Commit Graph

633919 Commits

Author SHA1 Message Date
Chris Wilson
eeacd86efa drm/i915/gvt: Remove dangerous unpin of backing storage of bound GPU object
Unpinning the pages prior to the object being release from the GPU may
allow the GPU to read and write into system pages (i.e. use after free
by the hw).

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:40 +08:00
Chris Wilson
b6d891429d drm/i915/gvt: Use the returned VMA to provide the virtual address
The purpose of returning the just-pinned VMA is so that we can use the
information within, like its address. Also it should be tracked and used
as the cookie to unpin...

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:40 +08:00
Chris Wilson
894cf7d156 drm/i915/gvt: i915_gem_object_create() returns an error pointer
On failure from i915_gem_object_create(), we need to check for an error
pointer not NULL.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:39 +08:00
Chris Wilson
75ea10da06 drm/i915/gvt: Add runtime pm around fences
Manipulating the fence_list requires the runtime wakelock, as does
writing to the fence registers. Acquire a wakelock for the former, and
assert that the device is awake for the latter.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:39 +08:00
Zhenyu Wang
22681c7bc7 Documentation/gpu: Add section for Intel GVT-g host support
Update with brief overview and reference for more detailed
arch design documents.

Add new section for Intel GVT-g host support.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:39 +08:00
Zhenyu Wang
bbc3693351 drm/i915/gvt: Fix warning on obsolete function usage
Don't use obsolete drm_gem_object_unreference() but switch to i915_gem_object_put().

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:38 +08:00
Zhenyu Wang
66a46e9df0 MAINTAINERS: Add new Intel GVT-g driver maintainer
This adds new item for Intel GVT-g driver maintainer info.

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:38 +08:00
Zhenyu Wang
feddf6e866 drm/i915/gvt: clean up intel_gvt.h as interface for i915 core
i915 core should only call functions and structures exposed through
intel_gvt.h. Remove internal gvt.h and i915_pvinfo.h.

Change for internal intel_gvt structure as private handler which
not requires to expose gvt internal structure for i915 core.

v2: Fix per Chris's comment
- carefully handle dev_priv->gvt assignment
- add necessary bracket for macro helper
- forward declartion struct intel_gvt
- keep free operation within same file handling alloc

v3: fix use after free and remove intel_gvt.initialized

v4: change to_gvt() to an inline

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
2016-10-20 17:18:30 +08:00
James Morse
d08544127d arm64: suspend: Reconfigure PSTATE after resume from idle
The suspend/resume path in kernel/sleep.S, as used by cpu-idle, does not
save/restore PSTATE. As a result of this cpufeatures that were detected
and have bits in PSTATE get lost when we resume from idle.

UAO gets set appropriately on the next context switch. PAN will be
re-enabled next time we return from user-space, but on a preemptible
kernel we may run work accessing user space before this point.

Add code to re-enable theses two features in __cpu_suspend_exit().
We re-use uao_thread_switch() passing current.

Signed-off-by: James Morse <james.morse@arm.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-10-20 09:50:54 +01:00
James Morse
7209c86860 arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call
Commit 338d4f49d6 ("arm64: kernel: Add support for Privileged Access
Never") enabled PAN by enabling the 'SPAN' feature-bit in SCTLR_EL1.
This means the PSTATE.PAN bit won't be set until the next return to the
kernel from userspace. On a preemptible kernel we may schedule work that
accesses userspace on a CPU before it has done this.

Now that cpufeature enable() calls are scheduled via stop_machine(), we
can set PSTATE.PAN from the cpu_enable_pan() call.

Add WARN_ON_ONCE(in_interrupt()) to check the PSTATE value we updated
is not immediately discarded.

Reported-by: Tony Thompson <anthony.thompson@arm.com>
Reported-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
[will: fixed typo in comment]
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-10-20 09:50:53 +01:00
James Morse
2a6dcb2b5f arm64: cpufeature: Schedule enable() calls instead of calling them via IPI
The enable() call for a cpufeature/errata is called using on_each_cpu().
This issues a cross-call IPI to get the work done. Implicitly, this
stashes the running PSTATE in SPSR when the CPU receives the IPI, and
restores it when we return. This means an enable() call can never modify
PSTATE.

To allow PAN to do this, change the on_each_cpu() call to use
stop_machine(). This schedules the work on each CPU which allows
us to modify PSTATE.

This involves changing the protype of all the enable() functions.

enable_cpu_capabilities() is called during boot and enables the feature
on all online CPUs. This path now uses stop_machine(). CPU features for
hotplug'd CPUs are enabled by verify_local_cpu_features() which only
acts on the local CPU, and can already modify the running PSTATE as it
is called from secondary_start_kernel().

Reported-by: Tony Thompson <anthony.thompson@arm.com>
Reported-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-10-20 09:50:53 +01:00
Andre Przywara
87261d1904 arm64: Cortex-A53 errata workaround: check for kernel addresses
Commit 7dd01aef05 ("arm64: trap userspace "dc cvau" cache operation on
errata-affected core") adds code to execute cache maintenance instructions
in the kernel on behalf of userland on CPUs with certain ARM CPU errata.
It turns out that the address hasn't been checked to be a valid user
space address, allowing userland to clean cache lines in kernel space.
Fix this by introducing an address check before executing the
instructions on behalf of userland.

Since the address doesn't come via a syscall parameter, we can't just
reject tagged pointers and instead have to remove the tag when checking
against the user address limit.

Cc: <stable@vger.kernel.org>
Fixes: 7dd01aef05 ("arm64: trap userspace "dc cvau" cache operation on errata-affected core")
Reported-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
[will: rework commit message + replace access_ok with max_user_addr()]
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-10-20 09:50:49 +01:00
Andy Lutomirski
d17af5056c mm: Change vm_is_stack_for_task() to vm_is_stack_for_current()
Asking for a non-current task's stack can't be done without races
unless the task is frozen in kernel mode.  As far as I know,
vm_is_stack_for_task() never had a safe non-current use case.

The __unused annotation is because some KSTK_ESP implementations
ignore their parameter, which IMO is further justification for this
patch.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Jann Horn <jann@thejh.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linux API <linux-api@vger.kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tycho Andersen <tycho.andersen@canonical.com>
Link: http://lkml.kernel.org/r/4c3f68f426e6c061ca98b4fc7ef85ffbb0a25b0c.1475257877.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-10-20 09:21:41 +02:00
Andy Lutomirski
b18cb64ead fs/proc: Stop trying to report thread stacks
This reverts more of:

  b76437579d ("procfs: mark thread stack correctly in proc/<pid>/maps")

... which was partially reverted by:

  65376df582 ("proc: revert /proc/<pid>/maps [stack:TID] annotation")

Originally, /proc/PID/task/TID/maps was the same as /proc/TID/maps.

In current kernels, /proc/PID/maps (or /proc/TID/maps even for
threads) shows "[stack]" for VMAs in the mm's stack address range.

In contrast, /proc/PID/task/TID/maps uses KSTK_ESP to guess the
target thread's stack's VMA.  This is racy, probably returns garbage
and, on arches with CONFIG_TASK_INFO_IN_THREAD=y, is also crash-prone:
KSTK_ESP is not safe to use on tasks that aren't known to be running
ordinary process-context kernel code.

This patch removes the difference and just shows "[stack]" for VMAs
in the mm's stack range.  This is IMO much more sensible -- the
actual "stack" address really is treated specially by the VM code,
and the current thread stack isn't even well-defined for programs
that frequently switch stacks on their own.

Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linux API <linux-api@vger.kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tycho Andersen <tycho.andersen@canonical.com>
Link: http://lkml.kernel.org/r/3e678474ec14e0a0ec34c611016753eea2e1b8ba.1475257877.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-10-20 09:21:41 +02:00
Andy Lutomirski
0a1eb2d474 fs/proc: Stop reporting eip and esp in /proc/PID/stat
Reporting these fields on a non-current task is dangerous.  If the
task is in any state other than normal kernel code, they may contain
garbage or even kernel addresses on some architectures.  (x86_64
used to do this.  I bet lots of architectures still do.)  With
CONFIG_THREAD_INFO_IN_TASK=y, it can OOPS, too.

As far as I know, there are no use programs that make any material
use of these fields, so just get rid of them.

Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linux API <linux-api@vger.kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Tycho Andersen <tycho.andersen@canonical.com>
Link: http://lkml.kernel.org/r/a5fed4c3f4e33ed25d4bb03567e329bc5a712bcc.1475257877.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-10-20 09:21:41 +02:00
Chris Wilson
7fb71c8f4f drm/i915: Handle early failure during intel_get_load_detect_pipe
In the error path, we have to be ready to handle an error before either
the state or restore_state have been allocated.

[  397.001342] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  397.001419] IP: [<ffffffffa04347b4>] intel_get_load_detect_pipe+0xe4/0x610 [i915]
[  397.001502] PGD 136a2a067
[  397.001523] PUD 134b5f067
[  397.001546] PMD 0

[  397.001569] Oops: 0002 [#1] PREEMPT SMP
[  397.001599] Modules linked in: snd_hda_intel i915 cdc_ncm usbnet mii x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec snd_hwdep snd_hda_core snd_pcm lpc_ich mei_me mei sdhci_pci sdhci mmc_core e1000e ptp pps_core [last unloaded: i915]
[  397.001902] CPU: 1 PID: 9287 Comm: kms_force_conne Tainted: G     U          4.9.0-rc1-CI-CI_DRM_1730+ #1
[  397.001965] Hardware name: LENOVO 2356GCG/2356GCG, BIOS G7ET31WW (1.13 ) 07/02/2012
[  397.002017] task: ffff880138c38040 task.stack: ffffc900083e4000
[  397.002057] RIP: 0010:[<ffffffffa04347b4>]  [<ffffffffa04347b4>] intel_get_load_detect_pipe+0xe4/0x610 [i915]
[  397.002153] RSP: 0018:ffffc900083e7ae8  EFLAGS: 00010286
[  397.002191] RAX: 00000000ffffffdd RBX: ffffc900083e7bc8 RCX: 0000000000000006
[  397.002239] RDX: 0000000000000006 RSI: ffff880138c388b8 RDI: ffffc900083e79e0
[  397.002287] RBP: ffffc900083e7b78 R08: 0000000000000000 R09: 0000000000000000
[  397.002335] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  397.002386] R13: ffff8801305e1158 R14: 00000000ffffffdd R15: 0000000000000000
[  397.002434] FS:  00007fea1b03c740(0000) GS:ffff88013e240000(0000) knlGS:0000000000000000
[  397.002488] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  397.002528] CR2: 0000000000000000 CR3: 00000001361da000 CR4: 00000000001406e0
[  397.002576] Stack:
[  397.002592]  ffff88013046f180 0000000000000000 ffffc900083e7bc0 0000000000000000
[  397.002655]  0000000000000000 ffff8801306bd038 ffff88012e980000 ffffc90000000001
[  397.002718]  ffffc90000000000 ffff880136b8ca88 ffff88012e980890 ffff88012e980540
[  397.002780] Call Trace:
[  397.002828]  [<ffffffffa044e8c4>] intel_crt_detect+0x3c4/0x8f0 [i915]
[  397.002876]  [<ffffffff810e37fa>] ? vprintk_default+0x1a/0x20
[  397.002918]  [<ffffffff8116eb68>] ? printk+0x43/0x4b
[  397.002956]  [<ffffffff81546b06>] drm_helper_probe_single_connector_modes+0x406/0x4f0
[  397.003014]  [<ffffffff81819c09>] ? mutex_unlock+0x9/0x10
[  397.003054]  [<ffffffff815723dc>] drm_mode_getconnector+0x33c/0x3c0
[  397.003099]  [<ffffffff810ed59d>] ? debug_lockdep_rcu_enabled+0x1d/0x20
[  397.003147]  [<ffffffff811a6bae>] ? __might_fault+0x3e/0x90
[  397.003191]  [<ffffffff8155aaf6>] drm_ioctl+0x1f6/0x480
[  397.003231]  [<ffffffff815720a0>] ? drm_mode_connector_property_set_ioctl+0x30/0x30
[  397.003285]  [<ffffffff8120308e>] do_vfs_ioctl+0x8e/0x690
[  397.003324]  [<ffffffff810a102c>] ? task_work_run+0x8c/0xb0
[  397.003366]  [<ffffffff810d6d92>] ? trace_hardirqs_on_caller+0x122/0x1b0
[  397.003412]  [<ffffffff812036cc>] SyS_ioctl+0x3c/0x70
[  397.003451]  [<ffffffff8181df2e>] entry_SYSCALL_64_fastpath+0x1c/0xb1
[  397.003496] Code: 85 c0 41 89 c6 75 57 49 8b 85 f0 00 00 00 48 89 de 45 31 ff 48 8d 78 20 e8 1a 89 13 e1 45 31 c9 85 c0 41 89 c6 0f 84 2f 01 00 00 <f0> 41 83 29 01 74 53 f0 41 83 2f 01 74 2d 41 83 fe dd 75 35 48
[  397.003837] RIP  [<ffffffffa04347b4>] intel_get_load_detect_pipe+0xe4/0x610 [i915]
[  397.003921]  RSP <ffffc900083e7ae8>
[  397.003947] CR2: 0000000000000000

Testcase: igt/kms_force_connector_basic/force-load-detect # ivb-3720m
Fixes: 0853695c3b ("drm: Add reference counting to drm_atomic_state"
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161019113743.19847-1-chris@chris-wilson.co.uk
2016-10-20 09:05:34 +02:00
Stefan Agner
41b9bb1b3b drm/fb_cma_helper: do not free fbdev if there is none
If fbdev emulation is not in use (or not built-in), fb_helper.fbdev
is NULL. Don't call calling drm_fbdev_cma_defio_fini in this case.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161020003221.2941-2-stefan@agner.ch
2016-10-20 09:05:34 +02:00
Alex Thorlton
caef78b6cd x86/platform/UV: Fix support for EFI_OLD_MEMMAP after BIOS callback updates
Some time ago, we brought our UV BIOS callback code up to speed with the
new EFI memory mapping scheme, in commit:

    d1be84a232 ("x86/uv: Update uv_bios_call() to use efi_call_virt_pointer()")

By leveraging some changes that I made to a few of the EFI runtime
callback mechanisms, in commit:

    80e7559607 ("efi: Convert efi_call_virt() to efi_call_virt_pointer()")

This got everything running smoothly on UV, with the new EFI mapping
code.  However, this left one, small loose end, in that EFI_OLD_MEMMAP
(a.k.a. efi=old_map) will no longer work on UV, on kernels that include
the aforementioned changes.

At the time this was not a major issue (in fact, it still really isn't),
but there's no reason that EFI_OLD_MEMMAP *shouldn't* work on our
systems.  This commit adds a check into uv_bios_call(), to see if we have
the EFI_OLD_MEMMAP bit set in efi.flags.  If it is set, we fall back to
using our old callback method, which uses efi_call() directly on the __va()
of our function pointer.

Signed-off-by: Alex Thorlton <athorlton@sgi.com>
Acked-by: Matt Fleming <matt@codeblueprint.co.uk>
Cc: <stable@vger.kernel.org> # v4.7 and later
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dimitri Sivanich <sivanich@sgi.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Mike Travis <travis@sgi.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Russ Anderson <rja@sgi.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1476928131-170101-1-git-send-email-athorlton@sgi.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-10-20 08:47:58 +02:00
Nicholas Bellinger
61f36166c2 Revert "target: Fix residual overflow handling in target_complete_cmd_with_length"
This reverts commit c1ccbfe031.

Reverting this patch, as it incorrectly assumes the additional length
for INQUIRY in target_complete_cmd_with_length() is SCSI allocation
length, which breaks existing user-space code when SCSI allocation
length is smaller than additional length.

  root@scsi-mq:~# sg_inq --len=4 -vvvv /dev/sdb
  found bsg_major=253
  open /dev/sdb with flags=0x800
      inquiry cdb: 12 00 00 00 04 00
        duration=0 ms
      inquiry: pass-through requested 4 bytes (data-in) but got -28 bytes
      inquiry: pass-through can't get negative bytes, say it got none
      inquiry: got too few bytes (0)
  INQUIRY resid (32) should never exceed requested len=4
      inquiry: failed requesting 4 byte response: Malformed response to
               SCSI command [resid=32]

AFAICT the original change was not to address a specific host issue,
so go ahead and revert to original logic for now.

Cc: Douglas Gilbert <dgilbert@interlog.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Sumit Rai <sumitrai96@gmail.com>
Cc: stable@vger.kernel.org # 4.8+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:34 -07:00
Dinesh Israni
926317de33 target: Don't override EXTENDED_COPY xcopy_pt_cmd SCSI status code
This patch addresses a bug where a local EXTENDED_COPY WRITE or READ
backend I/O request would always return SAM_STAT_CHECK_CONDITION,
even if underlying xcopy_pt_cmd->se_cmd generated a different
SCSI status code.

ESX host environments expect to hit SAM_STAT_RESERVATION_CONFLICT
for certain scenarios, and SAM_STAT_CHECK_CONDITION results in
non-retriable status for these cases.

Tested on v4.1.y with ESX v5.5u2+ with local IBLOCK backend copy.

Reported-by: Nixon Vincent <nixon.vincent@calsoftinc.com>
Tested-by: Nixon Vincent <nixon.vincent@calsoftinc.com>
Cc: Nixon Vincent <nixon.vincent@calsoftinc.com>
Tested-by: Dinesh Israni <ddi@datera.io>
Signed-off-by: Dinesh Israni <ddi@datera.io>
Cc: Dinesh Israni <ddi@datera.io>
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:33 -07:00
Nicholas Bellinger
449a137846 target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT REACHABLE
This patch addresses a bug where EXTENDED_COPY across multiple LUNs
results in a CHECK_CONDITION when the source + destination are not
located on the same physical node.

ESX Host environments expect sense COPY_ABORTED w/ COPY TARGET DEVICE
NOT REACHABLE to be returned when this occurs, in order to signal
fallback to local copy method.

As described in section 6.3.3 of spc4r22:

  "If it is not possible to complete processing of a segment because the
   copy manager is unable to establish communications with a copy target
   device, because the copy target device does not respond to INQUIRY,
   or because the data returned in response to INQUIRY indicates
   an unsupported logical unit, then the EXTENDED COPY command shall be
   terminated with CHECK CONDITION status, with the sense key set to
   COPY ABORTED, and the additional sense code set to COPY TARGET DEVICE
   NOT REACHABLE."

Tested on v4.1.y with ESX v5.5u2+ with BlockCopy across multiple nodes.

Reported-by: Nixon Vincent <nixon.vincent@calsoftinc.com>
Tested-by: Nixon Vincent <nixon.vincent@calsoftinc.com>
Cc: Nixon Vincent <nixon.vincent@calsoftinc.com>
Tested-by: Dinesh Israni <ddi@datera.io>
Signed-off-by: Dinesh Israni <ddi@datera.io>
Cc: Dinesh Israni <ddi@datera.io>
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:32 -07:00
Nicholas Bellinger
527268df31 target: Re-add missing SCF_ACK_KREF assignment in v4.1.y
This patch fixes a regression in >= v4.1.y code where the original
SCF_ACK_KREF assignment in target_get_sess_cmd() was dropped upstream
in commit 054922bb, but the series for addressing TMR ABORT_TASK +
LUN_RESET with fabric session reinstatement in commit febe562c20 still
depends on this code in transport_cmd_finish_abort().

The regression manifests itself as a se_cmd->cmd_kref +1 leak, where
ABORT_TASK + LUN_RESET can hang indefinately for a specific I_T session
for drivers using SCF_ACK_KREF, resulting in hung kthreads.

This patch has been verified with v4.1.y code.

Reported-by: Vaibhav Tandon <vst@datera.io>
Tested-by: Vaibhav Tandon <vst@datera.io>
Cc: Vaibhav Tandon <vst@datera.io>
Cc: stable@vger.kernel.org # 4.1+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:31 -07:00
Varun Prakash
1a40f0a36f iscsi-target: fix iscsi cmd leak
If iscsi-target receives NOP OUT with ITT and TTT
set to 0xffffffff it allocates iscsi_cmd but
does not free the cmd, so free iscsi_cmd in this case.

Signed-off-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:31 -07:00
Colin Ian King
3fc6a642e4 iscsi-target: fix spelling mistake "Unsolicitied" -> "Unsolicited"
Trivial fix to spelling mistakes in pr_debug message and comments

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:30 -07:00
Andy Grover
3d9b95558f target/user: Fix comments to not refer to data ring
We no longer use a ringbuffer for the data area, so this might cause
confusion. Just call it the data area.

Signed-off-by: Andy Grover <agrover@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:23 -07:00
Andy Grover
554617b2bb target/user: Return an error if cmd data size is too large
Userspace should be implementing VPD B0 (Block Limits) to inform the
initiator of max data size, but just in case we do get a too-large request,
do what the spec says and return INVALID_CDB_FIELD.

Make sure to unlock udev->cmdr_lock before returning.

Signed-off-by: Andy Grover <agrover@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:22:16 -07:00
Andy Grover
02eb924fab target/user: Use sense_reason_t in tcmu_queue_cmd_ring
Instead of using -ERROR-style returns, use sense_reason_t. This lets us
remove tcmu_pass_op(), and return more correct sense values.

Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-10-19 21:21:45 -07:00
Stefan Agner
0a70c998d0 drm/fsl-dcu: enable pixel clock when enabling CRTC
The pixel clock should not be on if the CRTC is not in use, hence
move clock enable/disable calls into CRTC callbacks.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Tested-By: Meng Yi <meng.yi@nxp.com>
2016-10-19 17:03:02 -07:00
Stefan Agner
9789037695 drm/fsl-dcu: do not transfer registers in mode_set_nofb
Do not schedule a transfer of mode settings early. Modes should
get applied on on CRTC enable where we also enable the pixel clock.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Tested-By: Meng Yi <meng.yi@nxp.com>
2016-10-19 17:02:59 -07:00
Stefan Agner
b6ead864ea drm/fsl-dcu: do not transfer registers on plane init
There is no need to explicitly initiate a register transfer and
turn off the DCU after initializing the plane registers. In fact,
this is harmful and leads to unnecessary flickers if the DCU has
been left on by the bootloader.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Tested-By: Meng Yi <meng.yi@nxp.com>
2016-10-19 17:02:54 -07:00
Stefan Agner
8dedefbc38 drm/fsl-dcu: enable TCON bypass mode by default
Do not use encoder disable/enable callbacks to control bypass
mode as this seems to mess with the signals not liked by
displays. This also makes more sense since the encoder is
already defined to be parallel RGB/LVDS at creation time.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Tested-By: Meng Yi <meng.yi@nxp.com>
2016-10-19 17:01:51 -07:00
Richard Weinberger
c83ed4c9db ubifs: Abort readdir upon error
If UBIFS is facing an error while walking a directory, it reports this
error and ubifs_readdir() returns the error code. But the VFS readdir
logic does not make the getdents system call fail in all cases. When the
readdir cursor indicates that more entries are present, the system call
will just return and the libc wrapper will try again since it also
knows that more entries are present.
This causes the libc wrapper to busy loop for ever when a directory is
corrupted on UBIFS.
A common approach do deal with corrupted directory entries is
skipping them by setting the cursor to the next entry. On UBIFS this
approach is not possible since we cannot compute the next directory
entry cursor position without reading the current entry. So all we can
do is setting the cursor to the "no more entries" position and make
getdents exit.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
2016-10-20 00:06:11 +02:00
Geert Uytterhoeven
884a3b6478 UBI: Fix crash in try_recover_peb()
drivers/mtd/ubi/eba.c: In function ‘try_recover_peb’:
    drivers/mtd/ubi/eba.c:744: warning: ‘vid_hdr’ is used uninitialized in this function

The pointer vid_hdr is indeed not initialized, leading to a crash when
it is dereferenced.

Fix this by obtaining the pointer from the VID buffer, like is done
everywhere else.

Fixes: 3291b52f9f ("UBI: introduce the VID buffer concept")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
2016-10-20 00:06:06 +02:00
Colin Ian King
a15cf34fed ubi: fix swapped arguments to call to ubi_alloc_aeb
Static analysis by CoverityScan detected the ec and pnum
arguments are in the wrong order on a call to ubi_alloc_aeb.
Swap the order to fix this.

Fixes: 91f4285fe3 ("UBI: provide helpers to allocate and free aeb elements")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
2016-10-20 00:06:00 +02:00
Richard Weinberger
843741c577 ubifs: Fix xattr_names length in exit paths
When the operation fails we also have to undo the changes
we made to ->xattr_names. Otherwise listxattr() will report
wrong lengths.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
2016-10-20 00:05:54 +02:00
Richard Weinberger
390975ac39 ubifs: Rename ubifs_rename2
Since ->rename2 is gone, rename ubifs_rename2() to ubifs_rename().

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
2016-10-20 00:05:47 +02:00
cpaul@redhat.com
faccd9941b drm/i915/gen9: Don't wrap strings in verify_wm_state()
Wrapping strings is against the guidelines in Documentation/CodingStyle,
chapter 2.

Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476480722-13015-11-git-send-email-cpaul@redhat.com
2016-10-19 18:27:38 -02:00
cpaul@redhat.com
3de8a14c28 drm/i915/gen9: Actually verify WM levels in verify_wm_state()
Thanks to Paulo Zanoni for indirectly pointing this out.

Looks like we never actually added any code for checking whether or not
we actually wrote watermark levels properly. Let's fix that.

Changes since v1:
- Use %u instead of %d when printing WM state mismatches

Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476480722-13015-10-git-send-email-cpaul@redhat.com
2016-10-19 18:27:01 -02:00
cpaul@redhat.com
45ece23016 drm/i915/gen9: Add skl_wm_level_equals()
Helper we're going to be using for implementing verification of the wm
levels in skl_verify_wm_level().

Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476480722-13015-9-git-send-email-cpaul@redhat.com
2016-10-19 18:26:14 -02:00
cpaul@redhat.com
bf9d99ad17 drm/i915/gen9: Make skl_pipe_wm_get_hw_state() reusable
There's not much of a reason this should have the locations to read out
the hardware state hardcoded, so allow the caller to specify the
location and add this function to intel_drv.h. As well, we're going to
need this function to be reusable for the next patch.

Changes since v1:
- Fix accidental behavior change in the code that Paulo pointed out

Signed-off-by: Lyude <cpaul@redhat.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476480722-13015-8-git-send-email-cpaul@redhat.com
2016-10-19 18:25:33 -02:00
cpaul@redhat.com
413fc530c5 drm/i915/gen9: Add ddb changes to atomic debug output
Finally, add some debugging output for ddb changes in the atomic debug
output. This makes it a lot easier to spot bugs from incorrect ddb
allocations.

Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476480722-13015-7-git-send-email-cpaul@redhat.com
2016-10-19 18:25:12 -02:00
cpaul@redhat.com
d8c0fafcbd drm/i915/gen9: Get rid of redundant watermark values
Now that we've make skl_wm_levels make a little more sense, we can
remove all of the redundant wm information. Up until now we'd been
storing two copies of all of the skl watermarks: one being the
skl_pipe_wm structs, the other being the global wm struct in
drm_i915_private containing the raw register values. This is confusing
and problematic, since it means we're prone to accidentally letting the
two copies go out of sync. So, get rid of all of the functions
responsible for computing the register values and just use a single
helper, skl_write_wm_level(), to convert and write the new watermarks on
the fly.

Changes since v1:
- Fixup skl_write_wm_level()
- Fixup skl_wm_level_from_reg_val()
- Don't forget to copy *active to intel_crtc->wm.active.skl
Changes since v2:
- Fix usage of wrong cstate
Changes since v3 (by Paulo):
- Rebase

Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com> (v2)
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Lyude <cpaul@redhat.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1476814189-6062-1-git-send-email-paulo.r.zanoni@intel.com
2016-10-19 18:24:18 -02:00
Chris Wilson
38fac8bffc drm/i915: STOP_MACHINE is no more, stop selecting it
The STOP_MACHINE kconfig symbol was removed upstream after making
stop_machine() always work, commit 86fffe4a61 ("kernel: remove
stop_machine() Kconfig dependency"), and was removed from i915's Kconfig
in commit 21fabbebff ("drm/i915: Remove select to deleted
STOP_MACHINE from Kconfig").

However, I accidentally reintroduced the select when rebasing an older
commit that also was dependent upon a working stop_machine.

Fixes: 9f267eb8d2 ("drm/i915: Stop the machine whilst capturing...")
Reported-by: Valentin Rothberg <valentinrothberg@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161019180635.27459-1-chris@chris-wilson.co.uk
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
2016-10-19 20:05:48 +01:00
Linus Torvalds
c3f8f7fa8b platform-drivers-x86 for 4.9-2
Fix a Kconfig issue leading potential link failure, and
 add a DMI match for an existing quirk.
 
 asus-wmi:
  - add SERIO_I8042 dependency
 
 ideapad-laptop:
  - Add Lenovo Yoga 910-13IKB to no_hw_rfkill dmi list
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJYB7xbAAoJEKbMaAwKp364JZ0IAKbnhIY5UuwIxbShgbKR6o/H
 QOosQwHx+ZzGW4jtYRCEMU1uJH5B4CESMlUzPMJSqkpAz4yZyvaLnMnNL1C2QQkV
 vzn92owyeuNm1VmWxCBL5EbowcMQyAlWtZik9JEwz9G1nlSOlgOhjH4mfugePJLr
 2sCGyfenzXM3otTTB5eGqKg6+4upmf/H8I3HQlu8TUnISslFHahf9czOaFWKwrK6
 tm4nWHzx/nx4PcPQm+EvWT5mlsg/+DhFtyzJIqPZypmBuXR2MRaomqe8AugAXcst
 iVHxve7CWrw/Oiaa4tESdS/P2KhnLzVbDjUaOyAMLyBu670xBnlieH6Q4jJjd4Y=
 =yZrl
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v4.9-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86

Pull x86 platform driver fixes from Darren Hart:
 "Fix a Kconfig issue leading potential link failure, and add a DMI
  match for an existing quirk.

  asus-wmi:
   - add SERIO_I8042 dependency

  ideapad-laptop:
   - Add Lenovo Yoga 910-13IKB to no_hw_rfkill dmi list"

* tag 'platform-drivers-x86-v4.9-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
  platform/x86: asus-wmi: add SERIO_I8042 dependency
  platform/x86: ideapad-laptop: Add Lenovo Yoga 910-13IKB to no_hw_rfkill dmi list
2016-10-19 11:45:06 -07:00
Arnd Bergmann
83aa3e0f79 nfs4: fix missing-braces warning
A bugfix introduced a harmless warning for update_open_stateid:

fs/nfs/nfs4proc.c:1548:2: error: missing braces around initializer [-Werror=missing-braces]

Removing the zero in the initializer will do the right thing here
and initialize the entire structure to zero.

Fixes: 1393d9612b ("NFSv4: Fix a race when updating an open_stateid")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
2016-10-19 14:39:15 -04:00
Linus Torvalds
147fdd8cf1 Minor changes to improve J2 support and match Kconfig expectations of
other subsystems.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJYB69cAAoJELcQ+SIFb8Hau0IH/3UBLH7YvoPomqZU3OhPzLMr
 49HgPJEcDNYv6piU+VlT3RK16GJcjobJF6OFlbNvCqvt/IqnrR3eX4LD2Tv0d7z1
 XlLQ0Re9pL3Lbe4Mo3YdiZrh+Zv6yzMsQqpbUSf298VvwZ84AoLWVTJ+oobGTTP/
 77PPyZiRxgVsC+3YERk49Af48xpt3Bm2pNhT1wutf7+OW2aatA/v9LIsz9zAzhRN
 gULZ9l+9w2pT9sVT6ho7w3Xm00kvGr/MW3AjbnMaHey3cpjkvj8VGmF0X6/d/4ct
 Tqygpe1nMXjbIvQ1Zg3uH3qbjo8N27ajoQaaOaWa80SGc2Urf8zDswCcagljCDU=
 =Lqsd
 -----END PGP SIGNATURE-----

Merge tag 'sh-for-4.9' of git://git.libc.org/linux-sh

Pull arch/sh updates from Rich Felker:
 "Minor changes to improve J2 support and match Kconfig expectations of
  other subsystems"

* tag 'sh-for-4.9' of git://git.libc.org/linux-sh:
  sh: add earlycon support to j2_defconfig
  sh: add Kconfig option for J-Core SoC core drivers
  sh: support CPU_J2 when compiler lacks -mj2
2016-10-19 11:21:06 -07:00
Christoph Hellwig
e9c9346e20 nvmet: use symbolic constants for CNS values
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Reviewed-by: Jay Freyensee <james_p_freyensee@linux.intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2016-10-19 11:36:22 -06:00
Christoph Hellwig
fa60682677 nvme: use symbolic constants for CNS values
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2016-10-19 11:36:22 -06:00
Christoph Hellwig
329dd7681c nvme.h: add an enum for cns values
Ported over from nvme-cli.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2016-10-19 11:36:22 -06:00
Christoph Hellwig
8d63687afd nvme.h: don't use uuid_be
This makes life easier for nvme-cli and we don't really need the uuid
type anyway to start with.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Reviewed-by: Jay Freyensee <james_p_freyensee@linux.intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2016-10-19 11:36:22 -06:00