Takashi Sakamoto [Tue, 10 May 2016 22:35:09 +0000 (07:35 +0900)]
ALSA: firewire-lib: drop skip argument from helper functions to queue a packet
On most of audio and music units on IEEE 1394 bus which ALSA firewire stack
supports (or plans to support), CIP with two quadlets header is used.
Thus, there's no cases to queue packets with blank payload. If such packets
are going to be queued, it means that they're for skips of the cycle.
This commit simplifies helper functions to queue a packet.
Takashi Sakamoto [Tue, 10 May 2016 22:33:27 +0000 (07:33 +0900)]
ALSA: firewire-lib: add context information to tracepoints
In current implementation, packet processing is done in both of software
IRQ contexts of IR/IT contexts and process contexts.
This is usual interrupt handling of IR/IT context for 1394 OHCI.
(in hardware IRQ context)
irq_handler() (drivers/firewire/ohci.c)
->tasklet_schedule()
(in software IRQ context)
handle_it_packet() or handle_ir_packet_per_buffer() (drivers/firewire/ohci.c)
->flush_iso_completions()
->struct fw_iso_context.callback.sc()
= out_stream_callback() or in_stream_callback()
However, we have another chance for packet processing. It's done in PCM
frame handling via ALSA PCM interfaces.
(in process context)
ioctl(i.e. SNDRV_PCM_IOCTL_HWSYNC)
->snd_pcm_hwsync() (sound/core/pcm_native.c)
->snd_pcm_update_hw_ptr() (sound/core/pcm_lib.c)
->snd_pcm_update_hw_ptr0()
->struct snd_pcm_ops.pointer()
= amdtp_stream_pcm_pointer()
->fw_iso_context_flush_completions() (drivers/firewire/core-iso.c)
->struct fw_card_driver.flush_iso_completions()
= ohci_flush_iso_completions() (drivers/firewire/ohci.c)
->flush_iso_completions()
->struct fw_iso_context.callback.sc()
= out_stream_callback() or in_stream_callback()
This design is for a better granularity of PCM pointer. When ioctl(2) is
executed with some commands for ALSA PCM interface, queued packets are
handled at first. Then, the latest number of handled PCM frames is
reported. The number can represent PCM frames transferred in most near
isochronous cycle.
Current tracepoints include no information to distinguish running contexts.
When tracing the interval of software IRQ context, this is not good.
This commit adds more information for current context. Additionally, the
index of packet processed in one context is added in a case that packet
processing is executed in continuous context of the same kind,
As a result, the output includes 11 fields with additional two fields
to commit 0c95c1d6197f ("ALSA: firewire-lib: add tracepoints to dump a part
of isochronous packet data"):
17131.9186: out_packet: 07 7494 ffc0 ffc1 00 000700c09001a496 058 45 1 13
17131.9186: out_packet: 07 7495 ffc0 ffc1 00 000700c89001ba00 058 46 1 14
17131.9186: out_packet: 07 7496 ffc0 ffc1 00 000700d09001ffff 002 47 1 15
17131.9189: out_packet: 07 7497 ffc0 ffc1 00 000700d09001d36a 058 00 0 00
17131.9189: out_packet: 07 7498 ffc0 ffc1 00 000700d89001e8d4 058 01 0 01
17131.9189: out_packet: 07 7499 ffc0 ffc1 00 000700e09001023e 058 02 0 00
17131.9206: in_packet: 07 7447 ffc1 ffc0 01 3f0700729001783d 058 32 1 00
17131.9206: in_packet: 07 7448 ffc1 ffc0 01 3f07007290ffffff 002 33 1 01
17131.9206: in_packet: 07 7449 ffc1 ffc0 01 3f07007a900191a8 058 34 1 02
(Here, some common fields are omitted so that a line is within 80
characters.)
The legend is:
- The second of cycle scheduled for the packet
- The count of cycle scheduled for the packet
- The ID of node as source (hex)
- The ID of node as destination (hex)
- The value of isochronous channel
- The first quadlet of CIP header (hex)
- The second quadlet of CIP header (hex)
- The number of included quadlets
- The index of packet in a buffer maintained by this module
- 0 in process context, 1 in IRQ context
- The index of packet processed in the context
Takashi Sakamoto [Wed, 11 May 2016 17:17:39 +0000 (02:17 +0900)]
ALSA: firewire-lib: permit to flush queued packets only in process context for better PCM period granularity
These three commits were merged to improve PCM pointer granularity.
commit 76fb87894828 ("ALSA: firewire-lib: taskletize the snd_pcm_period_elapsed() call")
commit e9148dddc3c7 ("ALSA: firewire-lib: flush completed packets when reading PCM position")
commit 92b862c7d685 ("ALSA: firewire-lib: optimize packet flushing")
The point of them is to handle queued packets not only in software IRQ
context of IR/IT contexts, but also in process context. As a result of
handling packets, period tasklet is scheduled when acrossing PCM period
boundary. This is to prevent recursive call of
'struct snd_pcm_ops.pointer()' in the same context.
When the pointer callback is executed in the process context, it's
better to avoid the second callback in the software IRQ context. The
software IRQ context runs immediately after scheduled in the process
context because few packets are queued yet.
For the aim, 'pointer_flush' is used, however it causes a race condition
between the process context and software IRQ context of IR/IT contexts.
Practically, this race is not so critical because it influences process
context to skip flushing queued packet and to get worse granularity of
PCM pointer. The race condition is quite rare but it should be improved
for stable service.
The similar effect can be achieved by using 'in_interrupt()' macro. This
commit obsoletes 'pointer_flush' with it.
Takashi Iwai [Tue, 10 May 2016 14:07:40 +0000 (16:07 +0200)]
ALSA: pcm: Bail out when chmap is already present
When snd_pcm_add_chmap_ctls() is called to the PCM stream to which a
chmap has been already assigned, it returns as an error due to the
conflicting snd_ctl_add() result. However, this also clears the
already assigned chmap_kctl field via pcm_chmap_ctl_private_free(),
and becomes inconsistent in the later operation.
This patch adds the check of the conflicting chmap kctl before
actually trying to allocate / assign. The check failure is treated as
a kernel warning, as the double call of snd_pcm_add_chmap_ctls() is
basically a driver bug and having the stack trace would help
developers to figure out the bad code path.
ALSA: firewire-lib: enable the same feature as CIP_SKIP_INIT_DBC_CHECK flag
In former commit, drivers in ALSA firewire stack always starts IT context
before IR context. If IR context starts after packets are transmitted by
peer unit, packet discontinuity may be detected because the context starts
in the middle of packet streaming. This situation is rare because IT
context usually starts immediately. However, it's better to solve this
issue. This is suppressed with CIP_SKIP_INIT_DBC_CHECK flag.
This commit enables the same feature as CIP_SKIP_INIT_DBC_CHECK.
ALSA: firewire-lib: code cleanup for outgoing packet handling
In previous commit, this module has no need to reuse parameters of
incoming packets for outgoing packets anymore. This commit arranges some
needless codes for outgoing packet processing.
ALSA: firewire-lib: code cleanup for incoming packet handling
In previous commit, this module has no need to reuse parameters of
incoming packets for outgoing packets anymore. This commit arranges some
needless codes for incoming packet processing.
ALSA: firewire-lib: handle IT/IR contexts in each software interrupt context
In clause 6.3 of IEC 61883-6:2000, there's an explanation about processing
of presentation timestamp. In the clause, we can see "If a function block
receives a CIP, processes it and subsequently re-transmits it, then the
SYT of the outgoing CIP shall be the sum of the incoming SYT and the
processing delay." ALSA firewire stack has an implementation to partly
satisfy this specification. Developers assumed the stack to perform as an
Audio function block[1].
Following to the assumption, current implementation of ALSA firewire stack
use one software interrupt context to handle both of in/out packets. In
most case, this is processed in 1394 OHCI IR context independently of the
opposite context. Thus, this implementation uses longer CPU time in the
software interrupt context. This is not better for whole system.
Against the assumption, I confirmed that each ASIC for IEC 61883-1/6
doesn't necessarily expect it to the stack. Thus, current implementation
of ALSA firewire stack includes over-engineering.
This commit purges the implementation. As a result, packets of one
direction are handled in one software interrupt context and spends
minimum CPU time.
[1] [alsa-devel] [PATCH 0/8] [RFC] new driver for Echo Audio's Fireworks based devices
http://mailman.alsa-project.org/pipermail/alsa-devel/2013-June/062660.html
ALSA: firewire-tascam: drop reuse of incoming packet parameter for outgoing packet parameter
In packet streaming protocol applied to TASCAM FireWire series, the value
of SYT field in CIP header is always zero, therefore it has no meaning.
There's no need to synchronize packets in both direction for the series.
In current implementation of ALSA firewire stack, driver for the series
uses incoming packet parameter for outgoing packet parameter to calculate
the number of data blocks. This can be simplified because the task of
corresponding driver is to transfer data blocks enough to sampling transfer
frequency.
This commit purges support of full duplex synchronization to prevent
over-engineering implementation.
ALSA: fireworks: drop reuse of incoming packet parameter for ougoing packet parameter
On Fireworks board module of Echo Audio, TSB43Cx43A (IceLynx Micro, iCEM)
is used to process payload of isochronous packets. There's an public
document of this chip[1]. This document is for firmware programmers to
transfer/receive AMDTP with IEC60958 data format, however in clause 2.5,
2.6 and 2.7, we can see system design to utilize the sequence of value in
SYT field of CIP header. In clause 2.3, we can see the specification of
Audio Master Clock (MCLK) from iCEM.
Well, this clock is actually not used for sampling clock. This can be
confirmed when corresponding driver transfer random value as the sequence
of SYT field. Even if in this case, the unit generates proper sound.
Additionally, in unique command set for this board module, the format
of CIP is changed; for IEC 61883-6 mode which we use, and for Windows
Operating System. In the latter mode, the whole 32 bit field in second CIP
header from Windows driver is used to represent counter of packets (NO-DATA
code is still used for packets without data blocks). If the master clock
was physically used by DSP on the board module, the Windows driver must
have transferred correct sequence of SYT field.
Furthermore, as long as seeing capacities of AudioFire2, AudioFire4,
AudioFire8, AudioFirePre8 and AudioFire12, these models don't support
SYT-Match clock source.
Summary, we have no need to relate incoming/outgoing packets. This commit
drops reusing SYT sequence of incoming packets for outgoing packets.
[1] Using TSB43Cx43A: S/PDIF over 1394 (2003, Texus Instruments
Incorporated)
http://www.ti.com/analog/docs/litabsmultiplefilelist.tsp?literatureNumber=slla148&docCategoryId=1&familyId=361
ALSA: bebob: drop reuse of incoming packet parameter for outgoing packet parameter
Windows driver for BeBoB-based models mostly wait for transmitted packets,
then transfer packets to the models. This looks for the relationship
between incoming packets and outgoing packets to synchronize the sequence
of presentation timestamp.
However, the sequence between packets of both direction has no
relationship. Even if receiving NO-DATA packets, the drivers transfer
packets with meaningful value in SYT field. Additionally, the order of
starting packets is always the same, independently of the source of clock.
The corresponding driver is expected as a generator of presentation
timestamp and these models can select it as a source of sampling clock.
This commit drops reusing SYT sequence from ALSA bebob driver. The driver
always transfer packets with presentation timestamp generated by ALSA
firewire stack, without re-using the sequence of value in SYT field in
incoming packets to outgoing packets.
Yura Pakhuchiy [Sat, 7 May 2016 16:53:36 +0000 (23:53 +0700)]
ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
Subwoofer does not work out of the box on ASUS N751/N551 laptops. This
patch fixes it. Patch tested on N751 laptop. N551 part is not tested,
but according to [1] and [2] this laptop requires similar changes, so I
included them in the patch.
Takashi Iwai [Tue, 10 May 2016 08:24:02 +0000 (10:24 +0200)]
ALSA: hda - Fix broken reconfig
The HD-audio reconfig function got broken in the recent kernels,
typically resulting in a failure like:
snd_hda_intel 0000:00:1b.0: control 3:0:0:Playback Channel Map:0 is already present
This is because of the code restructuring to move the PCM and control
instantiation into the codec drive probe, by the commit [bcd96557bd0a:
ALSA: hda - Build PCMs and controls at codec driver probe]. Although
the commit above removed the calls of snd_hda_codec_build_pcms() and
*_build_controls() at the controller driver probe, the similar calls
in the reconfig were still left forgotten. This caused the
conflicting and duplicated PCMs and controls.
The fix is trivial: just remove these superfluous calls from
reconfig_codec().
Since the recent rewrite of HD-audio infrastructure,
CONFIG_SND_HDA_RECONFIG has a slightly different meaning. In the
earlier versions, it implicitly assumed only the usage via hwdep sysfs
entries. Meanwhile, in the recent version, this option is meant to
enable the reconfig code in HD-audio driver, which may be used by the
patch loader without hwdep interface.
This patch tries to clarify the usage pattern a bit better, hopefully
avoid the further confusion.
Charles Keepax [Wed, 4 May 2016 13:59:10 +0000 (14:59 +0100)]
ALSA: compress: Fix poll error return codes
We can't return a negative error code from the poll callback the return
type is unsigned and is checked against the poll specific flags we need
to return POLLERR if we encounter an error.
Charles Keepax [Wed, 4 May 2016 13:59:07 +0000 (14:59 +0100)]
ALSA: pcm: Fix poll error return codes
We can't return a negative error code from the poll callback the return
type is unsigned and is checked against the poll specific flags we need
to return POLLERR if we encounter an error.
ALSA: firewire-lib: add tracepoints to dump a part of isochronous packet data
When audio and music units have some quirks in their sequence of packet,
it's really hard for non-owners to identify the quirks. Although developers
need dumps for sequence of packets, it's difficult for users who have no
knowledges and no equipments for this purpose.
This commit adds tracepoints for this situation. When users encounter
the issue, they can dump a part of packet data via Linux tracing framework
as long as using drivers in ALSA firewire stack.
Additionally, tracepoints for outgoing packets will be our help to check
and debug packet processing of ALSA firewire stack.
This commit newly adds 'snd_firewire_lib' subsystem with 'in_packet' and
'out_packet' events. In the events, some attributes of packets and the
index of packet managed by this module are recorded per packet.
This is an usage:
$ trace-cmd record -e snd_firewire_lib:out_packet \
-e snd_firewire_lib:in_packet
/sys/kernel/tracing/events/snd_firewire_lib/out_packet/filter
/sys/kernel/tracing/events/snd_firewire_lib/in_packet/filter
Hit Ctrl^C to stop recording
^C
$ trace-cmd report trace.dat
...
23647.033934: in_packet: 01 4073 ffc0 ffc1 00 000f00409001b2d1 122 44
23647.033936: in_packet: 01 4074 ffc0 ffc1 00 000f00489001c83b 122 45
23647.033937: in_packet: 01 4075 ffc0 ffc1 00 000f00509001ffff 002 46
23647.033938: in_packet: 01 4076 ffc0 ffc1 00 000f00509001e1a6 122 47
23647.035426: out_packet: 01 4123 ffc1 ffc0 01 010f00d09001fb40 122 17
23647.035428: out_packet: 01 4124 ffc1 ffc0 01 010f00d89001ffff 002 18
23647.035429: out_packet: 01 4125 ffc1 ffc0 01 010f00d8900114aa 122 19
23647.035430: out_packet: 01 4126 ffc1 ffc0 01 010f00e090012a15 122 20
(Here, some common fields are omitted so that a line to be within 80
characters.)
...
One line represent one packet. The legend for the last nine fields is:
- The second of cycle scheduled for the packet
- The count of cycle scheduled for the packet
- The ID of node as source (hex)
- Some devices transfer packets with invalid source node ID in their CIP
header.
- The ID of node as destination (hex)
- The value is not in CIP header of packets.
- The value of isochronous channel
- The first quadlet of CIP header (hex)
- The second quadlet of CIP header (hex)
- The number of included quadlets
- The index of packet in a buffer maintained by this module
This is an example to parse these lines from text file by Python3 script:
\#!/usr/bin/env python3
import sys
def parse_ts(second, cycle, syt):
offset = syt & 0xfff
syt >>= 12
if cycle & 0x0f > syt:
cycle += 0x10
cycle &= 0x1ff0
cycle |= syt
second += cycle // 8000
cycle %= 8000
# In CYCLE_TIMER of 1394 OHCI, second is represented in 8 bit.
second %= 128
return (second, cycle, offset)
def calc_ts(second, cycle, offset):
ts = offset
ts += cycle * 3072
# In DMA descriptor of 1394 OHCI, second is represented in 3 bit.
ts += (second % 8) * 8000 * 3072
return ts
def subtract_ts(minuend, subtrahend):
# In DMA descriptor of 1394 OHCI, second is represented in 3 bit.
if minuend < subtrahend:
minuend += 8 * 8000 * 3072
return minuend - subtrahend
if len(sys.argv) != 2:
print('At least, one argument is required for packet dump.')
sys.exit()
filename = sys.argv[1]
data = []
prev = 0
with open(filename, 'r') as f:
for line in f:
pos = line.find('packet:')
if pos < 0:
continue
pos += len('packet:')
line = line[pos:].strip()
fields = line.split(' ')
datum = []
datum.append(fields[8])
syt = int(fields[6][4:], 16)
# Empty packet in IEC 61883-1, or NODATA in IEC 61883-6
if syt == 0xffff:
data_blocks = 0
else:
payload_size = int(fields[7], 10)
data_block_size = int(fields[5][2:4], 16)
data_blocks = (payload_size - 2) / data_block_size
datum.append(data_blocks)
if syt == 0xffff:
second = 0
cycle = 0
tick = 0
else:
second, cycle, tick = parse_ts(second, cycle, syt)
ts = calc_ts(second, cycle, tick)
datum.append(start)
datum.append(ts)
if ts == 0:
datum.append(0)
datum.append(0)
else:
# Usual case, or a case over 8 seconds.
if ts > start or start > 7 * 8000 * 3072:
datum.append(subtract_ts(ts, start))
if ts > prev or start > 7 * 8000 * 3072:
gap = subtract_ts(ts, prev)
datum.append(gap)
else:
datum.append('backward')
else:
datum.append('invalid')
prev = ts
data.append(datum)
sys.exit()
The data variable includes array with these elements:
- The index of the packet
- The number of data blocks in the packet
- The value of cycle count (hex)
- The value of CIP header 1 (hex)
- The value of CIP header 2 (hex)
- The value of cycle count (tick)
- The value of calculated presentation timestamp (tick)
- The offset between the cycle count and presentation timestamp
- The elapsed ticks from the previous presentation timestamp
ALSA: firewire-lib: compute the value of second field in cycle count for IR context
In callback function of isochronous context, modules can queue packets to
indicated isochronous cycles. Although the cycle to queue a packet is
deterministic by calculation, this module doesn't implement the calculation
because it's useless for processing.
In future, the cycle count is going to be printed with the other parameters
for debugging. This commit is the preparation. The cycle count is computed
by cycle unit, and correctly arranged to corresponding packets. The
calculated count is used in later commit.
ALSA: firewire-lib: compute the value of second field in cycle count for IT context
In callback function of isochronous context, u32 variable is passed for
cycle count. The value of this variable comes from DMA descriptors of 1394
Open Host Controller Interface (1394 OHCI). In the specification, DMA
descriptors transport lower 3 bits for second field and full cycle field in
16 bits field, therefore 16 bits of the u32 variable are available. The
value for second is modulo 8, and the value for cycle is modulo 8,000.
Currently, ALSA firewire-lib module don't use the value of the second
field, because the value is useless to calculate presentation timestamp in
IEC 61883-6. However, the value may be useful for debugging. In later
commit, it will be printed with the other parameters for debugging.
This commit makes this module to handle the whole cycle count including
second. The value is calculated by cycle unit. The existed code is already
written with ignoring the value of second, thus this commit causes no
issues.
Kangjie Lu [Tue, 3 May 2016 20:44:32 +0000 (16:44 -0400)]
ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Kangjie Lu [Tue, 3 May 2016 20:44:20 +0000 (16:44 -0400)]
ALSA: timer: Fix leak in events via snd_timer_user_ccallback
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Kangjie Lu [Tue, 3 May 2016 20:44:07 +0000 (16:44 -0400)]
ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA: dice: add support for M-Audio Profire 610 and perhaps 2626
M-Audio Profire 610 has an unexpected value in version field of its config
ROM, thus ALSA dice driver is not assigned to the model due to a mismatch
of modalias.
This commit adds an entry to support the model. I expect the entry is
also for Profire 2626.
I note that Profire 610 uses TCD2220 (so-called Dice Jr.), and supports a
part of Extended Application Protocol (EAP).
$ cd linux-firewire-utils/src
$ ./crpp < /sys/bus/firewire/devices/fw1/config_rom
ROM header and bus information block
------------------------------------------------------------
400 04047689 bus_info_length 4, crc_length 4, crc 30345
404 31333934 bus_name "1394"
408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255,
max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400)
40c 000d6c04 company_id 000d6c |
410 04400002 device_id 0404400002 | EUI-64 000d6c0404400002
root directory
------------------------------------------------------------
414 000695fe directory_length 6, crc 38398
418 03000d6c vendor
41c 8100000a --> descriptor leaf at 444
420 17000011 model
424 8100000d --> descriptor leaf at 458
428 0c0087c0 node capabilities per IEEE 1394
42c d1000001 --> unit directory at 430
unit directory at 430
------------------------------------------------------------
430 0004fb14 directory_length 4, crc 64276
434 12000d6c specifier id
438 130100d1 version
43c 17000011 model
440 8100000c --> descriptor leaf at 470
ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2)
Phoenix Audio MT202pcs (1de7:0114) and MT202exe (1de7:0013) need the
same workaround as TMX320 for avoiding the firmware bug. It fixes the
frequent error about the sample rate inquiries and the slow device
probe as consequence.
There are many USB audio devices with buggy firmware that don't react
with the sample rate reading properly. This often results in the
flood of error messages and slowing down the operation.
The sample rate read back is basically only for confirming the sample
rate setup, and it's not critically important. As a compromise, in
this patch, we stop the sample rate read back once when the device
gives errors more than tolerance (twice, as of now). This should
improve most of error cases while we still can catch the firmware
bugginess.
Merge tag 'asoc-fix-v4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v4.6
This is a fairly large collection of fixes but almost all driver
specific ones, especially to the new Intel drivers which have had a lot
of recent development. The one core fix is a change to the debugfs code
to avoid crashes in some relatively unusual configurations.
ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
The recent bug report suggests that BCLK setup for i915 HSW/BDW needs
to be updated at each HDMI hotplug, not only at initialization and
resume. That is, we need to update HSW_EM4 and HSW_EM5 registers at
ELD notification, too. Otherwise the HDMI audio may be out of sync
and played in a wrong pitch.
However, the HDA codec driver has no access to the controller
registers, and currently the code managing these registers is in
hda_intel.c, i.e. local to the controller driver. For allowing the
explicit BCLK update from the codec driver, as in this patch, the
former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and
exposed as snd_hdac_i915_set_bclk(). This is called from both the HDA
controller driver and intel_pin_eld_notify() in HDMI codec driver.
Along with this change, snd_hdac_get_display_clk() gets dropped as
it's no longer used.
Takashi Iwai [Thu, 10 Mar 2016 20:03:09 +0000 (21:03 +0100)]
ALSA: au88x0: Fix overlapped PCM pointer
au88x0 hardware seems returning the current pointer at the buffer
boundary instead of going back to zero. This results in spewing
warnings from PCM core.
This patch corrects the return value from the pointer callback within
the proper value range, just returning zero if the position is equal
or above the buffer size.
This patch tries to address the still remaining issues in ALSA hrtimer
driver:
- Spurious use-after-free was detected in hrtimer callback
- Incorrect rescheduling due to delayed start
- WARN_ON() is triggered in hrtimer_forward() invoked in hrtimer
callback
The first issue happens only when the new timer is scheduled even
while hrtimer is being closed. It's related with the second and third
items; since ALSA timer core invokes hw.start callback during hrtimer
interrupt, this may result in the explicit call of hrtimer_start().
Also, the similar problem is seen for the stop; ALSA timer core
invokes hw.stop callback even in the hrtimer handler, too. Since we
must not call the synced hrtimer_cancel() in such a context, it's just
a hrtimer_try_to_cancel() call that doesn't properly work.
Another culprit of the second and third items is the call of
hrtimer_forward_now() before snd_timer_interrupt(). The timer->stick
value may change during snd_timer_interrupt() call, but this
possibility is ignored completely.
For covering these subtle and messy issues, the following changes have
been done in this patch:
- A new flag, in_callback, is introduced in the private data to
indicate that the hrtimer handler is being processed.
- Both start and stop callbacks skip when called from (during)
in_callback flag.
- The hrtimer handler returns properly HRTIMER_RESTART and NORESTART
depending on the running state now.
- The hrtimer handler reprograms the expiry properly after
snd_timer_interrupt() call, instead of before.
- The close callback clears running flag and sets in_callback flag
to block any further start/stop calls.
There are no users of rtctimer left. Remove its code as this is the
in-kernel user of the legacy PC RTC driver that will hopefully be removed
at some point.
Takashi Sakamoto [Wed, 30 Mar 2016 23:47:09 +0000 (08:47 +0900)]
ALSA: firewire-tascam: deleyed registration of sound card
When some tascam units are connected sequentially, userspace
applications are involved at bus-reset state on IEEE 1394 bus. In the
state, any communications can be canceled. Therefore, sound card
registration should be delayed till the bus gets calm.
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
Pull thermal fixes from Eduardo Valentin:
"Specifics in this pull request:
- Fixes in mediatek and OF thermal drivers
- Fixes in power_allocator governor
- More fixes of unsigned to int type change in thermal_core.c.
These change have been CI tested using KernelCI bot. \o/"
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
thermal: fix Mediatek thermal controller build
thermal: consistently use int for trip temp
thermal: fix mtk_thermal build dependency
thermal: minor mtk_thermal.c cleanups
thermal: power_allocator: req_range multiplication should be a 64 bit type
thermal: of: add __init attribute
Merge tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic
Pull asm-generic update from Arnd Bergmann:
"Here is one patch to wire up the preadv/pwritev system calls in the
generic system call table, which is required for all architectures
that were merged in the last few years, including arm64.
Usually these get merged along with the syscall implementation or one
of the architecture trees, but this time that did not happen.
Andre and Christoph both sent a version of this patch, I picked the
one I got first"
* tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
generic syscalls: wire up preadv2 and pwritev2 syscalls
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
"Misc fixes: two EDAC driver fixes, a Xen crash fix, a HyperV log spam
fix and a documentation fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86 EDAC, sb_edac.c: Take account of channel hashing when needed
x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
x86/mm/xen: Suppress hugetlbfs in PV guests
x86/doc: Correct limits in Documentation/x86/x86_64/mm.txt
x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances
Merge branches 'perf-urgent-for-linus', 'smp-urgent-for-linus' and 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf, cpu hotplug and timer fixes from Ingo Molnar:
"perf:
- A single tooling fix for a user-triggerable segfault.
CPU hotplug:
- Fix a CPU hotplug corner case regression, introduced by the recent
hotplug rework
timers:
- Fix a boot hang in the ARM based Tango SoC clocksource driver"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf intel-pt: Fix segfault tracing transactions
* 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
cpu/hotplug: Fix rollback during error-out in __cpu_disable()
* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource/drivers/tango-xtal: Fix boot hang due to incorrect test
Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
"Misc fixes:
pvqspinlocks:
- an instrumentation fix
futexes:
- preempt-count vs pagefault_disable decouple corner case fix
- futex requeue plist race window fix
- futex UNLOCK_PI transaction fix for a corner case"
* 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
futex: Acknowledge a new waiter in counter before plist
futex: Handle unlock_pi race gracefully
locking/pvqspinlock: Fix division by zero in qstat_read()
Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Ingo Molnar:
"A core irq affinity masks related fix and a MIPS irqchip driver fix"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/mips-gic: Don't overrun pcpu_masks array
genirq: Dont allow affinity mask to be updated on IPIs
Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull objtool fixes from Ingo Molnar:
"A handful of objtool fixes: two improvements to how warnings are
printed plus a false positive warning fix, and build environment fix"
* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
objtool: Fix Makefile to properly see if libelf is supported
objtool: Detect falling through to the next function
objtool: Add workaround for GCC switch jump table bug
Merge tag 'usb-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / PHY driver fixes from Greg KH:
"Here are two small sets of patches, both from subsystem trees, USB
gadget and PHY drivers.
Full details are in the shortlog, and they have all been in linux-next
for a while (before I merged them to the USB tree)"
* tag 'usb-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: gadget: f_fs: Fix use-after-free
usb: dwc3: gadget: Fix suspend/resume during device mode
usb: dwc3: fix memory leak of dwc->regset
usb: dwc3: core: fix PHY handling during suspend
usb: dwc3: omap: fix up error path on probe()
usb: gadget: composite: Clear reserved fields of SSP Dev Cap
phy: rockchip-emmc: adapt binding to specifiy register offset and length
phy: rockchip-emmc: should be a child device of the GRF
phy: rockchip-dp: should be a child device of the GRF
Merge tag 'tty-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull serial fixes from Greg KH:
"Here are 3 serial driver fixes for issues that have been reported.
Two are reverts, fixing problems that were in the big TTY/Serial
driver merge in 4.6-rc1, and the last one is a simple bugfix for a
regression that showed up in 4.6-rc1 as well.
All have been in linux-next with no reported issues"
* tag 'tty-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
Revert "serial: 8250: Add hardware dependency to RT288X option"
tty/serial/8250: fix RS485 half-duplex RX
Revert "serial-uartlite: Constify uartlite_be/uartlite_le"
Merge tag 'pinctrl-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
"Some pin control driver fixes came in. One headed for stable and the
other two are just ordinary merge window fixes.
- Make the i.MX driver select REGMAP as a dependency
- Fix up the Mediatek debounce time unit
- Fix a real hairy ffs vs __ffs issue in the Single pinctrl driver"
* tag 'pinctrl-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
pinctrl: imx: Kconfig: PINCTRL_IMX select REGMAP
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
- Cache invalidation fix for early CPU boot status update (incorrect
cacheline)
- of_put_node() missing in the spin_table code
- EL1/El2 early init inconsistency when Virtualisation Host Extensions
are present
- RCU warning fix in the arm_pmu.c driver
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: Fix EL1/EL2 early init inconsistencies with VHE
drivers/perf: arm-pmu: fix RCU usage on pmu resume from low-power
arm64: spin-table: add missing of_node_put()
arm64: fix invalidation of wrong __early_cpu_boot_status cacheline
Merge tag 'powerpc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Michael Ellerman:
"Three powerpc cpu feature fixes from Anton Blanchard:
- scan_features() updated incorrect bits for REAL_LE
- update cpu_user_features2 in scan_features()
- update TM user feature bits in scan_features()"
* tag 'powerpc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc: Update TM user feature bits in scan_features()
powerpc: Update cpu_user_features2 in scan_features()
powerpc: scan_features() updates incorrect bits for REAL_LE
Merge tag 'iommu-fixes-v4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
Pull IOMMU fixes from Joerg Roedel:
"The fixes include:
- Two patches to revert the use of default domains in the ARM SMMU
driver. Enabling this caused regressions which need more thorough
fixing. So the regressions are fixed for now by disabling the use
of default domains.
- A fix for a v4.4 regression in the AMD IOMMU driver which broke
devices behind invisible PCIe-to-PCI bridges with IOMMU enabled"
* tag 'iommu-fixes-v4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/arm-smmu: Don't allocate resources for bypass domains
iommu/arm-smmu: Fix stream-match conflict with IOMMU_DOMAIN_DMA
iommu/amd: Fix checking of pci dma aliases
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"i915, nouveau and amdgpu/radeon fixes in this:
nouveau:
Two fixes, one for a regression with dithering and one for a bug
hit by the userspace drivers.
i915:
A few fixes, mostly things heading for stable, two important
skylake GT3/4 hangs.
radeon/amdgpu:
Some audio, suspend/resume and some runtime PM fixes, along with
two patches to harden the userptr ABI a bit"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (24 commits)
drm: Loongson-3 doesn't fully support wc memory
drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
amdgpu/uvd: add uvd fw version for amdgpu
drm/amdgpu: forbid mapping of userptr bo through radeon device file
drm/radeon: forbid mapping of userptr bo through radeon device file
drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
drm/amdgpu: use defines for CRTCs and AMFT blocks
drm/dp/mst: Validate port in drm_dp_payload_send_msg()
drm/nouveau/kms: fix setting of default values for dithering properties
drm/radeon: print a message if ATPX dGPU power control is missing
Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
drm/amdgpu/acp: fix resume on CZ systems with AZ audio
drm/radeon: add a quirk for a XFX R9 270X
drm/radeon: print pci revision as well as pci ids on driver load
drm/i915: Use fw_domains_put_with_fifo() on HSW
drm/i915: Force ringbuffers to not be at offset 0
drm/i915: Adjust size of PIPE_CONTROL used for gen8 render seqno write
drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs
drm/i915/skl: Fix rc6 based gpu/system hang
drm/i915/userptr: Hold mmref whilst calling get-user-pages
...
Merge tag 'sound-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Again a relatively calm week without surprise: most of fixes are about
HD-audio, including fixes for Cirrus codec regression and a race over
regmap access. Although both change are slightly unintuitive, the
risk of further breakage is quite low, I hope.
Other than that, all the rest are trivial"
* tag 'sound-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - Fix possible race on regmap bypass flip
ALSA: pcxhr: Fix missing mutex unlock
ALSA: hda - add PCI ID for Intel Broxton-T
ALSA: hda - Keep powering up ADCs on Cirrus codecs
ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
ALSA - hda: hdmi check NULL pointer in hdmi_set_chmap
ALSA: hda - Don't trust the reported actual power state
Tony Luck [Thu, 14 Apr 2016 17:21:52 +0000 (10:21 -0700)]
x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
In commit:
eb1af3b71f9d ("Fix computation of channel address")
I switched the "sck_way" variable from holding the log2 value read
from the h/w to instead be the actual number. Unfortunately it
is needed in log2 form when used to shift the address.
Tested-by: Patrick Geary <patrickg@supermicro.com> Signed-off-by: Tony Luck <tony.luck@intel.com> Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Cc: Aristeu Rozanski <arozansk@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-edac@vger.kernel.org Cc: stable@vger.kernel.org Fixes: eb1af3b71f9d ("Fix computation of channel address") Signed-off-by: Ingo Molnar <mingo@kernel.org>
Merge tag 'fixes-for-v4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.6-rc5
No more major fixes left. Out of the 6 fixes we have
here, 4 are on dwc3.
The most important is the memory leak fix in
dwc3/debugfs.c. We also have a fix for PHY handling
in suspend/resume and a fix for dwc3-omap's error
handling.
Suspend/resume also had the potential to trigger a
NULL pointer dereference on dwc3; that's also fixed
now.
Our good ol' ffs function gets a use-after-free fix
while the generic composite.c layer has a robustness
fix by making sure reserved fields of a possible SSP
device capability descriptor is cleared to 0.
Jan Beulich [Thu, 21 Apr 2016 06:27:04 +0000 (00:27 -0600)]
x86/mm/xen: Suppress hugetlbfs in PV guests
Huge pages are not normally available to PV guests. Not suppressing
hugetlbfs use results in an endless loop of page faults when user mode
code tries to access a hugetlbfs mapped area (since the hypervisor
denies such PTEs to be created, but error indications can't be
propagated out of xen_set_pte_at(), just like for various of its
siblings), and - once killed in an oops like this:
cpu/hotplug: Fix rollback during error-out in __cpu_disable()
The recent introduction of the hotplug thread which invokes the callbacks on
the plugged cpu, cased the following regression:
If takedown_cpu() fails, then we run into several issues:
1) The rollback of the target cpu states is not invoked. That leaves the smp
threads and the hotplug thread in disabled state.
2) notify_online() is executed due to a missing skip_onerr flag. That causes
that both CPU_DOWN_FAILED and CPU_ONLINE notifications are invoked which
confuses quite some notifiers.
3) The CPU_DOWN_FAILED notification is not invoked on the target CPU. That's
not an issue per se, but it is inconsistent and in consequence blocks the
patches which rely on these states being invoked on the target CPU and not
on the controlling cpu. It also does not preserve the strict call order on
rollback which is problematic for the ongoing state machine conversion as
well.
To fix this we add a rollback flag to the remote callback machinery and invoke
the rollback including the CPU_DOWN_FAILED notification on the remote
cpu. Further mark the notify online state with 'skip_onerr' so we don't get a
double invokation.
This workaround will go away once we moved the unplug invocation to the target
cpu itself.
[ tglx: Massaged changelog and moved the CPU_DOWN_FAILED notifiaction to the
target cpu ]
Fixes: 4cb28ced23c4 ("cpu/hotplug: Create hotplug threads") Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: linux-s390@vger.kernel.org Cc: rt@linutronix.de Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Anna-Maria Gleixner <anna-maria@linutronix.de> Link: http://lkml.kernel.org/r/20160408124015.GA21960@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Daniel Lezcano [Tue, 19 Apr 2016 13:43:02 +0000 (15:43 +0200)]
clocksource/drivers/tango-xtal: Fix boot hang due to incorrect test
Commit 0881841f7e78 introduced a regression by inverting a test check
after calling clocksource_mmio_init(). That results on the system to
hang at boot time.
Fix it by inverting the test again.
Fixes: 0881841f7e78 ("Replace code by clocksource_mmio_init") Reported-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Steven Rostedt [Wed, 20 Apr 2016 15:32:35 +0000 (11:32 -0400)]
objtool: Fix Makefile to properly see if libelf is supported
When doing a make allmodconfig, I hit the following compile error:
In file included from builtin-check.c:32:0:
elf.h:22:18: fatal error: gelf.h: No such file or directory
compilation terminated.
...
Digging into it, it appears that the $(shell ..) command in the Makefile does
not give the proper result when it fails to find -lelf, and continues to
compile objtool.
Instead, use the "try-run" makefile macro to perform the test. This gives a
proper result for both cases.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Bernd Petrovitsch <bernd@petrovitsch.priv.at> Cc: Borislav Petkov <bp@alien8.de> Cc: Chris J Arges <chris.j.arges@canonical.com> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Michal Marek <mmarek@suse.cz> Cc: Namhyung Kim <namhyung@gmail.com> Cc: Pedro Alves <palves@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: live-patching@vger.kernel.org Fixes: 442f04c34a1a4 ("objtool: Add tool to perform compile-time stack metadata validation") Link: http://lkml.kernel.org/r/20160420153234.GA24032@home.goodmis.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
Dave Airlie [Fri, 22 Apr 2016 00:39:26 +0000 (10:39 +1000)]
Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Misc radeon and amdgpu bug fixes for 4.6.
* 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux:
amdgpu/uvd: add uvd fw version for amdgpu
drm/amdgpu: forbid mapping of userptr bo through radeon device file
drm/radeon: forbid mapping of userptr bo through radeon device file
drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
drm/amdgpu: use defines for CRTCs and AMFT blocks
drm/radeon: print a message if ATPX dGPU power control is missing
Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
drm/amdgpu/acp: fix resume on CZ systems with AZ audio
drm/radeon: add a quirk for a XFX R9 270X
drm/radeon: print pci revision as well as pci ids on driver load
drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work.
drm/radeon: fix initial connector audio value
drm/amdgpu: forbid mapping of userptr bo through radeon device file
Allowing userptr bo which are basicly a list of page from some vma
(so either anonymous page or file backed page) would lead to serious
corruption of kernel structures and counters (because we overwrite
the page->mapping field when mapping buffer).
This will already block if the buffer was populated before anyone does
try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the
ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm
vm fault handler.
So to be safe just add a check to verify_access() callback.
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jérôme Glisse <jglisse@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/radeon: forbid mapping of userptr bo through radeon device file
Allowing userptr bo which are basicly a list of page from some vma
(so either anonymous page or file backed page) would lead to serious
corruption of kernel structures and counters (because we overwrite
the page->mapping field when mapping buffer).
This will already block if the buffer was populated before anyone does
try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the
ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm
vm fault handler.
So to be safe just add a check to verify_access() callback.
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jérôme Glisse <jglisse@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/dp/mst: Validate port in drm_dp_payload_send_msg()
With the joys of things running concurrently, there's always a chance
that the port we get passed in drm_dp_payload_send_msg() isn't actually
valid anymore. Because of this, we need to make sure we validate the
reference to the port before we use it otherwise we risk running into
various race conditions. For instance, on the Dell MST monitor I have
here for testing, hotplugging it enough times causes us to kernel panic:
[drm:intel_mst_enable_dp] 1
[drm:drm_dp_update_payload_part2] payload 0 1
[drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020
[drm:intel_hpd_irq_handler] digital hpd port B - short
[drm:intel_dp_hpd_pulse] got hpd irq on port B - short
[drm:intel_dp_check_mst_status] got esi 00 10 00
[drm:drm_dp_update_payload_part2] payload 1 1
general protection fault: 0000 [#1] SMP
…
Call Trace:
[<ffffffffa012b632>] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper]
[<ffffffffa032ef08>] intel_mst_enable_dp+0xf8/0x180 [i915]
[<ffffffffa0310dbd>] haswell_crtc_enable+0x3ed/0x8c0 [i915]
[<ffffffffa030c84d>] intel_atomic_commit+0x5ad/0x1590 [i915]
[<ffffffffa01db877>] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm]
[<ffffffffa01dc4e7>] drm_atomic_commit+0x37/0x60 [drm]
[<ffffffffa0130a3a>] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper]
[<ffffffffa01cc482>] drm_mode_set_config_internal+0x62/0x100 [drm]
[<ffffffffa01d02ad>] drm_mode_setcrtc+0x3cd/0x4e0 [drm]
[<ffffffffa01c18e3>] drm_ioctl+0x143/0x510 [drm]
[<ffffffffa01cfee0>] ? drm_mode_setplane+0x1b0/0x1b0 [drm]
[<ffffffff810f79a7>] ? hrtimer_start_range_ns+0x1b7/0x3a0
[<ffffffff81212962>] do_vfs_ioctl+0x92/0x570
[<ffffffff81590852>] ? __sys_recvmsg+0x42/0x80
[<ffffffff81212eb9>] SyS_ioctl+0x79/0x90
[<ffffffff816b4e32>] entry_SYSCALL_64_fastpath+0x1a/0xa4
RIP [<ffffffffa012b026>] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper]
Which occurs because of the hotplug event shown in the log, which ends
up causing DRM's dp helpers to drop the port we're updating the payload
on and panic.
CC: stable@vger.kernel.org Signed-off-by: Lyude <cpaul@redhat.com> Reviewed-by: David Airlie <airlied@linux.ie> Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Thu, 21 Apr 2016 23:09:11 +0000 (09:09 +1000)]
Merge tag 'drm-intel-fixes-2016-04-21' of git://anongit.freedesktop.org/drm-intel into drm-fixes
Hi Dave, fixes all around, all but one are cc: stable material, the most
important ones are likely the Skylake hang fixes from Mika.
* tag 'drm-intel-fixes-2016-04-21' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Use fw_domains_put_with_fifo() on HSW
drm/i915: Force ringbuffers to not be at offset 0
drm/i915: Adjust size of PIPE_CONTROL used for gen8 render seqno write
drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs
drm/i915/skl: Fix rc6 based gpu/system hang
drm/i915/userptr: Hold mmref whilst calling get-user-pages
drm/i915: Fixup the free space logic in ring_prepare
drm/i915/skl+: Use plane size for relative data rate calculation
Merge tag 'rtc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC fixes from Alexandre Belloni:
"A few fixes for the RTC subsystem. The documentation fix already
missed 4.5 so I think it is worth taking it now:
A documentation fix for s3c and two fixes for the ds1307"
* tag 'rtc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
rtc: ds1307: Use irq when available for wakeup-source device
rtc: ds1307: ds3231 temperature s16 overflow
rtc: s3c: Document in binding that only s3c6410 needs a src clk
Merge tag 'pm+acpi-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"Two fixes for issues introduced recently, one for an intel_pstate
driver problem uncovered by the recent switch over from using timers
and the other one for a potential cpufreq core problem related to
system suspend/resume.
Specifics:
- Fix an intel_pstate driver problem causing CPUs to get stuck in the
highest P-state when completely idle uncovered by the recent switch
over from using timers (Rafael Wysocki).
- Avoid attempts to get the current CPU frequency when all devices
(like I2C controllers that may be nedded for that purpose) have
been suspended during system suspend/resume (Rafael Wysocki)"
* tag 'pm+acpi-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
cpufreq: Abort cpufreq_update_current_freq() for cpufreq_suspended set
intel_pstate: Avoid getting stuck in high P-states when idle
rtc: ds1307: Use irq when available for wakeup-source device
With commit 8bc2a40730ec ("rtc: ds1307: add support for the
DT property 'wakeup-source'") we lost the ability for rtc irq
functionality for devices that are actually hooked on a real IRQ
line and have capability to wakeup as well. This is not an expected
behavior. So, instead of just not requesting IRQ, skip the IRQ
requirement only if interrupts are not defined for the device.
Fixes: 8bc2a40730ec ("rtc: ds1307: add support for the DT property 'wakeup-source'") Reported-by: Tony Lindgren <tony@atomide.com> Cc: Michael Lange <linuxstuff@milaw.biz> Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Nishanth Menon <nm@ti.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Simon Horman [Thu, 21 Apr 2016 01:49:15 +0000 (11:49 +1000)]
openvswitch: use flow protocol when recalculating ipv6 checksums
When using masked actions the ipv6_proto field of an action
to set IPv6 fields may be zero rather than the prevailing protocol
which will result in skipping checksum recalculation.
This patch resolves the problem by relying on the protocol
in the flow key rather than that in the set field action.
Fixes: 83d2b9ba1abc ("net: openvswitch: Support masked set actions.") Cc: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Driver: Vmxnet3: set CHECKSUM_UNNECESSARY for IPv6 packets
For IPv6, if the device indicates that the checksum is correct, set
CHECKSUM_UNNECESSARY.
Reported-by: Subbarao Narahari <snarahari@vmware.com> Signed-off-by: Shrikrishna Khare <skhare@vmware.com> Signed-off-by: Jin Heo <heoj@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
atl2 includes NETIF_F_SG in hw_features even though it has no support
for non-linear skbs. This bug was originally harmless since the
driver does not claim to implement checksum offload and that used to
be a requirement for SG.
Now that SG and checksum offload are independent features, if you
explicitly enable SG *and* use one of the rare protocols that can use
SG without checkusm offload, this potentially leaks sensitive
information (before you notice that it just isn't working). Therefore
this obscure bug has been designated CVE-2016-2117.
Reported-by: Justin Yackoski <jyackoski@crypto-nite.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Fixes: ec5f06156423 ("net: Kill link between CSUM and SG features.") Signed-off-by: David S. Miller <davem@davemloft.net>
Paul Burton [Thu, 21 Apr 2016 10:31:54 +0000 (11:31 +0100)]
irqchip/mips-gic: Don't overrun pcpu_masks array
Commit 2a0787051182 ("irqchip/mips-gic: Use gic_vpes instead of
NR_CPUS") & commit 78930f09b940 ("irqchip/mips-gic: Clear percpu_masks
correctly when mapping") both introduce code which accesses gic_vpes
entries in the pcpu_masks array. However, this array has length NR_CPUS.
If NR_CPUS is less than gic_vpes (ie. the kernel supports use of less
CPUs than are present in the system) then we overrun the array, clobber
some other data & generally die pretty promptly.
Most notably this affects uniprocessor kernels running on any multicore
or multithreaded Malta with a GIC (ie. the vast majority of real Malta
boards).
Fix this by only accessing up to min(gic_vpes, NR_CPUS) entries in the
pcpu_masks array, preventing the array overrun.
Fixes: 2a0787051182 ("irqchip/mips-gic: Use gic_vpes instead of NR_CPUS") Fixes: 78930f09b940 ("irqchip/mips-gic: Clear percpu_masks correctly when mapping") Signed-off-by: Paul Burton <paul.burton@imgtec.com> Cc: linux-mips@linux-mips.org Cc: Jason Cooper <jason@lakedaemon.net> Cc: Marc Zyngier <marc.zyngier@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Link: http://lkml.kernel.org/r/1461234714-9975-1-git-send-email-paul.burton@imgtec.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
David S. Miller [Thu, 21 Apr 2016 19:02:41 +0000 (15:02 -0400)]
Merge branch 'mlx4-fixes'
Or Gerlitz says:
====================
Mellaox 40G driver fixes for 4.6-rc
With the fix for ARM bug being under the works, these are
few other fixes for mlx4 we have ready to go.
Eran addressed the problematic/wrong reporting of dropped packets, Daniel
fixed some matters related to PPC EEH's and Jenny's patch makes sure
VFs can't change the port's pause settings.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
projects / karo-tx-linux.git / log