commit fa253b2c80b4eb25785e98541842996cbd36ef83 Author: Greg Kroah-Hartman Date: Wed May 13 05:14:53 2015 -0700 Linux 4.0.3 commit 68b0aa6b3998439c60ad47d2dae15fb039970802 Author: K. Y. Srinivasan Date: Thu Mar 19 08:11:34 2015 -0700 Drivers: hv: vmbus: Don't wait after requesting offers commit 73cffdb65e679b98893f484063462c045adcf212 upstream. Don't wait after sending request for offers to the host. This wait is unnecessary and simply adds 5 seconds to the boot time. Signed-off-by: K. Y. Srinivasan Cc: Signed-off-by: Greg Kroah-Hartman commit 2e15dca25908efb782320658fdd741fd9e04adc2 Author: Thomas Hebb Date: Thu Apr 16 12:47:18 2015 -0700 hfsplus: don't store special "osx" xattr prefix on-disk commit db579e76f06e78de011b2cb7e028740a82f5558c upstream. On Mac OS X, HFS+ extended attributes are not namespaced. Since we want to be compatible with OS X filesystems and yet still support the Linux namespacing system, the hfsplus driver implements a special "osx" namespace that is reported for any attribute that is not namespaced on-disk. However, the current code for getting and setting these unprefixed attributes is broken. hfsplus_osx_setattr() and hfsplus_osx_getattr() are passed names that have already had their "osx." prefixes stripped by the generic functions. The functions first, quite correctly, check those names to make sure that they aren't prefixed with a known namespace, which would allow namespace access restrictions to be bypassed. However, the functions then prepend "osx." to the name they're given before passing it on to hfsplus_getattr() and hfsplus_setattr(). Not only does this cause the "osx." prefix to be stored on-disk, defeating its purpose, it also breaks the check for the special "com.apple.FinderInfo" attribute, which is reported for all files, and as a consequence makes some userspace applications (e.g. GNU patch) fail even when extended attributes are not otherwise in use. There are five commits which have touched this particular code: 127e5f5ae51e ("hfsplus: rework functionality of getting, setting and deleting of extended attributes") b168fff72109 ("hfsplus: use xattr handlers for removexattr") bf29e886b242 ("hfsplus: correct usage of HFSPLUS_ATTR_MAX_STRLEN for non-English attributes") fcacbd95e121 ("fs/hfsplus: move xattr_name allocation in hfsplus_getxattr()") ec1bbd346f18 ("fs/hfsplus: move xattr_name allocation in hfsplus_setxattr()") The first commit creates the functions to begin with. The namespace is prepended by the original code, which I believe was correct at the time, since hfsplus_?etattr() stripped the prefix if found. The second commit removes this behavior from hfsplus_?etattr() and appears to have been intended to also remove the prefixing from hfsplus_osx_?etattr(). However, what it actually does is remove a necessary strncpy() call completely, breaking the osx namespace entirely. The third commit re-adds the strncpy() call as it was originally, but doesn't mention it in its commit message. The final two commits refactor the code and don't affect its functionality. This commit does what b168fff attempted to do (prevent the prefix from being added), but does it properly, instead of passing in an empty buffer (which is what b168fff actually did). Fixes: b168fff72109 ("hfsplus: use xattr handlers for removexattr") Signed-off-by: Thomas Hebb Cc: Hin-Tak Leung Cc: Sergei Antonov Cc: Anton Altaparmakov Cc: Fabian Frederick Cc: Christian Kujau Cc: Christoph Hellwig Cc: Al Viro Cc: Viacheslav Dubeyko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Thomas Hebb Signed-off-by: Greg Kroah-Hartman commit e8ade718d9cfc32056ec78215b047aa764995b85 Author: Christian König Date: Mon Apr 27 17:04:36 2015 +0200 drm/radeon: check new address before removing old one commit c29c0876ec05d51a93508a39b90b92c29ba6423d upstream. Otherwise the change isn't atomic. Signed-off-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit e488a25194bbbb0e4e472cf30932db3e467dc3a9 Author: Christian König Date: Mon Apr 27 17:04:35 2015 +0200 drm/radeon: reset BOs address after clearing it. commit 48afbd70ac7b6aa62e8d452091023941d8085f8a upstream. Otherwise it is possible that we will have page table corruption if we change a BOs address multiple times. Signed-off-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 01c74f735d649f061287190a289bbbee000bd2a2 Author: Christian König Date: Mon Apr 27 17:04:34 2015 +0200 drm/radeon: fix lockup when BOs aren't part of the VM on release commit 26d4d129b6042197b4cbc8341c0618f99231af2f upstream. If we unmap BOs before releasing them them the intervall tree locks up because we try to remove an entry not inside the tree. Based on a patch from Michel Dänzer. Signed-off-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 621f855f262c9a0bb366c64068c87bd6b90c4833 Author: Alex Deucher Date: Mon Apr 27 09:51:43 2015 -0400 drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5 commit cd17e02ff4db58ec32d35cf331c705d295779930 upstream. Seems to have problems with high mclks. bug: https://bugs.freedesktop.org/show_bug.cgi?id=76490 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit d5c3b64b9618214a5443c57c64511ab5fa599cec Author: Alex Deucher Date: Sun Apr 19 12:01:00 2015 -0400 drm/radeon: adjust pll when audio is not enabled commit 7fe04d6fa824ccea704535a597dc417c8687f990 upstream. Fixes display problems with some monitors when audio is not enabled. Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89505 https://bugzilla.kernel.org/show_bug.cgi?id=94171 Plus several reports on IRC. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 125ebdda23c3d9d4473e8b2591bc0fdaec931daa Author: Michel Dänzer Date: Thu Apr 16 11:17:27 2015 +0900 drm/radeon: Use drm_calloc_ab for CS relocs commit b421ed15d2c3039eb724680e4de1e4b2bd196a9a upstream. The number of relocs is passed in by userspace and can be large. It has been observed to cause kcalloc failures in the wild. Reviewed-by: Christian König Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 3020ad2c93aa8ba98b0b7dbbad997500308400e6 Author: Alex Deucher Date: Tue Apr 7 10:20:49 2015 -0400 drm/radeon: only enable audio streams if the monitor supports it commit 38aef1549b18539eaecd804383a6ccb6588a9ce1 upstream. Selectively enable which packets we send based on monitor caps. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 016a255b7835ee7e49a3eba3c14ba0bc0221a4f8 Author: Alex Deucher Date: Tue Apr 7 09:52:42 2015 -0400 drm/radeon: only mark audio as connected if the monitor supports it (v3) commit 0f55db36d49d45b80eff0c0a2a498766016f458b upstream. Otherwise the driver may try and send audio which may confuse the monitor. v2: set pin to NULL if no audio v3: avoid crash with analog encoders Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 29bf371b4aa8f45013427bbe1fdb5f75ffe5953d Author: Alex Deucher Date: Tue Mar 31 11:43:12 2015 -0400 drm/radeon/audio: don't enable packets until the end commit 362ff251390f3d1f8fe94666f4fc4e5876381114 upstream. Don't enable the audio and avi infoframes and audio stream until all the state is set up. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 3bf0211e685a88b924c75333dc25e55c4c819ee1 Author: Alex Deucher Date: Tue Mar 31 11:38:48 2015 -0400 drm/radeon: drop dce6_dp_enable commit 12428327bbd1180b5d8ef83fdf9482b878d0502a upstream. It's mostly duplicated with evergreen_dp_enable. This is a prerequisite for fix implemented in another patch. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit a93368559fa795c69cbcc066ae94810736307fff Author: Alex Deucher Date: Tue Mar 31 10:33:05 2015 -0400 drm/radeon: fix ordering of AVI packet setup commit 304f07e9c8d302cf3183248cbabb40598eb5b732 upstream. Set the line first, then enable the stream. May fix pink line problems on some displays. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 1c6653fd6462e2b0862ca26e5cf358f416594547 Author: Christoph Hellwig Date: Thu Apr 23 09:48:49 2015 +0200 3w-sas: fix command completion race commit 579d69bc1fd56d5af5761969aa529d1d1c188300 upstream. The 3w-sas driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index. Signed-off-by: Christoph Hellwig Reported-by: Torsten Luettgert Tested-by: Bernd Kardatzki Acked-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 457eb9e105684d84b74df66c6365321af1907586 Author: Christoph Hellwig Date: Thu Apr 23 09:48:51 2015 +0200 3w-9xxx: fix command completion race commit 118c855b5623f3e2e6204f02623d88c09e0c34de upstream. The 3w-9xxx driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index. Signed-off-by: Christoph Hellwig Acked-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 65dabc13bb2707d7a04be0b6ed031442f7b18a87 Author: Christoph Hellwig Date: Thu Apr 23 09:48:50 2015 +0200 3w-xxxx: fix command completion race commit 9cd9554615cba14f0877cc9972a6537ad2bdde61 upstream. The 3w-xxxx driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index. Signed-off-by: Christoph Hellwig Acked-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit df22bc3a3c1acd21baf018ce8405094df306e46f Author: Mike Christie Date: Mon Apr 20 22:42:24 2015 -0500 SCSI: add 1024 max sectors black list flag commit 35e9a9f93994d7f7d12afa41169c7ba05513721b upstream. This works around a issue with qnap iscsi targets not handling large IOs very well. The target returns: VPD INQUIRY: Block limits page (SBC) Maximum compare and write length: 1 blocks Optimal transfer length granularity: 1 blocks Maximum transfer length: 4294967295 blocks Optimal transfer length: 4294967295 blocks Maximum prefetch, xdread, xdwrite transfer length: 0 blocks Maximum unmap LBA count: 8388607 Maximum unmap block descriptor count: 1 Optimal unmap granularity: 16383 Unmap granularity alignment valid: 0 Unmap granularity alignment: 0 Maximum write same length: 0xffffffff blocks Maximum atomic transfer length: 0 Atomic alignment: 0 Atomic transfer length granularity: 0 and it is *sometimes* able to handle at least one IO of size up to 8 MB. We have seen in traces where it will sometimes work, but other times it looks like it fails and it looks like it returns failures if we send multiple large IOs sometimes. Also it looks like it can return 2 different errors. It will sometimes send iscsi reject errors indicating out of resources or it will send invalid cdb illegal requests check conditions. And then when it sends iscsi rejects it does not seem to handle retries when there are command sequence holes, so I could not just add code to try and gracefully handle that error code. The problem is that we do not have a good contact for the company, so we are not able to determine under what conditions it returns which error and why it sometimes works. So, this patch just adds a new black list flag to set targets like this to the old max safe sectors of 1024. The max_hw_sectors changes added in 3.19 caused this regression, so I also ccing stable. Reported-by: Christian Hesse Signed-off-by: Mike Christie Reviewed-by: Christoph Hellwig Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 1754083fb992e955ef22fc07de639a41a5ca3c7a Author: Davide Italiano Date: Sat May 2 23:21:15 2015 -0400 ext4: move check under lock scope to close a race. commit 280227a75b56ab5d35854f3a77ef74a7ad56a203 upstream. fallocate() checks that the file is extent-based and returns EOPNOTSUPP in case is not. Other tasks can convert from and to indirect and extent so it's safe to check only after grabbing the inode mutex. Signed-off-by: Davide Italiano Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman commit ce879f96b58445d098969a1b329deae67b61d514 Author: Lukas Czerner Date: Sat May 2 21:36:55 2015 -0400 ext4: fix data corruption caused by unwritten and delayed extents commit d2dc317d564a46dfc683978a2e5a4f91434e9711 upstream. Currently it is possible to lose whole file system block worth of data when we hit the specific interaction with unwritten and delayed extents in status extent tree. The problem is that when we insert delayed extent into extent status tree the only way to get rid of it is when we write out delayed buffer. However there is a limitation in the extent status tree implementation so that when inserting unwritten extent should there be even a single delayed block the whole unwritten extent would be marked as delayed. At this point, there is no way to get rid of the delayed extents, because there are no delayed buffers to write out. So when a we write into said unwritten extent we will convert it to written, but it still remains delayed. When we try to write into that block later ext4_da_map_blocks() will set the buffer new and delayed and map it to invalid block which causes the rest of the block to be zeroed loosing already written data. For now we can fix this by simply not allowing to set delayed status on written extent in the extent status tree. Also add WARN_ON() to make sure that we notice if this happens in the future. This problem can be easily reproduced by running the following xfs_io. xfs_io -f -c "pwrite -S 0xaa 4096 2048" \ -c "falloc 0 131072" \ -c "pwrite -S 0xbb 65536 2048" \ -c "fsync" /mnt/test/fff echo 3 > /proc/sys/vm/drop_caches xfs_io -c "pwrite -S 0xdd 67584 2048" /mnt/test/fff This can be theoretically also reproduced by at random by running fsx, but it's not very reliable, though on machines with bigger page size (like ppc) this can be seen more often (especially xfstest generic/127) Signed-off-by: Lukas Czerner Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman commit ae28c480a79f6aa10d1286cdf4b7982f1cadf6c0 Author: Hans de Goede Date: Tue Apr 21 11:20:32 2015 +0200 uas: Set max_sectors_240 quirk for ASM1053 devices commit 8e779c6c4a398763c21371fe40f649206041dc1e upstream. Testing has shown that ASM1053 devices do not work properly with transfers larger than 240 sectors, so set max_sectors to 240 on these. Reported-by: Steve Bangert Signed-off-by: Hans de Goede Tested-by: Steve Bangert Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit f59aa94d0049794968867d843e5be50af2e7a470 Author: Hans de Goede Date: Tue Apr 21 11:20:31 2015 +0200 uas: Add US_FL_MAX_SECTORS_240 flag commit ee136af4a064c2f61e2025873584d2c7ec93f4ae upstream. The usb-storage driver sets max_sectors = 240 in its scsi-host template, for uas we do not want to do that for all devices, but testing has shown that some devices need it. This commit adds a US_FL_MAX_SECTORS_240 flag for such devices, and implements support for it in uas.c, while at it it also adds support for US_FL_MAX_SECTORS_64 to uas.c. Signed-off-by: Hans de Goede Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit f946179b11ff23653763870a801793383bb244b6 Author: Hans de Goede Date: Tue Apr 21 11:20:30 2015 +0200 uas: Allow uas_use_uas_driver to return usb-storage flags commit a5011d44f0e1117a6db14b19b57c51f8be5673a0 upstream. uas_use_uas_driver may set some US_FL_foo flags during detection, currently these are stored in a local variable and then throw away, but these may be of interest to the caller, so add an extra parameter to (optionally) return the detected flags, and use this in the uas driver. Signed-off-by: Hans de Goede Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 11748b94d987911b2c6aa9f2a5a2a24dc571fc2f Author: Ilya Dryomov Date: Sat Apr 25 15:56:15 2015 +0300 rbd: end I/O the entire obj_request on error commit 082a75dad84d79d1c15ea9e50f31cb4bb4fa7fd6 upstream. When we end I/O struct request with error, we need to pass obj_request->length as @nr_bytes so that the entire obj_request worth of bytes is completed. Otherwise block layer ends up confused and we trip on rbd_assert(more ^ (which == img_request->obj_request_count)); in rbd_img_obj_callback() due to more being true no matter what. We already do it in most cases but we are missing some, in particular those where we don't even get a chance to submit any obj_requests, due to an early -ENOMEM for example. A number of obj_request->xferred assignments seem to be redundant but I haven't touched any of obj_request->xferred stuff to keep this small and isolated. Cc: Alex Elder Reported-by: Shawn Edwards Reviewed-by: Sage Weil Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman commit 8aff8de536ecedc80b0171aa120cdd839d024add Author: Ludovic Desroches Date: Thu Apr 16 16:58:12 2015 +0200 tty/serial: at91: maxburst was missing for dma transfers commit a8d4e01637902311c5643b69a5c80e2805f04054 upstream. Maxburst was not set when doing the dma slave configuration. This value is checked by the recently introduced xdmac. It causes an error when doing the slave configuration and so prevents from using dma. Signed-off-by: Ludovic Desroches Acked-by: Nicolas Ferre Signed-off-by: Greg Kroah-Hartman commit bc9b5647bbf2c0818f729a87eeab983ba7714e84 Author: Chris Bainbridge Date: Wed Apr 22 16:40:21 2015 +0100 ACPI / SBS: Enable battery manager when present commit 61f8ff693923e4b19748b0e8287b99778f2661c7 upstream. Commit 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on Apple) introduced a regression disabling the SBS battery manager. The battery manager should be marked as present when acpi_manager_get_info() returns 0. Fixes: 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on Apple) Signed-off-by: Chris Bainbridge Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 8ab261bcddc4010cb395e659a58b67d854be7ede Author: Omar Sandoval Date: Fri Apr 10 14:20:40 2015 -0700 btrfs: unlock i_mutex after attempting to delete subvolume during send commit 909e26dce3f7600f5e293ac0522c28790a0c8c9c upstream. Whenever the check for a send in progress introduced in commit 521e0546c970 (btrfs: protect snapshots from deleting during send) is hit, we return without unlocking inode->i_mutex. This is easy to see with lockdep enabled: [ +0.000059] ================================================ [ +0.000028] [ BUG: lock held when returning to user space! ] [ +0.000029] 4.0.0-rc5-00096-g3c435c1 #93 Not tainted [ +0.000026] ------------------------------------------------ [ +0.000029] btrfs/211 is leaving the kernel with locks still held! [ +0.000029] 1 lock held by btrfs/211: [ +0.000023] #0: (&type->i_mutex_dir_key){+.+.+.}, at: [] btrfs_ioctl_snap_destroy+0x2df/0x7a0 Make sure we unlock it in the error path. Reviewed-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: Omar Sandoval Signed-off-by: Chris Mason Signed-off-by: Greg Kroah-Hartman commit bbc8c97c8e7fb76e07478e19e96a7fa6e7421bec Author: Bard Liao Date: Tue Apr 28 11:27:39 2015 +0800 ASoC: rt5677: fixed wrong DMIC ref clock commit 60a8d62b8497c23eb3d48149af7e55dac2dd83a2 upstream. DMIC clock source is not from codec system clock directly. it is generated from the division of system clock. And it should be 256 * sample rate of AIF1. Signed-off-by: Bard Liao Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 04f1f52606395df0bf8c9ce6198869803d2f45e9 Author: Charles Keepax Date: Wed Apr 22 13:58:47 2015 +0100 ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE commit a2d97723cb3a7741af81868427b36bba274b681b upstream. Correct small copy and paste error where autodisable was not being enabled for the SOC_DAPM_SINGLE_TLV_AUTODISABLE control. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit b6898f06f84ea6db7944c6c9f91ebeb13a18457b Author: Bard Liao Date: Fri Apr 24 15:19:29 2015 +0800 ASoC: rt5677: add register patch for PLL commit 74d6ea52aeef0236242221c6eff6d892565c5a92 upstream. The PLL output will be unstable in some cases. We can fix it by setting some registers. Signed-off-by: Bard Liao Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 99d705238af572efa5f8834d0d8255d5bdc5d6eb Author: Wei Yongjun Date: Thu Apr 16 20:17:46 2015 +0800 ASoC: tfa9879: Fix return value check in tfa9879_i2c_probe() commit 427ced4b203dfea4f08b1298cd1f88e19039fca4 upstream. In case of error, the function devm_kzalloc() returns NULL not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Signed-off-by: Wei Yongjun Acked-by: Peter Rosin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 9041f7e0f35402d0f2527ec952523e4086b83322 Author: Wei Yongjun Date: Thu Apr 16 20:18:02 2015 +0800 ASoC: samsung: s3c24xx-i2s: Fix return value check in s3c24xx_iis_dev_probe() commit c479163a1b6ab424786fbcd9225b4e3c1c58eb0b upstream. In case of error, the function devm_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun Reviewed-by: Krzysztof Kozlowski Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 1fe4f5a891aaec75cebb6e763557c8c694c6260f Author: Li Jun Date: Sun Apr 12 17:51:02 2015 +0800 usb: chipidea: otg: remove mutex unlock and lock while stop and start role commit a5a356cee89f86ff86cc3ce24136ca1f802c1bf1 upstream. Wrongly release mutex lock during otg_statemachine may result in re-enter otg_statemachine, which is not allowed, we should do next state transtition after previous one completed. Fixes: 826cfe751f3e ("usb: chipidea: add OTG fsm operation functions implementation") Signed-off-by: Li Jun Signed-off-by: Peter Chen Signed-off-by: Greg Kroah-Hartman commit 84b38028077d61c7058ede49ab7d115c563dc9ba Author: Dean Nelson Date: Wed Apr 29 16:09:18 2015 +0100 arm64: add missing PAGE_ALIGN() to __dma_free() commit 2cff98b99c469880ce830cbcde015b53b67e0a7b upstream. __dma_alloc() does a PAGE_ALIGN() on the passed in size argument before doing anything else. __dma_free() does not. And because it doesn't, it is possible to leak memory should size not be an integer multiple of PAGE_SIZE. The solution is to add a PAGE_ALIGN() to __dma_free() like is done in __dma_alloc(). Additionally, this patch removes a redundant PAGE_ALIGN() from __dma_alloc_coherent(), since __dma_alloc_coherent() can only be called from __dma_alloc(), which already does a PAGE_ALIGN() before the call. Acked-by: Catalin Marinas Signed-off-by: Dean Nelson Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman commit 41e45229f0a528a17ea7e36e9164b04fd071b751 Author: Marek Szyprowski Date: Thu Apr 23 12:46:16 2015 +0100 arm64: dma-mapping: always clear allocated buffers commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 upstream. Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha, ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures. It turned out that some drivers rely on this 'feature'. Allocated buffer might be also exposed to userspace with dma_mmap() call, so clearing it is desired from security point of view to avoid exposing random memory to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64 architecture with other implementations by unconditionally zeroing allocated buffer. Signed-off-by: Marek Szyprowski Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman commit 9b19c50bff3747129752fa7883cf9a8a7d9e96b2 Author: Michal Simek Date: Mon Apr 13 16:34:21 2015 +0200 serial: xilinx: Use platform_get_irq to get irq description structure commit 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed upstream. For systems with CONFIG_SERIAL_OF_PLATFORM=y and device_type = "serial"; property in DT of_serial.c driver maps and unmaps IRQ (because driver probe fails). Then a driver is called but irq mapping is not created that's why driver is failing again in again on request_irq(). Based on this use platform_get_irq() instead of platform_get_resource() which is doing irq_desc allocation and driver itself can request IRQ. Fix both xilinx serial drivers in the tree. Signed-off-by: Michal Simek Signed-off-by: Greg Kroah-Hartman commit 7128fcca1ba0f1598504627f8426ea8568be7ed6 Author: Michal Simek Date: Tue Apr 14 12:03:09 2015 +0200 serial: of-serial: Remove device_type = "serial" registration commit 6befa9d883385c580369a2cc9e53fbf329771f6d upstream. Do not probe all serial drivers by of_serial.c which are using device_type = "serial"; property. Only drivers which have valid compatible strings listed in the driver should be probed. When PORT_UNKNOWN is setup probe will fail anyway. Arnd quotation about driver historical background: "when I wrote that driver initially, the idea was that it would get used as a stub to hook up all other serial drivers but after that, the common code learned to create platform devices from DT" This patch fix the problem with on the system with xilinx_uartps and 16550a where of_serial failed to register for xilinx_uartps and because of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking for irq with request_irq() EINVAL is returned. Signed-off-by: Michal Simek Acked-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman commit 612e47f0f62e163b1cccc23f935b8200bbe87c74 Author: Quentin Casasnovas Date: Tue Apr 14 11:25:43 2015 +0200 cdc-acm: prevent infinite loop when parsing CDC headers. commit 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e upstream. Phil and I found out a problem with commit: 7e860a6e7aa6 ("cdc-acm: add sanity checks") It added some sanity checks to ignore potential garbage in CDC headers but also introduced a potential infinite loop. This can happen at the first loop iteration (elength = 0 in that case) if the description isn't a DT_CS_INTERFACE or later if 'buffer[0]' is zero. It should also be noted that the wrong length was being added to 'buffer' in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was assigned after that check in the loop. A specially crafted USB device could be used to trigger this infinite loop. Fixes: 7e860a6e7aa6 ("cdc-acm: add sanity checks") Signed-off-by: Phil Turnbull Signed-off-by: Quentin Casasnovas CC: Sergei Shtylyov CC: Oliver Neukum CC: Adam Lee Signed-off-by: Greg Kroah-Hartman commit 950cc6975a335370c01c2404c55375f5580fde8f Author: Takashi Iwai Date: Mon Apr 27 10:40:45 2015 +0200 ALSA: hda - Add mute-LED mode control to Thinkpad commit 7290006d8c0900c56d8c58428134f02c35109d17 upstream. This patch adds the missing flag to enable "Mute-LED Mode" mixer enum ctl for Thinkpads that have also the software mute-LED control. Reported-and-tested-by: Pali Rohár Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 53e5604bbe12fddc549d837190409f25ecb1393a Author: Takashi Iwai Date: Mon Apr 27 10:36:11 2015 +0200 ALSA: hda - Fix mute-LED fixed mode commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream. The mute-LED mode control has the fixed on/off states that are supposed to remain on/off regardless of the master switch. However, this doesn't work actually because the vmaster hook is called in the vmaster code itself. This patch fixes it by calling the hook indirectly after checking the mute LED mode. Reported-and-tested-by: Pali Rohár Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0feb7f1ffb2a7e68a66398edfc913fac275c08ef Author: Peter Zubaj Date: Tue Apr 28 21:57:29 2015 +0200 ALSA: emu10k1: Emu10k2 32 bit DMA mode commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream. Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two modes for DMA. Second mode is useful for 64 bit os with more then 2 GB of ram (fixes problems with big soundfont loading) 1) 32MB from 2 GB address space using 8192 pages (used now as default) 2) 16MB from 4 GB address space using 4096 pages Mode is set using HCFG_EXPANDED_MEM flag in HCFG register. Also format of emu10k2 page table is then different. Signed-off-by: Peter Zubaj Tested-by: Takashi Iwai Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ef7d6d70e1ad3c235e6d33000178c2aab9d3355f Author: Takashi Iwai Date: Mon Apr 27 13:00:09 2015 +0200 ALSA: emu10k1: Fix card shortname string buffer overflow commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream. Some models provide too long string for the shortname that has 32bytes including the terminator, and it results in a non-terminated string exposed to the user-space. This isn't too critical, though, as the string is stopped at the succeeding longname string. This patch fixes such entries by dropping "SB" prefix (it's enough to fit within 32 bytes, so far). Meanwhile, it also changes strcpy() with strlcpy() to make sure that this kind of problem won't happen in future, too. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0592aec34f12afc5f0e1676bdd6b238aa2f0ef71 Author: Takashi Iwai Date: Tue Apr 28 17:11:44 2015 +0200 ALSA: emux: Fix mutex deadlock in OSS emulation commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream. The OSS emulation in synth-emux helper has a potential AB/BA deadlock at the simultaneous closing and opening: close -> snd_seq_release() -> sne_seq_free_client() -> snd_seq_delete_all_ports(): takes client->ports_mutex -> port_delete() -> snd_emux_unuse(): takes emux->register_mutex open -> snd_seq_oss_open() -> snd_emux_open_seq_oss(): takes emux->register_mutex -> snd_seq_event_port_attach() -> snd_seq_create_port(): takes client->ports_mutex This patch addresses the deadlock by reducing the rance taking emux->register_mutex in snd_emux_open_seq_oss(). The lock is needed for the refcount handling, so move it locally. The calls in emux_seq.c are already with the mutex, thus they are replaced with the version without mutex lock/unlock. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 7327ee488670217fdf31787fe03ebbafd96b796e Author: Takashi Iwai Date: Mon Apr 27 14:50:39 2015 +0200 ALSA: emux: Fix mutex deadlock at unloading commit 07b0e5d49d227e3950cb13a3e8caf248ef2a310e upstream. The emux-synth driver has a possible AB/BA mutex deadlock at unloading the emu10k1 driver: snd_emux_free() -> snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) -> snd_seq_delete_kernel_client() -> snd_seq_free_client(): mutex_lock(®ister_mutex) snd_seq_release() -> snd_seq_free_client(): mutex_lock(®ister_mutex) -> snd_seq_delete_all_ports() -> snd_emux_unuse(): mutex_lock(&emu->register_mutex) Basically snd_emux_detach_seq() doesn't need a protection of emu->register_mutex as it's already being unregistered. So, we can get rid of this for avoiding the deadlock. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit cf30fb9b72fbf301f397d6cbdc28ac69686e4798 Author: Markos Chandras Date: Thu Apr 2 14:42:52 2015 +0100 MIPS: Makefile: Fix MIPS ASE detection code Commit 5306a5450824691e27d68f711758515debedeeac upstream. Commit 32098ec7bcba ("MIPS: Makefile: Move the ASEs checks after setting the core's CFLAGS") re-arranged the MIPS ASE detection code and also added the current cflags to the detection logic. However, this introduced a few bugs. First of all, the mips-cflags should not be quoted since that ends up being passed as a string to subsequent commands leading to broken detection from the cc-option-* tools. Moreover, in order to avoid duplicating the cflags-y because of how cc-option works, we rework the logic so we pass only those cflags which are needed by the selected ASE. Finally, fix some typos resulting in MSA not being detected correctly. Signed-off-by: Markos Chandras Fixes: Commit 32098ec7bcba ("MIPS: Makefile: Move the ASEs checks after setting the core's CFLAGS") Cc: Maciej W. Rozycki Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9661/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit ad6fac7f92dfbda856a6780b7e69138c3dce5a4b Author: Markos Chandras Date: Thu Feb 26 11:11:30 2015 +0000 MIPS: asm: elf: Set O32 default FPU flags Commit 48f8eaee3f59848809644507fc47363b37e54450 upstream. Set good default FPU flags (FR0) for O32 binaries similar to what the kernel does for the N64/N32 ones. This also fixes a regression introduced in commit 46490b572544 ("MIPS: kernel: elf: Improve the overall ABI and FPU mode checks") when MIPS_O32_FP64_SUPPORT is disabled. In that case, the mips_set_personality_fp() did not set the FPU mode at all because it assumed that the FPU mode was already set properly. That led to O32 userland problems. Signed-off-by: Markos Chandras Reported-by: Mans Rullgard Fixes: 46490b572544 ("MIPS: kernel: elf: Improve the overall ABI and FPU mode checks") Tested-by: Mans Rullgard Tested-by: Aaro Koskinen Cc: Matthew Fortune Cc: Paul Burton Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/9344/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 1935bb1a6db0f5fe9f0073d185e7e230a3bd927e Author: Rafał Miłecki Date: Wed Apr 1 16:01:02 2015 +0200 MIPS: BCM47XX: Fix detecting Microsoft MN-700 & Asus WL500G Commit 96f7c21363e0e0d19f3471f54a719ed06d708513 upstream. Since the day of adding this code it was broken. We were iterating over a wrong array and checking for wrong NVRAM entry. Signed-off-by: Rafał Miłecki Cc: linux-mips@linux-mips.org Cc: Hauke Mehrtens Patchwork: https://patchwork.linux-mips.org/patch/9654/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 54cca1007c3c0e6e6f2802ae9890f7d7c9cf9809 Author: Markos Chandras Date: Tue Nov 25 09:15:45 2014 +0000 MIPS: Kconfig: Disable SMP/CPS for 64-bit Commit 6ca716f2e5571d25a3899c6c5c91ff72ea6d6f5e upstream. A 64-bit build for Malta produces far too many build problems when SMP/CPS is selected. Moreover, there is currently no 64-bit product with SMP/CPS so we disable SMP/CPS when building for 64-bit until it is properly supported. Signed-off-by: Markos Chandras Cc: Paul Burton Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8573/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 5bd1f3713cd795cdd750b869f98674b40748ef92 Author: Niklas Cassel Date: Thu Jan 15 16:41:13 2015 +0100 MIPS: smp-cps: cpu_set FPU mask if FPU present Commit 90db024f140d0d6ad960cc5f090e3c8ed890ca55 upstream. If we have an FPU, enroll ourselves in the FPU-full mask. Matching the MT_SMP and CMP implementations of smp_setup. Signed-off-by: Niklas Cassel Cc: paul.burton@imgtec.com Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8948/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit b9b1a2af5a6aa82944f80c03152ddeecc86d91a8 Author: John Crispin Date: Mon Feb 23 06:17:33 2015 +0100 MIPS: ralink: add missing symbol for RALINK_ILL_ACC Commit a7b7aad383c5dd9221a06e378197350dd27c1163 upstream. A driver was added in commit 5433acd81e87 ("MIPS: ralink: add illegal access driver") without the Kconfig section being added. Fix this by adding the symbol to the Kconfig file. Signed-off-by: John Crispin Reported-by: Paul Bolle Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9299/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit b2243b7069f8d09f881a7d7a68aa46ef0794c49e Author: John Crispin Date: Mon Feb 23 06:17:32 2015 +0100 MIPS: ralink: Fix bad config symbol in PCI makefile. Commit 93a7de8819a661d06eb11f4de3d6888b9a842b30 upstream. A wrong symbol is referenced by commit 187c26ddf0b2 ("MIPS: ralink: add rt2880 pci driver"). Fix this by changing it to the correct symbol. Signed-off-by: John Crispin Reported-by: Paul Bolle Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9298/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit d0e3a82ab8f57ccceb175ca1e57449796ac97c04 Author: Adrien Schildknecht Date: Wed Mar 25 16:31:42 2015 +0100 SSB: fix Kconfig dependencies Commit 179fa46fb666c8f2aa2bbb1f3114d5d826d59d3d upstream. The commit 21400f252a97 ("MIPS: BCM47XX: Make ssb init NVRAM instead of bcm47xx polling it") introduces a dependency to SSB_SFLASH but did not add it to the Kconfig. drivers/ssb/driver_mipscore.c:216:36: error: 'struct ssb_mipscore' has no member named 'sflash' struct ssb_sflash *sflash = &mcore->sflash; ^ drivers/ssb/driver_mipscore.c:249:12: error: dereferencing pointer to incomplete type if (sflash->present) { ^ Signed-off-by: Adrien Schildknecht Cc: m@bues.ch Cc: zajec5@gmail.com Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/9598/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit d6e20b40aea718da033444bda27aedce16f124af Author: Ralf Baechle Date: Wed Mar 25 13:18:27 2015 +0100 Revert "MIPS: Avoid pipeline stalls on some MIPS32R2 cores." Commit 9eaffa84a8a46adab065c983401fc9d5949c958f upstream. For a discussion, see http://patchwork.linux-mips.org/patch/9539/. This reverts commit 625c0a21700bdb90844d926a1508a17a77e369c9. Signed-off-by: Greg Kroah-Hartman commit 52871e452e3814d87db2fd148de49e3db09c902c Author: Ralf Baechle Date: Wed Mar 25 13:21:51 2015 +0100 MIPS: Octeon: Delete override of cpu_has_mips_r2_exec_hazard. Commit f05ff43355e6997c18f82ddcee370a6e5f8643ce upstream. This is no longer needed with the fixed, new and improved definition of cpu_has_mips_r2_exec_hazard in . For a discussion, see http://patchwork.linux-mips.org/patch/9539/. Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit fb756fbe5affdb7984b8074aaa5fc98252dcff65 Author: Ralf Baechle Date: Wed Mar 25 13:14:16 2015 +0100 MIPS: Fix cpu_has_mips_r2_exec_hazard. Commit 9cdf30bd3bac697fc533988f44a117434a858f69 upstream. Returns a non-zero value if the current processor implementation requires an IHB instruction to deal with an instruction hazard as per MIPS R2 architecture specification, zero otherwise. For a discussion, see http://patchwork.linux-mips.org/patch/9539/. Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit cd2acc35751a7a88aa03b426e472dc0843b6404f Author: Markos Chandras Date: Tue Mar 3 18:48:49 2015 +0000 MIPS: kernel: entry.S: Set correct ISA level for mips_ihb Commit aebac99384f7a6d83a3dcd42bf2481eed2670083 upstream. Commit 6ebb496ffc7e("MIPS: kernel: entry.S: Add MIPS R6 related definitions") added the MIPSR6 definition but it did not update the ISA level of the actual assembly code so a pre-MIPSR6 jr.hb instruction was generated instead. Fix this by using the MISP_ISA_LEVEL_RAW macro. Signed-off-by: Markos Chandras Fixes: 6ebb496ffc7e("MIPS: kernel: entry.S: Add MIPS R6 related definitions") Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9386/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 44e6ee09bec252201891304cff339fb5bcfe4fc5 Author: Markos Chandras Date: Tue Mar 3 18:48:48 2015 +0000 MIPS: asm: spinlock: Fix addiu instruction for R10000_LLSC_WAR case Commit 518222161d4a2d3f3b2700098563b62383f83878 upstream. Commit 5753762cbd1c("MIPS: asm: spinlock: Replace "sub" instruction with "addiu") replaced the "sub" instruction with addiu but it did not update the immediate value in the R10000_LLSC_WAR case. Signed-off-by: Markos Chandras Fixes: 5753762cbd1c("MIPS: asm: spinlock: Replace "sub" instruction with "addiu"") Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9385/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit a521000f016321b61a2f610135cfbfa6166c79e1 Author: Markos Chandras Date: Tue Mar 3 18:48:47 2015 +0000 MIPS: r4kcache: Use correct base register for MIPS R6 cache flushes Commit f6b39ae6f4d6ee835bb16e452086121aa010f1a7 upstream. Commit 934c79231c1b("MIPS: asm: r4kcache: Add MIPS R6 cache unroll functions") added support for MIPS R6 cache flushes but it used the wrong base address register to perform the flushes so the same lines were flushed over and over. Moreover, replace the "addiu" instructions with LONG_ADDIU so the correct base address is calculated for 64-bit cores. Signed-off-by: Markos Chandras Fixes: 934c79231c1b("MIPS: asm: r4kcache: Add MIPS R6 cache unroll functions") Cc: linux-mips@linux-mips.org Reviewed-by: Maciej W. Rozycki Patchwork: https://patchwork.linux-mips.org/patch/9384/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 9f88c253c63b1755ffa7f239992ba4bd0b25cb8b Author: Markos Chandras Date: Tue Mar 10 12:30:56 2015 +0000 MIPS: Kconfig: Fix typo for the r2-to-r6 emulator kernel parameter Commit 07edf0d46c07568d08feee95bbaa38c71b084150 upstream. Commit b0a668fb2038 ("MIPS: kernel: mips-r2-to-r6-emul: Add R2 emulator for MIPS R6") added the mips r2-to-r6 emulator so an R2 userland can be executed on R6 kernels. This needed both build time and runtime support. The runtime support needed the "mipsr2emu" kernel parameter instead of the "mipsr2emul" listed in the Kconfig help message. Signed-off-by: Markos Chandras Fixes: b0a668fb2038 ("MIPS: kernel: mips-r2-to-r6-emul: Add R2 emulator for MIPS R6") Cc: linux-mips@linux-mips.org Cc: Markos Chandras Patchwork: https://patchwork.linux-mips.org/patch/9504/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 0fc7602c67ce7516066c670f16bf975ee10f9ea0 Author: Ganesan Ramalingam Date: Wed Jan 7 16:58:26 2015 +0530 MIPS: Netlogic: Fix for SATA PHY init Commit 872cd4c2c617bb3a203ebe18115fd0c697112b87 upstream. Update to the SATA PHY initialization. This is needed for SATA detection to succeed in all configurations. Signed-off-by: Ganesan Ramalingam Signed-off-by: Jayachandran C Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8886/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 86e0c1fc644db365c94350c90ebae3cbb2b6fba2 Author: Aaro Koskinen Date: Sun Mar 22 17:55:39 2015 +0200 MIPS: OCTEON: fix PCI interrupt mapping for D-Link DSR-1000N Commit b083518c52ab75a345d668ca7fa41e530df08d51 upstream. Fix PCI interrupt mapping for DSR1000N. This will get the PCI slot interrupts working. The mapping is based on D-Link GPL tarball. Signed-off-by: Aaro Koskinen Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9593/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit a77f685d0dfb58b193f56dc8d7b8d75c28eb13a5 Author: Alexander Sverdlin Date: Wed Mar 18 14:05:21 2015 +0100 MIPS: Octeon: Remove udelay() causing huge IRQ latency Commit 73bf3c2a500b2db8ac966469591196bf55afb409 upstream. udelay() in PCI/PCIe read/write callbacks cause 30ms IRQ latency on Octeon platforms because these operations are called from PCI_OP_READ() and PCI_OP_WRITE() under raw_spin_lock_irqsave(). Signed-off-by: Alexander Sverdlin Cc: linux-mips@linux-mips.org Cc: David Daney Cc: Rob Herring Cc: Jiri Kosina Cc: Randy Dunlap Cc: Masanari Iida Cc: Bjorn Helgaas Cc: Mathias Patchwork: https://patchwork.linux-mips.org/patch/9576/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 0e4fe74fd691b72bbc15c0b601073a18fa3b71ba Author: Lars Persson Date: Thu Feb 26 14:16:03 2015 +0100 MIPS: Fix race condition in lazy cache flushing. Commit 4d46a67a3eb827ccf1125959936fd51ba318dabc upstream. The lazy cache flushing implemented in the MIPS kernel suffers from a race condition that is exposed by do_set_pte() in mm/memory.c. A pre-condition is a file-system that writes to the page from the CPU in its readpage method and then calls flush_dcache_page(). One example is ubifs. Another pre-condition is that the dcache flush is postponed in __flush_dcache_page(). Upon a page fault for an executable mapping not existing in the page-cache, the following will happen: 1. Write to the page 2. flush_dcache_page 3. flush_icache_page 4. set_pte_at 5. update_mmu_cache (commits the flush of a dcache-dirty page) Between steps 4 and 5 another thread can hit the same page and it will encounter a valid pte. Because the data still is in the L1 dcache the CPU will fetch stale data from L2 into the icache and execute garbage. This fix moves the commit of the cache flush to step 3 to close the race window. It also reduces the amount of flushes on non-executable mappings because we never enter __flush_dcache_page() for non-aliasing CPUs. Regressions can occur in drivers that mistakenly relies on the flush_dcache_page() in get_user_pages() for DMA operations. [ralf@linux-mips.org: Folded in patch 9346 to fix highmem issue.] Signed-off-by: Lars Persson Cc: linux-mips@linux-mips.org Cc: paul.burton@imgtec.com Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/9346/ Patchwork: https://patchwork.linux-mips.org/patch/9738/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 82d1e92be93be323cf53c26664e00326827ffaf4 Author: Lars Persson Date: Thu Feb 26 14:16:02 2015 +0100 Revert "MIPS: Remove race window in page fault handling" Commit 5b9593f3bccb9904f260f9ad7f184e1d2921bd1e upstream. Revert commit 2a4a8b1e5d9d ("MIPS: Remove race window in page fault handling") because it increased the number of flushed dcache pages and became a performance problem for some workloads. Signed-off-by: Lars Persson Cc: linux-mips@linux-mips.org Cc: paul.burton@imgtec.com Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/9345/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit f9101d2a9034a3071c3e67c974188ef261b35e80 Author: Chandrakala Chavva Date: Fri Mar 6 14:02:21 2015 +0300 MIPS: OCTEON: Use correct CSR to soft reset Commit 9a49899eb88803dcc0ef437f09912f9a7b7a66fd upstream. Also delete unused cvmx_reset_octeon() This fixes reboot for Octeon III boards Signed-off-by: Chandrakala Chavva Signed-off-by: Aleksey Makarov Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: David Daney Patchwork: https://patchwork.linux-mips.org/patch/9471/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 7f80e58272c948d4fddec2d1abf40d6bf38d46bf Author: Aaro Koskinen Date: Wed Mar 4 23:08:49 2015 +0200 MIPS: OCTEON: dma-octeon: fix OHCI USB config check Commit a8667d706dfa394ef9fe5f9013dee92d40a096e8 upstream. CONFIG_USB_OCTEON_OHCI is deprecated and no longer needed to use OHCI on OCTEON II. Instead, CONFIG_USB_OHCI_HCD_PLATFORM should be used. Signed-off-by: Aaro Koskinen Cc: Aleksey Makarov Cc: David Daney Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9421/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 195161fd176acfedad69c0d259eabe050b993902 Author: Nicolas Schichan Date: Thu Mar 12 17:00:58 2015 +0100 MIPS: BCM63xx: Move bcm63xx_gpio_init() to bcm63xx_register_devices(). Commit 2ec459f2a77b808c1e5a3616c88b613d3f720c8d upstream. When called from prom init code, bcm63xx_gpio_init() will fail as it will call gpiochip_add() which relies on a working kmalloc() to alloc the gpio_desc array and kmalloc is not useable yet at prom init time. Move bcm63xx_gpio_init() to bcm63xx_register_devices() (an arch_initcall) where kmalloc works. Fixes: 14e85c0e69d5 ("gpio: remove gpio_descs global array") Signed-off-by: Nicolas Schichan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: Alexandre Courbot Patchwork: https://patchwork.linux-mips.org/patch/9530/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 77a23cb5bdb54f462341045248a7672009050fc0 Author: David S. Miller Date: Fri May 1 22:02:47 2015 -0400 ipv4: Missing sk_nulls_node_init() in ping_unhash(). [ Upstream commit a134f083e79fb4c3d0a925691e732c56911b4326 ] If we don't do that, then the poison value is left in the ->pprev backlink. This can cause crashes if we do a disconnect, followed by a connect(). Tested-by: Linus Torvalds Reported-by: Wen Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c603b10f503c66e72453c02143cc9f21b55a9c3b Author: Ido Shamay Date: Thu Apr 30 17:32:46 2015 +0300 net/mlx4_en: Schedule napi when RX buffers allocation fails [ Upstream commit 07841f9d94c11afe00c0498cf242edf4075729f4 ] When system is out of memory, refilling of RX buffers fails while the driver continue to pass the received packets to the kernel stack. At some point, when all RX buffers deplete, driver may fall into a sleep, and not recover when memory for new RX buffers is once again availible. This is because hardware does not have valid descriptors, so no interrupt will be generated for the driver to return to work in napi context. Fix it by schedule the napi poll function from stats_task delayed workqueue, as long as the allocations fail. Signed-off-by: Ido Shamay Signed-off-by: Amir Vadai Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 081025f9c9c3402a984564b0d647a9ebbb62b93e Author: Hariprasad Shenai Date: Wed Apr 29 17:19:05 2015 +0530 cxgb4: Fix MC1 memory offset calculation [ Upstream commit 7f0b8a56c978b0a3315ac84c6cbb065413afb8e9 ] Commit 6559a7e8296002b4 ("cxgb4: Cleanup macros so they follow the same style and look consistent") introduced a regression where reading MC1 memory in adapters where MC0 isn't present or MC0 size is not equal to MC1 size caused the adapter to crash due to incorrect computation of memoffset. Fix is to read the size of MC0 instead of MC1 for offset calculation Signed-off-by: Steve Wise Signed-off-by: Hariprasad Shenai Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 028a33eb801e1c48e7ff1d5c0505fdad97f615aa Author: Benjamin Poirier Date: Tue Apr 28 14:49:29 2015 -0700 mlx4: Fix tx ring affinity_mask creation [ Upstream commit 42eab005a5dd5d7ea2b0328aecc4d6cc0c23c9c2 ] By default, the number of tx queues is limited by the number of online cpus in mlx4_en_get_profile(). However, this limit no longer holds after the ethtool .set_channels method has been called. In that situation, the driver may access invalid bits of certain cpumask variables when queue_index >= nr_cpu_ids. Signed-off-by: Benjamin Poirier Acked-by: Ido Shamay Fixes: d03a68f ("net/mlx4_en: Configure the XPS queue mapping on driver load") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d177331ecb0579d5d12fb9bdbc385038ed3efac5 Author: Herbert Xu Date: Tue Apr 28 11:43:15 2015 +0800 route: Use ipv4_mtu instead of raw rt_pmtu [ Upstream commit cb6ccf09d6b94bec4def1ac5cf4678d12b216474 ] The commit 3cdaa5be9e81a914e633a6be7b7d2ef75b528562 ("ipv4: Don't increase PMTU with Datagram Too Big message") broke PMTU in cases where the rt_pmtu value has expired but is smaller than the new PMTU value. This obsolete rt_pmtu then prevents the new PMTU value from being installed. Fixes: 3cdaa5be9e81 ("ipv4: Don't increase PMTU with Datagram Too Big message") Reported-by: Gerd v. Egidy Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 59506497a7c844e81254c0a4bc2920510fac9a52 Author: Alexei Starovoitov Date: Mon Apr 27 14:40:37 2015 -0700 bpf: fix 64-bit divide [ Upstream commit 876a7ae65b86d8cec8efe7d15d050ac61116874e ] ALU64_DIV instruction should be dividing 64-bit by 64-bit, whereas do_div() does 64-bit by 32-bit divide. x64 and arm64 JITs correctly implement 64 by 64 unsigned divide. llvm BPF backend emits code assuming that ALU64_DIV does 64 by 64. Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") Reported-by: Michael Holzheu Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman