Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 09bf7fb

Browse files
gregkhgregkh
committed
Merge 4.9.201 into android-4.9-q
Changes in 4.9.201 CDC-NCM: handle incomplete transfer of MTU ipv4: Fix table id reference in fib_sync_down_addr net: fix data-race in neigh_event_send() net: usb: qmi_wwan: add support for DW5821e with eSIM support NFC: fdp: fix incorrect free object nfc: netlink: fix double device reference drop NFC: st21nfca: fix double free qede: fix NULL pointer deref in __qede_remove() ALSA: timer: Fix incorrectly assigned timer instance ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series ALSA: hda/ca0132 - Fix possible workqueue stall mm: thp: handle page cache THP correctly in PageTransCompoundMap mm, vmstat: hide /proc/pagetypeinfo from normal users dump_stack: avoid the livelock of the dump_lock perf tools: Fix time sorting drm/radeon: fix si_enable_smc_cac() failed issue ceph: fix use-after-free in __ceph_remove_cap() iio: imu: adis16480: make sure provided frequency is positive netfilter: nf_tables: Align nft_expr private data to 64-bit netfilter: ipset: Fix an error code in ip_set_sockfn_get() can: usb_8dev: fix use-after-free on disconnect can: c_can: c_can_poll(): only read status register after status IRQ can: peak_usb: fix a potential out-of-sync while decoding packets can: gs_usb: gs_can_open(): prevent memory leak can: peak_usb: fix slab info leak configfs: Fix bool initialization/comparison configfs: stash the data we need into configfs_buffer at open time configfs_register_group() shouldn't be (and isn't) called in rmdirable parts configfs: new object reprsenting tree fragments configfs: provide exclusion between IO and removals configfs: fix a deadlock in configfs_symlink() usbip: stub_rx: fix static checker warning on unnecessary checks usbip: Fix vhci_urb_enqueue() URB null transfer buffer error path usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c drivers: usb: usbip: Add missing break statement to switch PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 dmaengine: xilinx_dma: Fix control reg update in vdma_channel_set_config HID: intel-ish-hid: fix wrong error handling in ishtp_cl_alloc_tx_ring() scsi: qla2xxx: fixup incorrect usage of host_byte scsi: lpfc: Honor module parameter lpfc_use_adisc ipvs: move old_secure_tcp into struct netns_ipvs bonding: fix unexpected IFF_BONDING bit unset usb: fsl: Check memory resource before releasing it usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode. usb: gadget: composite: Fix possible double free memory bug usb: gadget: configfs: fix concurrent issue between composite APIs usb: dwc3: remove the call trace of USBx_GFLADJ perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity perf/x86/amd/ibs: Handle erratum torvalds#420 only on the affected CPU family (10h) USB: Skip endpoints with 0 maxpacket length RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case scsi: qla2xxx: stop timer in shutdown path fjes: Handle workqueue allocation failure net: hisilicon: Fix "Trying to free already-free IRQ" NFSv4: Don't allow a cached open with a revoked delegation net: ethernet: arc: add the missed clk_disable_unprepare igb: Fix constant media auto sense switching when no cable is connected e1000: fix memory leaks x86/apic: Move pending interrupt check code into it's own function x86/apic: Drop logical_smp_processor_id() inline x86/apic/32: Avoid bogus LDR warnings can: flexcan: disable completely the ECC mechanism mm/filemap.c: don't initiate writeback if mapping has no dirty pages cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead net: prevent load/store tearing on sk->sk_stamp drm/i915: kick out cmd_parser specific structs from i915_drv.h drm/i915: cleanup use of INSTR_CLIENT_MASK drm/i915: return EACCES for check_cmd() failures drm/i915: don't whitelist oacontrol in cmd parser drm/i915: Use the precomputed value for whether to enable command parsing drm/i915/cmdparser: Limit clflush to active cachelines drm/i915/gtt: Add read only pages to gen8_pte_encode drm/i915/gtt: Read-only pages for insert_entries on bdw+ drm/i915/gtt: Disable read-only support under GVT drm/i915: Prevent writing into a read-only object via a GGTT mmap drm/i915/cmdparser: Check reg_table_count before derefencing. drm/i915/cmdparser: Do not check past the cmd length. drm/i915: Silence smatch for cmdparser drm/i915: Move engine->needs_cmd_parser to engine->flags drm/i915: Rename gen7 cmdparser tables drm/i915: Disable Secure Batches for gen6+ drm/i915: Remove Master tables from cmdparser drm/i915: Add support for mandatory cmdparsing drm/i915: Support ro ppgtt mapped cmdparser shadow buffers drm/i915: Allow parsing of unsized batches drm/i915: Add gen9 BCS cmdparsing drm/i915/cmdparser: Use explicit goto for error paths drm/i915/cmdparser: Add support for backward jumps drm/i915/cmdparser: Ignore Length operands during command matching drm/i915: Lower RM timeout to avoid DSI hard hangs drm/i915/gen8+: Add RC6 CTX corruption WA drm/i915/cmdparser: Fix jump whitelist clearing Linux 4.9.201 Signed-off-by: Greg Kroah-Hartman <[email protected]>
2 parents 851ba64 + 9829ecf commit 09bf7fb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+1507
-740
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
VERSION = 4
22
PATCHLEVEL = 9
3-
SUBLEVEL = 200
3+
SUBLEVEL = 201
44
EXTRAVERSION =
55
NAME = Roaring Lionus
66

‎arch/x86/events/amd/ibs.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,8 @@ static inline void perf_ibs_disable_event(struct perf_ibs *perf_ibs,
388388
struct hw_perf_event *hwc, u64 config)
389389
{
390390
config &= ~perf_ibs->cnt_mask;
391-
wrmsrl(hwc->config_base, config);
391+
if (boot_cpu_data.x86 == 0x10)
392+
wrmsrl(hwc->config_base, config);
392393
config &= ~perf_ibs->enable_mask;
393394
wrmsrl(hwc->config_base, config);
394395
}
@@ -563,7 +564,8 @@ static struct perf_ibs perf_ibs_op = {
563564
},
564565
.msr = MSR_AMD64_IBSOPCTL,
565566
.config_mask = IBS_OP_CONFIG_MASK,
566-
.cnt_mask = IBS_OP_MAX_CNT,
567+
.cnt_mask = IBS_OP_MAX_CNT | IBS_OP_CUR_CNT |
568+
IBS_OP_CUR_CNT_RAND,
567569
.enable_mask = IBS_OP_ENABLE,
568570
.valid_mask = IBS_OP_VAL,
569571
.max_period = IBS_OP_MAX_CNT << 4,
@@ -624,7 +626,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs)
624626
if (event->attr.sample_type & PERF_SAMPLE_RAW)
625627
offset_max = perf_ibs->offset_max;
626628
else if (check_rip)
627-
offset_max = 2;
629+
offset_max = 3;
628630
else
629631
offset_max = 1;
630632
do {

‎arch/x86/include/asm/smp.h‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -177,16 +177,6 @@ extern int safe_smp_processor_id(void);
177177
#endif
178178

179179
#ifdef CONFIG_X86_LOCAL_APIC
180-
181-
#ifndef CONFIG_X86_64
182-
static inline int logical_smp_processor_id(void)
183-
{
184-
/* we don't want to mark this access volatile - bad code generation */
185-
return GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
186-
}
187-
188-
#endif
189-
190180
extern int hard_smp_processor_id(void);
191181

192182
#else /* CONFIG_X86_LOCAL_APIC */

‎arch/x86/kernel/apic/apic.c‎

Lines changed: 67 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,56 @@ static void lapic_setup_esr(void)
12811281
oldvalue, value);
12821282
}
12831283

1284+
static void apic_pending_intr_clear(void)
1285+
{
1286+
long long max_loops = cpu_khz ? cpu_khz : 1000000;
1287+
unsigned long long tsc = 0, ntsc;
1288+
unsigned int value, queued;
1289+
int i, j, acked = 0;
1290+
1291+
if (boot_cpu_has(X86_FEATURE_TSC))
1292+
tsc = rdtsc();
1293+
/*
1294+
* After a crash, we no longer service the interrupts and a pending
1295+
* interrupt from previous kernel might still have ISR bit set.
1296+
*
1297+
* Most probably by now CPU has serviced that pending interrupt and
1298+
* it might not have done the ack_APIC_irq() because it thought,
1299+
* interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it
1300+
* does not clear the ISR bit and cpu thinks it has already serivced
1301+
* the interrupt. Hence a vector might get locked. It was noticed
1302+
* for timer irq (vector 0x31). Issue an extra EOI to clear ISR.
1303+
*/
1304+
do {
1305+
queued = 0;
1306+
for (i = APIC_ISR_NR - 1; i >= 0; i--)
1307+
queued |= apic_read(APIC_IRR + i*0x10);
1308+
1309+
for (i = APIC_ISR_NR - 1; i >= 0; i--) {
1310+
value = apic_read(APIC_ISR + i*0x10);
1311+
for (j = 31; j >= 0; j--) {
1312+
if (value & (1<<j)) {
1313+
ack_APIC_irq();
1314+
acked++;
1315+
}
1316+
}
1317+
}
1318+
if (acked > 256) {
1319+
printk(KERN_ERR "LAPIC pending interrupts after %d EOI\n",
1320+
acked);
1321+
break;
1322+
}
1323+
if (queued) {
1324+
if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
1325+
ntsc = rdtsc();
1326+
max_loops = (cpu_khz << 10) - (ntsc - tsc);
1327+
} else
1328+
max_loops--;
1329+
}
1330+
} while (queued && max_loops > 0);
1331+
WARN_ON(max_loops <= 0);
1332+
}
1333+
12841334
/**
12851335
* setup_local_APIC - setup the local APIC
12861336
*
@@ -1290,13 +1340,8 @@ static void lapic_setup_esr(void)
12901340
void setup_local_APIC(void)
12911341
{
12921342
int cpu = smp_processor_id();
1293-
unsigned int value, queued;
1294-
int i, j, acked = 0;
1295-
unsigned long long tsc = 0, ntsc;
1296-
long long max_loops = cpu_khz ? cpu_khz : 1000000;
1343+
unsigned int value;
12971344

1298-
if (boot_cpu_has(X86_FEATURE_TSC))
1299-
tsc = rdtsc();
13001345

13011346
if (disable_apic) {
13021347
disable_ioapic_support();
@@ -1336,16 +1381,21 @@ void setup_local_APIC(void)
13361381
apic->init_apic_ldr();
13371382

13381383
#ifdef CONFIG_X86_32
1339-
/*
1340-
* APIC LDR is initialized. If logical_apicid mapping was
1341-
* initialized during get_smp_config(), make sure it matches the
1342-
* actual value.
1343-
*/
1344-
i = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
1345-
WARN_ON(i != BAD_APICID && i != logical_smp_processor_id());
1346-
/* always use the value from LDR */
1347-
early_per_cpu(x86_cpu_to_logical_apicid, cpu) =
1348-
logical_smp_processor_id();
1384+
if (apic->dest_logical) {
1385+
int logical_apicid, ldr_apicid;
1386+
1387+
/*
1388+
* APIC LDR is initialized. If logical_apicid mapping was
1389+
* initialized during get_smp_config(), make sure it matches
1390+
* the actual value.
1391+
*/
1392+
logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
1393+
ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
1394+
if (logical_apicid != BAD_APICID)
1395+
WARN_ON(logical_apicid != ldr_apicid);
1396+
/* Always use the value from LDR. */
1397+
early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
1398+
}
13491399
#endif
13501400

13511401
/*
@@ -1356,45 +1406,7 @@ void setup_local_APIC(void)
13561406
value &= ~APIC_TPRI_MASK;
13571407
apic_write(APIC_TASKPRI, value);
13581408

1359-
/*
1360-
* After a crash, we no longer service the interrupts and a pending
1361-
* interrupt from previous kernel might still have ISR bit set.
1362-
*
1363-
* Most probably by now CPU has serviced that pending interrupt and
1364-
* it might not have done the ack_APIC_irq() because it thought,
1365-
* interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it
1366-
* does not clear the ISR bit and cpu thinks it has already serivced
1367-
* the interrupt. Hence a vector might get locked. It was noticed
1368-
* for timer irq (vector 0x31). Issue an extra EOI to clear ISR.
1369-
*/
1370-
do {
1371-
queued = 0;
1372-
for (i = APIC_ISR_NR - 1; i >= 0; i--)
1373-
queued |= apic_read(APIC_IRR + i*0x10);
1374-
1375-
for (i = APIC_ISR_NR - 1; i >= 0; i--) {
1376-
value = apic_read(APIC_ISR + i*0x10);
1377-
for (j = 31; j >= 0; j--) {
1378-
if (value & (1<<j)) {
1379-
ack_APIC_irq();
1380-
acked++;
1381-
}
1382-
}
1383-
}
1384-
if (acked > 256) {
1385-
printk(KERN_ERR "LAPIC pending interrupts after %d EOI\n",
1386-
acked);
1387-
break;
1388-
}
1389-
if (queued) {
1390-
if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
1391-
ntsc = rdtsc();
1392-
max_loops = (cpu_khz << 10) - (ntsc - tsc);
1393-
} else
1394-
max_loops--;
1395-
}
1396-
} while (queued && max_loops > 0);
1397-
WARN_ON(max_loops <= 0);
1409+
apic_pending_intr_clear();
13981410

13991411
/*
14001412
* Now that we are all set up, enable the APIC

‎drivers/dma/xilinx/xilinx_dma.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@
7272
#define XILINX_DMA_DMACR_CIRC_EN BIT(1)
7373
#define XILINX_DMA_DMACR_RUNSTOP BIT(0)
7474
#define XILINX_DMA_DMACR_FSYNCSRC_MASK GENMASK(6, 5)
75+
#define XILINX_DMA_DMACR_DELAY_MASK GENMASK(31, 24)
76+
#define XILINX_DMA_DMACR_FRAME_COUNT_MASK GENMASK(23, 16)
77+
#define XILINX_DMA_DMACR_MASTER_MASK GENMASK(11, 8)
7578

7679
#define XILINX_DMA_REG_DMASR 0x0004
7780
#define XILINX_DMA_DMASR_EOL_LATE_ERR BIT(15)
@@ -2054,8 +2057,10 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
20542057
chan->config.gen_lock = cfg->gen_lock;
20552058
chan->config.master = cfg->master;
20562059

2060+
dmacr &= ~XILINX_DMA_DMACR_GENLOCK_EN;
20572061
if (cfg->gen_lock && chan->genlock) {
20582062
dmacr |= XILINX_DMA_DMACR_GENLOCK_EN;
2063+
dmacr &= ~XILINX_DMA_DMACR_MASTER_MASK;
20592064
dmacr |= cfg->master << XILINX_DMA_DMACR_MASTER_SHIFT;
20602065
}
20612066

@@ -2069,11 +2074,13 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
20692074
chan->config.delay = cfg->delay;
20702075

20712076
if (cfg->coalesc <= XILINX_DMA_DMACR_FRAME_COUNT_MAX) {
2077+
dmacr &= ~XILINX_DMA_DMACR_FRAME_COUNT_MASK;
20722078
dmacr |= cfg->coalesc << XILINX_DMA_DMACR_FRAME_COUNT_SHIFT;
20732079
chan->config.coalesc = cfg->coalesc;
20742080
}
20752081

20762082
if (cfg->delay <= XILINX_DMA_DMACR_DELAY_MAX) {
2083+
dmacr &= ~XILINX_DMA_DMACR_DELAY_MASK;
20772084
dmacr |= cfg->delay << XILINX_DMA_DMACR_DELAY_SHIFT;
20782085
chan->config.delay = cfg->delay;
20792086
}

‎drivers/gpu/drm/drm_gem.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -996,6 +996,15 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
996996
return -EACCES;
997997
}
998998

999+
if (node->readonly) {
1000+
if (vma->vm_flags & VM_WRITE) {
1001+
drm_gem_object_unreference_unlocked(obj);
1002+
return -EINVAL;
1003+
}
1004+
1005+
vma->vm_flags &= ~VM_MAYWRITE;
1006+
}
1007+
9991008
ret = drm_gem_mmap_obj(obj, drm_vma_node_size(node) << PAGE_SHIFT,
10001009
vma);
10011010

0 commit comments

Comments
 (0)