1. 21 Aug, 2013 5 commits
  2. 20 Aug, 2013 7 commits
    • David Daney's avatar
      MIPS: Handle OCTEON BBIT instructions in FPU emulator. · c26d4219
      David Daney authored
      The branch emulation needs to handle the OCTEON BBIT instructions,
      otherwise we get SIGILL instead of emulation.
      Signed-off-by: default avatarDavid Daney <david.daney@cavium.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/5726/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      c26d4219
    • Chuck Anderson's avatar
      xen/smp: initialize IPI vectors before marking CPU online · fc78d343
      Chuck Anderson authored
      An older PVHVM guest (v3.0 based) crashed during vCPU hot-plug with:
      
      	kernel BUG at drivers/xen/events.c:1328!
      
      RCU has detected that a CPU has not entered a quiescent state within the
      grace period.  It needs to send the CPU a reschedule IPI if it is not
      offline.  rcu_implicit_offline_qs() does this check:
      
      	/*
      	 * If the CPU is offline, it is in a quiescent state.  We can
      	 * trust its state not to change because interrupts are disabled.
      	 */
      	if (cpu_is_offline(rdp->cpu)) {
      		rdp->offline_fqs++;
      		return 1;
      	}
      
      	Else the CPU is online.  Send it a reschedule IPI.
      
      The CPU is in the middle of being hot-plugged and has been marked online
      (!cpu_is_offline()).  See start_secondary():
      
      	set_cpu_online(smp_processor_id(), true);
      	...
      	per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
      
      start_secondary() then waits for the CPU bringing up the hot-plugged CPU to
      mark it as active:
      
      	/*
      	 * Wait until the cpu which brought this one up marked it
      	 * online before enabling interrupts. If we don't do that then
      	 * we can end up waking up the softirq thread before this cpu
      	 * reached the active state, which makes the scheduler unhappy
      	 * and schedule the softirq thread on the wrong cpu. This is
      	 * only observable with forced threaded interrupts, but in
      	 * theory it could also happen w/o them. It's just way harder
      	 * to achieve.
      	 */
      	while (!cpumask_test_cpu(smp_processor_id(), cpu_active_mask))
      		cpu_relax();
      
      	/* enable local interrupts */
      	local_irq_enable();
      
      The CPU being hot-plugged will be marked active after it has been fully
      initialized by the CPU managing the hot-plug.  In the Xen PVHVM case
      xen_smp_intr_init() is called to set up the hot-plugged vCPU's
      XEN_RESCHEDULE_VECTOR.
      
      The hot-plugging CPU is marked online, not marked active and does not have
      its IPI vectors set up.  rcu_implicit_offline_qs() sees the hot-plugging
      cpu is !cpu_is_offline() and tries to send it a reschedule IPI:
      This will lead to:
      
      	kernel BUG at drivers/xen/events.c:1328!
      
      	xen_send_IPI_one()
      	xen_smp_send_reschedule()
      	rcu_implicit_offline_qs()
      	rcu_implicit_dynticks_qs()
      	force_qs_rnp()
      	force_quiescent_state()
      	__rcu_process_callbacks()
      	rcu_process_callbacks()
      	__do_softirq()
      	call_softirq()
      	do_softirq()
      	irq_exit()
      	xen_evtchn_do_upcall()
      
      because xen_send_IPI_one() will attempt to use an uninitialized IRQ for
      the XEN_RESCHEDULE_VECTOR.
      
      There is at least one other place that has caused the same crash:
      
      	xen_smp_send_reschedule()
      	wake_up_idle_cpu()
      	add_timer_on()
      	clocksource_watchdog()
      	call_timer_fn()
      	run_timer_softirq()
      	__do_softirq()
      	call_softirq()
      	do_softirq()
      	irq_exit()
      	xen_evtchn_do_upcall()
      	xen_hvm_callback_vector()
      
      clocksource_watchdog() uses cpu_online_mask to pick the next CPU to handle
      a watchdog timer:
      
      	/*
      	 * Cycle through CPUs to check if the CPUs stay synchronized
      	 * to each other.
      	 */
      	next_cpu = cpumask_next(raw_smp_processor_id(), cpu_online_mask);
      	if (next_cpu >= nr_cpu_ids)
      		next_cpu = cpumask_first(cpu_online_mask);
      	watchdog_timer.expires += WATCHDOG_INTERVAL;
      	add_timer_on(&watchdog_timer, next_cpu);
      
      This resulted in an attempt to send an IPI to a hot-plugging CPU that
      had not initialized its reschedule vector. One option would be to make
      the RCU code check to not check for CPU offline but for CPU active.
      As becoming active is done after a CPU is online (in older kernels).
      
      But Srivatsa pointed out that "the cpu_active vs cpu_online ordering has been
      completely reworked - in the online path, cpu_active is set *before* cpu_online,
      and also, in the cpu offline path, the cpu_active bit is reset in the CPU_DYING
      notification instead of CPU_DOWN_PREPARE." Drilling in this the bring-up
      path: "[brought up CPU].. send out a CPU_STARTING notification, and in response
      to that, the scheduler sets the CPU in the cpu_active_mask. Again, this mask
      is better left to the scheduler alone, since it has the intelligence to use it
      judiciously."
      
      The conclusion was that:
      "
      1. At the IPI sender side:
      
         It is incorrect to send an IPI to an offline CPU (cpu not present in
         the cpu_online_mask). There are numerous places where we check this
         and warn/complain.
      
      2. At the IPI receiver side:
      
         It is incorrect to let the world know of our presence (by setting
         ourselves in global bitmasks) until our initialization steps are complete
         to such an extent that we can handle the consequences (such as
         receiving interrupts without crashing the sender etc.)
      " (from Srivatsa)
      
      As the native code enables the interrupts at some point we need to be
      able to service them. In other words a CPU must have valid IPI vectors
      if it has been marked online.
      
      It doesn't need to handle the IPI (interrupts may be disabled) but needs
      to have valid IPI vectors because another CPU may find it in cpu_online_mask
      and attempt to send it an IPI.
      
      This patch will change the order of the Xen vCPU bring-up functions so that
      Xen vectors have been set up before start_secondary() is called.
      It also will not continue to bring up a Xen vCPU if xen_smp_intr_init() fails
      to initialize it.
      
      Orabug 13823853
      Signed-off-by Chuck Anderson <chuck.anderson@oracle.com>
      Acked-by: default avatarSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      fc78d343
    • David Vrabel's avatar
      xen/events: mask events when changing their VCPU binding · 4704fe4f
      David Vrabel authored
      When a event is being bound to a VCPU there is a window between the
      EVTCHNOP_bind_vpcu call and the adjustment of the local per-cpu masks
      where an event may be lost.  The hypervisor upcalls the new VCPU but
      the kernel thinks that event is still bound to the old VCPU and
      ignores it.
      
      There is even a problem when the event is being bound to the same VCPU
      as there is a small window beween the clear_bit() and set_bit() calls
      in bind_evtchn_to_cpu().  When scanning for pending events, the kernel
      may read the bit when it is momentarily clear and ignore the event.
      
      Avoid this by masking the event during the whole bind operation.
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
      CC: stable@vger.kernel.org
      4704fe4f
    • David Vrabel's avatar
      xen/events: initialize local per-cpu mask for all possible events · 84ca7a8e
      David Vrabel authored
      The sizeof() argument in init_evtchn_cpu_bindings() is incorrect
      resulting in only the first 64 (or 32 in 32-bit guests) ports having
      their bindings being initialized to VCPU 0.
      
      In most cases this does not cause a problem as request_irq() will set
      the irq affinity which will set the correct local per-cpu mask.
      However, if the request_irq() is called on a VCPU other than 0, there
      is a window between the unmasking of the event and the affinity being
      set were an event may be lost because it is not locally unmasked on
      any VCPU. If request_irq() is called on VCPU 0 then local irqs are
      disabled during the window and the race does not occur.
      
      Fix this by initializing all NR_EVENT_CHANNEL bits in the local
      per-cpu masks.
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      CC: stable@vger.kernel.org
      84ca7a8e
    • David Vrabel's avatar
      x86/xen: do not identity map UNUSABLE regions in the machine E820 · 3bc38cbc
      David Vrabel authored
      If there are UNUSABLE regions in the machine memory map, dom0 will
      attempt to map them 1:1 which is not permitted by Xen and the kernel
      will crash.
      
      There isn't anything interesting in the UNUSABLE region that the dom0
      kernel needs access to so we can avoid making the 1:1 mapping and
      treat it as RAM.
      
      We only do this for dom0, as that is where tboot case shows up.
      A PV domU could have an UNUSABLE region in its pseudo-physical map
      and would need to be handled in another patch.
      
      This fixes a boot failure on hosts with tboot.
      
      tboot marks a region in the e820 map as unusable and the dom0 kernel
      would attempt to map this region and Xen does not permit unusable
      regions to be mapped by guests.
      
        (XEN)  0000000000000000 - 0000000000060000 (usable)
        (XEN)  0000000000060000 - 0000000000068000 (reserved)
        (XEN)  0000000000068000 - 000000000009e000 (usable)
        (XEN)  0000000000100000 - 0000000000800000 (usable)
        (XEN)  0000000000800000 - 0000000000972000 (unusable)
      
      tboot marked this region as unusable.
      
        (XEN)  0000000000972000 - 00000000cf200000 (usable)
        (XEN)  00000000cf200000 - 00000000cf38f000 (reserved)
        (XEN)  00000000cf38f000 - 00000000cf3ce000 (ACPI data)
        (XEN)  00000000cf3ce000 - 00000000d0000000 (reserved)
        (XEN)  00000000e0000000 - 00000000f0000000 (reserved)
        (XEN)  00000000fe000000 - 0000000100000000 (reserved)
        (XEN)  0000000100000000 - 0000000630000000 (usable)
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      [v1: Altered the patch and description with domU's with UNUSABLE regions]
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      3bc38cbc
    • Will Deacon's avatar
      arm64: perf: fix event validation for software group leaders · ee7538a0
      Will Deacon authored
      This is a port of c95eb318 ("ARM: 7809/1: perf: fix event validation
      for software group leaders") to arm64, which fixes a panic in the arm64
      perf backend found as a result of Vince's fuzzing tool.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      ee7538a0
    • Will Deacon's avatar
      arm64: perf: fix array out of bounds access in armpmu_map_hw_event() · 868f6fea
      Will Deacon authored
      This is a port of d9f96635 ("ARM: 7810/1: perf: Fix array out of
      bounds access in armpmu_map_hw_event()") to arm64, which fixes an oops
      in the arm64 perf backend found as a result of Vince's fuzzing tool.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      868f6fea
  3. 19 Aug, 2013 15 commits
  4. 18 Aug, 2013 2 commits
  5. 17 Aug, 2013 4 commits
  6. 16 Aug, 2013 7 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 2620bf06
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "The usual collection of random fixes.  Also some further fixes to the
        last set of security fixes, and some more from Will (which you may
        already have in a slightly different form)"
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7807/1: kexec: validate CPU hotplug support
        ARM: 7812/1: rwlocks: retry trylock operation if strex fails on free lock
        ARM: 7811/1: locks: use early clobber in arch_spin_trylock
        ARM: 7810/1: perf: Fix array out of bounds access in armpmu_map_hw_event()
        ARM: 7809/1: perf: fix event validation for software group leaders
        ARM: Fix FIQ code on VIVT CPUs
        ARM: Fix !kuser helpers case
        ARM: Fix the world famous typo with is_gate_vma()
      2620bf06
    • Linus Torvalds's avatar
      Merge branch 'for-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k · 359d16ca
      Linus Torvalds authored
      Pull m68k fixes from Geert Uytterhoeven:
       "These are two critical fixes, needed by distro kernels, and thus also
        destined for stable:
      
         - The do_div() commit fixes a crash in mounting btrfs volumes, which
           was a regression from 3.2,
      
         - The ARAnyM fix allows to have NatFeat drivers as loadable modules,
           which is needed for initrds"
      
      * 'for-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
        m68k: Truncate base in do_div()
        m68k/atari: ARAnyM - Fix NatFeat module support
      359d16ca
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux · 0f7dd1aa
      Linus Torvalds authored
      Pull clock controller fixes from Michael Turquette:
       "Two small fixes for the Zynq clock controller introduced in 3.11-rc1
        and another Exynos clock patch which fixes a regression that prevents
        the video pipeline from functioning on that platform"
      
      * tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
        clk: exynos4: Add CLK_GET_RATE_NOCACHE flag for the Exynos4x12 ISP clocks
        clk/zynq/clkc: Add CLK_SET_RATE_PARENT flag to ethernet muxes
        clk/zynq/clkc: Add dedicated spinlock for the SWDT
      0f7dd1aa
    • Linus Torvalds's avatar
      Merge tag 'pm-3.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2d2843e6
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "The removal of delayed_work_pending() checks from kernel/power/qos.c
        done in 3.9 introduced a deadlock in pm_qos_work_fn().
      
        Fix from Stephen Boyd"
      
      * tag 'pm-3.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / QoS: Fix workqueue deadlock when using pm_qos_update_request_timeout()
      2d2843e6
    • Linus Torvalds's avatar
      Merge tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · f43c6064
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This batch contains a few USB audio fixes, a couple of HD-audio
        quirks, various small ASoC driver fixes in addition to an ASoC core
        fix that may lead to memory corruption.
      
        Unfortunately slightly more volume than the previous pull request, but
        all are reasonable regression fixes"
      
      * tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Add a fixup for Gateway LT27
        ASoC: tegra: fix Tegra30 I2S capture parameter setup
        ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam C525
        ALSA: hda - Fix missing mute controls for CX5051
        ALSA: usb-audio: fix automatic Roland/Yamaha MIDI detection
        ALSA: 6fire: make buffers DMA-able (midi)
        ALSA: 6fire: make buffers DMA-able (pcm)
        ALSA: hda - Add pinfix for LG LW25 laptop
        ASoC: cs42l52: Add new TLV for Beep Volume
        ASoC: cs42l52: Reorder Min/Max and update to SX_TLV for Beep Volume
        ASoC: dapm: Fix empty list check in dapm_new_mux()
        ASoC: sgtl5000: fix buggy 'Capture Attenuate Switch' control
        ASoC: sgtl5000: prevent playback to be muted when terminating concurrent capture
      f43c6064
    • Linus Torvalds's avatar
      Merge tag 'usb-3.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 89cb9ae2
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB fixes for 3.11-rc6 that have accumulated.
      
        Nothing huge, a EHCI fix that solves a much-reported audio USB
        problem, some usb-serial driver endian fixes and other minor fixes, a
        wireless USB oops fix, and two new quirks"
      
      * tag 'usb-3.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        USB: keyspan: fix null-deref at disconnect and release
        USB: mos7720: fix broken control requests
        usb: add two quirky touchscreen
        USB: ti_usb_3410_5052: fix big-endian firmware handling
        USB: adutux: fix big-endian device-type reporting
        USB: usbtmc: fix big-endian probe of Rigol devices
        USB: mos7840: fix big-endian probe
        USB-Serial: Fix error handling of usb_wwan
        wusbcore: fix kernel panic when disconnecting a wireless USB->serial device
        USB: EHCI: accept very late isochronous URBs
      89cb9ae2
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · ddea368c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix SKB leak in 8139cp, from Dave Jones.
      
       2) Fix use of *_PAGES interfaces with mlx5 firmware, from Moshe Lazar.
      
       3) RCU conversion of macvtap introduced two races, fixes by Eric
          Dumazet
      
       4) Synchronize statistic flows in bnx2x driver to prevent corruption,
          from Dmitry Kravkov
      
       5) Undo optimization in IP tunneling, we were using the inner IP header
          in some cases to inherit the IP ID, but that isn't correct in some
          circumstances.  From Pravin B Shelar
      
       6) Use correct struct size when parsing netlink attributes in
          rtnl_bridge_getlink().  From Asbjoern Sloth Toennesen
      
       7) Length verifications in tun_get_user() are bogus, from Weiping Pan
          and Dan Carpenter
      
       8) Fix bad merge resolution during 3.11 networking development in
          openvswitch, albeit a harmless one which added some unreachable
          code.  From Jesse Gross
      
       9) Wrong size used in flexible array allocation in openvswitch, from
          Pravin B Shelar
      
      10) Clear out firmware capability flags the be2net driver isn't ready to
          handle yet, from Sarveshwar Bandi
      
      11) Revert DMA mapping error checking addition to cxgb3 driver, it's
          buggy.  From Alexey Kardashevskiy
      
      12) Fix regression in packet scheduler rate limiting when working with a
          link layer of ATM.  From Jesper Dangaard Brouer
      
      13) Fix several errors in TCP Cubic congestion control, in particular
          overflow errors in timestamp calculations.  From Eric Dumazet and
          Van Jacobson
      
      14) In ipv6 routing lookups, we need to backtrack if subtree traversal
          don't result in a match.  From Hannes Frederic Sowa
      
      15) ipgre_header() returns incorrect packet offset.  Fix from Timo Teräs
      
      16) Get "low latency" out of the new MIB counter names.  From Eliezer
          Tamir
      
      17) State check in ndo_dflt_fdb_del() is inverted, from Sridhar
          Samudrala
      
      18) Handle TCP Fast Open properly in netfilter conntrack, from Yuchung
          Cheng
      
      19) Wrong memcpy length in pcan_usb driver, from Stephane Grosjean
      
      20) Fix dealock in TIPC, from Wang Weidong and Ding Tianhong
      
      21) call_rcu() call to destroy SCTP transport is done too early and
          might result in an oops.  From Daniel Borkmann
      
      22) Fix races in genetlink family dumps, from Johannes Berg
      
      23) Flags passed into macvlan by the user need to be validated properly,
          from Michael S Tsirkin
      
      24) Fix skge build on 32-bit, from Stephen Hemminger
      
      25) Handle malformed TCP headers properly in xt_TCPMSS, from Pablo Neira
          Ayuso
      
      26) Fix handling of stacked vlans in vlan_dev_real_dev(), from Nikolay
          Aleksandrov
      
      27) Eliminate MTU calculation overflows in esp{4,6}, from Daniel
          Borkmann
      
      28) neigh_parms need to be setup before calling the ->ndo_neigh_setup()
          method.  From Veaceslav Falico
      
      29) Kill out-of-bounds prefetch in fib_trie, from Eric Dumazet
      
      30) Don't dereference MLD query message if the length isn't value in the
          bridge multicast code, from Linus Lüssing
      
      31) Fix VXLAN IGMP join regression due to an inverted check, from Cong
          Wang
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (70 commits)
        net/mlx5_core: Support MANAGE_PAGES and QUERY_PAGES firmware command changes
        tun: signedness bug in tun_get_user()
        qlcnic: Fix diagnostic interrupt test for 83xx adapters
        qlcnic: Fix beacon state return status handling
        qlcnic: Fix set driver version command
        net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
        net_sched: restore "linklayer atm" handling
        drivers/net/ethernet/via/via-velocity.c: update napi implementation
        Revert "cxgb3: Check and handle the dma mapping errors"
        be2net: Clear any capability flags that driver is not interested in.
        openvswitch: Reset tunnel key between input and output.
        openvswitch: Use correct type while allocating flex array.
        openvswitch: Fix bad merge resolution.
        tun: compare with 0 instead of total_len
        rtnetlink: rtnl_bridge_getlink: Call nlmsg_find_attr() with ifinfomsg header
        ethernet/arc/arc_emac - fix NAPI "work > weight" warning
        ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id.
        bnx2x: prevent crash in shutdown flow with CNIC
        bnx2x: fix PTE write access error
        bnx2x: fix memory leak in VF
        ...
      ddea368c