1. 12 Sep, 2016 1 commit
    • Gautham R. Shenoy's avatar
      powerpc/powernv: Fix restore of SPRs upon wake up from hypervisor state loss · bd00a240
      Gautham R. Shenoy authored
      pnv_wakeup_tb_loss() currently expects cr4 to be "eq" if the CPU is
      waking up from a complete hypervisor state loss. Hence, it currently
      restores the SPR contents only if cr4 is "eq".
      
      However, after commit bcef83a0 ("powerpc/powernv: Add platform
      support for stop instruction"), on ISA v3.0 CPUs, the function
      pnv_restore_hyp_resource() sets cr4 to contain the result of the
      comparison between the state the CPU has woken up from and the first
      deep stop state before calling pnv_wakeup_tb_loss().
      
      Thus if the CPU woke up from a state that is deeper than the first
      deep stop state, cr4 will have "gt" set and hence, pnv_wakeup_tb_loss()
      will fail to restore the SPRs on waking up from such a state.
      
      Fix the code in pnv_wakeup_tb_loss() to restore the SPR states when cr4
      is "eq" or "gt".
      
      Fixes: bcef83a0
      
       ("powerpc/powernv: Add platform support for stop instruction")
      Signed-off-by: default avatarGautham R. Shenoy <ego@linux.vnet.ibm.com>
      Reviewed-by: default avatarShreyas B. Prabhu <shreyasbp@gmail.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      bd00a240
  2. 08 Sep, 2016 3 commits
    • Paul Mackerras's avatar
      powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET · f077aaf0
      Paul Mackerras authored
      In commit c60ac569 ("powerpc: Update kernel VSID range", 2013-03-13)
      we lost a check on the region number (the top four bits of the effective
      address) for addresses below PAGE_OFFSET.  That commit replaced a check
      that the top 18 bits were all zero with a check that bits 46 - 59 were
      zero (performed for all addresses, not just user addresses).
      
      This means that userspace can access an address like 0x1000_0xxx_xxxx_xxxx
      and we will insert a valid SLB entry for it.  The VSID used will be the
      same as if the top 4 bits were 0, but the page size will be some random
      value obtained by indexing beyond the end of the mm_ctx_high_slices_psize
      array in the paca.  If that page size is the same as would be used for
      region 0, then userspace just has an alias of the region 0 space.  If the
      page size is different, then no HPTE will be found for the access, and
      the process will get a SIGSEGV (since hash_page_mm() will refuse to create
      a HPTE for the bogus address).
      
      The access beyond the end of the mm_ctx_high_slices_psize can be at most
      5.5MB past the array, and so will be in RAM somewhere.  Since the access
      is a load performed in real mode, it won't fault or crash the kernel.
      At most this bug could perhaps leak a little bit of information about
      blocks of 32 bytes of memory located at offsets of i * 512kB past the
      paca->mm_ctx_high_slices_psize array, for 1 <= i <= 11.
      
      Fixes: c60ac569
      
       ("powerpc: Update kernel VSID range")
      Cc: stable@vger.kernel.org # v3.9+
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      Reviewed-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      f077aaf0
    • Christophe Leroy's avatar
      powerpc/32: Fix again csum_partial_copy_generic() · 8540571e
      Christophe Leroy authored
      Commit 7aef4136 ("powerpc32: rewrite csum_partial_copy_generic()
      based on copy_tofrom_user()") introduced a bug when destination address
      is odd and len is lower than cacheline size.
      
      In that case the resulting csum value doesn't have to be rotated one
      byte because the cache-aligned copy part is skipped so no alignment
      is performed.
      
      Fixes: 7aef4136
      
       ("powerpc32: rewrite csum_partial_copy_generic() based on copy_tofrom_user()")
      Cc: stable@vger.kernel.org # v4.6+
      Reported-by: default avatarAlessio Igor Bogani <alessio.bogani@elettra.eu>
      Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
      Tested-by: default avatarAlessio Igor Bogani <alessio.bogani@elettra.eu>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      8540571e
    • Gavin Shan's avatar
      powerpc/powernv: Fix corrupted PE allocation bitmap on releasing PE · caa58f80
      Gavin Shan authored
      In pnv_ioda_free_pe(), the PE object (including the associated PE
      number) is cleared before resetting the corresponding bit in the
      PE allocation bitmap. It means PE#0 is always released to the bitmap
      wrongly.
      
      This fixes above issue by caching the PE number before the PE object
      is cleared.
      
      Fixes: 1e916772
      
       ("powerpc/powernv: Use PE instead of number during setup and release"
      Cc: stable@vger.kernel.org # v4.7+
      Signed-off-by: default avatarGavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      caa58f80
  3. 06 Sep, 2016 3 commits
    • Gavin Shan's avatar
      powerpc/powernv: Fix crash on releasing compound PE · b314427a
      Gavin Shan authored
      The compound PE is created to accommodate the devices attached to
      one specific PCI bus that consume multiple M64 segments. The compound
      PE is made up of one master PE and possibly multiple slave PEs. The
      slave PEs should be destroyed when releasing the master PE. A kernel
      crash happens when derferencing @pe->pdev on releasing the slave PE
      in pnv_ioda_deconfigure_pe().
      
        # echo 0 > /sys/bus/pci/slots/C7/power
        iommu: Removing device 0000:01:00.1 from group 0
        iommu: Removing device 0000:01:00.0 from group 0
        Unable to handle kernel paging request for data at address 0x00000010
        Faulting instruction address: 0xc00000000005d898
        cpu 0x1: Vector: 300 (Data Access) at [c000000fe8217620]
            pc: c00000000005d898: pnv_ioda_release_pe+0x288/0x610
            lr: c00000000005dbdc: pnv_ioda_release_pe+0x5cc/0x610
            sp: c000000fe82178a0
           msr: 9000000000009033
           dar: 10
         dsisr: 40000000
          current = 0xc000000fe815ab80
          paca    = 0xc00000000ff00400	 softe: 0	 irq_happened: 0x01
            pid   = 2709, comm = sh
        Linux version 4.8.0-rc5-gavin-00006-g745efdb (gwshan@gwshan) \
        (gcc version 4.9.3 (Buildroot 2016.02-rc2-00093-g5ea3bce) ) #586 SMP \
        Tue Sep 6 13:37:29 AEST 2016
        enter ? for help
        [c000000fe8217940] c00000000005d684 pnv_ioda_release_pe+0x74/0x610
        [c000000fe82179e0] c000000000034460 pcibios_release_device+0x50/0x70
        [c000000fe8217a10] c0000000004aba80 pci_release_dev+0x50/0xa0
        [c000000fe8217a40] c000000000704898 device_release+0x58/0xf0
        [c000000fe8217ac0] c000000000470510 kobject_release+0x80/0xf0
        [c000000fe8217b00] c000000000704dd4 put_device+0x24/0x40
        [c000000fe8217b20] c0000000004af94c pci_remove_bus_device+0x12c/0x150
        [c000000fe8217b60] c000000000034244 pci_hp_remove_devices+0x94/0xd0
        [c000000fe8217ba0] c0000000004ca444 pnv_php_disable_slot+0x64/0xb0
        [c000000fe8217bd0] c0000000004c88c0 power_write_file+0xa0/0x190
        [c000000fe8217c50] c0000000004c248c pci_slot_attr_store+0x3c/0x60
        [c000000fe8217c70] c0000000002d6494 sysfs_kf_write+0x94/0xc0
        [c000000fe8217cb0] c0000000002d50f0 kernfs_fop_write+0x180/0x260
        [c000000fe8217d00] c0000000002334a0 __vfs_write+0x40/0x190
        [c000000fe8217d90] c000000000234738 vfs_write+0xc8/0x240
        [c000000fe8217de0] c000000000236250 SyS_write+0x60/0x110
        [c000000fe8217e30] c000000000009524 system_call+0x38/0x108
      
      It fixes the kernel crash by bypassing releasing resources (DMA,
      IO and memory segments, PELTM) because there are no resources assigned
      to the slave PE.
      
      Fixes: c5f7700b
      
       ("powerpc/powernv: Dynamically release PE")
      Reported-by: default avatarFrederic Barrat <fbarrat@linux.vnet.ibm.com>
      Signed-off-by: default avatarGavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      b314427a
    • Benjamin Herrenschmidt's avatar
      powerpc/xics/opal: Fix processor numbers in OPAL ICP · f8e33475
      Benjamin Herrenschmidt authored
      When using the OPAL ICP backend we incorrectly pass Linux CPU numbers
      rather than HW CPU numbers to OPAL.
      
      Fixes: d7436188
      
       ("powerpc/xics: Add ICP OPAL backend")
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      f8e33475
    • Thiago Jung Bauermann's avatar
      powerpc/pseries: Fix little endian build with CONFIG_KEXEC=n · d81d8258
      Thiago Jung Bauermann authored
      On ppc64le, builds with CONFIG_KEXEC=n fail with:
      
      arch/powerpc/platforms/pseries/setup.c: In function ‘pseries_big_endian_exceptions’:
      arch/powerpc/platforms/pseries/setup.c:403:13: error: implicit declaration of function ‘kdump_in_progress’
        if (rc && !kdump_in_progress())
      
      This is because pseries/setup.c includes <linux/kexec.h>, but
      kdump_in_progress() is defined in <asm/kexec.h>. This is a problem
      because the former only includes the latter if CONFIG_KEXEC_CORE=y.
      
      Fix it by including <asm/kexec.h> directly, as is done in powernv/setup.c.
      
      Fixes: d3cbff1b
      
       ("powerpc: Put exception configuration in a common place")
      Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      d81d8258
  4. 29 Aug, 2016 3 commits
    • Cyril Bur's avatar
      powerpc: signals: Discard transaction state from signal frames · 78a3e888
      Cyril Bur authored
      
      
      Userspace can begin and suspend a transaction within the signal
      handler which means they might enter sys_rt_sigreturn() with the
      processor in suspended state.
      
      sys_rt_sigreturn() wants to restore process context (which may have
      been in a transaction before signal delivery). To do this it must
      restore TM SPRS. To achieve this, any transaction initiated within the
      signal frame must be discarded in order to be able to restore TM SPRs
      as TM SPRs can only be manipulated non-transactionally..
      >From the PowerPC ISA:
        TM Bad Thing Exception [Category: Transactional Memory]
         An attempt is made to execute a mtspr targeting a TM register in
         other than Non-transactional state.
      
      Not doing so results in a TM Bad Thing:
      [12045.221359] Kernel BUG at c000000000050a40 [verbose debug info unavailable]
      [12045.221470] Unexpected TM Bad Thing exception at c000000000050a40 (msr 0x201033)
      [12045.221540] Oops: Unrecoverable exception, sig: 6 [#1]
      [12045.221586] SMP NR_CPUS=2048 NUMA PowerNV
      [12045.221634] Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE
       nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4
       xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp bridge stp llc ebtable_filter
       ebtables ip6table_filter ip6_tables iptable_filter ip_tables x_tables kvm_hv kvm
       uio_pdrv_genirq ipmi_powernv uio powernv_rng ipmi_msghandler autofs4 ses enclosure
       scsi_transport_sas bnx2x ipr mdio libcrc32c
      [12045.222167] CPU: 68 PID: 6178 Comm: sigreturnpanic Not tainted 4.7.0 #34
      [12045.222224] task: c0000000fce38600 ti: c0000000fceb4000 task.ti: c0000000fceb4000
      [12045.222293] NIP: c000000000050a40 LR: c0000000000163bc CTR: 0000000000000000
      [12045.222361] REGS: c0000000fceb7ac0 TRAP: 0700   Not tainted (4.7.0)
      [12045.222418] MSR: 9000000300201033 <SF,HV,ME,IR,DR,RI,LE,TM[SE]> CR: 28444280  XER: 20000000
      [12045.222625] CFAR: c0000000000163b8 SOFTE: 0 PACATMSCRATCH: 900000014280f033
      GPR00: 01100000b8000001 c0000000fceb7d40 c00000000139c100 c0000000fce390d0
      GPR04: 900000034280f033 0000000000000000 0000000000000000 0000000000000000
      GPR08: 0000000000000000 b000000000001033 0000000000000001 0000000000000000
      GPR12: 0000000000000000 c000000002926400 0000000000000000 0000000000000000
      GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      GPR24: 0000000000000000 00003ffff98cadd0 00003ffff98cb470 0000000000000000
      GPR28: 900000034280f033 c0000000fceb7ea0 0000000000000001 c0000000fce390d0
      [12045.223535] NIP [c000000000050a40] tm_restore_sprs+0xc/0x1c
      [12045.223584] LR [c0000000000163bc] tm_recheckpoint+0x5c/0xa0
      [12045.223630] Call Trace:
      [12045.223655] [c0000000fceb7d80] [c000000000026e74] sys_rt_sigreturn+0x494/0x6c0
      [12045.223738] [c0000000fceb7e30] [c0000000000092e0] system_call+0x38/0x108
      [12045.223806] Instruction dump:
      [12045.223841] 7c800164 4e800020 7c0022a6 f80304a8 7c0222a6 f80304b0 7c0122a6 f80304b8
      [12045.223955] 4e800020 e80304a8 7c0023a6 e80304b0 <7c0223a6> e80304b8 7c0123a6 4e800020
      [12045.224074] ---[ end trace cb8002ee240bae76 ]---
      
      It isn't clear exactly if there is really a use case for userspace
      returning with a suspended transaction, however, doing so doesn't (on
      its own) constitute a bad frame. As such, this patch simply discards
      the transactional state of the context calling the sigreturn and
      continues.
      Reported-by: default avatarLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Signed-off-by: default avatarCyril Bur <cyrilbur@gmail.com>
      Tested-by: default avatarLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Reviewed-by: default avatarLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Acked-by: default avatarSimon Guo <wei.guo.simon@gmail.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      78a3e888
    • Mukesh Ojha's avatar
      powerpc/powernv : Drop reference added by kset_find_obj() · a9cbf0b2
      Mukesh Ojha authored
      
      
      In a situation, where Linux kernel gets notified about duplicate error log
      from OPAL, it is been observed that kernel fails to remove sysfs entries
      (/sys/firmware/opal/elog/0xXXXXXXXX) of such error logs. This is because,
      we currently search the error log/dump kobject in the kset list via
      'kset_find_obj()' routine. Which eventually increment the reference count
      by one, once it founds the kobject.
      
      So, unless we decrement the reference count by one after it found the kobject,
      we would not be able to release the kobject properly later.
      
      This patch adds the 'kobject_put()' which was missing earlier.
      Signed-off-by: default avatarMukesh Ojha <mukesh02@linux.vnet.ibm.com>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarVasant Hegde <hegdevasant@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      a9cbf0b2
    • Nicholas Piggin's avatar
      powerpc/tm: do not use r13 for tabort_syscall · cc7786d3
      Nicholas Piggin authored
      tabort_syscall runs with RI=1, so a nested recoverable machine
      check will load the paca into r13 and overwrite what we loaded
      it with, because exceptions returning to privileged mode do not
      restore r13.
      
      Fixes: b4b56f9e
      
       (powerpc/tm: Abort syscalls in active transactions)
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNick Piggin <npiggin@gmail.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      cc7786d3
  5. 22 Aug, 2016 14 commits
    • Paolo Bonzini's avatar
      powerpc: move hmi.c to arch/powerpc/kvm/ · 7c379526
      Paolo Bonzini authored
      
      
      hmi.c functions are unused unless sibling_subcore_state is nonzero, and
      that in turn happens only if KVM is in use.  So move the code to
      arch/powerpc/kvm/, putting it under CONFIG_KVM_BOOK3S_HV_POSSIBLE
      rather than CONFIG_PPC_BOOK3S_64.  The sibling_subcore_state is also
      included in struct paca_struct only if KVM is supported by the kernel.
      
      Cc: Daniel Axtens <dja@axtens.net>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: linuxppc-dev@lists.ozlabs.org
      Cc: kvm-ppc@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      7c379526
    • Christophe Leroy's avatar
      powerpc: sysdev: cpm: fix gpio save_regs functions · 41017a75
      Christophe Leroy authored
      of_mm_gpiochip_add_data() calls mm_gc->save_regs() before
      setting the data. Therefore ->save_regs() cannot use
      gpiochip_get_data()
      
      [    0.275940] Unable to handle kernel paging request for data at address 0x00000130
      [    0.283120] Faulting instruction address: 0xc01b44cc
      [    0.288175] Oops: Kernel access of bad area, sig: 11 [#1]
      [    0.293343] PREEMPT CMPC885
      [    0.296141] CPU: 0 PID: 1 Comm: swapper Not tainted 4.7.0-g65124df-dirty #68
      [    0.304131] task: c6074000 ti: c6080000 task.ti: c6080000
      [    0.309459] NIP: c01b44cc LR: c0011720 CTR: c0011708
      [    0.314372] REGS: c6081d90 TRAP: 0300   Not tainted  (4.7.0-g65124df-dirty)
      [    0.322267] MSR: 00009032 <EE,ME,IR,DR,RI>  CR: 24000028  XER: 20000000
      [    0.328813] DAR: 00000130 DSISR: c0000000
      GPR00: c01b6d0c c6081e40 c6074000 c6017000 c9028000 c601d028 c6081dd8 00000000
      GPR08: c601d028 00000000 ffffffff 00000001 24000044 00000000 c0002790 00000000
      GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c05643b0 00000083
      GPR24: c04a1a6c c0560000 c04a8308 c04c6480 c0012498 c6017000 c7ffcc78 c6017000
      [    0.360806] NIP [c01b44cc] gpiochip_get_data+0x4/0xc
      [    0.365684] LR [c0011720] cpm1_gpio16_save_regs+0x18/0x44
      [    0.370972] Call Trace:
      [    0.373451] [c6081e50] [c01b6d0c] of_mm_gpiochip_add_data+0x70/0xdc
      [    0.379624] [c6081e70] [c00124c0] cpm_init_par_io+0x28/0x118
      [    0.385238] [c6081e80] [c04a8ac0] do_one_initcall+0xb0/0x17c
      [    0.390819] [c6081ef0] [c04a8cbc] kernel_init_freeable+0x130/0x1dc
      [    0.396924] [c6081f30] [c00027a4] kernel_init+0x14/0x110
      [    0.402177] [c6081f40] [c000b424] ret_from_kernel_thread+0x5c/0x64
      [    0.408233] Instruction dump:
      [    0.411168] 4182fafc 3f80c040 48234c6d 3bc0fff0 3b9c5ed0 4bfffaf4 81290020 712a0004
      [    0.418825] 4182fb34 48234c51 4bfffb2c 81230004 <80690130> 4e800020 7c0802a6 9421ffe0
      [    0.426763] ---[ end trace fe4113ee21d72ffa ]---
      
      fixes: e65078f1 ("powerpc: sysdev: cpm1: use gpiochip data pointer")
      fixes: a14a2d48
      
       ("powerpc: cpm_common: use gpiochip data pointer")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      41017a75
    • Nicholas Piggin's avatar
      powerpc/pseries: PACA save area fix for MCE vs MCE · a74599a5
      Nicholas Piggin authored
      
      
      MCE must not enable MSR_RI until PACA_EXMC is no longer being used.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      a74599a5
    • Nicholas Piggin's avatar
      powerpc/pseries: PACA save area fix for general exception vs MCE · 3f3b5dc1
      Nicholas Piggin authored
      
      
      MCE must not use PACA_EXGEN. When a general exception enables MSR_RI,
      that means SPRN_SRR[01] and SPRN_SPRG are no longer used. However the
      PACA save area is still in use.
      Acked-by: default avatarMahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      3f3b5dc1
    • Michael Ellerman's avatar
      powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support · 66443efa
      Michael Ellerman authored
      When booting from an OpenFirmware which supports it, we use the
      "ibm,client-architecture-support" firmware call to communicate
      our capabilities to firmware.
      
      The format of the structure we pass to firmware is specified in
      PAPR (Power Architecture Platform Requirements), or the public version
      LoPAPR (Linux on Power Architecture Platform Reference).
      
      Referring to table 244 in LoPAPR v1.1, option vector 5 contains a 4 byte
      field at bytes 17-20 for the "Platform Facilities Enable". This is
      followed by a 1 byte field at byte 21 for "Sub-Processor Represenation
      Level".
      
      Comparing to the code, there we have the Platform Facilities
      options (OV5_PFO_*) at byte 17, but we fail to pad that field out to its
      full width of 4 bytes. This means the OV5_SUB_PROCESSORS option is
      incorrectly placed at byte 18.
      
      Fix it by adding zero bytes for bytes 18, 19, 20, and comment the bytes
      to hopefully make it clearer in future.
      
      As far as I'm aware nothing actually consumes this value at this time,
      so the effect of this bug is nil in practice.
      
      It does mean we've been incorrectly setting bit 15 of the "Platform
      Facilities Enable" option for the past ~3 1/2 years, so we should avoid
      allocating that bit to anything else in future.
      
      Fixes: df77c799
      
       ("powerpc/pseries: Update ibm,architecture.vec for PAPR 2.7/POWER8")
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      66443efa
    • Boqun Feng's avatar
      powerpc, hotplug: Avoid to touch non-existent cpumasks. · 19ab58d1
      Boqun Feng authored
      
      
      We observed a kernel oops when running a PPC guest with config NR_CPUS=4
      and qemu option "-smp cores=1,threads=8":
      
      [   30.634781] Unable to handle kernel paging request for data at
      address 0xc00000014192eb17
      [   30.636173] Faulting instruction address: 0xc00000000003e5cc
      [   30.637069] Oops: Kernel access of bad area, sig: 11 [#1]
      [   30.637877] SMP NR_CPUS=4 NUMA pSeries
      [   30.638471] Modules linked in:
      [   30.638949] CPU: 3 PID: 27 Comm: migration/3 Not tainted
      4.7.0-07963-g9714b26 #1
      [   30.640059] task: c00000001e29c600 task.stack: c00000001e2a8000
      [   30.640956] NIP: c00000000003e5cc LR: c00000000003e550 CTR:
      0000000000000000
      [   30.642001] REGS: c00000001e2ab8e0 TRAP: 0300   Not tainted
      (4.7.0-07963-g9714b26)
      [   30.643139] MSR: 8000000102803033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE,TM[E]>  CR: 22004084  XER: 00000000
      [   30.644583] CFAR: c000000000009e98 DAR: c00000014192eb17 DSISR: 40000000 SOFTE: 0
      GPR00: c00000000140a6b8 c00000001e2abb60 c0000000016dd300 0000000000000003
      GPR04: 0000000000000000 0000000000000004 c0000000016e5920 0000000000000008
      GPR08: 0000000000000004 c00000014192eb17 0000000000000000 0000000000000020
      GPR12: c00000000140a6c0 c00000000ffffc00 c0000000000d3ea8 c00000001e005680
      GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      GPR20: 0000000000000000 c00000001e6b3a00 0000000000000000 0000000000000001
      GPR24: c00000001ff85138 c00000001ff85130 000000001eb6f000 0000000000000001
      GPR28: 0000000000000000 c0000000017014e0 0000000000000000 0000000000000018
      [   30.653882] NIP [c00000000003e5cc] __cpu_disable+0xcc/0x190
      [   30.654713] LR [c00000000003e550] __cpu_disable+0x50/0x190
      [   30.655528] Call Trace:
      [   30.655893] [c00000001e2abb60] [c00000000003e550] __cpu_disable+0x50/0x190 (unreliable)
      [   30.657280] [c00000001e2abbb0] [c0000000000aca0c] take_cpu_down+0x5c/0x100
      [   30.658365] [c00000001e2abc10] [c000000000163918] multi_cpu_stop+0x1a8/0x1e0
      [   30.659617] [c00000001e2abc60] [c000000000163cc0] cpu_stopper_thread+0xf0/0x1d0
      [   30.660737] [c00000001e2abd20] [c0000000000d8d70] smpboot_thread_fn+0x290/0x2a0
      [   30.661879] [c00000001e2abd80] [c0000000000d3fa8] kthread+0x108/0x130
      [   30.662876] [c00000001e2abe30] [c000000000009968] ret_from_kernel_thread+0x5c/0x74
      [   30.664017] Instruction dump:
      [   30.664477] 7bde1f24 38a00000 787f1f24 3b600001 39890008 7d204b78 7d05e214 7d0b07b4
      [   30.665642] 796b1f24 7d26582a 7d204a14 7d29f214 <7d4048a8> 7d4a3878 7d4049ad 40c2fff4
      [   30.666854] ---[ end trace 32643b7195717741 ]---
      
      The reason of this is that in __cpu_disable(), when we try to set the
      cpu_sibling_mask or cpu_core_mask of the sibling CPUs of the disabled
      one, we don't check whether the current configuration employs those
      sibling CPUs(hw threads). And if a CPU is not employed by a
      configuration, the percpu structures cpu_{sibling,core}_mask are not
      allocated, therefore accessing those cpumasks will result in problems as
      above.
      
      This patch fixes this problem by adding an addition check on whether the
      id is no less than nr_cpu_ids in the sibling CPU iteration code.
      Signed-off-by: default avatarBoqun Feng <boqun.feng@gmail.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      19ab58d1
    • Paul Gortmaker's avatar
      powerpc: migrate exception table users off module.h and onto extable.h · 8a39b05f
      Paul Gortmaker authored
      
      
      These files were only including module.h for exception table
      related functions.  We've now separated that content out into its
      own file "extable.h" so now move over to that and avoid all the
      extra header content in module.h that we don't really need to compile
      these files.
      
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: linuxppc-dev@lists.ozlabs.org
      Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      8a39b05f
    • Andrzej Hajda's avatar
      powerpc/powernv/pci: fix iterator signedness · 60964816
      Andrzej Hajda authored
      
      
      Unsigned type is always non-negative, so the loop could not end in case
      condition is never true.
      
      The problem has been detected using semantic patch
      scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci
      Signed-off-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      60964816
    • Mauricio Faria de Oliveira's avatar
      powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb) · 2dd9c11b
      Mauricio Faria de Oliveira authored
      
      
      This patch leverages 'struct pci_host_bridge' from the PCI subsystem
      in order to free the pci_controller only after the last reference to
      its devices is dropped (avoiding an oops in pcibios_release_device()
      if the last reference is dropped after pcibios_free_controller()).
      
      The patch relies on pci_host_bridge.release_fn() (and .release_data),
      which is called automatically by the PCI subsystem when the root bus
      is released (i.e., the last reference is dropped).  Those fields are
      set via pci_set_host_bridge_release() (e.g. in the platform-specific
      implementation of pcibios_root_bridge_prepare()).
      
      It introduces the 'pcibios_free_controller_deferred()' .release_fn()
      and it expects .release_data to hold a pointer to the pci_controller.
      
      The function implictly calls 'pcibios_free_controller()', so an user
      must *NOT* explicitly call it if using the new _deferred() callback.
      
      The functionality is enabled for pseries (although it isn't platform
      specific, and may be used by cxl).
      
      Details on not-so-elegant design choices:
      
       - Use 'pci_host_bridge.release_data' field as pointer to associated
         'struct pci_controller' so *not* to 'pci_bus_to_host(bridge->bus)'
         in pcibios_free_controller_deferred().
      
         That's because pci_remove_root_bus() sets 'host_bridge->bus = NULL'
         (so, if the last reference is released after pci_remove_root_bus()
         runs, which eventually reaches pcibios_free_controller_deferred(),
         that would hit a null pointer dereference).
      
         The cxl/vphb.c code calls pci_remove_root_bus(), and the cxl folks
         are interested in this fix.
      
      Test-case #1 (hold references)
      
        # ls -ld /sys/block/sd* | grep -m1 0021:01:00.0
        <...> /sys/block/sdaa -> ../devices/pci0021:01/0021:01:00.0/<...>
      
        # ls -ld /sys/block/sd* | grep -m1 0021:01:00.1
        <...> /sys/block/sdab -> ../devices/pci0021:01/0021:01:00.1/<...>
      
        # cat >/dev/sdaa & pid1=$!
        # cat >/dev/sdab & pid2=$!
      
        # drmgr -w 5 -d 1 -c phb -s 'PHB 33' -r
        Validating PHB DLPAR capability...yes.
        [  594.306719] pci_hp_remove_devices: PCI: Removing devices on bus 0021:01
        [  594.306738] pci_hp_remove_devices:    Removing 0021:01:00.0...
        ...
        [  598.236381] pci_hp_remove_devices:    Removing 0021:01:00.1...
        ...
        [  611.972077] pci_bus 0021:01: busn_res: [bus 01-ff] is released
        [  611.972140] rpadlpar_io: slot PHB 33 removed
      
        # kill -9 $pid1
        # kill -9 $pid2
        [  632.918088] pcibios_free_controller_deferred: domain 33, dynamic 1
      
      Test-case #2 (don't hold references)
      
        # drmgr -w 5 -d 1 -c phb -s 'PHB 33' -r
        Validating PHB DLPAR capability...yes.
        [  916.357363] pci_hp_remove_devices: PCI: Removing devices on bus 0021:01
        [  916.357386] pci_hp_remove_devices:    Removing 0021:01:00.0...
        ...
        [  920.566527] pci_hp_remove_devices:    Removing 0021:01:00.1...
        ...
        [  933.955873] pci_bus 0021:01: busn_res: [bus 01-ff] is released
        [  933.955977] pcibios_free_controller_deferred: domain 33, dynamic 1
        [  933.955999] rpadlpar_io: slot PHB 33 removed
      Suggested-By: default avatarGavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: default avatarMauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
      Reviewed-by: default avatarGavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: default avatarAndrew Donnellan <andrew.donnellan@au1.ibm.com>
      Tested-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com> # cxl
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      2dd9c11b
    • Andrew Donnellan's avatar
      cxl: use pcibios_free_controller_deferred() when removing vPHBs · 6f38a8b9
      Andrew Donnellan authored
      
      
      When cxl removes a vPHB, it's possible that the pci_controller may be freed
      before all references to the devices on the vPHB have been released. This
      in turn causes an invalid memory access when the devices are eventually
      released, as pcibios_release_device() attempts to call the phb's
      release_device hook.
      
      In cxl_pci_vphb_remove(), remove the existing call to
      pcibios_free_controller(). Instead, use
      pcibios_free_controller_deferred() to free the pci_controller after all
      devices have been released. Export pci_set_host_bridge_release() so we can
      do this.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAndrew Donnellan <andrew.donnellan@au1.ibm.com>
      Reviewed-by: default avatarMatthew R. Ochs <mrochs@linux.vnet.ibm.com>
      Acked-by: default avatarIan Munsie <imunsie@au1.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      6f38a8b9
    • Markus Elfring's avatar
      powerpc: mpc8349emitx: Delete unnecessary assignment for the field "owner" · f5ed841c
      Markus Elfring authored
      
      
      The field "owner" is set by the core.
      Thus delete an unneeded initialisation.
      
      Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci
      Signed-off-by: default avatarMarkus Elfring <elfring@users.sourceforge.net>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      f5ed841c
    • Markus Elfring's avatar
      powerpc/512x: Delete unnecessary assignment for the field "owner" · e72e799c
      Markus Elfring authored
      
      
      The field "owner" is set by the core.
      Thus delete an unneeded initialisation.
      
      Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci
      Signed-off-by: default avatarMarkus Elfring <elfring@users.sourceforge.net>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      e72e799c
    • Markus Elfring's avatar
      drivers/macintosh: Delete owner assignment · aded76ba
      Markus Elfring authored
      
      
      The field "owner" is set by core. Thus delete an extra initialisation.
      
      Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci
      Signed-off-by: default avatarMarkus Elfring <elfring@users.sourceforge.net>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      aded76ba
    • Guenter Roeck's avatar
      powerpc: cputhreads: Add missing include file · e340eca9
      Guenter Roeck authored
      Powerpc builds may fail with the following build error.
      
      Error log:
      In file included from ./arch/powerpc/include/asm/mmu_context.h:11:0,
                       from ./include/linux/mmu_context.h:4,
      		 from mm/mmu_context.c:8:
      ./arch/powerpc/include/asm/cputhreads.h: In function 'get_tensr':
      ./arch/powerpc/include/asm/cputhreads.h:101:2: error:
      	implicit declaration of function 'cpu_has_feature'
      
      The problem can be triggered by configuring ppc64e_defconfig and selecting
      CONFIG_TICK_CPU_ACCOUNTING instead of CONFIG_VIRT_CPU_ACCOUNTING_NATIVE.
      
      Fixes: b92a226e
      
       ("powerpc: Move cpu_has_feature() to a separate file")
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      e340eca9
  6. 21 Aug, 2016 3 commits
  7. 20 Aug, 2016 2 commits
    • Helge Deller's avatar
      parisc: Fix order of EREFUSED define in errno.h · 3eb53b20
      Helge Deller authored
      
      
      When building gccgo in userspace, errno.h gets parsed and the go include file
      sysinfo.go is generated.
      
      Since EREFUSED is defined to the same value as ECONNREFUSED, and ECONNREFUSED
      is defined later on in errno.h, this leads to go complaining that EREFUSED
      isn't defined yet.
      
      Fix this trivial problem by moving the define of EREFUSED down after
      ECONNREFUSED in errno.h (and clean up the indenting while touching this line).
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: stable@vger.kernel.org
      3eb53b20
    • Helge Deller's avatar
      parisc: Fix automatic selection of cr16 clocksource · ae141830
      Helge Deller authored
      Commit 54b66800
      
       (parisc: Add native high-resolution sched_clock()
      implementation) added support to use the CPU-internal cr16 counters as reliable
      clocksource with the help of HAVE_UNSTABLE_SCHED_CLOCK.
      
      Sadly the commit missed to remove the hack which prevented cr16 to become the
      default clocksource even on SMP systems.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: stable@vger.kernel.org # 4.7+
      ae141830
  8. 19 Aug, 2016 10 commits
    • Linus Torvalds's avatar
      Make the hardened user-copy code depend on having a hardened allocator · 6040e576
      Linus Torvalds authored
      
      
      The kernel test robot reported a usercopy failure in the new hardened
      sanity checks, due to a page-crossing copy of the FPU state into the
      task structure.
      
      This happened because the kernel test robot was testing with SLOB, which
      doesn't actually do the required book-keeping for slab allocations, and
      as a result the hardening code didn't realize that the task struct
      allocation was one single allocation - and the sanity checks fail.
      
      Since SLOB doesn't even claim to support hardening (and you really
      shouldn't use it), the straightforward solution is to just make the
      usercopy hardening code depend on the allocator supporting it.
      Reported-by: default avatarkernel test robot <xiaolong.ye@intel.com>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6040e576
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 8cc9dddd
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "I2C has some pretty standard driver bugfixes and one minor cleanup"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: meson: Use complete() instead of complete_all()
        i2c: brcmstb: Use complete() instead of complete_all()
        i2c: bcm-kona: Use complete() instead of complete_all()
        i2c: bcm-iproc: Use complete() instead of complete_all()
        i2c: at91: fix support of the "alternative command" feature
        i2c: ocores: add missed clk_disable_unprepare() on failure paths
        i2c: cros-ec-tunnel: Fix usage of cros_ec_cmd_xfer()
        i2c: mux: demux-pinctrl: properly roll back when adding adapter fails
      8cc9dddd
    • Linus Torvalds's avatar
      Merge tag 'dm-4.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm · 43f4d36c
      Linus Torvalds authored
      Pull device mapper fixes from Mike Snitzer:
      
       - a stable fix for DM round robin multipath path selector to disable
         preemption before using this_cpu_ptr()
      
       - a slight increase in DM crypt's mempool reserves to make swap ontop
         of DM crypt more performant
      
       - a few DM raid fixes to issues found while testing changes that were
         merged in v4.8-rc1
      
      * tag 'dm-4.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm raid: support raid0 with missing metadata devices
        dm raid: enhance attempt_restore_of_faulty_devices() to support more devices
        dm raid: fix restoring of failed devices regression
        dm raid: fix frozen recovery regression
        dm crypt: increase mempool reserve to better support swapping
        dm round robin: do not use this_cpu_ptr() without having preemption disabled
      43f4d36c
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · b2848792
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Six fairly small fixes.  The ipr, mpt3sas and ses ones all trigger
        oopses.  The megaraid one fixes an attach failure on io mapped only
        cards, the fcoe one is an obvious problem in the error path and the
        aacraid one is a theoretical security issue (ability to trick the
        kernel into a buffer overrun)"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        ses: Fix racy cleanup of /sys in remove_dev()
        mpt3sas: Fix resume on WarpDrive flash cards
        ipr: Fix sync scsi scan
        megaraid_sas: Fix probing cards without io port
        aacraid: Check size values after double-fetch from user
        fcoe: Use kfree_skb() instead of kfree()
      b2848792
    • Linus Torvalds's avatar
      Merge tag 'usb-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 080ebb15
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a number of USB fixes for reported issues for your tree.
      
        The normal amount of gadget fixes, xhci fixes, new device ids, and a
        few other minor things.  All of them have been in linux-next for a
        while, the full details are in the shortlog below"
      
      * tag 'usb-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (43 commits)
        xhci: don't dereference a xhci member after removing xhci
        usb: xhci: Fix panic if disconnect
        xhci: really enqueue zero length TRBs.
        xhci: always handle "Command Ring Stopped" events
        cdc-acm: fix wrong pipe type on rx interrupt xfers
        usb: misc: usbtest: add fix for driver hang
        usb: dwc3: gadget: stop processing on HWO set
        usb: dwc3: don't set last bit for ISOC endpoints
        usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG
        usb: udc: core: fix error handling
        usb: gadget: fsl_qe_udc: off by one in setup_received_handle()
        usb/gadget: fix gadgetfs aio support.
        usb: gadget: composite: Fix return value in case of error
        usb: gadget: uvc: Fix return value in case of error
        usb: gadget: fix check in sync read from ep in gadgetfs
        usb: misc: usbtest: usbtest_do_ioctl may return positive integer
        usb: dwc3: fix missing platform_set_drvdata() in dwc3_of_simple_probe()
        usb: phy: omap-otg: Fix missing platform_set_drvdata() in omap_otg_probe()
        usb: gadget: configfs: add mutex lock before unregister gadget
        usb: gadget: u_ether: fix dereference after null check coverify warning
        ...
      080ebb15
    • Linus Torvalds's avatar
      Merge tag 'xfs-iomap-for-linus-4.8-rc3' of... · a8414fa3
      Linus Torvalds authored
      Merge tag 'xfs-iomap-for-linus-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs
      
      Pull xfs and iomap fixes from Dave Chinner:
       "Changes in this update:
      
        Regression fixes for XFS changes introduce in 4.8-rc1:
         - buffer IO accounting assert failure
         - ENOSPC block accounting reservation issue
         - DAX IO path page cache invalidation fix
         - rmapbt on-disk block count in agf
         - correct classification of rmap block type when updating AGFL.
         - iomap support for attribute fork mapping
      
        Regression fixes for iomap infrastructure in 4.8-rc1:
         - fiemap: honor FIEMAP_FLAG_SYNC
         - fiemap: implement FIEMAP_FLAG_XATTR support to fix XFS regression
         - make mark_page_accessed and pagefault_disable usage consistent with
           other IO paths"
      
      * tag 'xfs-iomap-for-linus-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs:
        xfs: remove OWN_AG rmap when allocating a block from the AGFL
        xfs: (re-)implement FIEMAP_FLAG_XATTR
        xfs: simplify xfs_file_iomap_begin
        iomap: mark ->iomap_end as optional
        iomap: prepare iomap_fiemap for attribute mappings
        iomap: fiemap should honor the FIEMAP_FLAG_SYNC flag
        iomap: remove superflous pagefault_disable from iomap_write_actor
        iomap: remove superflous mark_page_accessed from iomap_write_actor
        xfs: store rmapbt block count in the AGF
        xfs: don't invalidate whole file on DAX read/write
        xfs: fix bogus space reservation in xfs_iomap_write_allocate
        xfs: don't assert fail on non-async buffers on ioacct decrement
      a8414fa3
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v4.8-rc2' of... · 3f318b3c
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
       "Fix a bug in it87 driver and URLs in ftsteutates driver"
      
      * tag 'hwmon-for-linus-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (ftsteutates) Correct ftp urls in driver documentation
        hwmon: (it87) Features mask must be 32 bit wide
      3f318b3c
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-4.8-rc3-2' of git://people.freedesktop.org/~airlied/linux · 952b159f
      Linus Torvalds authored
      Pull more drm fixes from Dave Airlie:
       "Daniel pointed out I'd missed some i915 fixes, and I also found a
        single etnaviv fix I missed.
      
        So here they are"
      
      * tag 'drm-fixes-for-4.8-rc3-2' of git://people.freedesktop.org/~airlied/linux:
        drm/etnaviv: take GPU lock later in the submit process
        drm/i915: Fix modeset handling during gpu reset, v5.
        drm/i915: fix aliasing_ppgtt leak
        drm/i915: fix WaInsertDummyPushConstPs
        drm/i915: Fix iboost setting for SKL Y/U DP DDI buffer translation entry 2
        drm/i915/gen9: Give one extra block per line for SKL plane WM calculations
        drm/i915: Acquire audio powerwell for HD-Audio registers
        drm/i915: Add missing rpm wakelock to GGTT pread
        drm/i915/fbc: FBC causes display flicker when VT-d is enabled on Skylake
        drm/i915: Clean up the extra RPM ref on CHV with i915.enable_rc6=0
        drm/i915: Program iboost settings for HDMI/DVI on SKL
        drm/i915: Fix iboost setting for DDI with 4 lanes on SKL
        drm/i915: Handle ENOSPC after failing to insert a mappable node
        drm/i915: Flush GT idle status upon reset
      952b159f
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · d8298d26
      Linus Torvalds authored
      Pull DeviceTree fixes from Rob Herring:
      
       - a couple of DT node ref counting fixes
      
       - fix __unflatten_device_tree for PPC PCI hotplug case
      
       - rework marking irq controllers as OF_POPULATED in cases where real
         driver is used.
      
       - disable of_platform_default_populate_init on PPC.  The change in
         initcall order causes problems which need to be sorted out later.
      
      * tag 'devicetree-fixes-for-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of: fix reference counting in of_graph_get_endpoint_by_regs
        of/platform: disable the of_platform_default_populate_init() for all the ppc boards
        ARM: imx6: mark GPC node as not populated after irq init to probe pm domain driver
        of/irq: Mark interrupt controllers as populated before initialisation
        drivers/of: Validate device node in __unflatten_device_tree()
        of: Delete an unnecessary check before the function call "of_node_put"
      d8298d26
    • Linus Torvalds's avatar
      Merge tag '4.8-doc-fixes' of git://git.lwn.net/linux · 5cae6fe2
      Linus Torvalds authored
      Pull documentation fixes from Jonathan Corbet:
       "Three small fixes for Sphinx-formatted documentation generation"
      
      * tag '4.8-doc-fixes' of git://git.lwn.net/linux:
        doc-rst: customize RTD theme, drop padding of inline literal
        docs: kernel-documentation: remove some highlight directives
        docs: Set the Sphinx default highlight language to "guess"
      5cae6fe2
  9. 18 Aug, 2016 1 commit
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2016-08-15' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 2c24ba21
      Dave Airlie authored
      Collection of i915 fixes.
      
      * tag 'drm-intel-fixes-2016-08-15' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Fix modeset handling during gpu reset, v5.
        drm/i915: fix aliasing_ppgtt leak
        drm/i915: fix WaInsertDummyPushConstPs
        drm/i915: Fix iboost setting for SKL Y/U DP DDI buffer translation entry 2
        drm/i915/gen9: Give one extra block per line for SKL plane WM calculations
        drm/i915: Acquire audio powerwell for HD-Audio registers
        drm/i915: Add missing rpm wakelock to GGTT pread
        drm/i915/fbc: FBC causes display flicker when VT-d is enabled on Skylake
        drm/i915: Clean up the extra RPM ref on CHV with i915.enable_rc6=0
        drm/i915: Program iboost settings for HDMI/DVI on SKL
        drm/i915: Fix iboost setting for DDI with 4 lanes on SKL
        drm/i915: Handle ENOSPC after failing to insert a mappable node
        drm/i915: Flush GT idle status upon reset
      2c24ba21