summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-09-13Make hash_64() use a 64-bit multiply when appropriateLinus Torvalds
The hash_64() function historically does the multiply by the GOLDEN_RATIO_PRIME_64 number with explicit shifts and adds, because unlike the 32-bit case, gcc seems unable to turn the constant multiply into the more appropriate shift and adds when required. However, that means that we generate those shifts and adds even when the architecture has a fast multiplier, and could just do it better in hardware. Use the now-cleaned-up CONFIG_ARCH_HAS_FAST_MULTIPLIER (together with "is it a 64-bit architecture") to decide whether to use an integer multiply or the explicit sequence of shift/add instructions. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-09-13Make ARCH_HAS_FAST_MULTIPLIER a real config variableLinus Torvalds
It used to be an ad-hoc hack defined by the x86 version of <asm/bitops.h> that enabled a couple of library routines to know whether an integer multiply is faster than repeated shifts and additions. This just makes it use the real Kconfig system instead, and makes x86 (which was the only architecture that did this) select the option. NOTE! Even for x86, this really is kind of wrong. If we cared, we would probably not enable this for builds optimized for netburst (P4), where shifts-and-adds are generally faster than multiplies. This patch does *not* change that kind of logic, though, it is purely a syntactic change with no code changes. This was triggered by the fact that we have other places that really want to know "do I want to expand multiples by constants by hand or not", particularly the hash generation code. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-09-13Merge tag 'dm-3.17-fix2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mike Snitzer: "Fix a race in the DM cache target that caused dirty blocks to be marked as clean. This could cause no writeback to occur or spurious dirty block counts" * tag 'dm-3.17-fix2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache: fix race causing dirty blocks to be marked as clean
2014-09-13Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds
Pull block fixes from Jens Axboe: "A small collection of fixes for the current rc series. This contains: - Two small blk-mq patches from Rob Elliott, cleaning up error case at init time. - A fix from Ming Lei, fixing SG merging for blk-mq where QUEUE_FLAG_SG_NO_MERGE is the default. - A dev_t minor lifetime fix from Keith, fixing an issue where a minor might be reused before all references to it were gone. - Fix from Alan Stern where an unbalanced queue bypass caused SCSI some headaches when it does a series of add/del on devices without fully registrering the queue. - A fix from me for improving the scaling of tag depth in blk-mq if we are short on memory" * 'for-linus' of git://git.kernel.dk/linux-block: blk-mq: scale depth and rq map appropriate if low on memory Block: fix unbalanced bypass-disable in blk_register_queue block: Fix dev_t minor allocation lifetime blk-mq: cleanup after blk_mq_init_rq_map failures blk-mq: pass along blk_mq_alloc_tag_set return values blk-merge: fix blk_recount_segments
2014-09-12Merge tag 'stable/for-linus-3.17-b-rc4-arm-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull Xen ARM bugfix from Stefano Stabellini: "The patches fix the "xen_add_mach_to_phys_entry: cannot add" bug that has been affecting xen on arm and arm64 guests since 3.16. They require a few hypervisor side changes that just went in xen-unstable. A couple of days ago David sent out a pull request with a few other Xen fixes (it is already in master). Sorry we didn't synchronized better among us" * tag 'stable/for-linus-3.17-b-rc4-arm-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/arm: remove mach_to_phys rbtree xen/arm: reimplement xen_dma_unmap_page & friends xen/arm: introduce XENFEAT_grant_map_identity
2014-09-13Merge tag 'topic/drm-header-rework-2014-09-12' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-next So here's the header cleanup, rebased on top of drm-next. Two new header files are created here: - drivers/gpu/drm/drm_internal.h for non-legacy drm.ko private declarations. - include/drm/drm_legacy.h for legacy interfaces used by non-kms drivers. And of course lots fo stuff gets shuffled into the already existing drivers/gpu/drm/drm_legacy.h for drm.ko internal stuff. topic branch smoke-tested in drm-intel-nightly for a bit. And the 0day tester also worked through it (and found a few places I didn't add a static to functions). * tag 'topic/drm-header-rework-2014-09-12' of git://anongit.freedesktop.org/drm-intel: drm: Move DRM_MAGIC_HASH_ORDER into drm_drv.c drm: Move drm_class to drm_internal.h drm: Move LOCK_TEST_WITH_RETURN to <drm/drm_legacy.h> drm: Move legacy buffer structures to <drm/drm_legacy.h> drm: Move drm_memory.c map support declarations to <drm/drm_legacy.h> drm: Purge ioctl forward declarations from drmP.h drm: unexport drm_global_mutex drm: Move piles of functions from drmP.h to drm_internal.h drm: Move vblank related module options into drm_irq.c drm: Drop drm_sysfs_class from drmP.h drm: Move __drm_pci_free to drm_legacy.h drm: Create drm legacy driver header drm: Move drm_legacy_vma_flush into drm_legacy.h drm: Move sg functions into drm_legacy.h drm: Move dma functions into drm_legacy.h
2014-09-12alarmtimer: Lock k_itimer during timer callbackRichard Larocque
Locks the k_itimer's it_lock member when handling the alarm timer's expiry callback. The regular posix timers defined in posix-timers.c have this lock held during timout processing because their callbacks are routed through posix_timer_fn(). The alarm timers follow a different path, so they ought to grab the lock somewhere else. Cc: stable@vger.kernel.org Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@kernel.org> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Sharvil Nanavati <sharvil@google.com> Signed-off-by: Richard Larocque <rlarocque@google.com> Signed-off-by: John Stultz <john.stultz@linaro.org>
2014-09-12alarmtimer: Do not signal SIGEV_NONE timersRichard Larocque
Avoids sending a signal to alarm timers created with sigev_notify set to SIGEV_NONE by checking for that special case in the timeout callback. The regular posix timers avoid sending signals to SIGEV_NONE timers by not scheduling any callbacks for them in the first place. Although it would be possible to do something similar for alarm timers, it's simpler to handle this as a special case in the timeout. Prior to this patch, the alarm timer would ignore the sigev_notify value and try to deliver signals to the process anyway. Even worse, the sanity check for the value of sigev_signo is skipped when SIGEV_NONE was specified, so the signal number could be bogus. If sigev_signo was an unitialized value (as it often would be if SIGEV_NONE is used), then it's hard to predict which signal will be sent. Cc: stable@vger.kernel.org Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@kernel.org> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Sharvil Nanavati <sharvil@google.com> Signed-off-by: Richard Larocque <rlarocque@google.com> Signed-off-by: John Stultz <john.stultz@linaro.org>
2014-09-12alarmtimer: Return relative times in timer_gettimeRichard Larocque
Returns the time remaining for an alarm timer, rather than the time at which it is scheduled to expire. If the timer has already expired or it is not currently scheduled, the it_value's members are set to zero. This new behavior matches that of the other posix-timers and the POSIX specifications. This is a change in user-visible behavior, and may break existing applications. Hopefully, few users rely on the old incorrect behavior. Cc: stable@vger.kernel.org Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@kernel.org> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Sharvil Nanavati <sharvil@google.com> Signed-off-by: Richard Larocque <rlarocque@google.com> [jstultz: minor style tweak] Signed-off-by: John Stultz <john.stultz@linaro.org>
2014-09-12jiffies: Fix timeval conversion to jiffiesAndrew Hunter
timeval_to_jiffies tried to round a timeval up to an integral number of jiffies, but the logic for doing so was incorrect: intervals corresponding to exactly N jiffies would become N+1. This manifested itself particularly repeatedly stopping/starting an itimer: setitimer(ITIMER_PROF, &val, NULL); setitimer(ITIMER_PROF, NULL, &val); would add a full tick to val, _even if it was exactly representable in terms of jiffies_ (say, the result of a previous rounding.) Doing this repeatedly would cause unbounded growth in val. So fix the math. Here's what was wrong with the conversion: we essentially computed (eliding seconds) jiffies = usec * (NSEC_PER_USEC/TICK_NSEC) by using scaling arithmetic, which took the best approximation of NSEC_PER_USEC/TICK_NSEC with denominator of 2^USEC_JIFFIE_SC = x/(2^USEC_JIFFIE_SC), and computed: jiffies = (usec * x) >> USEC_JIFFIE_SC and rounded this calculation up in the intermediate form (since we can't necessarily exactly represent TICK_NSEC in usec.) But the scaling arithmetic is a (very slight) *over*approximation of the true value; that is, instead of dividing by (1 usec/ 1 jiffie), we effectively divided by (1 usec/1 jiffie)-epsilon (rounding down). This would normally be fine, but we want to round timeouts up, and we did so by adding 2^USEC_JIFFIE_SC - 1 before the shift; this would be fine if our division was exact, but dividing this by the slightly smaller factor was equivalent to adding just _over_ 1 to the final result (instead of just _under_ 1, as desired.) In particular, with HZ=1000, we consistently computed that 10000 usec was 11 jiffies; the same was true for any exact multiple of TICK_NSEC. We could possibly still round in the intermediate form, adding something less than 2^USEC_JIFFIE_SC - 1, but easier still is to convert usec->nsec, round in nanoseconds, and then convert using time*spec*_to_jiffies. This adds one constant multiplication, and is not observably slower in microbenchmarks on recent x86 hardware. Tested: the following program: int main() { struct itimerval zero = {{0, 0}, {0, 0}}; /* Initially set to 10 ms. */ struct itimerval initial = zero; initial.it_interval.tv_usec = 10000; setitimer(ITIMER_PROF, &initial, NULL); /* Save and restore several times. */ for (size_t i = 0; i < 10; ++i) { struct itimerval prev; setitimer(ITIMER_PROF, &zero, &prev); /* on old kernels, this goes up by TICK_USEC every iteration */ printf("previous value: %ld %ld %ld %ld\n", prev.it_interval.tv_sec, prev.it_interval.tv_usec, prev.it_value.tv_sec, prev.it_value.tv_usec); setitimer(ITIMER_PROF, &prev, NULL); } return 0; } Cc: stable@vger.kernel.org Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Paul Turner <pjt@google.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Prarit Bhargava <prarit@redhat.com> Reviewed-by: Paul Turner <pjt@google.com> Reported-by: Aaron Jacobs <jacobsa@google.com> Signed-off-by: Andrew Hunter <ahh@google.com> [jstultz: Tweaked to apply to 3.17-rc] Signed-off-by: John Stultz <john.stultz@linaro.org>
2014-09-12futex: Unlock hb->lock in futex_wait_requeue_pi() error pathThomas Gleixner
futex_wait_requeue_pi() calls futex_wait_setup(). If futex_wait_setup() succeeds it returns with hb->lock held and preemption disabled. Now the sanity check after this does: if (match_futex(&q.key, &key2)) { ret = -EINVAL; goto out_put_keys; } which releases the keys but does not release hb->lock. So we happily return to user space with hb->lock held and therefor preemption disabled. Unlock hb->lock before taking the exit route. Reported-by: Dave "Trinity" Jones <davej@redhat.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Darren Hart <dvhart@linux.intel.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1409112318500.4178@nanos Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-09-12Merge tag 'char-misc-3.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fix from Greg KH: "Here is one misc driver fix for 3.17-rc5. It resolves a kernel oops that can happen in the lattice FPGA driver if the firmware isn't present on the system. It's been in the linux-next tree for a while now" * tag 'char-misc-3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Lattice ECP3 FPGA: Check firmware pointer
2014-09-12Merge tag 'staging-3.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are 3 tiny staging driver fixes for 3.17-rc5. Two are fixes for the imx-drm driver, resolving issues that have been reported. The other is a memory leak fix for the Android sync driver, due to changes that went into 3.17-rc1. All have been in linux-next for a while" * tag 'staging-3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: android: fix reference leak in sync_fence_create imx-drm: imx-ldb: fix NULL pointer in imx_ldb_unbind() imx-drm: ipuv3-plane: fix ipu_plane_dpms()
2014-09-12Merge tag 'tty-3.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are 3 patches for 3.17-rc5. Two serial driver fixes that resolve some reported issues, and one new device id. All have been in linux-next just fine" * tag 'tty-3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: xuartps: Fix tx_emtpy() callback tty/serial: at91: BUG: disable interrupts when !UART_ENABLE_MS() serial: 8250_dw: Add ACPI ID for Intel Braswell
2014-09-12Merge tag 'usb-3.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB and PHY fixes for 3.17-rc5. Nothing major here, just a number of tiny fixes for reported issues, and some new device ids as well. All have been tested in linux-next" * tag 'usb-3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (46 commits) xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices usb: xhci: Fix OOPS in xhci error handling code xhci: Fix null pointer dereference if xhci initialization fails storage: Add single-LUN quirk for Jaz USB Adapter uas: Add missing le16_to_cpu calls to asm1051 / asm1053 usb-id check usb: chipidea: msm: Initialize PHY on reset event usb: chipidea: msm: Use USB PHY API to control PHY state usb: hub: take hub->hdev reference when processing from eventlist uas: Disable uas on ASM1051 devices usb: dwc2/gadget: avoid disabling ep0 usb: dwc2/gadget: delay enabling irq once hardware is configured properly usb: dwc2/gadget: do not call disconnect method in pullup usb: dwc2/gadget: break infinite loop in endpoint disable code usb: dwc2/gadget: fix phy initialization sequence usb: dwc2/gadget: fix phy disable sequence uwb: init beacon cache entry before registering uwb device USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device USB: document the 'u' flag for usb-storage quirks parameter usb: host: xhci: fix compliance mode workaround usb: dwc3: fix TRB completion when multiple TRBs are started ...
2014-09-12Merge tag 'nfs-for-3.17-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfsLinus Torvalds
Pull NFS client fixes from Trond Myklebust: "Highlights: - fix a kernel warning when removing /proc/net/nfsfs - revert commit 49a4bda22e18 due to Oopses - fix a typo in the pNFS file layout commit code" * tag 'nfs-for-3.17-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: pnfs: fix filelayout_retry_commit when idx > 0 nfs: revert "nfs4: queue free_lock_state job submission to nfsiod" nfs: fix kernel warning when removing proc entry
2014-09-12Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fixes from Chris Mason: "Filipe is doing a careful pass through fsync problems, and these are the fixes so far. I'll have one more for rc6 that we're still testing. My big commit is fixing up some inode hash races that Al Viro found (thanks Al)" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: use insert_inode_locked4 for inode creation Btrfs: fix fsync data loss after a ranged fsync Btrfs: kfree()ing ERR_PTRs Btrfs: fix crash while doing a ranged fsync Btrfs: fix corruption after write/fsync failure + fsync + log recovery Btrfs: fix autodefrag with compression
2014-09-12Merge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Just a couple of stragglers here: - fix an issue migrating interrupts on CPU hotplug - fix a potential information leak of TLS registers across an exec (Nathan has sent a corresponding patch for arch/arm/ to rmk)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: flush TLS registers during exec arm64: use irq_set_affinity with force=false when migrating irqs
2014-09-12Merge tag 'iommu-fixes-v3.17-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - two fixes for issues found by Coverity - various fixes for the ARM SMMU driver - a warning fix for the FSL PAMU driver * tag 'iommu-fixes-v3.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/fsl: Fix warning resulting from adding PCI device twice iommu/arm-smmu: fix corner cases in address size calculations iommu/arm-smmu: fix decimal printf format specifiers prefixed with 0x iommu/arm-smmu: Do not access non-existing S2CR registers iommu/arm-smmu: fix s2cr and smr teardown on device detach from domain iommu/arm-smmu: remove pgtable_page_{c,d}tor() iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1 iommu/arm-smmu: avoid calling request_irq in atomic context iommu/vt-d: Check return value of acpi_bus_get_device() iommu/core: Make iommu_group_get_for_dev() more robust
2014-09-12Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull assoc array garbage collection fix from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: KEYS: Fix termination condition in assoc array garbage collection
2014-09-12Merge tag 'fbdev-fixes-3.17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: "Minor fixes for amba-clcd and video DT bindings" * tag 'fbdev-fixes-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: video: ARM CLCD: Fix color model capabilities for DT platforms video: fix composite video connector compatible string
2014-09-12Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "AST, i915, radeon and msm fixes, all over the place. All fixing build issues, regressions, oopses or failure to detect cards" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/ast: AST2000 cannot be detected correctly drm/ast: open key before detect chips drm/msm: don't crash if no msm.vram param drm/msm/hdmi: fix build break on non-CCF platforms drm/msm: Change nested function to static function drm/radeon/dpm: set the thermal type properly for special configs drm/radeon: reduce memory footprint for debugging drm/radeon: add connector quirk for fujitsu board drm/radeon: fix semaphore value init drm/radeon: only use me/pfp sync on evergreen+ drm/i915: Wait for vblank before enabling the TV encoder drm/i915: Evict CS TLBs between batches drm/i915: Fix irq enable tracking in driver load drm/i915: Fix EIO/wedged handling in gem fault handler drm/i915: Prevent recursive deadlock on releasing a busy userptr
2014-09-12drm: use c99 initializers in structuresJulia Lawall
Use c99 initializers for structures. Drop 0 initializers in drivers/gpu/drm/sti/sti_vtac.c. A 0x0 initializer is left in vtac_mode_aux in drivers/gpu/drm/sti/sti_vtac.c to highlight the relation to vtac_mode_main. A simplified version of the semantic match that finds the first problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @decl@ identifier i1,fld; type T; field list[n] fs; @@ struct i1 { fs T fld; ...}; @bad@ identifier decl.i1,i2; expression e; initializer list[decl.n] is; @@ struct i1 i2 = { is, + .fld = e - e ,...}; // </smpl> v2: Drop 0 initializers and add trailing commas at the suggestions of Josh Triplett. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: fix drm_modeset_lock.h kernel-doc notationRandy Dunlap
Fix drm kernel-doc notation to squelch these warnings: Warning(..//include/drm/drm_modeset_lock.h:41): cannot understand function prototype: 'struct drm_modeset_acquire_ctx ' Warning(..//include/drm/drm_modeset_lock.h:66): cannot understand function prototype: 'struct drm_modeset_lock ' Need to include the keyword 'struct' for structure descriptions. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move DRM_MAGIC_HASH_ORDER into drm_drv.cDaniel Vetter
Only used in one place ever, so put it right next to that. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move drm_class to drm_internal.hDaniel Vetter
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move LOCK_TEST_WITH_RETURN to <drm/drm_legacy.h>Daniel Vetter
Unfortunately we can't move struct drm_lock_data easily since it's embedded into struct drm_master. And figuring out where exactly this struct should be allocated isn't that simple ... Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move legacy buffer structures to <drm/drm_legacy.h>Daniel Vetter
A few odd cases: - mgag200 someho had a totally unused drm_dma_handle_t. Remove it. - i915 still uses the legacy pci dma alloc api, so grows an include. Everything else fairly standard. v2: Include "drm_legacy.h" in drm.ko source files for consistency. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move drm_memory.c map support declarations to <drm/drm_legacy.h>Daniel Vetter
And replace the drm_core_ prefix with drm_legacy_ since really, this isn't core stuff. Also drop drm_core_dropmap since it's unused. v2: Fix up i810.ko fully which somehow slipped through. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Purge ioctl forward declarations from drmP.hDaniel Vetter
If we push down the ioctl table in drm_ioctl.c all the forward declarations in drmP.h are not required any more. v2: Fold in fixup from Fenugguang Wu to declare functions as static. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12KEYS: Fix termination condition in assoc array garbage collectionDavid Howells
This fixes CVE-2014-3631. It is possible for an associative array to end up with a shortcut node at the root of the tree if there are more than fan-out leaves in the tree, but they all crowd into the same slot in the lowest level (ie. they all have the same first nibble of their index keys). When assoc_array_gc() returns back up the tree after scanning some leaves, it can fall off of the root and crash because it assumes that the back pointer from a shortcut (after label ascend_old_tree) must point to a normal node - which isn't true of a shortcut node at the root. Should we find we're ascending rootwards over a shortcut, we should check to see if the backpointer is zero - and if it is, we have completed the scan. This particular bug cannot occur if the root node is not a shortcut - ie. if you have fewer than 17 keys in a keyring or if you have at least two keys that sit into separate slots (eg. a keyring and a non keyring). This can be reproduced by: ring=`keyctl newring bar @s` for ((i=1; i<=18; i++)); do last_key=`keyctl newring foo$i $ring`; done keyctl timeout $last_key 2 Doing this: echo 3 >/proc/sys/kernel/keys/gc_delay first will speed things up. If we do fall off of the top of the tree, we get the following oops: BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540 PGD dae15067 PUD cfc24067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: xt_nat xt_mark nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_ni CPU: 0 PID: 26011 Comm: kworker/0:1 Not tainted 3.14.9-200.fc20.x86_64 #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: events key_garbage_collector task: ffff8800918bd580 ti: ffff8800aac14000 task.ti: ffff8800aac14000 RIP: 0010:[<ffffffff8136cea7>] [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540 RSP: 0018:ffff8800aac15d40 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8800aaecacc0 RDX: ffff8800daecf440 RSI: 0000000000000001 RDI: ffff8800aadc2bc0 RBP: ffff8800aac15da8 R08: 0000000000000001 R09: 0000000000000003 R10: ffffffff8136ccc7 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000070 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000018 CR3: 00000000db10d000 CR4: 00000000000006f0 Stack: ffff8800aac15d50 0000000000000011 ffff8800aac15db8 ffffffff812e2a70 ffff880091a00600 0000000000000000 ffff8800aadc2bc3 00000000cd42c987 ffff88003702df20 ffff88003702dfa0 0000000053b65c09 ffff8800aac15fd8 Call Trace: [<ffffffff812e2a70>] ? keyring_detect_cycle_iterator+0x30/0x30 [<ffffffff812e3e75>] keyring_gc+0x75/0x80 [<ffffffff812e1424>] key_garbage_collector+0x154/0x3c0 [<ffffffff810a67b6>] process_one_work+0x176/0x430 [<ffffffff810a744b>] worker_thread+0x11b/0x3a0 [<ffffffff810a7330>] ? rescuer_thread+0x3b0/0x3b0 [<ffffffff810ae1a8>] kthread+0xd8/0xf0 [<ffffffff810ae0d0>] ? insert_kthread_work+0x40/0x40 [<ffffffff816ffb7c>] ret_from_fork+0x7c/0xb0 [<ffffffff810ae0d0>] ? insert_kthread_work+0x40/0x40 Code: 08 4c 8b 22 0f 84 bf 00 00 00 41 83 c7 01 49 83 e4 fc 41 83 ff 0f 4c 89 65 c0 0f 8f 5a fe ff ff 48 8b 45 c0 4d 63 cf 49 83 c1 02 <4e> 8b 34 c8 4d 85 f6 0f 84 be 00 00 00 41 f6 c6 01 0f 84 92 RIP [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540 RSP <ffff8800aac15d40> CR2: 0000000000000018 ---[ end trace 1129028a088c0cbd ]--- Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Don Zickus <dzickus@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2014-09-12drm: unexport drm_global_mutexDaniel Vetter
Drivers really, really have no business even looking at this lock. And thankfully they don't. So unexport it and move the declaration to drm_internal.h. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move piles of functions from drmP.h to drm_internal.hDaniel Vetter
This way drivers can't grow crazy ideas any more, and it also helps a bit in reviewing EXPORT_SYMBOLS. v2: Even more stuff. Unfortunately we can't move drm_vm_open_locked because exynos does some horrible stuff with it. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move vblank related module options into drm_irq.cDaniel Vetter
This allows us to drop 2 header declarations from drmP.h. The 3rd one is also used in drm_ioctl.c, so for that create a new drm_internal.h header for non-legacy non-kms (since we have internal headers for those parts already) declarations private to drm.ko. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Drop drm_sysfs_class from drmP.hDaniel Vetter
No user at all. My guess is that this is a leftover from ttm before it used the more abstract helpers to register/unregister its sysfs objects (see drm_sysfs.h). At least in the existing history it was never used. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move __drm_pci_free to drm_legacy.hDaniel Vetter
Also sprinkle the customary legacy_ prefix. Unfortunately we can't move the other functions since i915 is still using them. Shame on me for that one :( v2: Fix patch subject as spotted by David Herrmann. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Create drm legacy driver headerDaniel Vetter
And move a few legayc functions to start things over there. It compiles ... Inspired by a patch from Dave Airlie, but with a split between drm.ko private legacy functions and stuff used by drivers. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move drm_legacy_vma_flush into drm_legacy.hDaniel Vetter
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
2014-09-12drm: Move sg functions into drm_legacy.hDaniel Vetter
Also sprinkle the drm_legacy_ prefix where missing. v2: Drop extern from function declarations and include "drm_legacy.h" in drm_scatter.c, spotted by David. Cc: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12drm: Move dma functions into drm_legacy.hDaniel Vetter
Also drop the unneeded EXPORT_SYMBOL and sprinkle drm_legacy_ prefixes where missing. v2: Drop the confusing _core_ and drop extern, both suggested by David. Cc: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-09-12Merge tag 'topic/vblank-rework-2014-09-12' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-next So updated vblank-rework pull request, now with the polish that Mario requested applied (and reviewed by him). Also with backmerge like you've requested for easier merging. The neat thing this finally allows is to immediately disable the vblank interrupt on the last drm_vblank_put if the hardware has perfectly accurate vblank counter and timestamp readout support. On i915 that required piles of small adjustements from Ville since depending upon the platform and port the vblank happens at different scanout lines. Of course this is fully opt-in and per-device (we need that since gen2 doesn't have a hw vblank counter). * tag 'topic/vblank-rework-2014-09-12' of git://anongit.freedesktop.org/drm-intel: (22 commits) drm: Clarify vblank ts/scanoutpos sampling #defines drm: Simplify return value of drm_get_last_vbltimestamp drm: Only update final vblank count when precise ts is available drm: Really never disable vblank irqs for offdelay==0 drm: Use vblank_disable_and_save in drm_vblank_cleanup() drm: Remove drm_vblank_cleanup from drm_vblank_init error path. drm: Store the vblank timestamp when adjusting the counter during disable drm: Fix confusing debug message in drm_update_vblank_count() drm/i915: Update scanline_offset only for active crtcs drm: Kick start vblank interrupts at drm_vblank_on() drm/i915: Opt out of vblank disable timer on >gen2 drm: Add dev->vblank_disable_immediate flag drm: Disable vblank interrupt immediately when drm_vblank_offdelay<0 drm: Fix race between drm_vblank_off() and drm_queue_vblank_event() drm: Fix deadlock between event_lock and vbl_lock/vblank_time_lock drm: Reduce the amount of dev->vblank[crtc] in the code drm: Avoid random vblank counter jumps if the hardware counter has been reset drm: Have the vblank counter account for the time between vblank irq disable and drm_vblank_off() drm: Move drm_update_vblank_count() drm: Don't clear vblank timestamps when vblank interrupt is disabled ...
2014-09-12video: ARM CLCD: Fix color model capabilities for DT platformsPawel Moll
The DT-based panel capabilities selection was picking up a subset of available modes based on hardware configuration. This was wrong, as the capabilities describe available memory models and adapt the display controller to them that the RGB output is wired up correctly (as in: R and B components are not swapped). This patch fixes it by removing the unnecessary limitation. Signed-off-by: Pawel Moll <pawel.moll@arm.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-09-12drm/ast: switch to using CACHED by default for sysramDave Airlie
This fixes problems on ppc64 platforms, where we could end up using a WC mapping for migrating BOs with memcpy, when really we want to use cached memory. Tested-by: Ben Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-09-12drm: split ati_pcigart.h out of drmP.hDave Airlie
Just move this into a separate header file, and make the two users use it. Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-09-12Merge branch 'drm-next-3.18' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-next concurrent buffer reads. * 'drm-next-3.18' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: allow concurrent buffer reads drm/radeon: add the infrastructure for concurrent buffer access drm/ttm: allow fence to be added as shared
2014-09-12drm/vmwgfx: Fix drm.h includeJosh Boyer
The userspace drm.h include doesn't prefix the drm directory. This can lead to compile failures as /usr/include/drm/ isn't in the standard gcc include paths. Fix it to be <drm/drm.h>, which matches the rest of the driver drm header files that get installed into /usr/include/drm. Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1138759 Fixes: 1d7a5cbf8f74e Reported-by: Jeffrey Bastian <jbastian@redhat.com> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-09-12drm/ast: AST2000 cannot be detected correctlyY.C. Chen
Type error and cause AST2000 cannot be detected correctly Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com> Reviewed-by: Egbert Eich <eich@suse.de> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-09-12drm/ast: open key before detect chipsY.C. Chen
Some config settings like 3rd TX chips will not get correctly if the extended reg is protected Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com> Reviewed-by: Egbert Eich <eich@suse.de> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-09-11Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "The main thing here is a set of three patches that fix a buffer overrun for large authentication tickets (sigh). There is also a trivial warning fix and an error path fix that are both regressions" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: libceph: do not hard code max auth ticket len libceph: add process_one_ticket() helper libceph: gracefully handle large reply messages from the mon rbd: fix error return code in rbd_dev_device_setup() rbd: avoid format-security warning inside alloc_workqueue()
2014-09-11Merge tag 'stable/for-linus-3.17-b-rc4-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull Xen bug fixes from David Vrabel: - fix for PVHVM suspend/resume and migration - don't pointlessly retry certain ballooning ops - fix gntalloc when grefs have run out. - fix PV boot if KSALR is enable or very large modules are used. * tag 'stable/for-linus-3.17-b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: don't copy bogus duplicate entries into kernel page tables xen/gntalloc: safely delete grefs in add_grefs() undo path xen/gntalloc: fix oops after runnning out of grant refs xen/balloon: cancel ballooning if adding new memory failed xen/manage: Always freeze/thaw processes when suspend/resuming