1. 10 12月, 2016 9 次提交
    • T
      x86/ldt: Make all size computations unsigned · 990e9dc3
      Thomas Gleixner 提交于
      ldt->size can never be negative. The helper functions take 'unsigned int'
      arguments which are assigned from ldt->size. The related user space
      user_desc struct member entry_number is unsigned as well.
      
      But ldt->size itself and a few local variables which are related to
      ldt->size are type 'int' which makes no sense whatsoever and results in
      typecasts which make the eyes bleed.
      
      Clean it up and convert everything which is related to ldt->size to
      unsigned it.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      990e9dc3
    • D
      x86/ldt: Make a size argument unsigned · 296dc580
      Dan Carpenter 提交于
      My static checker complains that we put an upper bound on the "size"
      argument but not a lower bound.  The checker is not smart enough to know
      the possible ranges of "old_mm->context.ldt->size" from
      init_new_context_ldt() so it thinks maybe it could be negative.
      
      Let's make it unsigned to silence the warning and future proof the code
      a bit.
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: NAndy Lutomirski <luto@kernel.org>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: kernel-janitors@vger.kernel.org
      Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Link: http://lkml.kernel.org/r/20161208105602.GA11382@elgon.mountainSigned-off-by: NThomas Gleixner <tglx@linutronix.de>
      296dc580
    • L
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 810ac7b7
      Linus Torvalds 提交于
      Pull libnvdimm fixes from Dan Williams:
       "Several fixes to the DSM (ACPI device specific method) marshaling
        implementation.
      
        I consider these urgent enough to send for 4.9 consideration since
        they fix the kernel's handling of ARS (Address Range Scrub) commands.
        Especially for platforms without machine-check-recovery capabilities,
        successful execution of ARS commands enables the platform to
        potentially break out of an infinite reboot problem if a media error
        is present in the boot path. There is also a one line fix for a
        device-dax read-only mapping regression.
      
        Commits 9a901f54 ("acpi, nfit: fix extended status translations
        for ACPI DSMs") and 325896ff ("device-dax: fix private mapping
        restriction, permit read-only") are true regression fixes for changes
        introduced this cycle.
      
        Commit efda1b5d ("acpi, nfit, libnvdimm: fix / harden ars_status
        output length handling") fixes the kernel's handling of zero-length
        results, this never would have worked in the past, but we only just
        recently discovered a BIOS implementation that emits this arguably
        spec non-compliant result.
      
        The remaining two commits are additional fall out from thinking
        through the implications of a zero / truncated length result of the
        ARS Status command.
      
        In order to mitigate the risk that these changes introduce yet more
        regressions they are backstopped by a new unit test in commit
        a7de92da ("tools/testing/nvdimm: unit test acpi_nfit_ctl()") that
        mocks up inputs to acpi_nfit_ctl()"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        device-dax: fix private mapping restriction, permit read-only
        tools/testing/nvdimm: unit test acpi_nfit_ctl()
        acpi, nfit: fix bus vs dimm confusion in xlat_status
        acpi, nfit: validate ars_status output buffer size
        acpi, nfit, libnvdimm: fix / harden ars_status output length handling
        acpi, nfit: fix extended status translations for ACPI DSMs
      810ac7b7
    • L
      Merge branch 'for-4.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata · 861d75d0
      Linus Torvalds 提交于
      Pull libata fixes from Tejun Heo:
       "This is quite late but SCT Write Same support added during this cycle
        is broken subtly but seriously and it'd be best to disable it before
        v4.9 gets released.
      
        This contains two commits - one low impact sata_mv fix and the
        mentioned disabling of SCT Write Same"
      
      * 'for-4.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
        libata-scsi: disable SCT Write Same for the moment
        ata: sata_mv: check for errors when parsing nr-ports from dt
      861d75d0
    • L
      Merge tag 'ceph-for-4.9-rc9' of git://github.com/ceph/ceph-client · af9468db
      Linus Torvalds 提交于
      Pull ceph fix from Ilya Dryomov:
       "A fix for an issue with ->d_revalidate() in ceph, causing frequent
        kernel crashes.
      
        Marked for stable - it goes back to 4.6, but started popping up only
        in 4.8"
      
      * tag 'ceph-for-4.9-rc9' of git://github.com/ceph/ceph-client:
        ceph: don't set req->r_locked_dir in ceph_d_revalidate
      af9468db
    • L
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 1f6c926c
      Linus Torvalds 提交于
      Pull ARM SoC fixes from Olof Johansson:
       "Final batch of SoC fixes
      
        A few fixes that have trickled in over the last week, all fixing minor
        errors in devicetrees -- UART pin assignment on Allwinner H3,
        correcting number of SATA ports on a Marvell-based Linkstation
        platform and a display clock fix for Freescale/NXP i.MX7D that fixes a
        freeze when starting up X"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: orion5x: fix number of sata port for linkstation ls-gl
        ARM: dts: imx7d: fix LCDIF clock assignment
        dts: sun8i-h3: correct UART3 pin definitions
      1f6c926c
    • L
      Merge tag 'm68k-for-v4.9-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k · 75147120
      Linus Torvalds 提交于
      Pull m68k fixes from Geert Uytterhoeven:
      
       - build fix for drivers calling ndelay() in a conditional block without
         curly braces
      
       - defconfig updates
      
      * tag 'm68k-for-v4.9-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
        m68k: Fix ndelay() macro
        m68k/defconfig: Update defconfigs for v4.9-rc1
      75147120
    • L
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 1ca17e97
      Linus Torvalds 提交于
      Pull drm fix from Dave Airlie:
       "Just a single fix for amdgpu to just suspend the gpu on 'shutdown'
        instead of shutting it down fully, as for some reason the hw was
        getting upset in some situations"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/amdgpu: just suspend the hw on pci shutdown
      1ca17e97
    • L
      Revert "radix tree test suite: fix compilation" · 2b41226b
      Linus Torvalds 提交于
      This reverts commit 53855d10.
      
      It shouldn't have come in yet - it depends on the changes in linux-next
      that will come in during the next merge window.  As Matthew Wilcox says,
      the test suite is broken with the current state without the revert.
      Requested-by: NMatthew Wilcox <mawilcox@microsoft.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      2b41226b
  2. 09 12月, 2016 4 次提交
    • L
      Merge branch 'parisc-4.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · a37102dc
      Linus Torvalds 提交于
      Pull parisc fixes from Helge Deller:
       "Three important fixes for the parisc architecture.
      
        Dave provided two patches: One which purges the TLB before setting a
        PTE entry and a second one which drops unnecessary TLB flushes. Both
        patches have been tested for one week on the debian buildd servers and
        prevent random segmentation faults.
      
        The patch from me fixes a crash at boot inside the TLB measuring code
        on SMP machines with PA8000-PA8700 CPUs (specifically A500-44 and
        J5000 servers)"
      
      * 'parisc-4.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Fix TLB related boot crash on SMP machines
        parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm
        parisc: Purge TLB before setting PTE
      a37102dc
    • H
      parisc: Fix TLB related boot crash on SMP machines · 24d0492b
      Helge Deller 提交于
      At bootup we run measurements to calculate the best threshold for when we
      should be using full TLB flushes instead of just flushing a specific amount of
      TLB entries.  This performance test is run over the kernel text segment.
      
      But running this TLB performance test on the kernel text segment turned out to
      crash some SMP machines when the kernel text pages were mapped as huge pages.
      
      To avoid those crashes this patch simply skips this test on some SMP machines
      and calculates an optimal threshold based on the maximum number of available
      TLB entries and number of online CPUs.
      
      On a technical side, this seems to happen:
      The TLB measurement code uses flush_tlb_kernel_range() to flush specific TLB
      entries with a page size of 4k (pdtlb 0(sr1,addr)). On UP systems this purge
      instruction seems to work without problems even if the pages were mapped as
      huge pages.  But on SMP systems the TLB purge instruction is broadcasted to
      other CPUs. Those CPUs then crash the machine because the page size is not as
      expected.  C8000 machines with PA8800/PA8900 CPUs were not affected by this
      problem, because the required cache coherency prohibits to use huge pages at
      all.  Sadly I didn't found any documentation about this behaviour, so this
      finding is purely based on testing with phyiscal SMP machines (A500-44 and
      J5000, both were 2-way boxes).
      
      Cc: <stable@vger.kernel.org> # v3.18+
      Signed-off-by: NHelge Deller <deller@gmx.de>
      24d0492b
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · b4aafe77
      Linus Torvalds 提交于
      Pull SCSI fix from James Bottomley:
       "One small fix for a regression in a prior fix (again).
      
        This time the condition in the prior fix BUG_ON proved to be wrong
        under certain circumstances causing a BUG to trigger where it
        shouldn't in the lpfc driver"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: lpfc: fix oops/BUG in lpfc_sli_ringtxcmpl_put()
      b4aafe77
    • R
      ARM: dts: orion5x: fix number of sata port for linkstation ls-gl · 038ccb3e
      Roger Shimizu 提交于
      Bug report from Debian [0] shows there's minor changed model of
      Linkstation LS-GL that uses the 2nd SATA port of the SoC.
      So it's necessary to enable two SATA ports, though for that specific
      model only the 2nd one is used.
      
      [0] https://bugs.debian.org/845611
      
      Fixes: b1742ffa ("ARM: dts: orion5x: add device tree for buffalo linkstation ls-gl")
      Reported-by: NRyan Tandy <ryan@nardis.ca>
      Tested-by: NRyan Tandy <ryan@nardis.ca>
      Signed-off-by: NRoger Shimizu <rogershimizu@gmail.com>
      Signed-off-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
      038ccb3e
  3. 08 12月, 2016 18 次提交
  4. 07 12月, 2016 9 次提交
    • J
      parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm · febe4296
      John David Anglin 提交于
      We have four routines in pacache.S that use temporary alias pages:
      copy_user_page_asm(), clear_user_page_asm(), flush_dcache_page_asm() and
      flush_icache_page_asm().  copy_user_page_asm() and clear_user_page_asm()
      don't purge the TLB entry used for the operation.
      flush_dcache_page_asm() and flush_icache_page_asm do purge the entry.
      
      Presumably, this was thought to optimize TLB use.  However, the
      operation is quite heavy weight on PA 1.X processors as we need to take
      the TLB lock and a TLB broadcast is sent to all processors.
      
      This patch removes the purges from flush_dcache_page_asm() and
      flush_icache_page_asm.
      Signed-off-by: NJohn David Anglin  <dave.anglin@bell.net>
      Cc: <stable@vger.kernel.org> # v3.16+
      Signed-off-by: NHelge Deller <deller@gmx.de>
      febe4296
    • J
      parisc: Purge TLB before setting PTE · c78e710c
      John David Anglin 提交于
      The attached change interchanges the order of purging the TLB and
      setting the corresponding page table entry.  TLB purges are strongly
      ordered.  It occurred to me one night that setting the PTE first might
      have subtle ordering issues on SMP machines and cause random memory
      corruption.
      
      A TLB lock guards the insertion of user TLB entries.  So after the TLB
      is purged, a new entry can't be inserted until the lock is released.
      This ensures that the new PTE value is used when the lock is released.
      
      Since making this change, no random segmentation faults have been
      observed on the Debian hppa buildd servers.
      Signed-off-by: NJohn David Anglin  <dave.anglin@bell.net>
      Cc: <stable@vger.kernel.org> # v3.16+
      Signed-off-by: NHelge Deller <deller@gmx.de>
      c78e710c
    • D
      device-dax: fix private mapping restriction, permit read-only · 325896ff
      Dan Williams 提交于
      Hugh notes in response to commit 4cb19355 "device-dax: fail all
      private mapping attempts":
      
        "I think that is more restrictive than you intended: haven't tried, but I
        believe it rejects a PROT_READ, MAP_SHARED, O_RDONLY fd mmap, leaving no
        way to mmap /dev/dax without write permission to it."
      
      Indeed it does restrict read-only mappings, switch to checking
      VM_MAYSHARE, not VM_SHARED.
      
      Cc: <stable@vger.kernel.org>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Pawel Lebioda <pawel.lebioda@intel.com>
      Fixes: 4cb19355 ("device-dax: fail all private mapping attempts")
      Reported-by: NHugh Dickins <hughd@google.com>
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      325896ff
    • D
      tools/testing/nvdimm: unit test acpi_nfit_ctl() · a7de92da
      Dan Williams 提交于
      A recent flurry of bug discoveries in the nfit driver's DSM marshalling
      routine has highlighted the fact that we do not have unit test coverage
      for this routine. Add a self-test of acpi_nfit_ctl() routine before
      probing the "nfit_test.0" device. This mocks stimulus to acpi_nfit_ctl()
      and if any of the tests fail "nfit_test.0" will be unavailable causing
      the rest of the tests to not run / fail.
      
      This unit test will also be a place to land reproductions of quirky BIOS
      behavior discovered in the field and ensure the kernel does not regress
      against implementations it has seen in practice.
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      a7de92da
    • D
      acpi, nfit: fix bus vs dimm confusion in xlat_status · d6eb270c
      Dan Williams 提交于
      Given dimms and bus commands share the same command number space we need
      to be careful that we are translating status in the correct context.
      Otherwise we can, for example, fail an ND_CMD_GET_CONFIG_SIZE command
      because max_xfer is zero. It fails because that condition erroneously
      correlates with the 'cleared == 0' failure of ND_CMD_CLEAR_ERROR.
      
      Cc: <stable@vger.kernel.org>
      Fixes: aef25338 ("libnvdimm, nfit: centralize command status translation")
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      d6eb270c
    • D
      acpi, nfit: validate ars_status output buffer size · 82aa37cf
      Dan Williams 提交于
      If an ARS Status command returns truncated output, do not process
      partial records or otherwise consume non-status fields.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 0caeef63 ("libnvdimm: Add a poison list and export badblocks")
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      82aa37cf
    • D
      acpi, nfit, libnvdimm: fix / harden ars_status output length handling · efda1b5d
      Dan Williams 提交于
      Given ambiguities in the ACPI 6.1 definition of the "Output (Size)"
      field of the ARS (Address Range Scrub) Status command, a firmware
      implementation may in practice return 0, 4, or 8 to indicate that there
      is no output payload to process.
      
      The specification states "Size of Output Buffer in bytes, including this
      field.". However, 'Output Buffer' is also the name of the entire
      payload, and earlier in the specification it states "Max Query ARS
      Status Output Buffer Size: Maximum size of buffer (including the Status
      and Extended Status fields)".
      
      Without this fix if the BIOS happens to return 0 it causes memory
      corruption as evidenced by this result from the acpi_nfit_ctl() unit
      test.
      
       ars_status00000000: 00020000 00000000                    ........
       BUG: stack guard page was hit at ffffc90001750000 (stack is ffffc9000174c000..ffffc9000174ffff)
       kernel stack overflow (page fault): 0000 [#1] SMP DEBUG_PAGEALLOC
       task: ffff8803332d2ec0 task.stack: ffffc9000174c000
       RIP: 0010:[<ffffffff814cfe72>]  [<ffffffff814cfe72>] __memcpy+0x12/0x20
       RSP: 0018:ffffc9000174f9a8  EFLAGS: 00010246
       RAX: ffffc9000174fab8 RBX: 0000000000000000 RCX: 000000001fffff56
       RDX: 0000000000000000 RSI: ffff8803231f5a08 RDI: ffffc90001750000
       RBP: ffffc9000174fa88 R08: ffffc9000174fab0 R09: ffff8803231f54b8
       R10: 0000000000000008 R11: 0000000000000001 R12: 0000000000000000
       R13: 0000000000000000 R14: 0000000000000003 R15: ffff8803231f54a0
       FS:  00007f3a611af640(0000) GS:ffff88033ed00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: ffffc90001750000 CR3: 0000000325b20000 CR4: 00000000000406e0
       Stack:
        ffffffffa00bc60d 0000000000000008 ffffc90000000001 ffffc9000174faac
        0000000000000292 ffffffffa00c24e4 ffffffffa00c2914 0000000000000000
        0000000000000000 ffffffff00000003 ffff880331ae8ad0 0000000800000246
       Call Trace:
        [<ffffffffa00bc60d>] ? acpi_nfit_ctl+0x49d/0x750 [nfit]
        [<ffffffffa01f4fe0>] nfit_test_probe+0x670/0xb1b [nfit_test]
      
      Cc: <stable@vger.kernel.org>
      Fixes: 747ffe11 ("libnvdimm, tools/testing/nvdimm: fix 'ars_status' output buffer sizing")
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      efda1b5d
    • V
      acpi, nfit: fix extended status translations for ACPI DSMs · 9a901f54
      Vishal Verma 提交于
      ACPI DSMs can have an 'extended' status which can be non-zero to convey
      additional information about the command. In the xlat_status routine,
      where we translate the command statuses, we were returning an error for
      a non-zero extended status, even if the primary status indicated success.
      
      Return from each command's 'case' once we have verified both its status
      and extend status are good.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 11294d63 ("nfit: fail DSMs that return non-zero status by default")
      Signed-off-by: NVishal Verma <vishal.l.verma@intel.com>
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      9a901f54
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · bc3913a5
      Linus Torvalds 提交于
      Pull sparc fix from David Miller:
       "A use-before-NULL-check from Dan Carpenter"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        dbri: move dereference after check for NULL
      bc3913a5