000000000004 x12: 0000000000000000
         x11: ffffff80089a1690 x10: 00000000000008f0
         x9 : ffffffc036553b20 x8 : ffffffc036561650
         x7 : ffffffc03fe6cb40 x6 : 0000000000000000
         x5 : 0000000000000001 x4 : 0000000000000002
         x3 : ffffffc035659000 x2 : ffffffc0240e8c80
         x1 : 0000000000000000 x0 : ffffffc02adbe588
      
         ---[ end trace 13aeec77c3fb55e2 ]---
         Call trace:
         Exception stack(0xffffffc036553990 to 0xffffffc036553ac0)
         3980:                                   0000000000000000 0000008000000000
         39a0: ffffffc036553b60 ffffff80084f6040 0000000000004ff0 0000000000000038
         39c0: ffffffc0365539d0 ffffff800857e098 ffffffc036553a00 ffffff800857e1b0
         39e0: ffffffc036553a10 ffffff800857c554 ffffffc0365e8400 ffffffc0365e8400
         3a00: ffffffc036553a20 ffffff8008103358 000000000001aad7 ffffff800851b72c
         3a20: ffffffc036553a50 ffffff80080e9228 ffffffc02adbe588 0000000000000000
         3a40: ffffffc0240e8c80 ffffffc035659000 0000000000000002 0000000000000001
         3a60: 0000000000000000 ffffffc03fe6cb40 ffffffc036561650 ffffffc036553b20
         3a80: 00000000000008f0 ffffff80089a1690 0000000000000000 0000000000000004
         3aa0: ffffffc00a192700 0000000000000000 0000000000000000 0000000000000000
         [<ffffff80084f6040>] drm_atomic_helper_wait_for_fences+0xe0/0xf8
         [<ffffff800854176c>] complete_commit.isra.1+0x44/0x1c0
         [<ffffff8008541c64>] msm_atomic_commit+0x32c/0x350
         [<ffffff8008516230>] drm_atomic_commit+0x50/0x60
         [<ffffff8008517548>] drm_atomic_remove_fb+0x158/0x250
         [<ffffff80085186d0>] drm_framebuffer_remove+0x50/0x158
         [<ffffff8008518818>] drm_mode_rmfb_work_fn+0x40/0x58
         [<ffffff80080d5668>] process_one_work+0x1d0/0x378
         [<ffffff80080d5a54>] worker_thread+0x244/0x488
         [<ffffff80080db7fc>] kthread+0xfc/0x128
         [<ffffff8008082ec0>] ret_from_fork+0x10/0x50
      
      Fixes: 96260142
      
       ("drm/fence: add in-fences support")
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Reported-by: default avatarStanimir Varbanov <stanimir.varbanov@linaro.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      786813c3
    • Rob Clark's avatar
      drm/msm: select PM_OPP · ac20fa0a
      Rob Clark authored
      Otherwise, if nothing else enabled selects it, dev_pm_opp_of_add_table()
      will return -ENOTSUPP.
      
      Fixes: e2af8b6b
      
       ("drm/msm: gpu: Use OPP tables if we can")
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      ac20fa0a
    • Linus Torvalds's avatar
      Merge tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 249f1efd
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some serial and tty fixes for 4.12-rc3. They are a bit bigger
        than normal, which is why I had them bake in linux-next for a few
        weeks and didn't send them to you for -rc2.
      
        They revert a few of the serdev patches from 4.12-rc1, and bring
        things back to how they were in 4.11, to try to make things a bit more
        stable there. Rob and Johan both agree that this is the way forward,
        so this isn't people squabbling over semantics. Other than that, just
        a few minor serial driver fixes that people have had problems with.
      
        All of these have been in linux-next for a few weeks with no reported
        issues"
      
      * tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: altera_uart: call iounmap() at driver remove
        serial: imx: ensure UCR3 and UFCR are setup correctly
        MAINTAINERS/serial: Change maintainer of jsm driver
        serial: enable serdev support
        tty/serdev: add serdev registration interface
        serdev: Restore serdev_device_write_buf for atomic context
        serial: core: fix crash in uart_suspend_port
        tty: fix port buffer locking
        tty: ehv_bytechan: clean up init error handling
        serial: ifx6x60: fix use-after-free on module unload
        serial: altera_jtaguart: adding iounmap()
        serial: exar: Fix stuck MSIs
        serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
        serdev: fix tty-port client deregistration
        Revert "tty_port: register tty ports with serdev bus"
        drivers/tty: 8250: only call fintek_8250_probe when doing port I/O
      249f1efd
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 6f68a6ae
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Fix running SPU programs on Cell, and a few other minor fixes.
      
        Thanks to Alistair Popple, Jeremy Kerr, Michael Neuling, Nicholas
        Piggin"
      
      * tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc: Add PPC_FEATURE userspace bits for SCV and DARN instructions
        powerpc/spufs: Fix hash faults for kernel regions
        powerpc: Fix booting P9 hash with CONFIG_PPC_RADIX_MMU=N
        powerpc/powernv/npu-dma.c: Fix opal_npu_destroy_context() call
        selftests/powerpc: Fix TM resched DSCR test with some compilers
      6f68a6ae
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 38e6bf23
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A series of fixes for X86:
      
         - The final fix for the end-of-stack issue in the unwinder
         - Handle non PAT systems gracefully
         - Prevent access to uninitiliazed memory
         - Move early delay calaibration after basic init
         - Fix Kconfig help text
         - Fix a cross compile issue
         - Unbreak older make versions"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/timers: Move simple_udelay_calibration past init_hypervisor_platform
        x86/alternatives: Prevent uninitialized stack byte read in apply_alternatives()
        x86/PAT: Fix Xorg regression on CPUs that don't support PAT
        x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation
        x86/build: Permit building with old make versions
        x86/unwind: Add end-of-stack check for ftrace handlers
        Revert "x86/entry: Fix the end of the stack for newly forked tasks"
        x86/boot: Use CROSS_COMPILE prefix for readelf
      38e6bf23