summaryrefslogtreecommitdiffstats
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2014-04-18drm: Split out drm_probe_helper.c from drm_crtc_helper.cDaniel Vetter3-371/+427
This is leftover stuff from my previous doc round which I kinda wanted to do but didn't yet due to rebase hell. The modeset helpers and the probing helpers a independent and e.g. i915 uses the probing stuff but has its own modeset infrastructure. It hence makes to split this up. While at it add a DOC: comment for the probing libraray. It would be rather neat to pull some of the DocBook documenting these two helpers into in-line DOC: comments. But unfortunately kerneldoc doesn't support markdown or something similar to make nice-looking documentation, so the current state is better. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/plane-helper: Don't fake-implement primary plane disablingDaniel Vetter1-28/+5
After thinking about this topic a bit more I've reached the conclusion that implementing this doesn't make sense: - The locking is all wrong: set_config(NULL) will also unlink encoders and connectors, but those links are protected with the mode_config mutex. In the ->disable_plane callback we only hold all modeset locks, but eventually we want to switch to just grabbing the per-crtc (and maybe per-plane) locks as needed, maybe based on ww_mutexes. Having a callback which absolutely needs all modeset locks is bad for this conversion. Note that the same isn't true for the provided ->update_plane since we've audited the crtc helpers to make sure that not encoder or connector links are changed. - There's no way to re-enable the plane with an ->update_plane: The connectors/encoder links are lost and so we can't re-enable the CRTC. Even without that issue the driver might have reassigned some shared resources (as opposed to e.g. DPMS off, where drivers are not allowed to do that to make sure the CRTC can be enabled again). - The semantics don't make much sense: Userspace asked to scan out black (or some other color if the driver supports a background color), not that the screen be disabled. - Implementing proper primary plane support (i.e. actually disabling the primary plane without disabling the CRTC) is really simple, at least if all the hw needs is flipping a bit. The big task is auditing all the interactions with other ioctls when the CRTC is on but there's no primary plane (e.g. pageflips). And some of that work still needs to be done. Cc: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/ast: fix value check in cbr_scan2Dave Airlie1-1/+1
this is a typo vs the ums driver, fix to check correct value. Found initially by Coverity. Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/nouveau/bios: fix a bit shift error introduced by 457e77bSergei Antonov1-1/+1
Commit 457e77b26428ab4a24998eecfb99f27fa4195397 added two checks applied to a value received from nv_rd32(bios, 0x619f04). But after this new piece of code is executed, the addr local variable does not hold the same value it used to hold before the commit. Here is what is was assigned in the original code: (u64)(nv_rd32(bios, 0x619f04) & 0xffffff00) << 8 in the committed code it ends up with this value: (u64)(nv_rd32(bios, 0x619f04) >> 8) << 8 These expressions are obviously not equivalent. My Nvidia video card does not show anything on the display when I boot a kernel containing this commit. The patch fixes the code so that the new checks are still done, but the side effect of an incorrect addr value is gone. Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sergei Antonov <saproj@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18Merge tag 'omapdrm-fixes-3.15' of ↵Dave Airlie7-42/+133
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux into drm-next Fixes for omapdrm, some of which were already present in 3.14, and some which appeared in 3.15-rc1: - fixes for primary-plane handling which caused crashes - fix all kinds of uninit issues which prevented from unloading the omapdrm module. - fixes for HDMI enable/disable issues * tag 'omapdrm-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: drm/omap: fix the handling of fb ref counts drm/omap: protect omap_crtc's event with event_lock spinlock drm/omap: Use old_fb to synchronize between successive page flips drm/omap: Fix crash when using LCD3 overlay manager drm/omap: gem sync: wait on correct events drm/omap: Fix memory leak in omap_gem_op_async drm/omap: remove warn from debugfs drm/omap: remove extra plane->destroy from crtc destroy drm/omap: print warning when rotating non-TILER fb drm/omap: fix missing unref to fb's buf object drm/omap: fix plane rotation drm/omap: fix enabling/disabling of video pipeline drm/omap: fix missing disable for unused encoder drm/omap: fix race issue when unloading omapdrm drm/omap: fix DMM driver (un)registration drm/omap: fix uninit order in pdev_remove() drm/omap: fix output enable/disable sequence
2014-04-18Merge branch 'drm-fixes-3.15' of ↵Dave Airlie12-78/+115
git://people.freedesktop.org/~deathsimple/linux into drm-next 1. Fixing PLL regressions 2. A couple of memory reclocking and DPM fixes 3. Small cleanups * 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux: drm/radeon/ci: make sure mc ucode is loaded before checking the size drm/radeon/si: make sure mc ucode is loaded before checking the size drm/radeon: improve PLL params if we don't match exactly v2 drm/radeon: memory leak on bo reservation failure. v2 drm/radeon: fix VCE fence command drm/radeon: re-enable mclk dpm on R7 260X asics drm/radeon: add support for newer mc ucode on CI (v2) drm/radeon: add support for newer mc ucode on SI (v2) drm/radeon: apply more strict limits for PLL params v2 drm/radeon: update CI DPM powertune settings drm/radeon: fix runpm handling on APUs (v4) drm/radeon: disable mclk dpm on R7 260X
2014-04-18Merge tag 'drm/tegra/for-3.15-rc2' of ↵Dave Airlie1-2/+2
git://anongit.freedesktop.org/tegra/linux into drm-next drm/tegra: Fixes for v3.15-rc2 This contains a fix for the host1x driver writing to non-existent syncpt registers. A second commit removes an excess pad field in the parameter structure for the DRM_TEGRA_SUBMIT IOCTL. Archeaology on earlier versions of this file indicates that this was once there to pad an uneven number of u32 u32 fields, of which one was subsequently removed. Unfortunately nobody remembered to get rid of the padding when that happened. Both of these commits are Cc: stable because they fix issues that were introduced back in v3.10. * tag 'drm/tegra/for-3.15-rc2' of git://anongit.freedesktop.org/tegra/linux: drm/tegra: Remove gratuitous pad field gpu: host1x: handle the correct # of syncpt regs
2014-04-17drm/radeon/ci: make sure mc ucode is loaded before checking the sizeAlex Deucher1-1/+3
Avoid a possible segfault. Noticed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon/si: make sure mc ucode is loaded before checking the sizeAlex Deucher1-1/+3
Avoid a possible segfault. Noticed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: improve PLL params if we don't match exactly v2Christian König1-6/+7
Otherwise we might be quite off on older chipsets. v2: keep ref_div minimum Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: memory leak on bo reservation failure. v2Quentin Casasnovas1-2/+7
On bo reservation failure, we end up leaking fpriv. v2 (chk): rebased and added missing free on vm failure as well Fixes: 5e386b574cf7e1 ("drm/radeon: fix missing bo reservation") Cc: stable@vger.kernel.org Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: fix VCE fence commandChristoph Jaeger1-1/+1
Due to a type mismatch that causes an implicit type conversion, the upper 32 bits of the GPU address have been zeroed out when adding to the command buffer. Picked up by Coverity - CID 1198624. Signed-off-by: Christoph Jaeger <christophjaeger@linux.com>
2014-04-17drm/radeon: re-enable mclk dpm on R7 260X asicsAlex Deucher1-2/+6
If the new mc ucode is available. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: add support for newer mc ucode on CI (v2)Alex Deucher2-10/+20
Fixes mclk stability on certain asics. v2: print out mc firmware version used and size bug: https://bugs.freedesktop.org/show_bug.cgi?id=75992 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: add support for newer mc ucode on SI (v2)Alex Deucher2-13/+25
May fix stability issues with some newer cards. v2: print out mc firmware version used and size Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: apply more strict limits for PLL params v2Christian König1-0/+3
Letting post and refernce divider get to big is bad for signal stability. v2: increase the limit to 210 Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: update CI DPM powertune settingsAlex Deucher1-12/+13
As per internal recommendations. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-04-17drm/radeon: fix runpm handling on APUs (v4)Alex Deucher6-34/+27
Don't try and runtime suspend the APU in PX systems. We only want to power down the dGPU. v2: fix harder v3: fix stupid typo v4: consolidate runpm enablement to a single flag bugs: https://bugs.freedesktop.org/show_bug.cgi?id=75127 https://bugzilla.kernel.org/show_bug.cgi?id=72701 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: disable mclk dpm on R7 260XAlex Deucher1-0/+4
Setting higher mclks seems to cause stability issues on some R7 260X boards. Disable it for now for stability until we find a proper fix. bug: https://bugs.freedesktop.org/show_bug.cgi?id=75992 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-16gpu: host1x: handle the correct # of syncpt regsStephen Warren1-2/+2
BIT_WORD() truncates rather than rounds, so the loops in syncpt_thresh_isr() and _host1x_intr_disable_all_syncpt_intrs() use <= rather than < in an attempt to process the correct number of registers when rounding of the conversion of count of bits to count of words is necessary. However, when rounding isn't necessary because the value is already a multiple of the divisor (as is the case for all values of nb_pts the code actually sees), this causes one too many registers to be processed. Solve this by using and explicit DIV_ROUND_UP() call, rather than BIT_WORD(), and comparing with < rather than <=. Fixes: 7ede0b0bf3e2 ("gpu: host1x: Add syncpoint wait and interrupts") Cc: <stable@vger.kernel.org> # 3.10 Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-By: Terje Bergstrom <tbergstrom@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-04-16Merge tag 'drm-intel-fixes-2014-04-11' of ↵Dave Airlie9-139/+122
git://anongit.freedesktop.org/drm-intel into drm-next Some fixes from Intel. * tag 'drm-intel-fixes-2014-04-11' of git://anongit.freedesktop.org/drm-intel: drm/i915: Always use kref tracking for all contexts. drm/i915: do not setup backlight if not available according to VBT drm/i915: check VBT for supported backlight type drm/i915: Disable self-refresh for untiled fbs on i915gm drm/mm: Don't WARN if drm_mm_reserve_node
2014-04-15drm/omap: fix the handling of fb ref countsTomi Valkeinen1-5/+5
With the recent primary-plane changes for drm, the primary plane's framebuffer needs to be ref counted the same way as for non-primary-planes. This was not done by the omapdrm driver, which caused the ref count to drop to 0 too early, causing problems. This patch moves the fb unref and ref from omap_plane_update to omap_plane_mode_set. This way the fb refs are updated for both primary and non-primary cases, as omap_plane_update calls omap_plane_mode_set. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: protect omap_crtc's event with event_lock spinlockArchit Taneja1-0/+6
The vblank_cb callback and the page_flip ioctl can occur together in different CPU contexts. vblank_cb uses takes tje drm device's event_lock spinlock when sending the vblank event and updating omap_crtc->event and omap_crtc->od_fb. Use the same spinlock in page_flip, to make sure the above omap_crtc parameters are configured sequentially. Signed-off-by: Archit Taneja <archit@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: Use old_fb to synchronize between successive page flipsArchit Taneja1-1/+1
omap_crtc->old_fb is used to check whether the previous page flip has completed or not. However, it's never initialized to anything, so it's always NULL. This results in the check to always succeed, and the page_flip to proceed. Initialize old_fb to the fb that we intend to flip to through page_flip, and therefore prevent a future page flip to proceed if the last one didn't complete. Signed-off-by: Archit Taneja <archit@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: Fix crash when using LCD3 overlay managerArchit Taneja1-0/+1
The channel_names list didn't have a string populated for LCD3 manager, this results in a crash when the display's output is connected to LCD3. Add an entry for LCD3. Reported-by: Somnath Mukherjee <somnath@ti.com> Signed-off-by: Archit Taneja <archit@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: gem sync: wait on correct eventsArchit Taneja1-2/+2
A waiter of the type OMAP_GEM_READ should wait for a buffer to be completely written, and only then proceed with reading it. A similar logic applies for waiters with OMAP_GEM_WRITE flag. Currently the function is_waiting() waits on the read_complete/read_target counts in the sync object. This should be the other way round, as a reader should wait for users who are 'writing' to this buffer, and vice versa. Make readers of the buffer(OMAP_GEM_READ) wait on the write counters, and writers to the buffer(OMAP_GEM_WRITE) wait on the read counters in is_waiting() Signed-off-by: Archit Taneja <archit@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: Fix memory leak in omap_gem_op_asyncSubhajit Paul1-0/+2
In omap_gem_op_async(), if a waiter is not added to the wait list, it needs to be free'd in the function itself. Make sure we free the waiter for this case. Signed-off-by: Subhajit Paul <subhajit_paul@ti.com> Signed-off-by: Archit Taneja <archit@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: remove warn from debugfsTomi Valkeinen1-3/+0
Patch dfe96ddcfa22b44100814b9435770f6ff1309d37 (omapdrm: simplify locking in the fb debugfs file) removed taking locks when using omapdrm's debugfs to dump fb objects. However, in omap_gem_describe we give a WARN is the lock has not been taken, so that WARN is now seen every time omapdrm debugfs is used. So, presuming the removal of locks is ok, we can also remove the WARN. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: remove extra plane->destroy from crtc destroyTomi Valkeinen1-1/+0
All the planes, including primary planes, are now destroyed by the drm framework. Thus we no longer need the explicit call to plane->destroy from the crtc's destroy function. This patch removes the call, thus fixing the crash caused by double freeing the plane. remove omap_crtc->plane->funcs->destroy(omap_crtc->plane) Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-15drm/omap: print warning when rotating non-TILER fbTomi Valkeinen1-0/+14
Print a warning when the user tries to rotate a non-TILER framebuffer. Also set the rotation to 0, to avoid constant flood of the warnings in case of page flipping. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-14Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds1-5/+5
Pull bmc2835 crypto fix from Herbert Xu: "This fixes a potential boot crash on bcm2835 due to the recent change that now causes hardware RNGs to be accessed on registration" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: hwrng: bcm2835 - fix oops when rng h/w is accessed during registration
2014-04-14drm/omap: fix missing unref to fb's buf objectTomi Valkeinen1-0/+3
omap_fbdev_create() takes a reference to the fb's gem object with omap_gem_get_paddr(). However, it never releases it with omap_gem_put_paddr(). This patch adds the missing omap_gem_put_paddr() to omap_fbdev_free(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-14drm/omap: fix plane rotationGrazvydas Ignotas1-0/+8
Plane rotation with omapdrm is currently broken. It seems omap_plane_mode_set() expects width and height in screen coordinates, so pass it like that. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2014-04-14drm/omap: fix enabling/disabling of video pipelineTomi Valkeinen1-7/+12
At the moment the omap_crtc_pre_apply() handles the enabling, disabling and configuring of encoders and panels separately from the CRTC (i.e. the overlay manager). However, this doesn't work correctly. The encoder driver has to be in control of its video input (i.e. the crtc) for correct operation. This problem causes bugs with (at least) HDMI: the HDMI encoder supplies pixel clock for DISPC, and DISPC supplies video stream for HDMI. The current code first enables the HDMI encoder, and CRTC after that. However, the encoder expects the video stream to start during the encoder's enable, and if it doesn't, there will be sync lost errors. The encoder enables its video source by calling src->enable(), and this call goes to omapdrm (omap_crtc_enable), but omapdrm doesn't do anything in that function. Similarly for disable, which goes to omap_crtc_disable(). This patch moves the code to setup and enable/disable the crtc to omap_crtc_enable. and omap_crtc_disable(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-14drm/omap: fix missing disable for unused encoderTomi Valkeinen1-0/+6
When an encoder is no longer connected to a crtc, the driver will leave the encoder enabled. This patch adds code to track the encoder used for a crtc, and when the encoder changes, the old one is disabled. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-14drm/omap: fix race issue when unloading omapdrmTomi Valkeinen3-0/+26
At module unload, omap_fbdev_free() gets called which releases the framebuffers. However, the framebuffers are still used by crtcs, and will be released only later at vsync. The driver doesn't wait for this, and goes on to release the rest of the resources, which often causes a crash. This patchs adds a omap_crtc_flush() function which waits until the crtc has finished with its apply queue and page flips. The function utilizes a simple polling while-loop, as the performance is not an issue here. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-14drm/omap: fix DMM driver (un)registrationTomi Valkeinen1-4/+19
At the moment the DMM driver is never unregistered, even if it's registered in the omapdrm module's init function. This means we'll get errors when reloading the omapdrm module. Fix this by unregistering the DMM driver properly, and also change the module init to fail if DMM driver cannot be registered, simplifying the unregister path as we don't need to keep the state whether we registered the DMM driver or not. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-14drm/omap: fix uninit order in pdev_remove()Tomi Valkeinen1-1/+2
When unloading omapdrm driver, the omapdrm platform device is uninitialized last, after the displays have been disconnected omap_crtc callbacks have been removed. As the omapdrm pdev uninitialization needs the features uninitialized in earlier steps, a crash is guaranteed. This patch fixes the uninitialize order so that the omapdrm pdev is removed first. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-14drm/omap: fix output enable/disable sequenceTomi Valkeinen1-19/+27
At the moment it's quite easy to get the following errors when the HDMI output is enabled or disabled: [drm:omap_crtc_error_irq] *ERROR* tv: errors: 00008000 The reason for the errors is that the omapdrm driver doesn't properly handle the sync-lost irqs that happen when enabling the DIGIT crtc, which is used for HDMI and analog TV. The driver does disable the sync-lost irq properly, but it fails to wait until the output has been fully enabled (i.e. the first vsync), so the sync-lost errors are still seen occasionally. This patch makes the omapdrm act the same way as the omapfb does: - When enabling a display, we'll wait for the first vsync. - When disabling a display, we'll wait for framedone if available, or odd and even vsyncs. These changes make sure the output is fully enabled or disabled at the end of the function. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reported-by: Sanjay Singh Rawat <sanjay.rawat@linaro.org> Reviewed-by: Rob Clark <robdclark@gmail.com>
2014-04-12sym53c8xx_2: Set DID_REQUEUE return code when aborting squeueMikulas Patocka1-0/+4
This patch fixes I/O errors with the sym53c8xx_2 driver when the disk returns QUEUE FULL status. When the controller encounters an error (including QUEUE FULL or BUSY status), it aborts all not yet submitted requests in the function sym_dequeue_from_squeue. This function aborts them with DID_SOFT_ERROR. If the disk has full tag queue, the request that caused the overflow is aborted with QUEUE FULL status (and the scsi midlayer properly retries it until it is accepted by the disk), but the sym53c8xx_2 driver aborts the following requests with DID_SOFT_ERROR --- for them, the midlayer does just a few retries and then signals the error up to sd. The result is that disk returning QUEUE FULL causes request failures. The error was reproduced on 53c895 with COMPAQ BD03685A24 disk (rebranded ST336607LC) with command queue 48 or 64 tags. The disk has 64 tags, but under some access patterns it return QUEUE FULL when there are less than 64 pending tags. The SCSI specification allows returning QUEUE FULL anytime and it is up to the host to retry. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: Matthew Wilcox <matthew@wil.cx> Cc: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-12Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds42-302/+285
Pull yet more networking updates from David Miller: 1) Various fixes to the new Redpine Signals wireless driver, from Fariya Fatima. 2) L2TP PPP connect code takes PMTU from the wrong socket, fix from Dmitry Petukhov. 3) UFO and TSO packets differ in whether they include the protocol header in gso_size, account for that in skb_gso_transport_seglen(). From Florian Westphal. 4) If VLAN untagging fails, we double free the SKB in the bridging output path. From Toshiaki Makita. 5) Several call sites of sk->sk_data_ready() were referencing an SKB just added to the socket receive queue in order to calculate the second argument via skb->len. This is dangerous because the moment the skb is added to the receive queue it can be consumed in another context and freed up. It turns out also that none of the sk->sk_data_ready() implementations even care about this second argument. So just kill it off and thus fix all these use-after-free bugs as a side effect. 6) Fix inverted test in tcp_v6_send_response(), from Lorenzo Colitti. 7) pktgen needs to do locking properly for LLTX devices, from Daniel Borkmann. 8) xen-netfront driver initializes TX array entries in RX loop :-) From Vincenzo Maffione. 9) After refactoring, some tunnel drivers allow a tunnel to be configured on top itself. Fix from Nicolas Dichtel. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (46 commits) vti: don't allow to add the same tunnel twice gre: don't allow to add the same tunnel twice drivers: net: xen-netfront: fix array initialization bug pktgen: be friendly to LLTX devices r8152: check RTL8152_UNPLUG net: sun4i-emac: add promiscuous support net/apne: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO net: ipv6: Fix oif in TCP SYN+ACK route lookup. drivers: net: cpsw: enable interrupts after napi enable and clearing previous interrupts drivers: net: cpsw: discard all packets received when interface is down net: Fix use after free by removing length arg from sk_data_ready callbacks. Drivers: net: hyperv: Address UDP checksum issues Drivers: net: hyperv: Negotiate suitable ndis version for offload support Drivers: net: hyperv: Allocate memory for all possible per-pecket information bridge: Fix double free and memory leak around br_allowed_ingress bonding: Remove debug_fs files when module init fails i40evf: program RSS LUT correctly i40evf: remove open-coded skb_cow_head ixgb: remove open-coded skb_cow_head igbvf: remove open-coded skb_cow_head ...
2014-04-12Merge tag 'remoteproc-3.15-cleanups' of ↵Linus Torvalds2-17/+3
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc Pull remoteproc cleanups from Ohad Ben-Cohen: "Several remoteproc cleanup patches coming from Jingoo Han, Julia Lawall and Uwe Kleine-König" * tag 'remoteproc-3.15-cleanups' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc: remoteproc/ste_modem: staticize local symbols remoteproc/davinci: simplify use of devm_ioremap_resource remoteproc/davinci: drop needless devm_clk_put
2014-04-12Merge branch 'for-next' of ↵Linus Torvalds29-422/+1213
git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target updates from Nicholas Bellinger: "Here are the target pending updates for v3.15-rc1. Apologies in advance for waiting until the second to last day of the merge window to send these out. The highlights this round include: - iser-target support for T10 PI (DIF) offloads (Sagi + Or) - Fix Task Aborted Status (TAS) handling in target-core (Alex Leung) - Pass in transport supported PI at session initialization (Sagi + MKP + nab) - Add WRITE_INSERT + READ_STRIP T10 PI support in target-core (nab + Sagi) - Fix iscsi-target ERL=2 ASYNC_EVENT connection pointer bug (nab) - Fix tcm_fc use-after-free of ft_tpg (Andy Grover) - Use correct ib_sg_dma primitives in ib_isert (Mike Marciniszyn) Also, note the virtio-scsi + vhost-scsi changes to expose T10 PI metadata into KVM guest have been left-out for now, as there where a few comments from MST + Paolo that where not able to be addressed in time for v3.15. Please expect this feature for v3.16-rc1" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (43 commits) ib_srpt: Use correct ib_sg_dma primitives target/tcm_fc: Rename ft_tport_create to ft_tport_get target/tcm_fc: Rename ft_{add,del}_lport to {add,del}_wwn target/tcm_fc: Rename structs and list members for clarity target/tcm_fc: Limit to 1 TPG per wwn target/tcm_fc: Don't export ft_lport_list target/tcm_fc: Fix use-after-free of ft_tpg target: Add check to prevent Abort Task from aborting itself target: Enable READ_STRIP emulation in target_complete_ok_work target/sbc: Add sbc_dif_read_strip software emulation target: Enable WRITE_INSERT emulation in target_execute_cmd target/sbc: Add sbc_dif_generate software emulation target/sbc: Only expose PI read_cap16 bits when supported by fabric target/spc: Only expose PI mode page bits when supported by fabric target/spc: Only expose PI inquiry bits when supported by fabric target: Pass in transport supported PI at session initialization target/iblock: Fix double bioset_integrity_free bug Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist target/rd: T10-Dif: RAM disk is allocating more space than required. iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug ...
2014-04-12Merge branch 'v4l_for_linus' of ↵Linus Torvalds16-124/+192
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A series of bug fix patches for v3.15-rc1. Most are just driver fixes. There are some changes at remote controller core level, fixing some definitions on a new API added for Kernel v3.15. It also adds the missing include at include/uapi/linux/v4l2-common.h, to allow its compilation on userspace, as pointed by you" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (24 commits) [media] gpsca: remove the risk of a division by zero [media] stk1160: warrant a NUL terminated string [media] v4l: ti-vpe: retain v4l2_buffer flags for captured buffers [media] v4l: ti-vpe: Set correct field parameter for output and capture buffers [media] v4l: ti-vpe: zero out reserved fields in try_fmt [media] v4l: ti-vpe: Fix initial configuration queue data [media] v4l: ti-vpe: Use correct bus_info name for the device in querycap [media] v4l: ti-vpe: report correct capabilities in querycap [media] v4l: ti-vpe: Allow usage of smaller images [media] v4l: ti-vpe: Use video_device_release_empty [media] v4l: ti-vpe: Make sure in job_ready that we have the needed number of dst_bufs [media] lgdt3305: include sleep functionality in lgdt3304_ops [media] drx-j: use customise option correctly [media] m88rs2000: fix sparse static warnings [media] r820t: fix size and init values [media] rc-core: remove generic scancode filter [media] rc-core: split dev->s_filter [media] rc-core: do not change 32bit NEC scancode format for now [media] rtl28xxu: remove duplicate ID 0458:707f Genius TVGo DVB-T03 [media] xc2028: add missing break to switch ...
2014-04-12Merge tag 'ntb-3.15' of git://github.com/jonmason/ntbLinus Torvalds4-109/+138
Pull PCIe non-transparent bridge fixes and features from Jon Mason: "NTB driver bug fixes to address issues in list traversal, skb leak in ntb_netdev, a typo, and a leak of msix entries in the error path. Clean ups of the event handling logic, as well as a overall style cleanup. Finally, the driver was converted to use the new pci_enable_msix_range logic (and the refactoring to go along with it)" * tag 'ntb-3.15' of git://github.com/jonmason/ntb: ntb: Use pci_enable_msix_range() instead of pci_enable_msix() ntb: Split ntb_setup_msix() into separate BWD/SNB routines ntb: Use pci_msix_vec_count() to obtain number of MSI-Xs NTB: Code Style Clean-up NTB: client event cleanup ntb: Fix leakage of ntb_device::msix_entries[] array NTB: Fix typo in setting one translation register ntb_netdev: Fix skb free issue in open ntb_netdev: Fix list_for_each_entry exit issue
2014-04-12Merge branch 'for-linus' of ↵Linus Torvalds12-175/+54
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs updates from Al Viro: "The first vfs pile, with deep apologies for being very late in this window. Assorted cleanups and fixes, plus a large preparatory part of iov_iter work. There's a lot more of that, but it'll probably go into the next merge window - it *does* shape up nicely, removes a lot of boilerplate, gets rid of locking inconsistencie between aio_write and splice_write and I hope to get Kent's direct-io rewrite merged into the same queue, but some of the stuff after this point is having (mostly trivial) conflicts with the things already merged into mainline and with some I want more testing. This one passes LTP and xfstests without regressions, in addition to usual beating. BTW, readahead02 in ltp syscalls testsuite has started giving failures since "mm/readahead.c: fix readahead failure for memoryless NUMA nodes and limit readahead pages" - might be a false positive, might be a real regression..." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits) missing bits of "splice: fix racy pipe->buffers uses" cifs: fix the race in cifs_writev() ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failure kill generic_file_buffered_write() ocfs2_file_aio_write(): switch to generic_perform_write() ceph_aio_write(): switch to generic_perform_write() xfs_file_buffered_aio_write(): switch to generic_perform_write() export generic_perform_write(), start getting rid of generic_file_buffer_write() generic_file_direct_write(): get rid of ppos argument btrfs_file_aio_write(): get rid of ppos kill the 5th argument of generic_file_buffered_write() kill the 4th argument of __generic_file_aio_write() lustre: don't open-code kernel_recvmsg() ocfs2: don't open-code kernel_recvmsg() drbd: don't open-code kernel_recvmsg() constify blk_rq_map_user_iov() and friends lustre: switch to kernel_sendmsg() ocfs2: don't open-code kernel_sendmsg() take iov_iter stuff to mm/iov_iter.c process_vm_access: tidy up a bit ...
2014-04-12drivers: net: xen-netfront: fix array initialization bugVincenzo Maffione1-1/+1
This patch fixes the initialization of an array used in the TX datapath that was mistakenly initialized together with the RX datapath arrays. An out of range array access could happen when RX and TX rings had different sizes. Signed-off-by: Vincenzo Maffione <v.maffione@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12Merge branch 'master' of ↵David S. Miller14-203/+91
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates This series contains updates to e1000, e1000e, igb, igbvf, ixgb, ixgbe, ixgbevf and i40evf. Mark fixes an issue with ixgbe and ixgbevf by adding a bit to indicate when workqueues have been initialized. This permits the register read error handling from attempting to use them prior to that, which also generates warnings. Checking for a detected removal after initializing the work queues allows the probe function to return an error without getting the workqueue involved. Further, if the error_detected callback is entered before the workqueues are initialized, exit without recovery since the device initialization was so truncated. Francois Romieu provides several patches to all the drivers to remove the open coded skb_cow_head. Jakub Kicinski provides a fix for igb where last_rx_timestamp should be updated only when Rx time stamp is read. Mitch provides a fix for i40evf where a recent change broke the RSS LUT programming causing it to be programmed with all 0's. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12Merge git://git.infradead.org/users/eparis/auditLinus Torvalds1-1/+2
Pull audit updates from Eric Paris. * git://git.infradead.org/users/eparis/audit: (28 commits) AUDIT: make audit_is_compat depend on CONFIG_AUDIT_COMPAT_GENERIC audit: renumber AUDIT_FEATURE_CHANGE into the 1300 range audit: do not cast audit_rule_data pointers pointlesly AUDIT: Allow login in non-init namespaces audit: define audit_is_compat in kernel internal header kernel: Use RCU_INIT_POINTER(x, NULL) in audit.c sched: declare pid_alive as inline audit: use uapi/linux/audit.h for AUDIT_ARCH declarations syscall_get_arch: remove useless function arguments audit: remove stray newline from audit_log_execve_info() audit_panic() call audit: remove stray newlines from audit_log_lost messages audit: include subject in login records audit: remove superfluous new- prefix in AUDIT_LOGIN messages audit: allow user processes to log from another PID namespace audit: anchor all pid references in the initial pid namespace audit: convert PPIDs to the inital PID namespace. pid: get pid_t ppid of task in init_pid_ns audit: rename the misleading audit_get_context() to audit_take_context() audit: Add generic compat syscall support audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL ...
2014-04-12r8152: check RTL8152_UNPLUGhayeswang1-0/+48
When the device is unplugged, the driver would try to disable the device. Add checking the flag of RTL8152_UNPLUG to skip setting the device when it is unplugged. This could shorten the time of unloading the driver. Signed-off-by: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net>