1. 12 Apr, 2013 3 commits
    • Dave Airlie's avatar
      drm: add new QXL driver. (v1.4) · f64122c1
      Dave Airlie authored
      QXL is a paravirtual graphics device used by the Spice virtual desktop
      interface.
      
      The drivers uses GEM and TTM to manage memory, the qxl hw fencing however
      is quite different than normal TTM expects, we have to keep track of a number
      of non-linear fence ids per bo that we need to have released by the hardware.
      
      The releases are freed from a workqueue that wakes up and processes the
      release ring.
      
      releases are suballocated from a BO, there are 3 release categories, drawables,
      surfaces and cursor cmds. The hw also has 3 rings for commands, cursor and release handling.
      
      The hardware also have a surface id tracking mechnaism and the driver encapsulates it completely inside the kernel, userspace never sees the actual hw surface
      ids.
      
      This requires a newer version of the QXL userspace driver, so shouldn't be
      enabled until that has been placed into your distro of choice.
      
      Authors: Dave Airlie, Alon Levy
      
      v1.1: fixup some issues in the ioctl interface with padding
      v1.2: add module device table
      v1.3: fix nomodeset, fbcon leak, dumb bo create, release ring irq,
            don't try flush release ring (broken hw), fix -modesetting.
      v1.4: fbcon cpu usage reduction + suitable accel flags.
      Signed-off-by: default avatarAlon Levy <alevy@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      f64122c1
    • Dave Airlie's avatar
      ttm: export functions to allow qxl do its own iomapping · afe6804c
      Dave Airlie authored
      qxl wants to use io mapping like i915 gem does, for now
      just export the symbols so the driver can implement atomic
      page maps using io mapping.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      afe6804c
    • Alon Levy's avatar
  2. 05 Apr, 2013 1 commit
    • Dave Airlie's avatar
      Merge tag 'drm-intel-next-2013-03-23' of... · 399403c7
      Dave Airlie authored
      Merge tag 'drm-intel-next-2013-03-23' of git://people.freedesktop.org/~danvet/drm-intel into drm-next
      
      Daniel writes:
      Highlights:
      - Imre's for_each_sg_pages rework (now also with the stolen mem backed
        case fixed with a hack) plus the drm prime sg list coalescing patch from
        Rahul Sharma. I have some follow-up cleanups pending, already acked by
        Andrew Morton.
      - Some prep-work for the crazy no-pch/display-less platform by Ben.
      - Some vlv patches, by far not all (Jesse et al).
      - Clean up the HDMI/SDVO #define confusion (Paulo)
      - gen2-4 vblank fixes from Ville.
      - Unclaimed register warning fixes for hsw (Paulo). More still to come ...
      - Complete pageflips which have been stuck in a gpu hang, should prevent
        stuck gl compositors (Ville).
      - pm patches for vt-switchless resume (Jesse). Note that the i915 enabling
        is not (yet) included, that took a bit longer to settle. PM patches are
        acked by Rafael Wysocki.
      - Minor fixlets all over from various people.
      
      * tag 'drm-intel-next-2013-03-23' of git://people.freedesktop.org/~danvet/drm-intel: (79 commits)
        drm/i915: Implement WaSwitchSolVfFArbitrationPriority
        drm/i915: Set the VIC in AVI infoframe for SDVO
        drm/i915: Kill a strange comment about DPMS functions
        drm/i915: Correct sandybrige overclocking
        drm/i915: Introduce GEN7_FEATURES for device info
        drm/i915: Move num_pipes to intel info
        drm/i915: fixup pd vs pt confusion in gen6 ppgtt code
        style nit: Align function parameter continuation properly.
        drm/i915: VLV doesn't have HDMI on port C
        drm/i915: DSPFW and BLC regs are in the display offset range
        drm/i915: set conservative clock gating values on VLV v2
        drm/i915: fix WaDisablePSDDualDispatchEnable on VLV v2
        drm/i915: add more VLV IDs
        drm/i915: use VLV DIP routines on VLV v2
        drm/i915: add media well to VLV force wake routines v2
        drm/i915: don't use plane pipe select on VLV
        drm: modify pages_to_sg prime helper to create optimized SG table
        drm/i915: use for_each_sg_page for setting up the gtt ptes
        drm/i915: create compact dma scatter lists for gem objects
        drm/i915: handle walking compact dma scatter lists
        ...
      399403c7
  3. 04 Apr, 2013 5 commits
  4. 03 Apr, 2013 15 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 66ade474
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Another round of ARM fixes, which include:
         - Fixing a problem with LPAE mapping sections
         - Reporting of some hwcaps on Krait CPUs
         - Avoiding repetitive warnings in the breakpoint code
         - Fixing a build error noticed on Dove platforms with PJ4 CPUs
         - Fix masking of level 2 cache revision.
         - Fixing timer-based udelay()
         - A larger fix for an erratum causing people major grief with Cortex
           A15 CPUs"
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7690/1: mm: fix CONFIG_LPAE typos
        ARM: 7689/1: add unwind annotations to ftrace asm
        ARM: 7685/1: delay: use private ticks_per_jiffy field for timer-based delay ops
        ARM: 7684/1: errata: Workaround for Cortex-A15 erratum 798181 (TLBI/DSB operations)
        ARM: 7682/1: cache-l2x0: fix masking of RTL revision numbering and set_debug init
        ARM: iWMMXt: always enable iWMMXt support with PJ4 CPUs
        ARM: 7681/1: hw_breakpoint: use warn_once to avoid spam from reset_ctrl_regs()
        ARM: 7678/1: Work around faulty ISAR0 register in some Krait CPUs
        ARM: 7680/1: Detect support for SDIV/UDIV from ISAR0 register
        ARM: 7679/1: Clear IDIVT hwcap if CONFIG_ARM_THUMB=n
        ARM: 7677/1: LPAE: Fix mapping in alloc_init_section for unaligned addresses
        ARM: KVM: vgic: take distributor lock on sync_hwstate path
        ARM: KVM: vgic: force EOIed LRs to the empty state
      66ade474
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · cbfa0e72
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Unfortunately, we introduced some big-endian bugs during the last
        merge window.  Fortunately, Cai and Christian noticed before 3.9
        shipped."
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix big-endian bugs which could cause fs corruptions
      cbfa0e72
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · cd0e4a9d
      Linus Torvalds authored
      Pull reiserfs fix from Jan Kara:
       "A fix for reiserfs xattr bug exposed by changes to lookup_one_len()"
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        reiserfs: Fix warning and inode leak when deleting inode with xattrs
      cd0e4a9d
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 17eb3d8f
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Just a bunch of bugfixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: provide emtpy check_pgt_cache() function
        s390/uaccess: fix page table walk
        s390/3270: fix minor_start issue
        s390/uaccess: fix clear_user_pt()
        s390/scm_blk: fix error return code in scm_blk_init()
        s390/scm_block: fix printk format string
        drivers/Kconfig: add several missing GENERIC_HARDIRQS dependencies
      17eb3d8f
    • Zheng Liu's avatar
      ext4: fix big-endian bugs which could cause fs corruptions · 8cde7ad1
      Zheng Liu authored
      When an extent was zeroed out, we forgot to do convert from cpu to le16.
      It could make us hit a BUG_ON when we try to write dirty pages out.  So
      fix it.
      
      [ Also fix a bug found by Dmitry Monakhov where we were missing
        le32_to_cpu() calls in the new indirect punch hole code.
      
        There are a number of other big endian warnings found by static code
        analyzers, but we'll wait for the next merge window to fix them all
        up.  These fixes are designed to be Obviously Correct by code
        inspection, and easy to demonstrate that it won't make any
        difference (and hence, won't introduce any bugs) on little endian
        architectures such as x86.  --tytso ]
      Signed-off-by: default avatarZheng Liu <wenqing.lz@taobao.com>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Reported-by: default avatarCAI Qian <caiqian@redhat.com>
      Reported-by: default avatarChristian Kujau <lists@nerdbynature.de>
      Cc: Dmitry Monakhov <dmonakhov@openvz.org>
      8cde7ad1
    • Paul Bolle's avatar
      ARM: 7690/1: mm: fix CONFIG_LPAE typos · 4e1db26a
      Paul Bolle authored
      CONFIG_LPAE doesn't exist: the correct option is CONFIG_ARM_LPAE, so fix
      up the two typos under arch/arm/.
      
      The fix to head.S is slightly scary, but this is just for setting up
      an early io-mapping for the serial port when running on a big-endian,
      LPAE system. Since these systems don't exist in the wild (at least, I
      have no access to one outside of kvmtool, which doesn't provide a serial
      port suitable for earlyprintk), then we can revisit the code later if it
      causes any problems.
      Signed-off-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      4e1db26a
    • Rabin Vincent's avatar
      ARM: 7689/1: add unwind annotations to ftrace asm · b21e023b
      Rabin Vincent authored
      Add unwind annotations to the ftrace assembly code so that the function
      tracer's stacktracing options (func_stack_trace, etc.) work when
      CONFIG_ARM_UNWIND is enabled.
      Signed-off-by: default avatarRabin Vincent <rabin@rab.in>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      b21e023b
    • Will Deacon's avatar
      ARM: 7685/1: delay: use private ticks_per_jiffy field for timer-based delay ops · 6f3d90e5
      Will Deacon authored
      Commit 70264367 ("ARM: 7653/2: do not scale loops_per_jiffy when
      using a constant delay clock") fixed a problem with our timer-based
      delay loop, where loops_per_jiffy is scaled by cpufreq yet used directly
      by the timer delay ops.
      
      This patch fixes the problem in a more elegant way by keeping a private
      ticks_per_jiffy field in the delay ops, independent of loops_per_jiffy
      and therefore not subject to scaling. The loop-based delay continues to
      use loops_per_jiffy directly, as it should.
      Acked-by: default avatarNicolas Pitre <nico@linaro.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      6f3d90e5
    • Catalin Marinas's avatar
      ARM: 7684/1: errata: Workaround for Cortex-A15 erratum 798181 (TLBI/DSB operations) · 93dc6887
      Catalin Marinas authored
      On Cortex-A15 (r0p0..r3p2) the TLBI/DSB are not adequately shooting down
      all use of the old entries. This patch implements the erratum workaround
      which consists of:
      
      1. Dummy TLBIMVAIS and DSB on the CPU doing the TLBI operation.
      2. Send IPI to the CPUs that are running the same mm (and ASID) as the
         one being invalidated (or all the online CPUs for global pages).
      3. CPU receiving the IPI executes a DMB and CLREX (part of the exception
         return code already).
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      93dc6887
    • Rob Herring's avatar
      ARM: 7682/1: cache-l2x0: fix masking of RTL revision numbering and set_debug init · 6e7aceeb
      Rob Herring authored
      Commit b8db6b88 (ARM: 7547/4: cache-l2x0: add support for Aurora L2 cache
      ctrl) moved the masking of the part ID which caused the RTL version to be
      lost. Commit 6248d060 (ARM: 7545/1: cache-l2x0: make outer_cache_fns a
      field of l2x0_of_data) changed how .set_debug is initialized. Both commits
      break commit 74ddcdb8 (ARM: 7608/1: l2x0: Only set .set_debug
      on PL310 r3p0 and earlier) which uses the RTL version to conditionally set
      .set_debug function pointer. Commit b8db6b88 also caused the printed cache
      ID to be missing the version information.
      
      Fix this by reverting how the part number is masked so the RTL version
      info is maintained. The cache-id-part DT property does not set the RTL
      bits so masking them should have no effect. Also, re-arrange the order
      of the function pointer init so the .set_debug function can be overridden.
      Reported-by: default avatarPaolo Pisati <paolo.pisati@canonical.com>
      Signed-off-by: default avatarRob Herring <rob.herring@calxeda.com>
      Cc: Gregory CLEMENT <gregory.clement@free-electrons.com>
      Cc: Yehuda Yitschak <yehuday@marvell.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      6e7aceeb
    • Russell King's avatar
      ARM: iWMMXt: always enable iWMMXt support with PJ4 CPUs · 698613b6
      Russell King authored
      Jason Cooper reports these build errors:
      arch/arm/kernel/built-in.o: In function `iwmmxt_do':
      /.../arch/arm/kernel/pj4-cp0.c:36: undefined reference to `iwmmxt_task_release'
      /.../arch/arm/kernel/pj4-cp0.c:40: undefined reference to `iwmmxt_task_switch'
      make: *** [vmlinux] Error 1
      
      This is caused because the PJ4 code explicitly references the iWMMXt
      code, but doesn't require it to be built.  Fix this by ensuring that
      iWMMXt is always enabled with PJ4.
      Reported-by: default avatarJason Cooper <jason@lakedaemon.net>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      698613b6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · da241efc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix VSOCK layer handling of context ID changes, from Reilly Grant.
      
       2) Now that we have a synchronize_net() in netdev_rx_handler_unregister(),
          we can't let any call sites hold locks.  Unfortunately bonding does,
          so we have to drop the rwlock there a little bit earlier, fix from
          Veaceslav Falico.
      
       3) MAC address setting loop exits one iteration too early in mlx4
          driver, from Yan Burman.
      
       4) Restore ipv6 routes properly upon ifdown/ifup of loopback, from
          Balakumaran Kannan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        VSOCK: Handle changes to the VMCI context ID.
        net IPv6 : Fix broken IPv6 routing table after loopback down-up
        cbq: incorrect processing of high limits
        net/mlx4_en: Fix setting initial MAC address
        bonding: get netdev_rx_handler_unregister out of locks
      da241efc
    • Linus Torvalds's avatar
      Merge tag 'regmap-v3.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap · 6e8517a9
      Linus Torvalds authored
      Pull regmap fixes from Mark Brown:
       "A small collection of fixes.  The most important ones are those from
        Stephen and Lars-Peter both of which fix cache issues that have been
        lurking for a while but not manifesting noticably enough for anyone to
        report them."
      
      * tag 'regmap-v3.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
        regmap: async: Add missing return
        regmap: don't corrupt work buffer in _regmap_raw_write()
        regmap: cache Fix regcache-rbtree sync
        regmap: Initialize `map->debugfs' before regcache
      6e8517a9
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · bd709bd0
      Linus Torvalds authored
      Pull DRM fixes from Dave Airlie:
       "Two core fixes, both regressions, along with some intel and some
        nouveau fixes for regressions and oopses"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm: correctly restore mappings if drm_open fails
        drm/nouveau: fix NULL ptr dereference from nv50_disp_intr()
        drm/nouveau: fix handling empty channel list in ioctl's
        drm: don't unlock in the addfb error paths
        drm/i915: Fix build failure
        drm/i915: Be sure to turn hsync/vsync back on at crt enable (v2)
        drm/i915: duct-tape locking when eDP init fails
      bd709bd0
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · aea7fab8
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "A collection of fixes pretty much across the MIPS code.  Even the
        change to include/linux/signal.h by David Howells' 2a148698 ("Fix
        breakage in MIPS siginfo handling") should be considered MIPS-specific
        as it touches an ifdefed segment that is only relevant to MIPS and
        which unfortunately can't be made to go away entirely."
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        Fix breakage in MIPS siginfo handling
        Revert "MIPS: BCM63XX: Call board_register_device from device_initcall()"
        MIPS: BCM63XX: Make nvram checksum failure non fatal
        MIPS: Fix code generation for non-DSP capable CPUs
        MIPS: Fix inconsistent formatting inside /proc/cpuinfo
        MIPS: SEAD3: Enable LL/SC.
        MIPS: Get rid of CONFIG_CPU_HAS_LLSC again
        MIPS: Add dependencies for HAVE_ARCH_TRANSPARENT_HUGEPAGE
        MIPS: VR4133: Fix probe for LL/SC.
        MIPS: Fix logic errors in bitops.c
        MIPS: Use CONFIG_CPU_MIPSR2 in csum_partial.S
        MIPS: compat: Return same error ENOSYS as native for invalid operation.
      aea7fab8
  5. 02 Apr, 2013 14 commits
    • Ilija Hadzic's avatar
      drm: correctly restore mappings if drm_open fails · a8ec3a66
      Ilija Hadzic authored
      If first drm_open fails, the error-handling path will
      incorrectly restore inode's mapping to NULL. This can
      cause the crash later on. Fix by separately storing
      away mapping pointers that drm_open can touch and
      restore each from its own respective variable if the
      call fails.
      
      Fixes: https://bugzilla.novell.com/show_bug.cgi?id=807850
      (thanks to Michal Hocko for investigating investigating and
      finding the root cause of the bug)
      
      Reference:
      http://lists.freedesktop.org/archives/dri-devel/2013-March/036564.html
      
      v2: Use one variable to store file and inode mapping
          since they are the same at the function entry.
          Fix spelling mistakes in commit message.
      
      v3: Add reference to the original bug report.
      Reported-by: default avatarMarco Munderloh <munderl@tnt.uni-hannover.de>
      Tested-by: default avatarMarco Munderloh <munderl@tnt.uni-hannover.de>
      Signed-off-by: default avatarIlija Hadzic <ihadzic@research.bell-labs.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      a8ec3a66
    • Dave Airlie's avatar
      Merge branch 'drm-nouveau-fixes-3.9' of... · 7cebefe6
      Dave Airlie authored
      Merge branch 'drm-nouveau-fixes-3.9' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-next
      
      Oops fixers.
      * 'drm-nouveau-fixes-3.9' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
        drm/nouveau: fix NULL ptr dereference from nv50_disp_intr()
        drm/nouveau: fix handling empty channel list in ioctl's
      7cebefe6
    • Dave Airlie's avatar
      Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next · 1caa5900
      Dave Airlie authored
      One locking regression fix, and a couple of other i915 ones.
      
      * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
        drm: don't unlock in the addfb error paths
        drm/i915: Fix build failure
        drm/i915: Be sure to turn hsync/vsync back on at crt enable (v2)
        drm/i915: duct-tape locking when eDP init fails
      1caa5900
    • Reilly Grant's avatar
      VSOCK: Handle changes to the VMCI context ID. · 990454b5
      Reilly Grant authored
      The VMCI context ID of a virtual machine may change at any time. There
      is a VMCI event which signals this but datagrams may be processed before
      this is handled. It is therefore necessary to be flexible about the
      destination context ID of any datagrams received. (It can be assumed to
      be correct because it is provided by the hypervisor.) The context ID on
      existing sockets should be updated to reflect how the hypervisor is
      currently referring to the system.
      Signed-off-by: default avatarReilly Grant <grantr@vmware.com>
      Acked-by: default avatarAndy King <acking@vmware.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      990454b5
    • Balakumaran Kannan's avatar
      net IPv6 : Fix broken IPv6 routing table after loopback down-up · 25fb6ca4
      Balakumaran Kannan authored
      IPv6 Routing table becomes broken once we do ifdown, ifup of the loopback(lo)
      interface. After down-up, routes of other interface's IPv6 addresses through
      'lo' are lost.
      
      IPv6 addresses assigned to all interfaces are routed through 'lo' for internal
      communication. Once 'lo' is down, those routing entries are removed from routing
      table. But those removed entries are not being re-created properly when 'lo' is
      brought up. So IPv6 addresses of other interfaces becomes unreachable from the
      same machine. Also this breaks communication with other machines because of
      NDISC packet processing failure.
      
      This patch fixes this issue by reading all interface's IPv6 addresses and adding
      them to IPv6 routing table while bringing up 'lo'.
      
      ==Testing==
      Before applying the patch:
      $ route -A inet6
      Kernel IPv6 routing table
      Destination                    Next Hop                   Flag Met Ref Use If
      2000::20/128                   ::                         U    256 0     0 eth0
      fe80::/64                      ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      ::1/128                        ::                         Un   0   1     0 lo
      2000::20/128                   ::                         Un   0   1     0 lo
      fe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo
      ff00::/8                       ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      $ sudo ifdown lo
      $ sudo ifup lo
      $ route -A inet6
      Kernel IPv6 routing table
      Destination                    Next Hop                   Flag Met Ref Use If
      2000::20/128                   ::                         U    256 0     0 eth0
      fe80::/64                      ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      ::1/128                        ::                         Un   0   1     0 lo
      ff00::/8                       ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      $
      
      After applying the patch:
      $ route -A inet6
      Kernel IPv6 routing
      table
      Destination                    Next Hop                   Flag Met Ref Use If
      2000::20/128                   ::                         U    256 0     0 eth0
      fe80::/64                      ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      ::1/128                        ::                         Un   0   1     0 lo
      2000::20/128                   ::                         Un   0   1     0 lo
      fe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo
      ff00::/8                       ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      $ sudo ifdown lo
      $ sudo ifup lo
      $ route -A inet6
      Kernel IPv6 routing table
      Destination                    Next Hop                   Flag Met Ref Use If
      2000::20/128                   ::                         U    256 0     0 eth0
      fe80::/64                      ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      ::1/128                        ::                         Un   0   1     0 lo
      2000::20/128                   ::                         Un   0   1     0 lo
      fe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo
      ff00::/8                       ::                         U    256 0     0 eth0
      ::/0                           ::                         !n   -1  1     1 lo
      $
      Signed-off-by: default avatarBalakumaran Kannan <Balakumaran.Kannan@ap.sony.com>
      Signed-off-by: default avatarMaruthi Thotad <Maruthi.Thotad@ap.sony.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25fb6ca4
    • Vasily Averin's avatar
      cbq: incorrect processing of high limits · f0f6ee1f
      Vasily Averin authored
      currently cbq works incorrectly for limits > 10% real link bandwidth,
      and practically does not work for limits > 50% real link bandwidth.
      Below are results of experiments taken on 1 Gbit link
      
       In shaper | Actual Result
      -----------+---------------
        100M     | 108 Mbps
        200M     | 244 Mbps
        300M     | 412 Mbps
        500M     | 893 Mbps
      
      This happen because of q->now changes incorrectly in cbq_dequeue():
      when it is called before real end of packet transmitting,
      L2T is greater than real time delay, q_now gets an extra boost
      but never compensate it.
      
      To fix this problem we prevent change of q->now until its synchronization
      with real time.
      Signed-off-by: default avatarVasily Averin <vvs@openvz.org>
      Reviewed-by: default avatarAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f0f6ee1f
    • Stanislav Kinsbursky's avatar
      ipc: set msg back to -EAGAIN if copy wasn't performed · 2dc958fa
      Stanislav Kinsbursky authored
      Make sure that msg pointer is set back to error value in case of
      MSG_COPY flag is set and desired message to copy wasn't found.  This
      garantees that msg is either a error pointer or a copy address.
      
      Otherwise the last message in queue will be freed without unlinking from
      the queue (which leads to memory corruption) and the dummy allocated
      copy won't be released.
      Signed-off-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2dc958fa
    • Yan Burman's avatar
      net/mlx4_en: Fix setting initial MAC address · bab6a9ea
      Yan Burman authored
      Commit 6bbb6d99 "net/mlx4_en: Optimize Rx fast path filter checks" introduced a regression
      under which the MAC address read from the card was not converted correctly
      (the most significant byte was not handled), fix that.
      Reviewed-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Signed-off-by: default avatarYan Burman <yanb@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bab6a9ea
    • Veaceslav Falico's avatar
      bonding: get netdev_rx_handler_unregister out of locks · fcd99434
      Veaceslav Falico authored
      Now that netdev_rx_handler_unregister contains synchronize_net(), we need
      to call it outside of bond->lock, cause it might sleep. Also, remove the
      already unneded synchronize_net().
      Signed-off-by: default avatarVeaceslav Falico <vfalico@redhat.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fcd99434
    • Linus Torvalds's avatar
      Merge tag 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 118c9a45
      Linus Torvalds authored
      Pull ARM SoC bug fixes from Arnd Bergmann:
       "After a quiet set of fixes for 3.9-rc4, a lot of people woke up and
        sent urgent fixes for 3.9.  I pushed back on a number of them that got
        deferred to 3.10, but these are the ones that seemed important.
      
        Regression in 3.9:
      
         - Multiple regressions in OMAP2+ clock cleanup
         - SH-Mobile frame buffer bug fix that merged here because of
           maintainer MIA
         - ux500 prcmu changes broke DT booting
         - MMCI duplicated regulator setup on ux500
         - New ux500 clock driver broke ethernet on snowball
         - Local interrupt driver for mvebu broke ethernet
         - MVEBU GPIO driver did not get set up right on Orion DT
         - incorrect interrupt number on Orion crypto for DT
      
        Long-standing bugs, including candidates for stable:
      
         - Kirkwood MMC needs to disable invalid card detect pins
         - MV SDIO pinmux was wrong on Mirabox
         - GoFlex Net board file needs to set NAND chip delay
         - MSM timer restart race
         - ep93xx early debug code broke in 3.7
         - i.MX CPU hotplug race
         - Incorrect clock setup for OMAP1 USB
         - Workaround for bad clock setup by some old OMAP4 boot loaders
         - Static I/O mappings on cns3xxx since 3.2"
      
      * tag 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: cns3xxx: fix mapping of private memory region
        arm: mvebu: Fix pinctrl for Armada 370 Mirabox SDIO port.
        arm: orion5x: correct IRQ used in dtsi for mv_cesa
        arm: orion5x: fix orion5x.dtsi gpio parameters
        ARM: Kirkwood: fix unused mvsdio gpio pins
        arm: mvebu: Use local interrupt only for the timer 0
        ARM: kirkwood: Fix chip-delay for GoFlex Net
        ARM: ux500: Enable the clock controlling Ethernet on Snowball
        ARM: ux500: Stop passing ios_handler() as an MMCI power controlling call-back
        ARM: ux500: Apply the TCPM and TCDM locations and sizes to dbx5x0 DT
        fbdev: sh_mobile_lcdc: fixup B side hsync adjust settings
        ARM: OMAP: clocks: Delay clk inits atleast until slab is initialized
        ARM: imx: fix sync issue between imx_cpu_die and imx_cpu_kill
        ARM: msm: Stop counting before reprogramming clockevent
        ARM: ep93xx: Fix wait for UART FIFO to be empty
        ARM: OMAP4: PM: fix PM regression introduced by recent clock cleanup
        ARM: OMAP3: hwmod data: keep MIDLEMODE in force-standby for musb
        ARM: OMAP4: clock data: lock USB DPLL on boot
        ARM: OMAP1: fix USB host on 1710
      118c9a45
    • Linus Torvalds's avatar
      Merge branch 'for-3.9' of git://linux-nfs.org/~bfields/linux · f8e9248d
      Linus Torvalds authored
      Pull nfsd bugfix from J Bruce Fields:
       "An xdr decoding error--thanks, Toralf Förster, and Trinity!"
      
      * 'for-3.9' of git://linux-nfs.org/~bfields/linux:
        nfsd4: reject "negative" acl lengths
      f8e9248d
    • Arnd Bergmann's avatar
      Merge tag 'v3.9-rc1_cns3xxx_fixes' of git://git.infradead.org/users/cbou/linux-cns3xxx into fixes · 06d1d8c8
      Arnd Bergmann authored
      From Anton Vorontsov <anton@enomsg.org>:
      
      This tag includes Mac Lin's work to revive CNS3xxx booting:
      
       "Since commit 0536bdf3 (ARM: move iotable mappings within the vmalloc
       region), [...] the pre-defined iotable mappings is not in the vmalloc
       region. [...] move the iotable mappings into the vmalloc region, and
       merge the MPCore private memory region (containing the SCU, the GIC and
       the TWD) as a single region."
      
      Plus there is a small cosmetic fix, also from Mac Lin.
      
      * tag 'v3.9-rc1_cns3xxx_fixes' of git://git.infradead.org/users/cbou/linux-cns3xxx:
        ARM: cns3xxx: fix mapping of private memory region
      
      [arnd: dropped the cosmetic fix from the merge as it is not needed for 3.9]
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      06d1d8c8
    • Heiko Carstens's avatar
      s390/mm: provide emtpy check_pgt_cache() function · 765a0cac
      Heiko Carstens authored
      All architectures need to provide a check_pgt_cache() function. The s390 one
      got lost somewhere.
      So reintroduce it to prevent future compile errors e.g. if Thomas Gleixner's
      idle loop rework patches get merged.
      Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      765a0cac
    • Heiko Carstens's avatar
      s390/uaccess: fix page table walk · ea81531d
      Heiko Carstens authored
      When translating user space addresses to kernel addresses the follow_table()
      function had two bugs:
      
      - PROT_NONE mappings could be read accessed via the kernel mapping. That is
        e.g. putting a filename into a user page, then protecting the page with
        PROT_NONE and afterwards issuing the "open" syscall with a pointer to
        the filename would incorrectly succeed.
      
      - when walking the page tables it used the pgd/pud/pmd/pte primitives which
        with dynamic page tables give no indication which real level of page tables
        is being walked (region2, region3, segment or page table). So in case of an
        exception the translation exception code passed to __handle_fault() is not
        necessarily correct.
        This is not really an issue since __handle_fault() doesn't evaluate the code.
        Only in case of e.g. a SIGBUS this code gets passed to user space. If user
        space can do something sane with the value is a different question though.
      
      To fix these issues don't use any Linux primitives. Only walk the page tables
      like the hardware would do it, however we leave quite some checks away since
      we know that we only have full size page tables and each index is within bounds.
      
      In theory this should fix all issues...
      Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Reviewed-by: default avatarGerald Schaefer <gerald.schaefer@de.ibm.com>
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      ea81531d
  6. 01 Apr, 2013 2 commits
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux · fefcdbe4
      Linus Torvalds authored
      Pull virtio fixes from Rusty Russell:
       "One reversion, a tiny leak fix, and a cc:stable locking fix, in two
        parts"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
        virtio: console: add locking around c_ovq operations
        virtio: console: rename cvq_lock to c_ivq_lock
        hw_random: free rng_buffer at module exit
        Revert "virtio_console: Initialize guest_connected=true for rproc_serial"
      fefcdbe4
    • Anatol Pomozov's avatar
      loop: prevent bdev freeing while device in use · c1681bf8
      Anatol Pomozov authored
      struct block_device lifecycle is defined by its inode (see fs/block_dev.c) -
      block_device allocated first time we access /dev/loopXX and deallocated on
      bdev_destroy_inode. When we create the device "losetup /dev/loopXX afile"
      we want that block_device stay alive until we destroy the loop device
      with "losetup -d".
      
      But because we do not hold /dev/loopXX inode its counter goes 0, and
      inode/bdev can be destroyed at any moment. Usually it happens at memory
      pressure or when user drops inode cache (like in the test below). When later in
      loop_clr_fd() we want to use bdev we have use-after-free error with following
      stack:
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000280
        bd_set_size+0x10/0xa0
        loop_clr_fd+0x1f8/0x420 [loop]
        lo_ioctl+0x200/0x7e0 [loop]
        lo_compat_ioctl+0x47/0xe0 [loop]
        compat_blkdev_ioctl+0x341/0x1290
        do_filp_open+0x42/0xa0
        compat_sys_ioctl+0xc1/0xf20
        do_sys_open+0x16e/0x1d0
        sysenter_dispatch+0x7/0x1a
      
      To prevent use-after-free we need to grab the device in loop_set_fd()
      and put it later in loop_clr_fd().
      
      The issue is reprodusible on current Linus head and v3.3. Here is the test:
      
        dd if=/dev/zero of=loop.file bs=1M count=1
        while [ true ]; do
          losetup /dev/loop0 loop.file
          echo 2 > /proc/sys/vm/drop_caches
          losetup -d /dev/loop0
        done
      
      [ Doing bdgrab/bput in loop_set_fd/loop_clr_fd is safe, because every
        time we call loop_set_fd() we check that loop_device->lo_state is
        Lo_unbound and set it to Lo_bound If somebody will try to set_fd again
        it will get EBUSY.  And if we try to loop_clr_fd() on unbound loop
        device we'll get ENXIO.
      
        loop_set_fd/loop_clr_fd (and any other loop ioctl) is called under
        loop_device->lo_ctl_mutex. ]
      Signed-off-by: default avatarAnatol Pomozov <anatol.pomozov@gmail.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c1681bf8