* [001/152] x86, hotplug: Use mwait to offline a processor, fix the legacy case
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [002/152] fuse: verify ioctl retries Greg KH
` (151 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, linux-pm, x86,
H. Peter Anvin, Len Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: H. Peter Anvin <hpa@linux.intel.com>
upstream ea53069231f9317062910d6e772cca4ce93de8c8
x86, hotplug: Use mwait to offline a processor, fix the legacy case
Here included also some small follow-on patches to the same code:
upstream a68e5c94f7d3dd64fef34dd5d97e365cae4bb42a
x86, hotplug: Move WBINVD back outside the play_dead loop
upstream ce5f68246bf2385d6174856708d0b746dc378f20
x86, hotplug: In the MWAIT case of play_dead, CLFLUSH the cache line
https://bugzilla.kernel.org/show_bug.cgi?id=5471
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/include/asm/processor.h | 23 ----------
arch/x86/kernel/smpboot.c | 85 ++++++++++++++++++++++++++++++++++++++-
2 files changed, 84 insertions(+), 24 deletions(-)
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -764,29 +764,6 @@ extern unsigned long idle_halt;
extern unsigned long idle_nomwait;
extern bool c1e_detected;
-/*
- * on systems with caches, caches must be flashed as the absolute
- * last instruction before going into a suspended halt. Otherwise,
- * dirty data can linger in the cache and become stale on resume,
- * leading to strange errors.
- *
- * perform a variety of operations to guarantee that the compiler
- * will not reorder instructions. wbinvd itself is serializing
- * so the processor will not reorder.
- *
- * Systems without cache can just go into halt.
- */
-static inline void wbinvd_halt(void)
-{
- mb();
- /* check for clflush to determine if wbinvd is legal */
- if (cpu_has_clflush)
- asm volatile("cli; wbinvd; 1: hlt; jmp 1b" : : : "memory");
- else
- while (1)
- halt();
-}
-
extern void enable_sep_cpu(void);
extern int sysenter_setup(void);
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1383,11 +1383,94 @@ void play_dead_common(void)
local_irq_disable();
}
+#define MWAIT_SUBSTATE_MASK 0xf
+#define MWAIT_SUBSTATE_SIZE 4
+
+#define CPUID_MWAIT_LEAF 5
+#define CPUID5_ECX_EXTENSIONS_SUPPORTED 0x1
+
+/*
+ * We need to flush the caches before going to sleep, lest we have
+ * dirty data in our caches when we come back up.
+ */
+static inline void mwait_play_dead(void)
+{
+ unsigned int eax, ebx, ecx, edx;
+ unsigned int highest_cstate = 0;
+ unsigned int highest_subcstate = 0;
+ int i;
+ void *mwait_ptr;
+
+ if (!cpu_has(¤t_cpu_data, X86_FEATURE_MWAIT))
+ return;
+ if (!cpu_has(¤t_cpu_data, X86_FEATURE_CLFLSH))
+ return;
+ if (current_cpu_data.cpuid_level < CPUID_MWAIT_LEAF)
+ return;
+
+ eax = CPUID_MWAIT_LEAF;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
+
+ /*
+ * eax will be 0 if EDX enumeration is not valid.
+ * Initialized below to cstate, sub_cstate value when EDX is valid.
+ */
+ if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED)) {
+ eax = 0;
+ } else {
+ edx >>= MWAIT_SUBSTATE_SIZE;
+ for (i = 0; i < 7 && edx; i++, edx >>= MWAIT_SUBSTATE_SIZE) {
+ if (edx & MWAIT_SUBSTATE_MASK) {
+ highest_cstate = i;
+ highest_subcstate = edx & MWAIT_SUBSTATE_MASK;
+ }
+ }
+ eax = (highest_cstate << MWAIT_SUBSTATE_SIZE) |
+ (highest_subcstate - 1);
+ }
+
+ /*
+ * This should be a memory location in a cache line which is
+ * unlikely to be touched by other processors. The actual
+ * content is immaterial as it is not actually modified in any way.
+ */
+ mwait_ptr = ¤t_thread_info()->flags;
+
+ wbinvd();
+
+ while (1) {
+ /*
+ * The CLFLUSH is a workaround for erratum AAI65 for
+ * the Xeon 7400 series. It's not clear it is actually
+ * needed, but it should be harmless in either case.
+ * The WBINVD is insufficient due to the spurious-wakeup
+ * case where we return around the loop.
+ */
+ clflush(mwait_ptr);
+ __monitor(mwait_ptr, 0, 0);
+ mb();
+ __mwait(eax, 0);
+ }
+}
+
+static inline void hlt_play_dead(void)
+{
+ if (current_cpu_data.x86 >= 4)
+ wbinvd();
+
+ while (1) {
+ native_halt();
+ }
+}
+
void native_play_dead(void)
{
play_dead_common();
tboot_shutdown(TB_SHUTDOWN_WFS);
- wbinvd_halt();
+
+ mwait_play_dead(); /* Only returns on failure */
+ hlt_play_dead();
}
#else /* ... !CONFIG_HOTPLUG_CPU */
^ permalink raw reply [flat|nested] 177+ messages in thread* [002/152] fuse: verify ioctl retries
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
2011-01-06 0:21 ` [001/152] x86, hotplug: Use mwait to offline a processor, fix the legacy case Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [003/152] fuse: fix ioctl when server is 32bit Greg KH
` (150 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Miklos Szeredi, Tejun Heo
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit 7572777eef78ebdee1ecb7c258c0ef94d35bad16 upstream.
Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY
doesn't overflow iov_length().
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/fuse/file.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1627,6 +1627,20 @@ static int fuse_ioctl_copy_user(struct p
return 0;
}
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+ size_t n;
+ u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+ for (n = 0; n < count; n++) {
+ if (iov->iov_len > (size_t) max)
+ return -ENOMEM;
+ max -= iov->iov_len;
+ }
+ return 0;
+}
+
/*
* For ioctls, there is no generic way to determine how much memory
* needs to be read and/or written. Furthermore, ioctls are allowed
@@ -1820,6 +1834,14 @@ long fuse_do_ioctl(struct file *file, un
in_iov = page_address(iov_page);
out_iov = in_iov + in_iovs;
+ err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+ if (err)
+ goto out;
+
+ err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+ if (err)
+ goto out;
+
goto retry;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [003/152] fuse: fix ioctl when server is 32bit
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
2011-01-06 0:21 ` [001/152] x86, hotplug: Use mwait to offline a processor, fix the legacy case Greg KH
2011-01-06 0:21 ` [002/152] fuse: verify ioctl retries Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [004/152] ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work Greg KH
` (149 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Miklos Szeredi, Tejun Heo
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit d9d318d39dd5cb686660504a3565aac453709ccc upstream.
If a 32bit CUSE server is run on 64bit this results in EIO being
returned to the caller.
The reason is that FUSE_IOCTL_RETRY reply was defined to use 'struct
iovec', which is different on 32bit and 64bit archs.
Work around this by looking at the size of the reply to determine
which struct was used. This is only needed if CONFIG_COMPAT is
defined.
A more permanent fix for the interface will be to use the same struct
on both 32bit and 64bit.
Reported-by: "ccmail111" <ccmail111@yahoo.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/fuse/file.c | 50 ++++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 44 insertions(+), 6 deletions(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -13,6 +13,7 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/module.h>
+#include <linux/compat.h>
static const struct file_operations fuse_direct_io_file_operations;
@@ -1642,6 +1643,44 @@ static int fuse_verify_ioctl_iov(struct
}
/*
+ * CUSE servers compiled on 32bit broke on 64bit kernels because the
+ * ABI was defined to be 'struct iovec' which is different on 32bit
+ * and 64bit. Fortunately we can determine which structure the server
+ * used from the size of the reply.
+ */
+static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
+ size_t transferred, unsigned count,
+ bool is_compat)
+{
+#ifdef CONFIG_COMPAT
+ if (count * sizeof(struct compat_iovec) == transferred) {
+ struct compat_iovec *ciov = src;
+ unsigned i;
+
+ /*
+ * With this interface a 32bit server cannot support
+ * non-compat (i.e. ones coming from 64bit apps) ioctl
+ * requests
+ */
+ if (!is_compat)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+ dst[i].iov_base = compat_ptr(ciov[i].iov_base);
+ dst[i].iov_len = ciov[i].iov_len;
+ }
+ return 0;
+ }
+#endif
+
+ if (count * sizeof(struct iovec) != transferred)
+ return -EIO;
+
+ memcpy(dst, src, transferred);
+ return 0;
+}
+
+/*
* For ioctls, there is no generic way to determine how much memory
* needs to be read and/or written. Furthermore, ioctls are allowed
* to dereference the passed pointer, so the parameter requires deep
@@ -1822,14 +1861,13 @@ long fuse_do_ioctl(struct file *file, un
in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
goto out;
- err = -EIO;
- if ((in_iovs + out_iovs) * sizeof(struct iovec) != transferred)
- goto out;
-
- /* okay, copy in iovs and retry */
vaddr = kmap_atomic(pages[0], KM_USER0);
- memcpy(page_address(iov_page), vaddr, transferred);
+ err = fuse_copy_ioctl_iovec(page_address(iov_page), vaddr,
+ transferred, in_iovs + out_iovs,
+ (flags & FUSE_IOCTL_COMPAT) != 0);
kunmap_atomic(vaddr, KM_USER0);
+ if (err)
+ goto out;
in_iov = page_address(iov_page);
out_iov = in_iov + in_iovs;
^ permalink raw reply [flat|nested] 177+ messages in thread* [004/152] ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (2 preceding siblings ...)
2011-01-06 0:21 ` [003/152] fuse: fix ioctl when server is 32bit Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [005/152] ALSA: hda - Do not wrongly restrict min_channels based on ELD Greg KH
` (148 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, David Henningsson,
Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit 8a96b1e02029aa512199b1b6d281dcede9ed81f1 upstream.
BugLink: http://launchpad.net/497546
Confirmed that the ideapad model works better than the current
quirk for Dell Vostro 320.
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/patch_conexant.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3085,8 +3085,7 @@ static const char *cxt5066_models[CXT506
static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
SND_PCI_QUIRK(0x14f1, 0x0101, "Conexant Reference board",
CXT5066_LAPTOP),
- SND_PCI_QUIRK(0x1028, 0x02f5, "Dell",
- CXT5066_DELL_LAPTOP),
+ SND_PCI_QUIRK(0x1028, 0x02f5, "Dell Vostro 320", CXT5066_IDEAPAD),
SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTO),
SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
^ permalink raw reply [flat|nested] 177+ messages in thread* [005/152] ALSA: hda - Do not wrongly restrict min_channels based on ELD
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (3 preceding siblings ...)
2011-01-06 0:21 ` [004/152] ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [006/152] ALSA: hda - Always allow basic audio irrespective of ELD info Greg KH
` (147 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Anssi Hannula, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anssi Hannula <anssi.hannula@iki.fi>
commit 4b0dbdb17f846a8887e5f7fbeea2deb0703236bd upstream.
Commit bbbe33900d1f3c added functionality to restrict PCM parameters
based on ELD info (derived from EDID data) of the audio sink.
However, it wrongly assumes that the bits 0-2 of the first byte of
CEA Short Audio Descriptors mean a supported number of channels. In
reality, they mean the maximum number of channels (as per CEA-861-D
7.5.2). This means that the channel count can only be used to restrict
max_channels, not min_channels.
Restricting min_channels causes us to deny opening the device in stereo
mode if the sink only has SADs that declare larger numbers of channels
(like Primare SP32 AV Processor does).
Fix that by not restricting min_channels based on ELD information.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Reported-by: Jean-Yves Avenard <jyavenard@gmail.com>
Tested-by: Jean-Yves Avenard <jyavenard@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_eld.c | 4 ----
sound/pci/hda/patch_hdmi.c | 1 -
2 files changed, 5 deletions(-)
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -607,13 +607,10 @@ void hdmi_eld_update_pcm_info(struct hdm
pcm->rates = 0;
pcm->formats = 0;
pcm->maxbps = 0;
- pcm->channels_min = -1;
pcm->channels_max = 0;
for (i = 0; i < eld->sad_count; i++) {
struct cea_sad *a = &eld->sad[i];
pcm->rates |= a->rates;
- if (a->channels < pcm->channels_min)
- pcm->channels_min = a->channels;
if (a->channels > pcm->channels_max)
pcm->channels_max = a->channels;
if (a->format == AUDIO_CODING_TYPE_LPCM) {
@@ -641,7 +638,6 @@ void hdmi_eld_update_pcm_info(struct hdm
/* restrict the parameters by the values the codec provides */
pcm->rates &= codec_pars->rates;
pcm->formats &= codec_pars->formats;
- pcm->channels_min = max(pcm->channels_min, codec_pars->channels_min);
pcm->channels_max = min(pcm->channels_max, codec_pars->channels_max);
pcm->maxbps = min(pcm->maxbps, codec_pars->maxbps);
}
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -779,7 +779,6 @@ static int hdmi_pcm_open(struct hda_pcm_
return -ENODEV;
} else {
/* fallback to the codec default */
- hinfo->channels_min = codec_pars->channels_min;
hinfo->channels_max = codec_pars->channels_max;
hinfo->rates = codec_pars->rates;
hinfo->formats = codec_pars->formats;
^ permalink raw reply [flat|nested] 177+ messages in thread* [006/152] ALSA: hda - Always allow basic audio irrespective of ELD info
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (4 preceding siblings ...)
2011-01-06 0:21 ` [005/152] ALSA: hda - Do not wrongly restrict min_channels based on ELD Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [007/152] ALSA: hda: Use position_fix=1 for Acer Aspire 5538 to enable capture on internal mic Greg KH
` (146 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Anssi Hannula, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anssi Hannula <anssi.hannula@iki.fi>
commit 3dc86429032910bdf762adeb2969112bb303924c upstream.
Commit bbbe33900d1f3c added functionality to restrict PCM parameters
based on ELD info (derived from EDID data) of the audio sink.
However, according to CEA-861-D no SAD is needed for basic audio
(32/44.1/48kHz stereo 16-bit audio), which is instead indicated with a
basic audio flag in the CEA EDID Extension.
The flag is not present in ELD. However, as all audio capable sinks are
required to support basic audio, we can assume it to be always
available.
Fix allowed audio formats with sinks that have SADs (Short Audio
Descriptors) which do not completely overlap with the basic audio
formats (there are no reports of affected devices so far) by always
assuming that basic audio is supported.
Reported-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_eld.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -604,21 +604,19 @@ void hdmi_eld_update_pcm_info(struct hdm
{
int i;
- pcm->rates = 0;
- pcm->formats = 0;
- pcm->maxbps = 0;
- pcm->channels_max = 0;
+ /* assume basic audio support (the basic audio flag is not in ELD;
+ * however, all audio capable sinks are required to support basic
+ * audio) */
+ pcm->rates = SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000;
+ pcm->formats = SNDRV_PCM_FMTBIT_S16_LE;
+ pcm->maxbps = 16;
+ pcm->channels_max = 2;
for (i = 0; i < eld->sad_count; i++) {
struct cea_sad *a = &eld->sad[i];
pcm->rates |= a->rates;
if (a->channels > pcm->channels_max)
pcm->channels_max = a->channels;
if (a->format == AUDIO_CODING_TYPE_LPCM) {
- if (a->sample_bits & AC_SUPPCM_BITS_16) {
- pcm->formats |= SNDRV_PCM_FMTBIT_S16_LE;
- if (pcm->maxbps < 16)
- pcm->maxbps = 16;
- }
if (a->sample_bits & AC_SUPPCM_BITS_20) {
pcm->formats |= SNDRV_PCM_FMTBIT_S32_LE;
if (pcm->maxbps < 20)
^ permalink raw reply [flat|nested] 177+ messages in thread* [007/152] ALSA: hda: Use position_fix=1 for Acer Aspire 5538 to enable capture on internal mic
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (5 preceding siblings ...)
2011-01-06 0:21 ` [006/152] ALSA: hda - Always allow basic audio irrespective of ELD info Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [008/152] ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture Greg KH
` (145 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel T Chen <crimsun@ubuntu.com>
commit dd5a089edfa51a74692604b4b427953d8e16bc35 upstream.
BugLink: https://launchpad.net/bugs/685161
The reporter of the bug states that he must use position_fix=1 to enable
capture for the internal microphone, so set it for his machine's PCI
SSID. Verified using 2.6.35 and the 2010-12-04 alsa-driver build.
Reported-and-tested-by: Ralph Wabel <rwabel@gmx.net>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2298,6 +2298,7 @@ static int azx_dev_free(struct snd_devic
*/
static struct snd_pci_quirk position_fix_list[] __devinitdata = {
SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1025, 0x026f, "Acer Aspire 5538", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
^ permalink raw reply [flat|nested] 177+ messages in thread* [008/152] ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (6 preceding siblings ...)
2011-01-06 0:21 ` [007/152] ALSA: hda: Use position_fix=1 for Acer Aspire 5538 to enable capture on internal mic Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [009/152] drm/radeon/kms: dont apply 7xx HDP flush workaround on AGP Greg KH
` (144 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel T Chen <crimsun@ubuntu.com>
commit 77c4d5cdb81d25a45fbdfb84dd3348121219a072 upstream.
BugLink: https://launchpad.net/bugs/595482
The original reporter states that audible playback from the internal
speaker is inaudible despite the hardware being properly detected. To
work around this symptom, he uses the model=lg quirk to properly enable
both playback, capture, and jack sense. Another user corroborates this
workaround on separate hardware. Add this PCI SSID to the quirk table
to enable it for further LG P1 Expresses.
Reported-and-tested-by: Philip Peitsch <philip.peitsch@gmail.com>
Tested-by: nikhov
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4389,6 +4389,7 @@ static struct snd_pci_quirk alc880_cfg_t
SND_PCI_QUIRK(0x1734, 0x10b0, "Fujitsu", ALC880_FUJITSU),
SND_PCI_QUIRK(0x1854, 0x0018, "LG LW20", ALC880_LG_LW),
SND_PCI_QUIRK(0x1854, 0x003b, "LG", ALC880_LG),
+ SND_PCI_QUIRK(0x1854, 0x005f, "LG P1 Express", ALC880_LG),
SND_PCI_QUIRK(0x1854, 0x0068, "LG w1", ALC880_LG),
SND_PCI_QUIRK(0x1854, 0x0077, "LG LW25", ALC880_LG_LW),
SND_PCI_QUIRK(0x19db, 0x4188, "TCL S700", ALC880_TCL_S700),
^ permalink raw reply [flat|nested] 177+ messages in thread* [009/152] drm/radeon/kms: dont apply 7xx HDP flush workaround on AGP
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (7 preceding siblings ...)
2011-01-06 0:21 ` [008/152] ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [010/152] drm/kms: remove spaces from connector names (v2) Greg KH
` (143 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit f3886f85cfde578f1d0ba6e40ac5f9d70043923b upstream.
It should be required for all 7xx asics, but seems to cause
problems on some AGP 7xx chips.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=19002
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Reported-and-Tested-by: Duncan <1i5t5.duncan@cox.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/r600.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -878,12 +878,15 @@ void r600_pcie_gart_tlb_flush(struct rad
u32 tmp;
/* flush hdp cache so updates hit vram */
- if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+ if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+ !(rdev->flags & RADEON_IS_AGP)) {
void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
u32 tmp;
/* r7xx hw bug. write to HDP_DEBUG1 followed by fb read
* rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
+ * This seems to cause problems on some AGP cards. Just use the old
+ * method for them.
*/
WREG32(HDP_DEBUG1, 0);
tmp = readl((void __iomem *)ptr);
@@ -3525,10 +3528,12 @@ int r600_debugfs_mc_info_init(struct rad
void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
{
/* r7xx hw bug. write to HDP_DEBUG1 followed by fb read
- * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
+ * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL.
+ * This seems to cause problems on some AGP cards. Just use the old
+ * method for them.
*/
if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
- rdev->vram_scratch.ptr) {
+ rdev->vram_scratch.ptr && !(rdev->flags & RADEON_IS_AGP)) {
void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
u32 tmp;
^ permalink raw reply [flat|nested] 177+ messages in thread* [010/152] drm/kms: remove spaces from connector names (v2)
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (8 preceding siblings ...)
2011-01-06 0:21 ` [009/152] drm/radeon/kms: dont apply 7xx HDP flush workaround on AGP Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [011/152] drm/radeon/kms: fix vram base calculation on rs780/rs880 Greg KH
` (142 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Sergej Pupykin, Alex Deucher,
Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit e76116ca9671e2e5239054a40303b94feab585ad upstream.
Grub doesn't parse spaces in parameters correctly, so
this makes it impossible to force video= parameters
for kms on the grub kernel command line.
v2: shorten the names to make them easier to type.
Reported-by: Sergej Pupykin <ml@sergej.pp.ru>
Cc: Sergej Pupykin <ml@sergej.pp.ru>
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/drm_crtc.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -156,12 +156,12 @@ static struct drm_conn_prop_enum_list dr
{ DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO", 0 },
{ DRM_MODE_CONNECTOR_LVDS, "LVDS", 0 },
{ DRM_MODE_CONNECTOR_Component, "Component", 0 },
- { DRM_MODE_CONNECTOR_9PinDIN, "9-pin DIN", 0 },
- { DRM_MODE_CONNECTOR_DisplayPort, "DisplayPort", 0 },
- { DRM_MODE_CONNECTOR_HDMIA, "HDMI Type A", 0 },
- { DRM_MODE_CONNECTOR_HDMIB, "HDMI Type B", 0 },
+ { DRM_MODE_CONNECTOR_9PinDIN, "DIN", 0 },
+ { DRM_MODE_CONNECTOR_DisplayPort, "DP", 0 },
+ { DRM_MODE_CONNECTOR_HDMIA, "HDMI-A", 0 },
+ { DRM_MODE_CONNECTOR_HDMIB, "HDMI-B", 0 },
{ DRM_MODE_CONNECTOR_TV, "TV", 0 },
- { DRM_MODE_CONNECTOR_eDP, "Embedded DisplayPort", 0 },
+ { DRM_MODE_CONNECTOR_eDP, "eDP", 0 },
};
static struct drm_prop_enum_list drm_encoder_enum_list[] =
^ permalink raw reply [flat|nested] 177+ messages in thread* [011/152] drm/radeon/kms: fix vram base calculation on rs780/rs880
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (9 preceding siblings ...)
2011-01-06 0:21 ` [010/152] drm/kms: remove spaces from connector names (v2) Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [012/152] drm/i915: Always set the DP transcoder config to 8BPC Greg KH
` (141 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit 8961d52d4cc52edf5672f8f2712c57162b736793 upstream.
Avoid overflowing a 32 bit value.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/r600.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1198,8 +1198,10 @@ void r600_vram_gtt_location(struct radeo
mc->vram_end, mc->real_vram_size >> 20);
} else {
u64 base = 0;
- if (rdev->flags & RADEON_IS_IGP)
- base = (RREG32(MC_VM_FB_LOCATION) & 0xFFFF) << 24;
+ if (rdev->flags & RADEON_IS_IGP) {
+ base = RREG32(MC_VM_FB_LOCATION) & 0xFFFF;
+ base <<= 24;
+ }
radeon_vram_location(rdev, &rdev->mc, base);
rdev->mc.gtt_base_align = 0;
radeon_gtt_location(rdev, mc);
^ permalink raw reply [flat|nested] 177+ messages in thread* [012/152] drm/i915: Always set the DP transcoder config to 8BPC.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (10 preceding siblings ...)
2011-01-06 0:21 ` [011/152] drm/radeon/kms: fix vram base calculation on rs780/rs880 Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [013/152] nohz: Fix printk_needs_cpu() return value on offline cpus Greg KH
` (140 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Anholt, Chris Wilson
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Anholt <eric@anholt.net>
commit 220cad3cbf553f893432919b458da36489373fc6 upstream.
The pipe is always set to 8BPC, but here we were leaving whatever
previous bits were set by the BIOS in place.
Signed-off-by: Eric Anholt <eric@anholt.net>
Tested-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/i915_reg.h | 1 +
drivers/gpu/drm/i915/intel_display.c | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2953,6 +2953,7 @@
#define TRANS_DP_10BPC (1<<9)
#define TRANS_DP_6BPC (2<<9)
#define TRANS_DP_12BPC (3<<9)
+#define TRANS_DP_BPC_MASK (3<<9)
#define TRANS_DP_VSYNC_ACTIVE_HIGH (1<<4)
#define TRANS_DP_VSYNC_ACTIVE_LOW 0
#define TRANS_DP_HSYNC_ACTIVE_HIGH (1<<3)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2044,9 +2044,11 @@ static void ironlake_crtc_dpms(struct dr
reg = I915_READ(trans_dp_ctl);
reg &= ~(TRANS_DP_PORT_SEL_MASK |
- TRANS_DP_SYNC_MASK);
+ TRANS_DP_SYNC_MASK |
+ TRANS_DP_BPC_MASK);
reg |= (TRANS_DP_OUTPUT_ENABLE |
TRANS_DP_ENH_FRAMING);
+ reg |= TRANS_DP_8BPC;
if (crtc->mode.flags & DRM_MODE_FLAG_PHSYNC)
reg |= TRANS_DP_HSYNC_ACTIVE_HIGH;
^ permalink raw reply [flat|nested] 177+ messages in thread* [013/152] nohz: Fix printk_needs_cpu() return value on offline cpus
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (11 preceding siblings ...)
2011-01-06 0:21 ` [012/152] drm/i915: Always set the DP transcoder config to 8BPC Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [014/152] nohz: Fix get_next_timer_interrupt() vs cpu hotplug Greg KH
` (139 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Heiko Carstens,
Peter Zijlstra, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit 61ab25447ad6334a74e32f60efb135a3467223f8 upstream.
This patch fixes a hang observed with 2.6.32 kernels where timers got enqueued
on offline cpus.
printk_needs_cpu() may return 1 if called on offline cpus. When a cpu gets
offlined it schedules the idle process which, before killing its own cpu, will
call tick_nohz_stop_sched_tick(). That function in turn will call
printk_needs_cpu() in order to check if the local tick can be disabled. On
offline cpus this function should naturally return 0 since regardless if the
tick gets disabled or not the cpu will be dead short after. That is besides the
fact that __cpu_disable() should already have made sure that no interrupts on
the offlined cpu will be delivered anyway.
In this case it prevents tick_nohz_stop_sched_tick() to call
select_nohz_load_balancer(). No idea if that really is a problem. However what
made me debug this is that on 2.6.32 the function get_nohz_load_balancer() is
used within __mod_timer() to select a cpu on which a timer gets enqueued. If
printk_needs_cpu() returns 1 then the nohz_load_balancer cpu doesn't get
updated when a cpu gets offlined. It may contain the cpu number of an offline
cpu. In turn timers get enqueued on an offline cpu and not very surprisingly
they never expire and cause system hangs.
This has been observed 2.6.32 kernels. On current kernels __mod_timer() uses
get_nohz_timer_target() which doesn't have that problem. However there might be
other problems because of the too early exit tick_nohz_stop_sched_tick() in
case a cpu goes offline.
Easiest way to fix this is just to test if the current cpu is offline and call
printk_tick() directly which clears the condition.
Alternatively I tried a cpu hotplug notifier which would clear the condition,
however between calling the notifier function and printk_needs_cpu() something
could have called printk() again and the problem is back again. This seems to
be the safest fix.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <20101126120235.406766476@de.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/printk.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1062,6 +1062,8 @@ void printk_tick(void)
int printk_needs_cpu(int cpu)
{
+ if (unlikely(cpu_is_offline(cpu)))
+ printk_tick();
return per_cpu(printk_pending, cpu);
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [014/152] nohz: Fix get_next_timer_interrupt() vs cpu hotplug
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (12 preceding siblings ...)
2011-01-06 0:21 ` [013/152] nohz: Fix printk_needs_cpu() return value on offline cpus Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [015/152] firewire: ohci: fix regression with VIA VT6315, disable MSI Greg KH
` (138 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Heiko Carstens,
Peter Zijlstra, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit dbd87b5af055a0cc9bba17795c9a2b0d17795389 upstream.
This fixes a bug as seen on 2.6.32 based kernels where timers got
enqueued on offline cpus.
If a cpu goes offline it might still have pending timers. These will
be migrated during CPU_DEAD handling after the cpu is offline.
However while the cpu is going offline it will schedule the idle task
which will then call tick_nohz_stop_sched_tick().
That function in turn will call get_next_timer_intterupt() to figure
out if the tick of the cpu can be stopped or not. If it turns out that
the next tick is just one jiffy off (delta_jiffies == 1)
tick_nohz_stop_sched_tick() incorrectly assumes that the tick should
not stop and takes an early exit and thus it won't update the load
balancer cpu.
Just afterwards the cpu will be killed and the load balancer cpu could
be the offline cpu.
On 2.6.32 based kernel get_nohz_load_balancer() gets called to decide
on which cpu a timer should be enqueued (see __mod_timer()). Which
leads to the possibility that timers get enqueued on an offline cpu.
These will never expire and can cause a system hang.
This has been observed 2.6.32 kernels. On current kernels
__mod_timer() uses get_nohz_timer_target() which doesn't have that
problem. However there might be other problems because of the too
early exit tick_nohz_stop_sched_tick() in case a cpu goes offline.
The easiest and probably safest fix seems to be to let
get_next_timer_interrupt() just lie and let it say there isn't any
pending timer if the current cpu is offline.
I also thought of moving migrate_[hr]timers() from CPU_DEAD to
CPU_DYING, but seeing that there already have been fixes at least in
the hrtimer code in this area I'm afraid that this could add new
subtle bugs.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <20101201091109.GA8984@osiris.boeblingen.de.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/timer.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1252,6 +1252,12 @@ unsigned long get_next_timer_interrupt(u
struct tvec_base *base = __get_cpu_var(tvec_bases);
unsigned long expires;
+ /*
+ * Pretend that there is no timer pending if the cpu is offline.
+ * Possible pending timers will be migrated later to an active cpu.
+ */
+ if (cpu_is_offline(smp_processor_id()))
+ return now + NEXT_TIMER_MAX_DELTA;
spin_lock(&base->lock);
if (time_before_eq(base->next_timer, base->timer_jiffies))
base->next_timer = __next_timer_interrupt(base);
^ permalink raw reply [flat|nested] 177+ messages in thread* [015/152] firewire: ohci: fix regression with VIA VT6315, disable MSI
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (13 preceding siblings ...)
2011-01-06 0:21 ` [014/152] nohz: Fix get_next_timer_interrupt() vs cpu hotplug Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [016/152] firewire: ohci: fix regression with Agere FW643 rev 06, " Greg KH
` (137 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Stefan Richter
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stefan Richter <stefanr@s5r6.in-berlin.de>
commit af0cdf4947818becfe209610b209315578645ab4 upstream.
"VIA Technologies, Inc. VT6315 Series Firewire Controller [1106:3403]"
does not generate any interrupts if Message Signaled Interrupts were
enabled. This is a regression since kernel 2.6.36 in which MSI support
was added to firewire-ohci. Hence blacklist MSI on all VIA controllers.
Reported-by: Robin Cook <rcook@wyrms.net>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/firewire/ohci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -262,7 +262,8 @@ static const struct {
{PCI_VENDOR_ID_AL, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
{PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
{PCI_VENDOR_ID_NEC, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
- {PCI_VENDOR_ID_VIA, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
+ {PCI_VENDOR_ID_VIA, PCI_ANY_ID, QUIRK_CYCLE_TIMER |
+ QUIRK_NO_MSI},
{PCI_VENDOR_ID_RICOH, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
{PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [016/152] firewire: ohci: fix regression with Agere FW643 rev 06, disable MSI
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (14 preceding siblings ...)
2011-01-06 0:21 ` [015/152] firewire: ohci: fix regression with VIA VT6315, disable MSI Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [017/152] NFS: Fix panic after nfs_umount() Greg KH
` (136 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Stefan Richter
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stefan Richter <stefanr@s5r6.in-berlin.de>
commit 9993e0fe0f5f29c69e79efcb271ffc9843002985 upstream.
Agere FW643 rev 06, listed as "11c1:5901 (rev 06) (prog-if 10 [OHCI])",
produced SBP-2 I/O errors since kernel 2.6.36. Disabling MSI fixes it.
Since MSI work on Agere FW643-E (same vendor and device ID, but rev 07),
introduce a device revision field into firewire-ohci's quirks list so
that different quirks can be defined for older and newer revisions.
Reported-by: Jonathan Isom <jeisom@gmail.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/firewire/ohci.c | 48 +++++++++++++++++++++++++++++++++---------------
1 file changed, 33 insertions(+), 15 deletions(-)
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -242,6 +242,7 @@ static inline struct fw_ohci *fw_ohci(st
static char ohci_driver_name[] = KBUILD_MODNAME;
+#define PCI_DEVICE_ID_AGERE_FW643 0x5901
#define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
#define PCI_DEVICE_ID_TI_TSB12LV22 0x8009
@@ -253,19 +254,34 @@ static char ohci_driver_name[] = KBUILD_
/* In case of multiple matches in ohci_quirks[], only the first one is used. */
static const struct {
- unsigned short vendor, device, flags;
+ unsigned short vendor, device, revision, flags;
} ohci_quirks[] = {
- {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, QUIRK_CYCLE_TIMER |
- QUIRK_RESET_PACKET |
- QUIRK_NO_1394A},
- {PCI_VENDOR_ID_TI, PCI_ANY_ID, QUIRK_RESET_PACKET},
- {PCI_VENDOR_ID_AL, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
- {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
- {PCI_VENDOR_ID_NEC, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
- {PCI_VENDOR_ID_VIA, PCI_ANY_ID, QUIRK_CYCLE_TIMER |
- QUIRK_NO_MSI},
- {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
- {PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
+ {PCI_VENDOR_ID_AL, PCI_ANY_ID, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER},
+
+ {PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_FW, PCI_ANY_ID,
+ QUIRK_BE_HEADERS},
+
+ {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+ QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, PCI_ANY_ID,
+ QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_NEC, PCI_ANY_ID, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER},
+
+ {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER},
+
+ {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER | QUIRK_RESET_PACKET | QUIRK_NO_1394A},
+
+ {PCI_VENDOR_ID_TI, PCI_ANY_ID, PCI_ANY_ID,
+ QUIRK_RESET_PACKET},
+
+ {PCI_VENDOR_ID_VIA, PCI_ANY_ID, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
};
/* This overrides anything that was found in ohci_quirks[]. */
@@ -2922,9 +2938,11 @@ static int __devinit pci_probe(struct pc
}
for (i = 0; i < ARRAY_SIZE(ohci_quirks); i++)
- if (ohci_quirks[i].vendor == dev->vendor &&
- (ohci_quirks[i].device == dev->device ||
- ohci_quirks[i].device == (unsigned short)PCI_ANY_ID)) {
+ if ((ohci_quirks[i].vendor == dev->vendor) &&
+ (ohci_quirks[i].device == (unsigned short)PCI_ANY_ID ||
+ ohci_quirks[i].device == dev->device) &&
+ (ohci_quirks[i].revision == (unsigned short)PCI_ANY_ID ||
+ ohci_quirks[i].revision >= dev->revision)) {
ohci->quirks = ohci_quirks[i].flags;
break;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [017/152] NFS: Fix panic after nfs_umount()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (15 preceding siblings ...)
2011-01-06 0:21 ` [016/152] firewire: ohci: fix regression with Agere FW643 rev 06, " Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [018/152] nfsd: Fix possible BUG_ON firing in set_change_info Greg KH
` (135 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Chuck Lever, Trond Myklebust
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 5b362ac3799ff4225c40935500f520cad4d7ed66 upstream.
After a few unsuccessful NFS mount attempts in which the client and
server cannot agree on an authentication flavor both support, the
client panics. nfs_umount() is invoked in the kernel in this case.
Turns out nfs_umount()'s UMNT RPC invocation causes the RPC client to
write off the end of the rpc_clnt's iostat array. This is because the
mount client's nrprocs field is initialized with the count of defined
procedures (two: MNT and UMNT), rather than the size of the client's
proc array (four).
The fix is to use the same initialization technique used by most other
upper layer clients in the kernel.
Introduced by commit 0b524123, which failed to update nrprocs when
support was added for UMNT in the kernel.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=24302
BugLink: http://bugs.launchpad.net/bugs/683938
Reported-by: Stefan Bader <stefan.bader@canonical.com>
Tested-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfs/mount_clnt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -503,13 +503,13 @@ static struct rpc_procinfo mnt3_procedur
static struct rpc_version mnt_version1 = {
.number = 1,
- .nrprocs = 2,
+ .nrprocs = ARRAY_SIZE(mnt_procedures),
.procs = mnt_procedures,
};
static struct rpc_version mnt_version3 = {
.number = 3,
- .nrprocs = 2,
+ .nrprocs = ARRAY_SIZE(mnt3_procedures),
.procs = mnt3_procedures,
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [018/152] nfsd: Fix possible BUG_ON firing in set_change_info
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (16 preceding siblings ...)
2011-01-06 0:21 ` [017/152] NFS: Fix panic after nfs_umount() Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [019/152] NFS: Fix fcntl F_GETLK not reporting some conflicts Greg KH
` (134 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, NeilBrown, J. Bruce Fields
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Neil Brown <neilb@suse.de>
commit c1ac3ffcd0bc7e9617f62be8c7043d53ab84deac upstream.
If vfs_getattr in fill_post_wcc returns an error, we don't
set fh_post_change.
For NFSv4, this can result in set_change_info triggering a BUG_ON.
i.e. fh_post_saved being zero isn't really a bug.
So:
- instead of BUGging when fh_post_saved is zero, just clear ->atomic.
- if vfs_getattr fails in fill_post_wcc, take a copy of i_ctime anyway.
This will be used i seg_change_info, but not overly trusted.
- While we are there, remove the pointless 'if' statements in set_change_info.
There is no harm setting all the values.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfsd/nfs3xdr.c | 6 ++++--
fs/nfsd/xdr4.h | 21 ++++++++++-----------
2 files changed, 14 insertions(+), 13 deletions(-)
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -260,9 +260,11 @@ void fill_post_wcc(struct svc_fh *fhp)
err = vfs_getattr(fhp->fh_export->ex_path.mnt, fhp->fh_dentry,
&fhp->fh_post_attr);
fhp->fh_post_change = fhp->fh_dentry->d_inode->i_version;
- if (err)
+ if (err) {
fhp->fh_post_saved = 0;
- else
+ /* Grab the ctime anyway - set_change_info might use it */
+ fhp->fh_post_attr.ctime = fhp->fh_dentry->d_inode->i_ctime;
+ } else
fhp->fh_post_saved = 1;
}
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -484,18 +484,17 @@ static inline bool nfsd4_not_cached(stru
static inline void
set_change_info(struct nfsd4_change_info *cinfo, struct svc_fh *fhp)
{
- BUG_ON(!fhp->fh_pre_saved || !fhp->fh_post_saved);
- cinfo->atomic = 1;
+ BUG_ON(!fhp->fh_pre_saved);
+ cinfo->atomic = fhp->fh_post_saved;
cinfo->change_supported = IS_I_VERSION(fhp->fh_dentry->d_inode);
- if (cinfo->change_supported) {
- cinfo->before_change = fhp->fh_pre_change;
- cinfo->after_change = fhp->fh_post_change;
- } else {
- cinfo->before_ctime_sec = fhp->fh_pre_ctime.tv_sec;
- cinfo->before_ctime_nsec = fhp->fh_pre_ctime.tv_nsec;
- cinfo->after_ctime_sec = fhp->fh_post_attr.ctime.tv_sec;
- cinfo->after_ctime_nsec = fhp->fh_post_attr.ctime.tv_nsec;
- }
+
+ cinfo->before_change = fhp->fh_pre_change;
+ cinfo->after_change = fhp->fh_post_change;
+ cinfo->before_ctime_sec = fhp->fh_pre_ctime.tv_sec;
+ cinfo->before_ctime_nsec = fhp->fh_pre_ctime.tv_nsec;
+ cinfo->after_ctime_sec = fhp->fh_post_attr.ctime.tv_sec;
+ cinfo->after_ctime_nsec = fhp->fh_post_attr.ctime.tv_nsec;
+
}
int nfs4svc_encode_voidres(struct svc_rqst *, __be32 *, void *);
^ permalink raw reply [flat|nested] 177+ messages in thread* [019/152] NFS: Fix fcntl F_GETLK not reporting some conflicts
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (17 preceding siblings ...)
2011-01-06 0:21 ` [018/152] nfsd: Fix possible BUG_ON firing in set_change_info Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:21 ` [020/152] sunrpc: prevent use-after-free on clearing XPT_BUSY Greg KH
` (133 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Sergey Vlasov,
Trond Myklebust
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sergey Vlasov <vsu@altlinux.ru>
commit 21ac19d484a8ffb66f64487846c8d53afef04d2b upstream.
The commit 129a84de2347002f09721cda3155ccfd19fade40 (locks: fix F_GETLK
regression (failure to find conflicts)) fixed the posix_test_lock()
function by itself, however, its usage in NFS changed by the commit
9d6a8c5c213e34c475e72b245a8eb709258e968c (locks: give posix_test_lock
same interface as ->lock) remained broken - subsequent NFS-specific
locking code received F_UNLCK instead of the user-specified lock type.
To fix the problem, fl->fl_type needs to be saved before the
posix_test_lock() call and restored if no local conflicts were reported.
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=23892
Tested-by: Alexander Morozov <amorozov@etersoft.ru>
Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfs/file.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -687,6 +687,7 @@ static int do_getlk(struct file *filp, i
{
struct inode *inode = filp->f_mapping->host;
int status = 0;
+ unsigned int saved_type = fl->fl_type;
/* Try local locking first */
posix_test_lock(filp, fl);
@@ -694,6 +695,7 @@ static int do_getlk(struct file *filp, i
/* found a conflict */
goto out;
}
+ fl->fl_type = saved_type;
if (nfs_have_delegation(inode, FMODE_READ))
goto out_noconflict;
^ permalink raw reply [flat|nested] 177+ messages in thread* [020/152] sunrpc: prevent use-after-free on clearing XPT_BUSY
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (18 preceding siblings ...)
2011-01-06 0:21 ` [019/152] NFS: Fix fcntl F_GETLK not reporting some conflicts Greg KH
@ 2011-01-06 0:21 ` Greg KH
2011-01-06 0:22 ` [021/152] hwmon: (adm1026) Allow 1 as a valid divider value Greg KH
` (132 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, NeilBrown, J. Bruce Fields
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <neilb@suse.de>
commit ed2849d3ecfa339435818eeff28f6c3424300cec upstream.
When an xprt is created, it has a refcount of 1, and XPT_BUSY is set.
The refcount is *not* owned by the thread that created the xprt
(as is clear from the fact that creators never put the reference).
Rather, it is owned by the absence of XPT_DEAD. Once XPT_DEAD is set,
(And XPT_BUSY is clear) that initial reference is dropped and the xprt
can be freed.
So when a creator clears XPT_BUSY it is dropping its only reference and
so must not touch the xprt again.
However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY
reference on a new xprt), calls svc_xprt_recieved. This clears
XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.
This is dangerous and has been seen to leave svc_xprt_enqueue working
with an xprt containing garbage.
So we need to hold an extra counted reference over that call to
svc_xprt_received.
For safety, any time we clear XPT_BUSY and then use the xprt again, we
first get a reference, and the put it again afterwards.
Note that svc_close_all does not need this extra protection as there are
no threads running, and the final free can only be called asynchronously
from such a thread.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/sunrpc/svc_xprt.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -212,6 +212,7 @@ int svc_create_xprt(struct svc_serv *ser
spin_lock(&svc_xprt_class_lock);
list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
struct svc_xprt *newxprt;
+ unsigned short newport;
if (strcmp(xprt_name, xcl->xcl_name))
continue;
@@ -230,8 +231,9 @@ int svc_create_xprt(struct svc_serv *ser
spin_lock_bh(&serv->sv_lock);
list_add(&newxprt->xpt_list, &serv->sv_permsocks);
spin_unlock_bh(&serv->sv_lock);
+ newport = svc_xprt_local_port(newxprt);
clear_bit(XPT_BUSY, &newxprt->xpt_flags);
- return svc_xprt_local_port(newxprt);
+ return newport;
}
err:
spin_unlock(&svc_xprt_class_lock);
@@ -431,8 +433,13 @@ void svc_xprt_received(struct svc_xprt *
{
BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
xprt->xpt_pool = NULL;
+ /* As soon as we clear busy, the xprt could be closed and
+ * 'put', so we need a reference to call svc_xprt_enqueue with:
+ */
+ svc_xprt_get(xprt);
clear_bit(XPT_BUSY, &xprt->xpt_flags);
svc_xprt_enqueue(xprt);
+ svc_xprt_put(xprt);
}
EXPORT_SYMBOL_GPL(svc_xprt_received);
^ permalink raw reply [flat|nested] 177+ messages in thread* [021/152] hwmon: (adm1026) Allow 1 as a valid divider value
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (19 preceding siblings ...)
2011-01-06 0:21 ` [020/152] sunrpc: prevent use-after-free on clearing XPT_BUSY Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [022/152] hwmon: (adm1026) Fix setting fan_div Greg KH
` (131 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Gabriele Gorla, Jean Delvare
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Gabriele Gorla <gorlik@penguintown.net>
commit 8b0f1840a46449e1946fc88860ef3ec8d6b1c2c7 upstream.
Allow 1 as a valid div value as specified in the ADM1026 datasheet.
Signed-off-by: Gabriele Gorla <gorlik@penguintown.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/hwmon/adm1026.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -920,9 +920,7 @@ static ssize_t set_fan_div(struct device
val = simple_strtol(buf, NULL, 10);
new_div = DIV_TO_REG(val);
- if (new_div == 0) {
- return -EINVAL;
- }
+
mutex_lock(&data->update_lock);
orig_div = data->fan_div[nr];
data->fan_div[nr] = DIV_FROM_REG(new_div);
^ permalink raw reply [flat|nested] 177+ messages in thread* [022/152] hwmon: (adm1026) Fix setting fan_div
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (20 preceding siblings ...)
2011-01-06 0:22 ` [021/152] hwmon: (adm1026) Allow 1 as a valid divider value Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [023/152] EDAC: Fix workqueue-related crashes Greg KH
` (130 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Gabriele Gorla, Jean Delvare
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Gabriele Gorla <gorlik@penguintown.net>
commit 52bc9802ce849d0d287cc5fe76d06b0daa3986ca upstream.
Prevent setting fan_div from stomping on other fans that share the
same I2C register.
Signed-off-by: Gabriele Gorla <gorlik@penguintown.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/hwmon/adm1026.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -916,7 +916,7 @@ static ssize_t set_fan_div(struct device
int nr = sensor_attr->index;
struct i2c_client *client = to_i2c_client(dev);
struct adm1026_data *data = i2c_get_clientdata(client);
- int val, orig_div, new_div, shift;
+ int val, orig_div, new_div;
val = simple_strtol(buf, NULL, 10);
new_div = DIV_TO_REG(val);
@@ -926,15 +926,17 @@ static ssize_t set_fan_div(struct device
data->fan_div[nr] = DIV_FROM_REG(new_div);
if (nr < 4) { /* 0 <= nr < 4 */
- shift = 2 * nr;
adm1026_write_value(client, ADM1026_REG_FAN_DIV_0_3,
- ((DIV_TO_REG(orig_div) & (~(0x03 << shift))) |
- (new_div << shift)));
+ (DIV_TO_REG(data->fan_div[0]) << 0) |
+ (DIV_TO_REG(data->fan_div[1]) << 2) |
+ (DIV_TO_REG(data->fan_div[2]) << 4) |
+ (DIV_TO_REG(data->fan_div[3]) << 6));
} else { /* 3 < nr < 8 */
- shift = 2 * (nr - 4);
adm1026_write_value(client, ADM1026_REG_FAN_DIV_4_7,
- ((DIV_TO_REG(orig_div) & (~(0x03 << (2 * shift)))) |
- (new_div << shift)));
+ (DIV_TO_REG(data->fan_div[4]) << 0) |
+ (DIV_TO_REG(data->fan_div[5]) << 2) |
+ (DIV_TO_REG(data->fan_div[6]) << 4) |
+ (DIV_TO_REG(data->fan_div[7]) << 6));
}
if (data->fan_div[nr] != orig_div) {
^ permalink raw reply [flat|nested] 177+ messages in thread* [023/152] EDAC: Fix workqueue-related crashes
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (21 preceding siblings ...)
2011-01-06 0:22 ` [022/152] hwmon: (adm1026) Fix setting fan_div Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [024/152] amd64_edac: Fix interleaving check Greg KH
` (129 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Borislav Petkov
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Borislav Petkov <borislav.petkov@amd.com>
commit bb31b3122c0dd07d2d958da17a50ad771ce79e2b upstream.
00740c58541b6087d78418cebca1fcb86dc6077d changed edac_core to
un-/register a workqueue item only if a lowlevel driver supplies a
polling routine. Normally, when we remove a polling low-level driver, we
go and cancel all the queued work. However, the workqueue unreg happens
based on the ->op_state setting, and edac_mc_del_mc() sets this to
OP_OFFLINE _before_ we cancel the work item, leading to NULL ptr oops on
the workqueue list.
Fix it by putting the unreg stuff in proper order.
Reported-and-tested-by: Tobias Karnat <tobias.karnat@googlemail.com>
LKML-Reference: <1291201307.3029.21.camel@Tobias-Karnat>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/edac/edac_mc.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -578,14 +578,16 @@ struct mem_ctl_info *edac_mc_del_mc(stru
return NULL;
}
- /* marking MCI offline */
- mci->op_state = OP_OFFLINE;
-
del_mc_from_global_list(mci);
mutex_unlock(&mem_ctls_mutex);
- /* flush workq processes and remove sysfs */
+ /* flush workq processes */
edac_mc_workq_teardown(mci);
+
+ /* marking MCI offline */
+ mci->op_state = OP_OFFLINE;
+
+ /* remove from sysfs */
edac_remove_sysfs_mci_device(mci);
edac_printk(KERN_INFO, EDAC_MC,
^ permalink raw reply [flat|nested] 177+ messages in thread* [024/152] amd64_edac: Fix interleaving check
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (22 preceding siblings ...)
2011-01-06 0:22 ` [023/152] EDAC: Fix workqueue-related crashes Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [025/152] ASoC: Fix swap of left and right channels for WM8993/4 speaker boost gain Greg KH
` (128 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Borislav Petkov
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Borislav Petkov <borislav.petkov@amd.com>
commit e726f3c368e7c1919a7166ec09c5705759f1a69d upstream.
When matching error address to the range contained by one memory node,
we're in valid range when node interleaving
1. is disabled, or
2. enabled and when the address bits we interleave on match the
interleave selector on this node (see the "Node Interleaving" section in
the BKDG for an enlightening example).
Thus, when we early-exit, we need to reverse the compound logic
statement properly.
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/edac/amd64_edac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1572,7 +1572,7 @@ static int f10_match_to_this_node(struct
debugf1(" HoleOffset=0x%x HoleValid=0x%x IntlvSel=0x%x\n",
hole_off, hole_valid, intlv_sel);
- if (intlv_en ||
+ if (intlv_en &&
(intlv_sel != ((sys_addr >> 12) & intlv_en)))
return -EINVAL;
^ permalink raw reply [flat|nested] 177+ messages in thread* [025/152] ASoC: Fix swap of left and right channels for WM8993/4 speaker boost gain
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (23 preceding siblings ...)
2011-01-06 0:22 ` [024/152] amd64_edac: Fix interleaving check Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [026/152] ASoC: Fix off by one error in WM8994 EQ register bank size Greg KH
` (127 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Uk Kim, Liam Girdwood,
Mark Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Uk Kim <w0806.kim@samsung.com>
commit ed8cc471d75365f8590c76f580def899d58028c0 upstream.
SPKOUTL_BOOST start from third bit, SPKOUTLR_BOOST start from 0 bit.
Signed-off-by: Uk Kim <w0806.kim@samsung.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/soc/codecs/wm_hubs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -293,7 +293,7 @@ SOC_DOUBLE_R("Speaker Switch",
SOC_DOUBLE_R("Speaker ZC Switch",
WM8993_SPEAKER_VOLUME_LEFT, WM8993_SPEAKER_VOLUME_RIGHT,
7, 1, 0),
-SOC_DOUBLE_TLV("Speaker Boost Volume", WM8993_SPKOUT_BOOST, 0, 3, 7, 0,
+SOC_DOUBLE_TLV("Speaker Boost Volume", WM8993_SPKOUT_BOOST, 3, 0, 7, 0,
spkboost_tlv),
SOC_ENUM("Speaker Reference", speaker_ref),
SOC_ENUM("Speaker Mode", speaker_mode),
^ permalink raw reply [flat|nested] 177+ messages in thread* [026/152] ASoC: Fix off by one error in WM8994 EQ register bank size
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (24 preceding siblings ...)
2011-01-06 0:22 ` [025/152] ASoC: Fix swap of left and right channels for WM8993/4 speaker boost gain Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [027/152] ASoC: WM8580: Fix R8 initial value Greg KH
` (126 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Uk Kim, Liam Girdwood,
Mark Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Uk Kim <w0806.kim@samsung.com>
commit 3fcc0afbb9c93f3599ba03273e59915670b6c2c2 upstream.
Signed-off-by: Uk Kim <w0806.kim@samsung.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/mfd/wm8994/pdata.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/mfd/wm8994/pdata.h
+++ b/include/linux/mfd/wm8994/pdata.h
@@ -29,7 +29,7 @@ struct wm8994_ldo_pdata {
#define WM8994_CONFIGURE_GPIO 0x8000
#define WM8994_DRC_REGS 5
-#define WM8994_EQ_REGS 19
+#define WM8994_EQ_REGS 20
/**
* DRC configurations are specified with a label and a set of register
^ permalink raw reply [flat|nested] 177+ messages in thread* [027/152] ASoC: WM8580: Fix R8 initial value
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (25 preceding siblings ...)
2011-01-06 0:22 ` [026/152] ASoC: Fix off by one error in WM8994 EQ register bank size Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [028/152] ASoC: fix deemphasis control in wm8904/55/60 codecs Greg KH
` (125 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Seungwhan Youn,
Liam Girdwood, Mark Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Seungwhan Youn <sw.youn@samsung.com>
commit a0968628097380be52db8b4664da98fc425546a5 upstream.
Acc to WM8580 manual, the default value for R8 is 0x10, not 0x1c.
Signed-off-by: Seungwhan Youn <sw.youn@samsung.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/soc/codecs/wm8580.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm8580.c
+++ b/sound/soc/codecs/wm8580.c
@@ -171,7 +171,7 @@
static const u16 wm8580_reg[] = {
0x0121, 0x017e, 0x007d, 0x0014, /*R3*/
0x0121, 0x017e, 0x007d, 0x0194, /*R7*/
- 0x001c, 0x0002, 0x0002, 0x00c2, /*R11*/
+ 0x0010, 0x0002, 0x0002, 0x00c2, /*R11*/
0x0182, 0x0082, 0x000a, 0x0024, /*R15*/
0x0009, 0x0000, 0x00ff, 0x0000, /*R19*/
0x00ff, 0x00ff, 0x00ff, 0x00ff, /*R23*/
^ permalink raw reply [flat|nested] 177+ messages in thread* [028/152] ASoC: fix deemphasis control in wm8904/55/60 codecs
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (26 preceding siblings ...)
2011-01-06 0:22 ` [027/152] ASoC: WM8580: Fix R8 initial value Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [029/152] bootmem: Add alloc_bootmem_align() Greg KH
` (124 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Dmitry Artamonow,
Liam Girdwood, Mark Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dmitry Artamonow <mad_soft@inbox.ru>
commit 3f343f8512c7882a3637d9aea4ec6b3801cbcdc5 upstream.
Deemphasis control's .get callback should update control's value instead
of returning it - return value of callback function is used for indicating
error or success of operation.
Signed-off-by: Dmitry Artamonow <mad_soft@inbox.ru>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/soc/codecs/wm8904.c | 3 ++-
sound/soc/codecs/wm8955.c | 3 ++-
sound/soc/codecs/wm8960.c | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -820,7 +820,8 @@ static int wm8904_get_deemph(struct snd_
struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
- return wm8904->deemph;
+ ucontrol->value.enumerated.item[0] = wm8904->deemph;
+ return 0;
}
static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -384,7 +384,8 @@ static int wm8955_get_deemph(struct snd_
struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
- return wm8955->deemph;
+ ucontrol->value.enumerated.item[0] = wm8955->deemph;
+ return 0;
}
static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -137,7 +137,8 @@ static int wm8960_get_deemph(struct snd_
struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
- return wm8960->deemph;
+ ucontrol->value.enumerated.item[0] = wm8960->deemph;
+ return 0;
}
static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
^ permalink raw reply [flat|nested] 177+ messages in thread* [029/152] bootmem: Add alloc_bootmem_align()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (27 preceding siblings ...)
2011-01-06 0:22 ` [028/152] ASoC: fix deemphasis control in wm8904/55/60 codecs Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [030/152] x86, xsave: Use alloc_bootmem_align() instead of alloc_bootmem() Greg KH
` (123 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Suresh Siddha,
H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <suresh.b.siddha@intel.com>
commit 53dde5f385bc56e312f78b7cb25ffaf8efd4735d upstream.
Add an alloc_bootmem_align() interface to allocate bootmem with
specified alignment. This is necessary to be able to allocate the
xsave area in a subsequent patch.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <20101116212441.977574826@sbsiddha-MOBL3.sc.intel.com>
Acked-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/bootmem.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -105,6 +105,8 @@ extern void *__alloc_bootmem_low_node(pg
#define alloc_bootmem(x) \
__alloc_bootmem(x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
+#define alloc_bootmem_align(x, align) \
+ __alloc_bootmem(x, align, __pa(MAX_DMA_ADDRESS))
#define alloc_bootmem_nopanic(x) \
__alloc_bootmem_nopanic(x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
#define alloc_bootmem_pages(x) \
^ permalink raw reply [flat|nested] 177+ messages in thread* [030/152] x86, xsave: Use alloc_bootmem_align() instead of alloc_bootmem()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (28 preceding siblings ...)
2011-01-06 0:22 ` [029/152] bootmem: Add alloc_bootmem_align() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [031/152] IB/uverbs: Handle large number of entries in poll CQ Greg KH
` (122 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Suresh Siddha,
H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <suresh.b.siddha@intel.com>
commit 10340ae130fb70352eae1ae8a00b7906d91bf166 upstream.
Alignment of alloc_bootmem() depends on the value of
L1_CACHE_SHIFT. What we need here, however, is 64 byte alignment. Use
alloc_bootmem_align() and explicitly specify the alignment instead.
This fixes a kernel boot crash reported by Jody when the cpu in .config
is set to MPENTIUMII but the kernel is booted on a xsave-capable CPU.
Reported-by: Jody Bruchon <jody@nctritech.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <20101116212442.059967454@sbsiddha-MOBL3.sc.intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/xsave.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -394,7 +394,8 @@ static void __init setup_xstate_init(voi
* Setup init_xstate_buf to represent the init state of
* all the features managed by the xsave
*/
- init_xstate_buf = alloc_bootmem(xstate_size);
+ init_xstate_buf = alloc_bootmem_align(xstate_size,
+ __alignof__(struct xsave_struct));
init_xstate_buf->i387.mxcsr = MXCSR_DEFAULT;
clts();
^ permalink raw reply [flat|nested] 177+ messages in thread* [031/152] IB/uverbs: Handle large number of entries in poll CQ
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (29 preceding siblings ...)
2011-01-06 0:22 ` [030/152] x86, xsave: Use alloc_bootmem_align() instead of alloc_bootmem() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [032/152] PM / Hibernate: Fix PM_POST_* notification with user-space suspend Greg KH
` (121 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Roland Dreier
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Carpenter <error27@gmail.com>
commit 7182afea8d1afd432a17c18162cc3fd441d0da93 upstream.
In ib_uverbs_poll_cq() code there is a potential integer overflow if
userspace passes in a large cmd.ne. The calls to kmalloc() would
allocate smaller buffers than intended, leading to memory corruption.
There iss also an information leak if resp wasn't all used.
Unprivileged userspace may call this function, although only if an
RDMA device that uses this function is present.
Fix this by copying CQ entries one at a time, which avoids the
allocation entirely, and also by moving this copying into a function
that makes sure to initialize all memory copied to userspace.
Special thanks to Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
for his help and advice.
Signed-off-by: Dan Carpenter <error27@gmail.com>
[ Monkey around with things a bit to avoid bad code generation by gcc
when designated initializers are used. - Roland ]
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/infiniband/core/uverbs_cmd.c | 101 +++++++++++++++++++----------------
1 file changed, 57 insertions(+), 44 deletions(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -891,68 +891,81 @@ out:
return ret ? ret : in_len;
}
+static int copy_wc_to_user(void __user *dest, struct ib_wc *wc)
+{
+ struct ib_uverbs_wc tmp;
+
+ tmp.wr_id = wc->wr_id;
+ tmp.status = wc->status;
+ tmp.opcode = wc->opcode;
+ tmp.vendor_err = wc->vendor_err;
+ tmp.byte_len = wc->byte_len;
+ tmp.ex.imm_data = (__u32 __force) wc->ex.imm_data;
+ tmp.qp_num = wc->qp->qp_num;
+ tmp.src_qp = wc->src_qp;
+ tmp.wc_flags = wc->wc_flags;
+ tmp.pkey_index = wc->pkey_index;
+ tmp.slid = wc->slid;
+ tmp.sl = wc->sl;
+ tmp.dlid_path_bits = wc->dlid_path_bits;
+ tmp.port_num = wc->port_num;
+ tmp.reserved = 0;
+
+ if (copy_to_user(dest, &tmp, sizeof tmp))
+ return -EFAULT;
+
+ return 0;
+}
+
ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
const char __user *buf, int in_len,
int out_len)
{
struct ib_uverbs_poll_cq cmd;
- struct ib_uverbs_poll_cq_resp *resp;
+ struct ib_uverbs_poll_cq_resp resp;
+ u8 __user *header_ptr;
+ u8 __user *data_ptr;
struct ib_cq *cq;
- struct ib_wc *wc;
- int ret = 0;
- int i;
- int rsize;
+ struct ib_wc wc;
+ int ret;
if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT;
- wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
- if (!wc)
- return -ENOMEM;
-
- rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
- resp = kmalloc(rsize, GFP_KERNEL);
- if (!resp) {
- ret = -ENOMEM;
- goto out_wc;
- }
-
cq = idr_read_cq(cmd.cq_handle, file->ucontext, 0);
- if (!cq) {
- ret = -EINVAL;
- goto out;
- }
+ if (!cq)
+ return -EINVAL;
- resp->count = ib_poll_cq(cq, cmd.ne, wc);
-
- put_cq_read(cq);
+ /* we copy a struct ib_uverbs_poll_cq_resp to user space */
+ header_ptr = (void __user *)(unsigned long) cmd.response;
+ data_ptr = header_ptr + sizeof resp;
+
+ memset(&resp, 0, sizeof resp);
+ while (resp.count < cmd.ne) {
+ ret = ib_poll_cq(cq, 1, &wc);
+ if (ret < 0)
+ goto out_put;
+ if (!ret)
+ break;
+
+ ret = copy_wc_to_user(data_ptr, &wc);
+ if (ret)
+ goto out_put;
- for (i = 0; i < resp->count; i++) {
- resp->wc[i].wr_id = wc[i].wr_id;
- resp->wc[i].status = wc[i].status;
- resp->wc[i].opcode = wc[i].opcode;
- resp->wc[i].vendor_err = wc[i].vendor_err;
- resp->wc[i].byte_len = wc[i].byte_len;
- resp->wc[i].ex.imm_data = (__u32 __force) wc[i].ex.imm_data;
- resp->wc[i].qp_num = wc[i].qp->qp_num;
- resp->wc[i].src_qp = wc[i].src_qp;
- resp->wc[i].wc_flags = wc[i].wc_flags;
- resp->wc[i].pkey_index = wc[i].pkey_index;
- resp->wc[i].slid = wc[i].slid;
- resp->wc[i].sl = wc[i].sl;
- resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
- resp->wc[i].port_num = wc[i].port_num;
+ data_ptr += sizeof(struct ib_uverbs_wc);
+ ++resp.count;
}
- if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
+ if (copy_to_user(header_ptr, &resp, sizeof resp)) {
ret = -EFAULT;
+ goto out_put;
+ }
-out:
- kfree(resp);
+ ret = in_len;
-out_wc:
- kfree(wc);
- return ret ? ret : in_len;
+out_put:
+ put_cq_read(cq);
+ return ret;
}
ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
^ permalink raw reply [flat|nested] 177+ messages in thread* [032/152] PM / Hibernate: Fix PM_POST_* notification with user-space suspend
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (30 preceding siblings ...)
2011-01-06 0:22 ` [031/152] IB/uverbs: Handle large number of entries in poll CQ Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [033/152] ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix Greg KH
` (120 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Takashi Iwai,
Rafael J. Wysocki
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 1497dd1d29c6a53fcd3c80f7ac8d0e0239e7389e upstream.
The user-space hibernation sends a wrong notification after the image
restoration because of thinko for the file flag check. RDONLY
corresponds to hibernation and WRONLY to restoration, confusingly.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/power/user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -137,7 +137,7 @@ static int snapshot_release(struct inode
free_all_swap_pages(data->swap);
if (data->frozen)
thaw_processes();
- pm_notifier_call_chain(data->mode == O_WRONLY ?
+ pm_notifier_call_chain(data->mode == O_RDONLY ?
PM_POST_HIBERNATION : PM_POST_RESTORE);
atomic_inc(&snapshot_device_available);
^ permalink raw reply [flat|nested] 177+ messages in thread* [033/152] ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (31 preceding siblings ...)
2011-01-06 0:22 ` [032/152] PM / Hibernate: Fix PM_POST_* notification with user-space suspend Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [034/152] [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts Greg KH
` (119 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Valentine Barshak,
George G. Davis, Catalin Marinas, Russell King
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Valentine Barshak <vbarshak@mvista.com>
commit 85b093bcc5322baa811a03ec73de0909c157f181 upstream.
Cache ownership must be acquired by reading/writing data from the
cache line to make cache operation have the desired effect on the
SMP MPCore CPU. However, the ownership is never acquired in the
v6_dma_inv_range function when cleaning the first line and
flushing the last one, in case the address is not aligned
to D_CACHE_LINE_SIZE boundary.
Fix this by reading/writing data if needed, before performing
cache operations.
While at it, fix v6_dma_flush_range to prevent RWFO outside
the buffer.
Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
Signed-off-by: George G. Davis <gdavis@mvista.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/arm/mm/cache-v6.S | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -196,6 +196,10 @@ ENTRY(v6_flush_kern_dcache_area)
* - end - virtual end address of region
*/
v6_dma_inv_range:
+#ifdef CONFIG_DMA_CACHE_RWFO
+ ldrb r2, [r0] @ read for ownership
+ strb r2, [r0] @ write for ownership
+#endif
tst r0, #D_CACHE_LINE_SIZE - 1
bic r0, r0, #D_CACHE_LINE_SIZE - 1
#ifdef HARVARD_CACHE
@@ -204,6 +208,10 @@ v6_dma_inv_range:
mcrne p15, 0, r0, c7, c11, 1 @ clean unified line
#endif
tst r1, #D_CACHE_LINE_SIZE - 1
+#ifdef CONFIG_DMA_CACHE_RWFO
+ ldrneb r2, [r1, #-1] @ read for ownership
+ strneb r2, [r1, #-1] @ write for ownership
+#endif
bic r1, r1, #D_CACHE_LINE_SIZE - 1
#ifdef HARVARD_CACHE
mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D line
@@ -211,10 +219,6 @@ v6_dma_inv_range:
mcrne p15, 0, r1, c7, c15, 1 @ clean & invalidate unified line
#endif
1:
-#ifdef CONFIG_DMA_CACHE_RWFO
- ldr r2, [r0] @ read for ownership
- str r2, [r0] @ write for ownership
-#endif
#ifdef HARVARD_CACHE
mcr p15, 0, r0, c7, c6, 1 @ invalidate D line
#else
@@ -222,6 +226,10 @@ v6_dma_inv_range:
#endif
add r0, r0, #D_CACHE_LINE_SIZE
cmp r0, r1
+#ifdef CONFIG_DMA_CACHE_RWFO
+ ldrlo r2, [r0] @ read for ownership
+ strlo r2, [r0] @ write for ownership
+#endif
blo 1b
mov r0, #0
mcr p15, 0, r0, c7, c10, 4 @ drain write buffer
@@ -256,12 +264,12 @@ v6_dma_clean_range:
* - end - virtual end address of region
*/
ENTRY(v6_dma_flush_range)
- bic r0, r0, #D_CACHE_LINE_SIZE - 1
-1:
#ifdef CONFIG_DMA_CACHE_RWFO
- ldr r2, [r0] @ read for ownership
- str r2, [r0] @ write for ownership
+ ldrb r2, [r0] @ read for ownership
+ strb r2, [r0] @ write for ownership
#endif
+ bic r0, r0, #D_CACHE_LINE_SIZE - 1
+1:
#ifdef HARVARD_CACHE
mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line
#else
@@ -269,6 +277,10 @@ ENTRY(v6_dma_flush_range)
#endif
add r0, r0, #D_CACHE_LINE_SIZE
cmp r0, r1
+#ifdef CONFIG_DMA_CACHE_RWFO
+ ldrlob r2, [r0] @ read for ownership
+ strlob r2, [r0] @ write for ownership
+#endif
blo 1b
mov r0, #0
mcr p15, 0, r0, c7, c10, 4 @ drain write buffer
^ permalink raw reply [flat|nested] 177+ messages in thread* [034/152] [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (32 preceding siblings ...)
2011-01-06 0:22 ` [033/152] ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [035/152] [SCSI] qla2xxx: Populate Command Type 6 LUN field properly Greg KH
` (118 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Andrew Vasquez,
Madhuranath Iyengar, James Bottomley
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Vasquez <andrew.vasquez@qlogic.com>
commit 087c621e22f49c326cdc65d98c6fc0737ac13533 upstream.
This would cause a panic while reading the NPIV-config data.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/scsi/qla2xxx/qla_os.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2095,6 +2095,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
ha->init_cb_size = sizeof(struct mid_init_cb_81xx);
ha->gid_list_info_size = 8;
ha->optrom_size = OPTROM_SIZE_82XX;
+ ha->nvram_npiv_size = QLA_MAX_VPORTS_QLA25XX;
ha->isp_ops = &qla82xx_isp_ops;
ha->flash_conf_off = FARX_ACCESS_FLASH_CONF;
ha->flash_data_off = FARX_ACCESS_FLASH_DATA;
^ permalink raw reply [flat|nested] 177+ messages in thread* [035/152] [SCSI] qla2xxx: Populate Command Type 6 LUN field properly.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (33 preceding siblings ...)
2011-01-06 0:22 ` [034/152] [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [036/152] llc: fix a device refcount imbalance Greg KH
` (117 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mike Hernandez,
Madhuranath Iyengar, James Bottomley
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Hernandez <michael.hernandez@qlogic.com>
commit 85727e1f78bd8392a0657ad6a4ff85fef1cc4a6d upstream.
Use the host_to_fcp_swap call to correctly populate the LUN field
in the Command Type 6 path. This field is used during LUN reset
cleanup and must match the field used in the FCP command.
Signed-off-by: Mike Hernandez <michael.hernandez@qlogic.com>
Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/scsi/qla2xxx/qla_iocb.c | 1 +
drivers/scsi/qla2xxx/qla_nx.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1061,6 +1061,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp
fcp_cmnd->additional_cdb_len |= 2;
int_to_scsilun(sp->cmd->device->lun, &fcp_cmnd->lun);
+ host_to_fcp_swap((uint8_t *)&fcp_cmnd->lun, sizeof(fcp_cmnd->lun));
memcpy(fcp_cmnd->cdb, cmd->cmnd, cmd->cmd_len);
cmd_pkt->fcp_cmnd_dseg_len = cpu_to_le16(fcp_cmnd_len);
cmd_pkt->fcp_cmnd_dseg_address[0] = cpu_to_le32(
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -2740,6 +2740,7 @@ sufficient_dsds:
goto queuing_error_fcp_cmnd;
int_to_scsilun(sp->cmd->device->lun, &cmd_pkt->lun);
+ host_to_fcp_swap((uint8_t *)&cmd_pkt->lun, sizeof(cmd_pkt->lun));
/* build FCP_CMND IU */
memset(ctx->fcp_cmnd, 0, sizeof(struct fcp_cmnd));
^ permalink raw reply [flat|nested] 177+ messages in thread* [036/152] llc: fix a device refcount imbalance
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (34 preceding siblings ...)
2011-01-06 0:22 ` [035/152] [SCSI] qla2xxx: Populate Command Type 6 LUN field properly Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [037/152] ath9k: Disable SWBA interrupt on remove_interface Greg KH
` (116 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
Octavian Purdila, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2465 bytes --]
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
commit 35d9b0c906ad92d32a0b8db5daa6fabfcc2f068d upstream.
Le dimanche 05 décembre 2010 à 12:23 +0100, Eric Dumazet a écrit :
> Le dimanche 05 décembre 2010 à 09:19 +0100, Eric Dumazet a écrit :
>
> > Hmm..
> >
> > If somebody can explain why RTNL is held in arp_ioctl() (and therefore
> > in arp_req_delete()), we might first remove RTNL use in arp_ioctl() so
> > that your patch can be applied.
> >
> > Right now it is not good, because RTNL wont be necessarly held when you
> > are going to call arp_invalidate() ?
>
> While doing this analysis, I found a refcount bug in llc, I'll send a
> patch for net-2.6
Oh well, of course I must first fix the bug in net-2.6, and wait David
pull the fix in net-next-2.6 before sending this rcu conversion.
Note: this patch should be sent to stable teams (2.6.34 and up)
[PATCH net-2.6] llc: fix a device refcount imbalance
commit abf9d537fea225 (llc: add support for SO_BINDTODEVICE) added one
refcount imbalance in llc_ui_bind(), because dev_getbyhwaddr() doesnt
take a reference on device, while dev_get_by_index() does.
Fix this using RCU locking. And since an RCU conversion will be done for
2.6.38 for dev_getbyhwaddr(), put the rcu_read_lock/unlock exactly at
their final place.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Octavian Purdila <opurdila@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/llc/af_llc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -317,8 +317,9 @@ static int llc_ui_bind(struct socket *so
goto out;
rc = -ENODEV;
rtnl_lock();
+ rcu_read_lock();
if (sk->sk_bound_dev_if) {
- llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+ llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
if (llc->dev) {
if (!addr->sllc_arphrd)
addr->sllc_arphrd = llc->dev->type;
@@ -329,13 +330,13 @@ static int llc_ui_bind(struct socket *so
!llc_mac_match(addr->sllc_mac,
llc->dev->dev_addr)) {
rc = -EINVAL;
- dev_put(llc->dev);
llc->dev = NULL;
}
}
} else
llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
addr->sllc_mac);
+ rcu_read_unlock();
rtnl_unlock();
if (!llc->dev)
goto out;
^ permalink raw reply [flat|nested] 177+ messages in thread* [037/152] ath9k: Disable SWBA interrupt on remove_interface
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (35 preceding siblings ...)
2011-01-06 0:22 ` [036/152] llc: fix a device refcount imbalance Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [038/152] ath9k: Fix STA disconnect issue due to received MIC failed bcast frames Greg KH
` (115 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Rajkumar Manoharan,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajkumar Manoharan <rmanoharan@atheros.com>
commit 46047784b8cdcfc916f6c1cccee0c18dd1223dfd upstream.
while removing beaconing mode interface, SWBA interrupt
was never disabled when there are no other beaconing interfaces.
Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath/ath9k/main.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1484,6 +1484,7 @@ static void ath9k_remove_interface(struc
struct ath_softc *sc = aphy->sc;
struct ath_common *common = ath9k_hw_common(sc->sc_ah);
struct ath_vif *avp = (void *)vif->drv_priv;
+ bool bs_valid = false;
int i;
ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -1512,7 +1513,15 @@ static void ath9k_remove_interface(struc
"slot\n", __func__);
sc->beacon.bslot[i] = NULL;
sc->beacon.bslot_aphy[i] = NULL;
- }
+ } else if (sc->beacon.bslot[i])
+ bs_valid = true;
+ }
+ if (!bs_valid && (sc->sc_ah->imask & ATH9K_INT_SWBA)) {
+ /* Disable SWBA interrupt */
+ sc->sc_ah->imask &= ~ATH9K_INT_SWBA;
+ ath9k_ps_wakeup(sc);
+ ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
+ ath9k_ps_restore(sc);
}
sc->nvifs--;
^ permalink raw reply [flat|nested] 177+ messages in thread* [038/152] ath9k: Fix STA disconnect issue due to received MIC failed bcast frames
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (36 preceding siblings ...)
2011-01-06 0:22 ` [037/152] ath9k: Disable SWBA interrupt on remove_interface Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [039/152] ath9k: Fix bug in reading input gpio state for ar9003 Greg KH
` (114 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Senthil Balasubramanian,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Senthil Balasubramanian <senthilkumar@atheros.com>
commit 916448e77f6bcaaa7f13c3de0c3851783ae2bfd0 upstream.
AR_RxKeyIdxValid will not be set for bcast/mcast frames and so relying
this status for MIC failed frames is buggy.
Due to this, MIC failure events for broadcast frames are not sent to
supplicant resulted in AP disconnecting the STA.
Able to pass Wifi Test case 5.2.18 with this fix.
Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath/ath9k/mac.c | 3 +--
drivers/net/wireless/ath/ath9k/recv.c | 4 +++-
2 files changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -711,8 +711,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
rs->rs_phyerr = phyerr;
} else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
rs->rs_status |= ATH9K_RXERR_DECRYPT;
- else if ((ads.ds_rxstatus8 & AR_MichaelErr) &&
- rs->rs_keyix != ATH9K_RXKEYIX_INVALID)
+ else if (ads.ds_rxstatus8 & AR_MichaelErr)
rs->rs_status |= ATH9K_RXERR_MIC;
else if (ads.ds_rxstatus8 & AR_KeyMiss)
rs->rs_status |= ATH9K_RXERR_DECRYPT;
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1035,9 +1035,11 @@ static void ath9k_rx_skb_postprocess(str
int hdrlen, padpos, padsize;
u8 keyix;
__le16 fc;
+ bool is_mc;
/* see if any padding is done by the hw and remove it */
hdr = (struct ieee80211_hdr *) skb->data;
+ is_mc = !!is_multicast_ether_addr(hdr->addr1);
hdrlen = ieee80211_get_hdrlen_from_skb(skb);
fc = hdr->frame_control;
padpos = ath9k_cmn_padpos(hdr->frame_control);
@@ -1058,7 +1060,7 @@ static void ath9k_rx_skb_postprocess(str
keyix = rx_stats->rs_keyix;
- if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+ if ((is_mc || !(keyix == ATH9K_RXKEYIX_INVALID)) && !decrypt_error &&
ieee80211_has_protected(fc)) {
rxs->flag |= RX_FLAG_DECRYPTED;
} else if (ieee80211_has_protected(fc)
^ permalink raw reply [flat|nested] 177+ messages in thread* [039/152] ath9k: Fix bug in reading input gpio state for ar9003
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (37 preceding siblings ...)
2011-01-06 0:22 ` [038/152] ath9k: Fix STA disconnect issue due to received MIC failed bcast frames Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [040/152] ath9k_hw: fix endian issues with CTLs on AR9003 Greg KH
` (113 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vasanthakumar Thiagarajan,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
commit 9306990a656d9cfd8bf3586938012729c1f2ea50 upstream.
The register which gives input gpio state is 0x404c for ar9003,
currently 0x4048 is wrongly used. This will disable RF and make
it unusable on some of AR9003.
Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath/ath9k/hw.c | 3 ++-
drivers/net/wireless/ath/ath9k/reg.h | 6 ++++--
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2351,7 +2351,8 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah,
val = REG_READ(ah, AR7010_GPIO_IN);
return (MS(val, AR7010_GPIO_IN_VAL) & AR_GPIO_BIT(gpio)) == 0;
} else if (AR_SREV_9300_20_OR_LATER(ah))
- return MS_REG_READ(AR9300, gpio) != 0;
+ return (MS(REG_READ(ah, AR_GPIO_IN), AR9300_GPIO_IN_VAL) &
+ AR_GPIO_BIT(gpio)) != 0;
else if (AR_SREV_9271(ah))
return MS_REG_READ(AR9271, gpio) != 0;
else if (AR_SREV_9287_10_OR_LATER(ah))
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -1019,11 +1019,13 @@ enum {
#define AR9287_GPIO_IN_VAL_S 11
#define AR9271_GPIO_IN_VAL 0xFFFF0000
#define AR9271_GPIO_IN_VAL_S 16
-#define AR9300_GPIO_IN_VAL 0x0001FFFF
-#define AR9300_GPIO_IN_VAL_S 0
#define AR7010_GPIO_IN_VAL 0x0000FFFF
#define AR7010_GPIO_IN_VAL_S 0
+#define AR_GPIO_IN 0x404c
+#define AR9300_GPIO_IN_VAL 0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S 0
+
#define AR_GPIO_OE_OUT (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
#define AR_GPIO_OE_OUT_DRV 0x3
#define AR_GPIO_OE_OUT_DRV_NO 0x0
^ permalink raw reply [flat|nested] 177+ messages in thread* [040/152] ath9k_hw: fix endian issues with CTLs on AR9003
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (38 preceding siblings ...)
2011-01-06 0:22 ` [039/152] ath9k: Fix bug in reading input gpio state for ar9003 Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [041/152] ath9k: fix bug in tx power Greg KH
` (112 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Felix Fietkau,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit e702ba18f25887c76d26c8a85cc1706463c62e9a upstream.
Parsing data using bitfields is messy, because it makes endian handling
much harder. AR9002 and earlier got it right, AR9003 got it wrong.
This might lead to either using too high or too low tx power values,
depending on frequency and eeprom settings.
Fix it by getting rid of the CTL related bitfields entirely and use
masks instead.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 79 ++++++++++++-------------
drivers/net/wireless/ath/ath9k/ar9003_eeprom.h | 9 --
drivers/net/wireless/ath/ath9k/eeprom.c | 6 -
drivers/net/wireless/ath/ath9k/eeprom.h | 13 +---
4 files changed, 50 insertions(+), 57 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -55,6 +55,8 @@
#define SUB_NUM_CTL_MODES_AT_5G_40 2 /* excluding HT40, EXT-OFDM */
#define SUB_NUM_CTL_MODES_AT_2G_40 3 /* excluding HT40, EXT-OFDM, EXT-CCK */
+#define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
+
static const struct ar9300_eeprom ar9300_default = {
.eepromVersion = 2,
.templateVersion = 2,
@@ -290,20 +292,21 @@ static const struct ar9300_eeprom ar9300
}
},
.ctlPowerData_2G = {
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
- { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
-
- { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-
- { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-
- { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
- { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+ { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
+
+ { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+ { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
},
.modalHeader5G = {
/* 4 idle,t1,t2,b (4 bits per setting) */
@@ -568,56 +571,56 @@ static const struct ar9300_eeprom ar9300
.ctlPowerData_5G = {
{
{
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
- {60, 1}, {60, 1}, {60, 1}, {60, 0},
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
}
},
{
{
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
- {60, 1}, {60, 1}, {60, 1}, {60, 0},
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
}
},
{
{
- {60, 0}, {60, 1}, {60, 0}, {60, 1},
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
+ CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
}
},
{
{
- {60, 0}, {60, 1}, {60, 1}, {60, 0},
- {60, 1}, {60, 0}, {60, 0}, {60, 0},
+ CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+ CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
}
},
{
{
- {60, 1}, {60, 1}, {60, 1}, {60, 0},
- {60, 0}, {60, 0}, {60, 0}, {60, 0},
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+ CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
}
},
{
{
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
- {60, 1}, {60, 0}, {60, 0}, {60, 0},
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+ CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
}
},
{
{
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
- {60, 1}, {60, 1}, {60, 1}, {60, 1},
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
}
},
{
{
- {60, 1}, {60, 1}, {60, 0}, {60, 1},
- {60, 1}, {60, 1}, {60, 1}, {60, 0},
+ CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
}
},
{
{
- {60, 1}, {60, 0}, {60, 1}, {60, 1},
- {60, 1}, {60, 1}, {60, 0}, {60, 1},
+ CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+ CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
}
},
}
@@ -1827,9 +1830,9 @@ static u16 ar9003_hw_get_direct_edge_pow
struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
if (is2GHz)
- return ctl_2g[idx].ctlEdges[edge].tPower;
+ return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge]);
else
- return ctl_5g[idx].ctlEdges[edge].tPower;
+ return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge]);
}
static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
@@ -1847,12 +1850,12 @@ static u16 ar9003_hw_get_indirect_edge_p
if (is2GHz) {
if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
- ctl_2g[idx].ctlEdges[edge - 1].flag)
- return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+ CTL_EDGE_FLAGS(ctl_2g[idx].ctlEdges[edge - 1]))
+ return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge - 1]);
} else {
if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
- ctl_5g[idx].ctlEdges[edge - 1].flag)
- return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+ CTL_EDGE_FLAGS(ctl_5g[idx].ctlEdges[edge - 1]))
+ return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge - 1]);
}
return AR9300_MAX_RATE_POWER;
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -261,17 +261,12 @@ struct cal_tgt_pow_ht {
u8 tPow2x[14];
} __packed;
-struct cal_ctl_edge_pwr {
- u8 tPower:6,
- flag:2;
-} __packed;
-
struct cal_ctl_data_2g {
- struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+ u8 ctlEdges[AR9300_NUM_BAND_EDGES_2G];
} __packed;
struct cal_ctl_data_5g {
- struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+ u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
} __packed;
struct ar9300_eeprom {
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -240,16 +240,16 @@ u16 ath9k_hw_get_max_edge_power(u16 freq
for (i = 0; (i < num_band_edges) &&
(pRdEdgesPower[i].bChannel != AR5416_BCHAN_UNUSED); i++) {
if (freq == ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel, is2GHz)) {
- twiceMaxEdgePower = pRdEdgesPower[i].tPower;
+ twiceMaxEdgePower = CTL_EDGE_TPOWER(pRdEdgesPower[i].ctl);
break;
} else if ((i > 0) &&
(freq < ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel,
is2GHz))) {
if (ath9k_hw_fbin2freq(pRdEdgesPower[i - 1].bChannel,
is2GHz) < freq &&
- pRdEdgesPower[i - 1].flag) {
+ CTL_EDGE_FLAGS(pRdEdgesPower[i - 1].ctl)) {
twiceMaxEdgePower =
- pRdEdgesPower[i - 1].tPower;
+ CTL_EDGE_TPOWER(pRdEdgesPower[i - 1].ctl);
}
break;
}
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -233,6 +233,9 @@
#define AR9287_CHECKSUM_LOCATION (AR9287_EEP_START_LOC + 1)
+#define CTL_EDGE_TPOWER(_ctl) ((_ctl) & 0x3f)
+#define CTL_EDGE_FLAGS(_ctl) (((_ctl) >> 6) & 0x03)
+
enum eeprom_param {
EEP_NFTHRESH_5,
EEP_NFTHRESH_2,
@@ -533,18 +536,10 @@ struct cal_target_power_ht {
u8 tPow2x[8];
} __packed;
-
-#ifdef __BIG_ENDIAN_BITFIELD
-struct cal_ctl_edges {
- u8 bChannel;
- u8 flag:2, tPower:6;
-} __packed;
-#else
struct cal_ctl_edges {
u8 bChannel;
- u8 tPower:6, flag:2;
+ u8 ctl;
} __packed;
-#endif
struct cal_data_op_loop_ar9287 {
u8 pwrPdg[2][5];
^ permalink raw reply [flat|nested] 177+ messages in thread* [041/152] ath9k: fix bug in tx power
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (39 preceding siblings ...)
2011-01-06 0:22 ` [040/152] ath9k_hw: fix endian issues with CTLs on AR9003 Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [042/152] mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs Greg KH
` (111 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Matteo Croce,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Matteo Croce <technoboy85@gmail.com>
commit 841051602e3fa18ea468fe5a177aa92b6eb44b56 upstream.
The ath9k driver subtracts 3 dBm to the txpower as with two radios the
signal power is doubled.
The resulting value is assigned in an u16 which overflows and makes
the card work at full power.
Signed-off-by: Matteo Croce <matteo@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath/ath9k/eeprom_def.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1062,15 +1062,19 @@ static void ath9k_hw_set_def_power_per_r
case 1:
break;
case 2:
- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+ else
+ scaledPower = 0;
break;
case 3:
- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+ else
+ scaledPower = 0;
break;
}
- scaledPower = max((u16)0, scaledPower);
-
if (IS_CHAN_2GHZ(chan)) {
numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
SUB_NUM_CTL_MODES_AT_2G_40;
^ permalink raw reply [flat|nested] 177+ messages in thread* [042/152] mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (40 preceding siblings ...)
2011-01-06 0:22 ` [041/152] ath9k: fix bug in tx power Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [043/152] SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ Greg KH
` (110 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Johannes Berg, Helmut Schaa,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Helmut Schaa <helmut.schaa@googlemail.com>
commit 7e2447075690860e2cea96b119fc9cadbaa7e83c upstream.
mac80211 doesn't handle shared skbs correctly at the moment. As a result
a possible resize can trigger a BUG in pskb_expand_head.
[ 676.030000] Kernel bug detected[#1]:
[ 676.030000] Cpu 0
[ 676.030000] $ 0 : 00000000 00000000 819662ff 00000002
[ 676.030000] $ 4 : 81966200 00000020 00000000 00000020
[ 676.030000] $ 8 : 819662e0 800043c0 00000002 00020000
[ 676.030000] $12 : 3b9aca00 00000000 00000000 00470000
[ 676.030000] $16 : 80ea2000 00000000 00000000 00000000
[ 676.030000] $20 : 818aa200 80ea2018 80ea2000 00000008
[ 676.030000] $24 : 00000002 800ace5c
[ 676.030000] $28 : 8199a000 8199bd20 81938f88 80f180d4
[ 676.030000] Hi : 0000026e
[ 676.030000] Lo : 0000757e
[ 676.030000] epc : 801245e4 pskb_expand_head+0x44/0x1d8
[ 676.030000] Not tainted
[ 676.030000] ra : 80f180d4 ieee80211_skb_resize+0xb0/0x114 [mac80211]
[ 676.030000] Status: 1000a403 KERNEL EXL IE
[ 676.030000] Cause : 10800024
[ 676.030000] PrId : 0001964c (MIPS 24Kc)
[ 676.030000] Modules linked in: mac80211_hwsim rt2800lib rt2x00soc rt2x00pci rt2x00lib mac80211 crc_itu_t crc_ccitt cfg80211 compat arc4 aes_generic deflate ecb cbc [last unloaded: rt2800pci]
[ 676.030000] Process kpktgend_0 (pid: 97, threadinfo=8199a000, task=81879f48, tls=00000000)
[ 676.030000] Stack : ffffffff 00000000 00000000 00000014 00000004 80ea2000 00000000 00000000
[ 676.030000] 818aa200 80f180d4 ffffffff 0000000a 81879f78 81879f48 81879f48 00000018
[ 676.030000] 81966246 80ea2000 818432e0 80f1a420 80203050 81814d98 00000001 81879f48
[ 676.030000] 81879f48 00000018 81966246 818432e0 0000001a 8199bdd4 0000001c 80f1b72c
[ 676.030000] 80203020 8001292c 80ef4aa2 7f10b55d 801ab5b8 81879f48 00000188 80005c90
[ 676.030000] ...
[ 676.030000] Call Trace:
[ 676.030000] [<801245e4>] pskb_expand_head+0x44/0x1d8
[ 676.030000] [<80f180d4>] ieee80211_skb_resize+0xb0/0x114 [mac80211]
[ 676.030000] [<80f1a420>] ieee80211_xmit+0x150/0x22c [mac80211]
[ 676.030000] [<80f1b72c>] ieee80211_subif_start_xmit+0x6f4/0x73c [mac80211]
[ 676.030000] [<8014361c>] pktgen_thread_worker+0xfac/0x16f8
[ 676.030000] [<8002ebe8>] kthread+0x7c/0x88
[ 676.030000] [<80008e0c>] kernel_thread_helper+0x10/0x18
[ 676.030000]
[ 676.030000]
[ 676.030000] Code: 24020001 10620005 2502001f <0200000d> 0804917a 00000000 2502001f 00441023 00531021
Fix this by making a local copy of shared skbs prior to mangeling them.
To avoid copying the skb unnecessarily move the skb_copy call below the
checks that don't need write access to the skb.
Also, move the assignment of nh_pos and h_pos below the skb_copy to point
to the correct skb.
It would be possible to avoid another resize of the copied skb by using
skb_copy_expand instead of skb_copy but that would make the patch more
complex. Also, shared skbs are a corner case right now, so the resize
shouldn't matter much.
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/mac80211/tx.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1705,15 +1705,13 @@ netdev_tx_t ieee80211_subif_start_xmit(s
int nh_pos, h_pos;
struct sta_info *sta = NULL;
u32 sta_flags = 0;
+ struct sk_buff *tmp_skb;
if (unlikely(skb->len < ETH_HLEN)) {
ret = NETDEV_TX_OK;
goto fail;
}
- nh_pos = skb_network_header(skb) - skb->data;
- h_pos = skb_transport_header(skb) - skb->data;
-
/* convert Ethernet header to proper 802.11 header (based on
* operation mode) */
ethertype = (skb->data[12] << 8) | skb->data[13];
@@ -1885,6 +1883,20 @@ netdev_tx_t ieee80211_subif_start_xmit(s
goto fail;
}
+ /*
+ * If the skb is shared we need to obtain our own copy.
+ */
+ if (skb_shared(skb)) {
+ tmp_skb = skb;
+ skb = skb_copy(skb, GFP_ATOMIC);
+ kfree_skb(tmp_skb);
+
+ if (!skb) {
+ ret = NETDEV_TX_OK;
+ goto fail;
+ }
+ }
+
hdr.frame_control = fc;
hdr.duration_id = 0;
hdr.seq_ctrl = 0;
@@ -1903,6 +1915,9 @@ netdev_tx_t ieee80211_subif_start_xmit(s
encaps_len = 0;
}
+ nh_pos = skb_network_header(skb) - skb->data;
+ h_pos = skb_transport_header(skb) - skb->data;
+
skb_pull(skb, skip_header_bytes);
nh_pos -= skip_header_bytes;
h_pos -= skip_header_bytes;
^ permalink raw reply [flat|nested] 177+ messages in thread* [043/152] SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (41 preceding siblings ...)
2011-01-06 0:22 ` [042/152] mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [044/152] sparc64: Delete prom_puts() unused Greg KH
` (109 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel Hellstrom,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel Hellstrom <daniel@gaisler.com>
[ Upstream commit b690c425fe07c725e7f1f7d40303588416cba67f ]
Signed-off-by: Daniel Hellstrom <daniel@gaisler.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/kernel/leon_kernel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -114,7 +114,7 @@ void __init leon_init_timers(irq_handler
if (leon3_gptimer_regs && leon3_irqctrl_regs) {
LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].val, 0);
LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].rld,
- (((1000000 / 100) - 1)));
+ (((1000000 / HZ) - 1)));
LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].ctrl, 0);
#ifdef CONFIG_SMP
@@ -128,7 +128,7 @@ void __init leon_init_timers(irq_handler
}
LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].val, 0);
- LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/100) - 1)));
+ LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/HZ) - 1)));
LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].ctrl, 0);
# endif
^ permalink raw reply [flat|nested] 177+ messages in thread* [044/152] sparc64: Delete prom_puts() unused.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (42 preceding siblings ...)
2011-01-06 0:22 ` [043/152] SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [045/152] sparc: Remove prom_pathtoinode() Greg KH
` (108 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit ce05a94efaf71d562eeefd30d6bbc2ab42b06bac ]
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/prom/console_64.c | 16 ----------------
1 file changed, 16 deletions(-)
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -81,19 +81,3 @@ prom_putchar(char c)
{
prom_nbputchar(c);
}
-
-void
-prom_puts(const char *s, int len)
-{
- unsigned long args[7];
-
- args[0] = (unsigned long) "write";
- args[1] = 3;
- args[2] = 1;
- args[3] = (unsigned int) prom_stdout;
- args[4] = (unsigned long) s;
- args[5] = len;
- args[6] = (unsigned long) -1;
-
- p1275_cmd_direct(args);
-}
^ permalink raw reply [flat|nested] 177+ messages in thread* [045/152] sparc: Remove prom_pathtoinode()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (43 preceding siblings ...)
2011-01-06 0:22 ` [044/152] sparc64: Delete prom_puts() unused Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [046/152] sparc: Kill prom devops_{32,64}.c Greg KH
` (107 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 17d70d6df0c4ea7a203b444001572a91ad9c2bef ]
Unused.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_32.h | 1 -
arch/sparc/include/asm/oplib_64.h | 1 -
arch/sparc/prom/tree_32.c | 15 ---------------
arch/sparc/prom/tree_64.c | 18 ------------------
4 files changed, 35 deletions(-)
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -238,7 +238,6 @@ extern int prom_node_has_property(int no
extern int prom_setprop(int node, const char *prop_name, char *prop_value,
int value_size);
-extern int prom_pathtoinode(char *path);
extern int prom_inst2pkg(int);
/* Dorking with Bus ranges... */
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -278,7 +278,6 @@ extern int prom_finddevice(const char *n
extern int prom_setprop(int node, const char *prop_name, char *prop_value,
int value_size);
-extern int prom_pathtoinode(const char *path);
extern int prom_inst2pkg(int);
extern int prom_service_exists(const char *service_name);
extern void prom_sun4v_guest_soft_state(void);
--- a/arch/sparc/prom/tree_32.c
+++ b/arch/sparc/prom/tree_32.c
@@ -341,18 +341,3 @@ int prom_inst2pkg(int inst)
if (node == -1) return 0;
return node;
}
-
-/* Return 'node' assigned to a particular prom 'path'
- * FIXME: Should work for v0 as well
- */
-int prom_pathtoinode(char *path)
-{
- int node, inst;
-
- inst = prom_devopen (path);
- if (inst == -1) return 0;
- node = prom_inst2pkg (inst);
- prom_devclose (inst);
- if (node == -1) return 0;
- return node;
-}
--- a/arch/sparc/prom/tree_64.c
+++ b/arch/sparc/prom/tree_64.c
@@ -374,24 +374,6 @@ inline int prom_inst2pkg(int inst)
return node;
}
-/* Return 'node' assigned to a particular prom 'path'
- * FIXME: Should work for v0 as well
- */
-int
-prom_pathtoinode(const char *path)
-{
- int node, inst;
-
- inst = prom_devopen (path);
- if (inst == 0)
- return 0;
- node = prom_inst2pkg(inst);
- prom_devclose(inst);
- if (node == -1)
- return 0;
- return node;
-}
-
int prom_ihandle2path(int handle, char *buffer, int bufsize)
{
unsigned long args[7];
^ permalink raw reply [flat|nested] 177+ messages in thread* [046/152] sparc: Kill prom devops_{32,64}.c
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (44 preceding siblings ...)
2011-01-06 0:22 ` [045/152] sparc: Remove prom_pathtoinode() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [047/152] sparc64: Unexport prom_service_exists() Greg KH
` (106 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit b148246912bea92bde2a0cba125ca94f1f776b12 ]
Completely unused.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_32.h | 19 --------
arch/sparc/include/asm/oplib_64.h | 21 ---------
arch/sparc/prom/Makefile | 1
arch/sparc/prom/devops_32.c | 87 --------------------------------------
arch/sparc/prom/devops_64.c | 67 -----------------------------
5 files changed, 195 deletions(-)
delete mode 100644 arch/sparc/prom/devops_32.c
delete mode 100644 arch/sparc/prom/devops_64.c
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -60,25 +60,6 @@ extern char *prom_getbootargs(void);
extern char *prom_mapio(char *virt_hint, int io_space, unsigned int phys_addr, unsigned int num_bytes);
extern void prom_unmapio(char *virt_addr, unsigned int num_bytes);
-/* Device operations. */
-
-/* Open the device described by the passed string. Note, that the format
- * of the string is different on V0 vs. V2->higher proms. The caller must
- * know what he/she is doing! Returns the device descriptor, an int.
- */
-extern int prom_devopen(char *device_string);
-
-/* Close a previously opened device described by the passed integer
- * descriptor.
- */
-extern int prom_devclose(int device_handle);
-
-/* Do a seek operation on the device described by the passed integer
- * descriptor.
- */
-extern void prom_seek(int device_handle, unsigned int seek_hival,
- unsigned int seek_lowval);
-
/* Miscellaneous routines, don't really fit in any category per se. */
/* Reboot the machine with the command line passed. */
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -67,27 +67,6 @@ extern void prom_init(void *cif_handler,
/* Boot argument acquisition, returns the boot command line string. */
extern char *prom_getbootargs(void);
-/* Device utilities. */
-
-/* Device operations. */
-
-/* Open the device described by the passed string. Note, that the format
- * of the string is different on V0 vs. V2->higher proms. The caller must
- * know what he/she is doing! Returns the device descriptor, an int.
- */
-extern int prom_devopen(const char *device_string);
-
-/* Close a previously opened device described by the passed integer
- * descriptor.
- */
-extern int prom_devclose(int device_handle);
-
-/* Do a seek operation on the device described by the passed integer
- * descriptor.
- */
-extern void prom_seek(int device_handle, unsigned int seek_hival,
- unsigned int seek_lowval);
-
/* Miscellaneous routines, don't really fit in any category per se. */
/* Reboot the machine with the command line passed. */
--- a/arch/sparc/prom/Makefile
+++ b/arch/sparc/prom/Makefile
@@ -6,7 +6,6 @@ ccflags := -Werror
lib-y := bootstr_$(BITS).o
lib-$(CONFIG_SPARC32) += devmap.o
-lib-y += devops_$(BITS).o
lib-y += init_$(BITS).o
lib-$(CONFIG_SPARC32) += memory.o
lib-y += misc_$(BITS).o
--- a/arch/sparc/prom/devops_32.c
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * devops.c: Device operations using the PROM.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- */
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-
-#include <asm/openprom.h>
-#include <asm/oplib.h>
-
-extern void restore_current(void);
-
-/* Open the device described by the string 'dstr'. Returns the handle
- * to that device used for subsequent operations on that device.
- * Returns -1 on failure.
- */
-int
-prom_devopen(char *dstr)
-{
- int handle;
- unsigned long flags;
- spin_lock_irqsave(&prom_lock, flags);
- switch(prom_vers) {
- case PROM_V0:
- handle = (*(romvec->pv_v0devops.v0_devopen))(dstr);
- if(handle == 0) handle = -1;
- break;
- case PROM_V2:
- case PROM_V3:
- handle = (*(romvec->pv_v2devops.v2_dev_open))(dstr);
- break;
- default:
- handle = -1;
- break;
- };
- restore_current();
- spin_unlock_irqrestore(&prom_lock, flags);
-
- return handle;
-}
-
-/* Close the device described by device handle 'dhandle'. */
-int
-prom_devclose(int dhandle)
-{
- unsigned long flags;
- spin_lock_irqsave(&prom_lock, flags);
- switch(prom_vers) {
- case PROM_V0:
- (*(romvec->pv_v0devops.v0_devclose))(dhandle);
- break;
- case PROM_V2:
- case PROM_V3:
- (*(romvec->pv_v2devops.v2_dev_close))(dhandle);
- break;
- default:
- break;
- };
- restore_current();
- spin_unlock_irqrestore(&prom_lock, flags);
- return 0;
-}
-
-/* Seek to specified location described by 'seekhi' and 'seeklo'
- * for device 'dhandle'.
- */
-void
-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo)
-{
- unsigned long flags;
- spin_lock_irqsave(&prom_lock, flags);
- switch(prom_vers) {
- case PROM_V0:
- (*(romvec->pv_v0devops.v0_seekdev))(dhandle, seekhi, seeklo);
- break;
- case PROM_V2:
- case PROM_V3:
- (*(romvec->pv_v2devops.v2_dev_seek))(dhandle, seekhi, seeklo);
- break;
- default:
- break;
- };
- restore_current();
- spin_unlock_irqrestore(&prom_lock, flags);
-}
--- a/arch/sparc/prom/devops_64.c
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * devops.c: Device operations using the PROM.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
- */
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-
-#include <asm/openprom.h>
-#include <asm/oplib.h>
-
-/* Open the device described by the string 'dstr'. Returns the handle
- * to that device used for subsequent operations on that device.
- * Returns 0 on failure.
- */
-int
-prom_devopen(const char *dstr)
-{
- unsigned long args[5];
-
- args[0] = (unsigned long) "open";
- args[1] = 1;
- args[2] = 1;
- args[3] = (unsigned long) dstr;
- args[4] = (unsigned long) -1;
-
- p1275_cmd_direct(args);
-
- return (int) args[4];
-}
-
-/* Close the device described by device handle 'dhandle'. */
-int
-prom_devclose(int dhandle)
-{
- unsigned long args[4];
-
- args[0] = (unsigned long) "close";
- args[1] = 1;
- args[2] = 0;
- args[3] = (unsigned int) dhandle;
-
- p1275_cmd_direct(args);
-
- return 0;
-}
-
-/* Seek to specified location described by 'seekhi' and 'seeklo'
- * for device 'dhandle'.
- */
-void
-prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo)
-{
- unsigned long args[7];
-
- args[0] = (unsigned long) "seek";
- args[1] = 3;
- args[2] = 1;
- args[3] = (unsigned int) dhandle;
- args[4] = seekhi;
- args[5] = seeklo;
- args[6] = (unsigned long) -1;
-
- p1275_cmd_direct(args);
-}
^ permalink raw reply [flat|nested] 177+ messages in thread* [047/152] sparc64: Unexport prom_service_exists().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (45 preceding siblings ...)
2011-01-06 0:22 ` [046/152] sparc: Kill prom devops_{32,64}.c Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [048/152] sparc64: Delete prom_setcallback() Greg KH
` (105 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit f7b5f55ac1623dfde24ef5319ad77c1746645f3f ]
Only used by functions in misc_64.c so make it private
to that file.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_64.h | 1 -
arch/sparc/prom/misc_64.c | 2 +-
2 files changed, 1 insertion(+), 2 deletions(-)
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -258,7 +258,6 @@ extern int prom_setprop(int node, const
int value_size);
extern int prom_inst2pkg(int);
-extern int prom_service_exists(const char *service_name);
extern void prom_sun4v_guest_soft_state(void);
extern int prom_ihandle2path(int handle, char *buffer, int bufsize);
--- a/arch/sparc/prom/misc_64.c
+++ b/arch/sparc/prom/misc_64.c
@@ -18,7 +18,7 @@
#include <asm/system.h>
#include <asm/ldc.h>
-int prom_service_exists(const char *service_name)
+static int prom_service_exists(const char *service_name)
{
unsigned long args[5];
^ permalink raw reply [flat|nested] 177+ messages in thread* [048/152] sparc64: Delete prom_setcallback().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (46 preceding siblings ...)
2011-01-06 0:22 ` [047/152] sparc64: Unexport prom_service_exists() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [049/152] sparc: Do not export prom_nb{get,put}char() Greg KH
` (104 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit c540ee70e49b573535c7ddfd0e9a0fc9d549c8b7 ]
Unused.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_64.h | 8 --------
arch/sparc/prom/misc_64.c | 14 --------------
2 files changed, 22 deletions(-)
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -88,14 +88,6 @@ extern void prom_halt(void) __attribute_
/* Halt and power-off the machine. */
extern void prom_halt_power_off(void) __attribute__ ((noreturn));
-/* Set the PROM 'sync' callback function to the passed function pointer.
- * When the user gives the 'sync' command at the prom prompt while the
- * kernel is still active, the prom will call this routine.
- *
- */
-typedef int (*callback_func_t)(long *cmd);
-extern void prom_setcallback(callback_func_t func_ptr);
-
/* Acquire the IDPROM of the root node in the prom device tree. This
* gets passed a buffer where you would like it stuffed. The return value
* is the format type of this idprom or 0xff on error.
--- a/arch/sparc/prom/misc_64.c
+++ b/arch/sparc/prom/misc_64.c
@@ -150,20 +150,6 @@ void prom_halt_power_off(void)
prom_halt();
}
-/* Set prom sync handler to call function 'funcp'. */
-void prom_setcallback(callback_func_t funcp)
-{
- unsigned long args[5];
- if (!funcp)
- return;
- args[0] = (unsigned long) "set-callback";
- args[1] = 1;
- args[2] = 1;
- args[3] = (unsigned long) funcp;
- args[4] = (unsigned long) -1;
- p1275_cmd_direct(args);
-}
-
/* Get the idprom and stuff it into buffer 'idbuf'. Returns the
* format type. 'num_bytes' is the number of bytes that your idbuf
* has space for. Returns 0xff on error.
^ permalink raw reply [flat|nested] 177+ messages in thread* [049/152] sparc: Do not export prom_nb{get,put}char().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (47 preceding siblings ...)
2011-01-06 0:22 ` [048/152] sparc64: Delete prom_setcallback() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [050/152] sparc: Pass buffer pointer all the way down to prom_{get,put}char() Greg KH
` (103 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 91921fef7c658b12de53376b312d071d757f7770 ]
Never used outside of console_{32,64}.c
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_32.h | 6 ------
arch/sparc/include/asm/oplib_64.h | 6 ------
arch/sparc/prom/console_32.c | 6 ++----
arch/sparc/prom/console_64.c | 6 ++----
4 files changed, 4 insertions(+), 20 deletions(-)
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -104,12 +104,6 @@ extern int prom_getprev(void);
/* Character operations to/from the console.... */
-/* Non-blocking get character from console. */
-extern int prom_nbgetchar(void);
-
-/* Non-blocking put character to console. */
-extern int prom_nbputchar(char character);
-
/* Blocking get character from console. */
extern char prom_getchar(void);
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -96,12 +96,6 @@ extern unsigned char prom_get_idprom(cha
/* Character operations to/from the console.... */
-/* Non-blocking get character from console. */
-extern int prom_nbgetchar(void);
-
-/* Non-blocking put character to console. */
-extern int prom_nbputchar(char character);
-
/* Blocking get character from console. */
extern char prom_getchar(void);
--- a/arch/sparc/prom/console_32.c
+++ b/arch/sparc/prom/console_32.c
@@ -19,8 +19,7 @@ extern void restore_current(void);
/* Non blocking get character from console input device, returns -1
* if no input was taken. This can be used for polling.
*/
-int
-prom_nbgetchar(void)
+static int prom_nbgetchar(void)
{
static char inc;
int i = -1;
@@ -51,8 +50,7 @@ prom_nbgetchar(void)
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
-int
-prom_nbputchar(char c)
+static int prom_nbputchar(char c)
{
static char outc;
unsigned long flags;
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -18,8 +18,7 @@ extern int prom_stdin, prom_stdout;
/* Non blocking get character from console input device, returns -1
* if no input was taken. This can be used for polling.
*/
-inline int
-prom_nbgetchar(void)
+static int prom_nbgetchar(void)
{
unsigned long args[7];
char inc;
@@ -42,8 +41,7 @@ prom_nbgetchar(void)
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
-inline int
-prom_nbputchar(char c)
+static int prom_nbputchar(char c)
{
unsigned long args[7];
char outc;
^ permalink raw reply [flat|nested] 177+ messages in thread* [050/152] sparc: Pass buffer pointer all the way down to prom_{get,put}char().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (48 preceding siblings ...)
2011-01-06 0:22 ` [049/152] sparc: Do not export prom_nb{get,put}char() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [051/152] sparc: Delete prom_*getchar() Greg KH
` (102 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit e62cac1fd035b4cde707285008499dbe71955a86 ]
This gets us closer to being able to eliminate the use
of dynamic and stack based buffers, so that we can adhere
to the "no buffer addresses above 4GB" rule for PROM calls.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/openprom.h | 2 -
arch/sparc/include/asm/oplib_32.h | 4 +--
arch/sparc/include/asm/oplib_64.h | 4 +--
arch/sparc/prom/console_32.c | 50 +++++++++++++++++++-------------------
arch/sparc/prom/console_64.c | 34 ++++++++++++-------------
arch/sparc/prom/printf.c | 15 ++++++-----
6 files changed, 55 insertions(+), 54 deletions(-)
--- a/arch/sparc/include/asm/openprom.h
+++ b/arch/sparc/include/asm/openprom.h
@@ -37,7 +37,7 @@ struct linux_dev_v2_funcs {
int (*v2_dev_open)(char *devpath);
void (*v2_dev_close)(int d);
int (*v2_dev_read)(int d, char *buf, int nbytes);
- int (*v2_dev_write)(int d, char *buf, int nbytes);
+ int (*v2_dev_write)(int d, const char *buf, int nbytes);
int (*v2_dev_seek)(int d, int hi, int lo);
/* Never issued (multistage load support) */
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -105,10 +105,10 @@ extern int prom_getprev(void);
/* Character operations to/from the console.... */
/* Blocking get character from console. */
-extern char prom_getchar(void);
+extern void prom_getchar(char *buf);
/* Blocking put character to console. */
-extern void prom_putchar(char character);
+extern void prom_putchar(const char *buf);
/* Prom's internal routines, don't use in kernel/boot code. */
extern void prom_printf(const char *fmt, ...);
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -97,10 +97,10 @@ extern unsigned char prom_get_idprom(cha
/* Character operations to/from the console.... */
/* Blocking get character from console. */
-extern char prom_getchar(void);
+extern void prom_getchar(char *buf);
/* Blocking put character to console. */
-extern void prom_putchar(char character);
+extern void prom_putchar(const char *buf);
/* Prom's internal routines, don't use in kernel/boot code. */
extern void prom_printf(const char *fmt, ...);
--- a/arch/sparc/prom/console_32.c
+++ b/arch/sparc/prom/console_32.c
@@ -19,27 +19,27 @@ extern void restore_current(void);
/* Non blocking get character from console input device, returns -1
* if no input was taken. This can be used for polling.
*/
-static int prom_nbgetchar(void)
+static int prom_nbgetchar(char *buf)
{
- static char inc;
- int i = -1;
unsigned long flags;
+ int i = -1;
spin_lock_irqsave(&prom_lock, flags);
switch(prom_vers) {
case PROM_V0:
i = (*(romvec->pv_nbgetchar))();
+ if (i != -1) {
+ *buf = i;
+ i = 0;
+ }
break;
case PROM_V2:
case PROM_V3:
- if( (*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin , &inc, 0x1) == 1) {
- i = inc;
- } else {
- i = -1;
- }
+ if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin,
+ buf, 0x1) == 1)
+ i = 0;
break;
default:
- i = -1;
break;
};
restore_current();
@@ -50,27 +50,23 @@ static int prom_nbgetchar(void)
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
-static int prom_nbputchar(char c)
+static int prom_nbputchar(const char *buf)
{
- static char outc;
unsigned long flags;
int i = -1;
spin_lock_irqsave(&prom_lock, flags);
switch(prom_vers) {
case PROM_V0:
- i = (*(romvec->pv_nbputchar))(c);
+ i = (*(romvec->pv_nbputchar))(*buf);
break;
case PROM_V2:
case PROM_V3:
- outc = c;
- if( (*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout, &outc, 0x1) == 1)
+ if ((*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout,
+ buf, 0x1) == 1)
i = 0;
- else
- i = -1;
break;
default:
- i = -1;
break;
};
restore_current();
@@ -79,17 +75,21 @@ static int prom_nbputchar(char c)
}
/* Blocking version of get character routine above. */
-char
-prom_getchar(void)
+void prom_getchar(char *buf)
{
- int character;
- while((character = prom_nbgetchar()) == -1) ;
- return (char) character;
+ while (1) {
+ int err = prom_nbgetchar(buf);
+ if (!err)
+ break;
+ }
}
/* Blocking version of put character routine above. */
-void
-prom_putchar(char c)
+void prom_putchar(const char *buf)
{
- while(prom_nbputchar(c) == -1) ;
+ while (1) {
+ int err = prom_nbputchar(buf);
+ if (!err)
+ break;
+ }
}
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -18,41 +18,37 @@ extern int prom_stdin, prom_stdout;
/* Non blocking get character from console input device, returns -1
* if no input was taken. This can be used for polling.
*/
-static int prom_nbgetchar(void)
+static int prom_nbgetchar(char *buf)
{
unsigned long args[7];
- char inc;
args[0] = (unsigned long) "read";
args[1] = 3;
args[2] = 1;
args[3] = (unsigned int) prom_stdin;
- args[4] = (unsigned long) &inc;
+ args[4] = (unsigned long) buf;
args[5] = 1;
args[6] = (unsigned long) -1;
p1275_cmd_direct(args);
if (args[6] == 1)
- return inc;
+ return 0;
return -1;
}
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
-static int prom_nbputchar(char c)
+static int prom_nbputchar(const char *buf)
{
unsigned long args[7];
- char outc;
-
- outc = c;
args[0] = (unsigned long) "write";
args[1] = 3;
args[2] = 1;
args[3] = (unsigned int) prom_stdout;
- args[4] = (unsigned long) &outc;
+ args[4] = (unsigned long) buf;
args[5] = 1;
args[6] = (unsigned long) -1;
@@ -65,17 +61,21 @@ static int prom_nbputchar(char c)
}
/* Blocking version of get character routine above. */
-char
-prom_getchar(void)
+void prom_getchar(char *buf)
{
- int character;
- while((character = prom_nbgetchar()) == -1) ;
- return (char) character;
+ while (1) {
+ int err = prom_nbgetchar(buf);
+ if (!err)
+ break;
+ }
}
/* Blocking version of put character routine above. */
-void
-prom_putchar(char c)
+void prom_putchar(const char *buf)
{
- prom_nbputchar(c);
+ while (1) {
+ int err = prom_nbputchar(buf);
+ if (!err)
+ break;
+ }
}
--- a/arch/sparc/prom/printf.c
+++ b/arch/sparc/prom/printf.c
@@ -23,13 +23,14 @@ static char ppbuf[1024];
void notrace prom_write(const char *buf, unsigned int n)
{
- char ch;
-
- while (n != 0) {
- --n;
- if ((ch = *buf++) == '\n')
- prom_putchar('\r');
- prom_putchar(ch);
+ while (n-- != 0) {
+ char ch = *buf;
+ if (ch == '\n') {
+ char tmp = '\r';
+ prom_putchar(&tmp);
+ }
+ prom_putchar(buf);
+ buf++;
}
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [051/152] sparc: Delete prom_*getchar().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (49 preceding siblings ...)
2011-01-06 0:22 ` [050/152] sparc: Pass buffer pointer all the way down to prom_{get,put}char() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [052/152] sparc: Write to prom console using indirect buffer Greg KH
` (101 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 12c7a35ee6a1c605e740733f2cbd5b5079f09f0f ]
Completely unused.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_32.h | 5 ----
arch/sparc/include/asm/oplib_64.h | 5 ----
arch/sparc/prom/console_32.c | 41 --------------------------------------
arch/sparc/prom/console_64.c | 32 -----------------------------
4 files changed, 83 deletions(-)
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -102,11 +102,6 @@ extern int prom_getrev(void);
/* Get the prom firmware revision. */
extern int prom_getprev(void);
-/* Character operations to/from the console.... */
-
-/* Blocking get character from console. */
-extern void prom_getchar(char *buf);
-
/* Blocking put character to console. */
extern void prom_putchar(const char *buf);
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -94,11 +94,6 @@ extern void prom_halt_power_off(void) __
*/
extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
-/* Character operations to/from the console.... */
-
-/* Blocking get character from console. */
-extern void prom_getchar(char *buf);
-
/* Blocking put character to console. */
extern void prom_putchar(const char *buf);
--- a/arch/sparc/prom/console_32.c
+++ b/arch/sparc/prom/console_32.c
@@ -16,37 +16,6 @@
extern void restore_current(void);
-/* Non blocking get character from console input device, returns -1
- * if no input was taken. This can be used for polling.
- */
-static int prom_nbgetchar(char *buf)
-{
- unsigned long flags;
- int i = -1;
-
- spin_lock_irqsave(&prom_lock, flags);
- switch(prom_vers) {
- case PROM_V0:
- i = (*(romvec->pv_nbgetchar))();
- if (i != -1) {
- *buf = i;
- i = 0;
- }
- break;
- case PROM_V2:
- case PROM_V3:
- if ((*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin,
- buf, 0x1) == 1)
- i = 0;
- break;
- default:
- break;
- };
- restore_current();
- spin_unlock_irqrestore(&prom_lock, flags);
- return i; /* Ugh, we could spin forever on unsupported proms ;( */
-}
-
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
@@ -74,16 +43,6 @@ static int prom_nbputchar(const char *bu
return i; /* Ugh, we could spin forever on unsupported proms ;( */
}
-/* Blocking version of get character routine above. */
-void prom_getchar(char *buf)
-{
- while (1) {
- int err = prom_nbgetchar(buf);
- if (!err)
- break;
- }
-}
-
/* Blocking version of put character routine above. */
void prom_putchar(const char *buf)
{
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -15,28 +15,6 @@
extern int prom_stdin, prom_stdout;
-/* Non blocking get character from console input device, returns -1
- * if no input was taken. This can be used for polling.
- */
-static int prom_nbgetchar(char *buf)
-{
- unsigned long args[7];
-
- args[0] = (unsigned long) "read";
- args[1] = 3;
- args[2] = 1;
- args[3] = (unsigned int) prom_stdin;
- args[4] = (unsigned long) buf;
- args[5] = 1;
- args[6] = (unsigned long) -1;
-
- p1275_cmd_direct(args);
-
- if (args[6] == 1)
- return 0;
- return -1;
-}
-
/* Non blocking put character to console device, returns -1 if
* unsuccessful.
*/
@@ -60,16 +38,6 @@ static int prom_nbputchar(const char *bu
return -1;
}
-/* Blocking version of get character routine above. */
-void prom_getchar(char *buf)
-{
- while (1) {
- int err = prom_nbgetchar(buf);
- if (!err)
- break;
- }
-}
-
/* Blocking version of put character routine above. */
void prom_putchar(const char *buf)
{
^ permalink raw reply [flat|nested] 177+ messages in thread* [052/152] sparc: Write to prom console using indirect buffer.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (50 preceding siblings ...)
2011-01-06 0:22 ` [051/152] sparc: Delete prom_*getchar() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [053/152] tcp: Dont change unlocked socket state in tcp_v4_err() Greg KH
` (100 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 595a251c0740785fd3c0d2156d78578c7479811e ]
sparc64 systems have a restriction in that passing in buffer
addressses above 4GB to prom calls is not reliable.
We end up violating this when we do prom console writes, because we
use an on-stack buffer to translate '\n' into '\r\n'.
So instead, do this translation into an intermediate buffer, which is
in the kernel image and thus below 4GB, then pass that to the PROM
console write calls.
On the 32-bit side we don't have to deal with any of these issues, so
the new prom_console_write_buf() uses the existing prom_nbputchar()
implementation. However we can now mark those routines static.
Since the 64-bit side completely uses new code we can delete the
putchar bits as they are now completely unused.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sparc/include/asm/oplib_32.h | 4 ++--
arch/sparc/include/asm/oplib_64.h | 4 ++--
arch/sparc/prom/console_32.c | 14 ++++++++------
arch/sparc/prom/console_64.c | 27 +++++++++++++--------------
arch/sparc/prom/printf.c | 32 +++++++++++++++++++++++++++-----
5 files changed, 52 insertions(+), 29 deletions(-)
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -102,8 +102,8 @@ extern int prom_getrev(void);
/* Get the prom firmware revision. */
extern int prom_getprev(void);
-/* Blocking put character to console. */
-extern void prom_putchar(const char *buf);
+/* Write a buffer of characters to the console. */
+extern void prom_console_write_buf(const char *buf, int len);
/* Prom's internal routines, don't use in kernel/boot code. */
extern void prom_printf(const char *fmt, ...);
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -94,8 +94,8 @@ extern void prom_halt_power_off(void) __
*/
extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
-/* Blocking put character to console. */
-extern void prom_putchar(const char *buf);
+/* Write a buffer of characters to the console. */
+extern void prom_console_write_buf(const char *buf, int len);
/* Prom's internal routines, don't use in kernel/boot code. */
extern void prom_printf(const char *fmt, ...);
--- a/arch/sparc/prom/console_32.c
+++ b/arch/sparc/prom/console_32.c
@@ -43,12 +43,14 @@ static int prom_nbputchar(const char *bu
return i; /* Ugh, we could spin forever on unsupported proms ;( */
}
-/* Blocking version of put character routine above. */
-void prom_putchar(const char *buf)
+void prom_console_write_buf(const char *buf, int len)
{
- while (1) {
- int err = prom_nbputchar(buf);
- if (!err)
- break;
+ while (len) {
+ int n = prom_nbputchar(buf);
+ if (n)
+ continue;
+ len--;
+ buf++;
}
}
+
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -15,35 +15,34 @@
extern int prom_stdin, prom_stdout;
-/* Non blocking put character to console device, returns -1 if
- * unsuccessful.
- */
-static int prom_nbputchar(const char *buf)
+static int __prom_console_write_buf(const char *buf, int len)
{
unsigned long args[7];
+ int ret;
args[0] = (unsigned long) "write";
args[1] = 3;
args[2] = 1;
args[3] = (unsigned int) prom_stdout;
args[4] = (unsigned long) buf;
- args[5] = 1;
+ args[5] = (unsigned int) len;
args[6] = (unsigned long) -1;
p1275_cmd_direct(args);
- if (args[6] == 1)
- return 0;
- else
+ ret = (int) args[6];
+ if (ret < 0)
return -1;
+ return ret;
}
-/* Blocking version of put character routine above. */
-void prom_putchar(const char *buf)
+void prom_console_write_buf(const char *buf, int len)
{
- while (1) {
- int err = prom_nbputchar(buf);
- if (!err)
- break;
+ while (len) {
+ int n = __prom_console_write_buf(buf, len);
+ if (n < 0)
+ continue;
+ len -= n;
+ buf += len;
}
}
--- a/arch/sparc/prom/printf.c
+++ b/arch/sparc/prom/printf.c
@@ -15,23 +15,45 @@
#include <linux/kernel.h>
#include <linux/compiler.h>
+#include <linux/spinlock.h>
#include <asm/openprom.h>
#include <asm/oplib.h>
+#define CONSOLE_WRITE_BUF_SIZE 1024
+
static char ppbuf[1024];
+static char console_write_buf[CONSOLE_WRITE_BUF_SIZE];
+static DEFINE_RAW_SPINLOCK(console_write_lock);
void notrace prom_write(const char *buf, unsigned int n)
{
+ unsigned int dest_len;
+ unsigned long flags;
+ char *dest;
+
+ dest = console_write_buf;
+ raw_spin_lock_irqsave(&console_write_lock, flags);
+
+ dest_len = 0;
while (n-- != 0) {
- char ch = *buf;
+ char ch = *buf++;
if (ch == '\n') {
- char tmp = '\r';
- prom_putchar(&tmp);
+ *dest++ = '\r';
+ dest_len++;
+ }
+ *dest++ = ch;
+ dest_len++;
+ if (dest_len >= CONSOLE_WRITE_BUF_SIZE - 1) {
+ prom_console_write_buf(console_write_buf, dest_len);
+ dest = console_write_buf;
+ dest_len = 0;
}
- prom_putchar(buf);
- buf++;
}
+ if (dest_len)
+ prom_console_write_buf(console_write_buf, dest_len);
+
+ raw_spin_unlock_irqrestore(&console_write_lock, flags);
}
void notrace prom_printf(const char *fmt, ...)
^ permalink raw reply [flat|nested] 177+ messages in thread* [053/152] tcp: Dont change unlocked socket state in tcp_v4_err().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (51 preceding siblings ...)
2011-01-06 0:22 ` [052/152] sparc: Write to prom console using indirect buffer Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [054/152] tcp: Increase TCP_MAXSEG socket option minimum Greg KH
` (99 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, David S. Miller,
Damian Lukowski, Eric Dumazet
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 8f49c2703b33519aaaccc63f571b465b9d2b3a2d ]
Alexey Kuznetsov noticed a regression introduced by
commit f1ecd5d9e7366609d640ff4040304ea197fbc618
("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable")
The RTO and timer modification code added to tcp_v4_err()
doesn't check sock_owned_by_user(), which if true means we
don't have exclusive access to the socket and therefore cannot
modify it's critical state.
Just skip this new code block if sock_owned_by_user() is true
and eliminate the now superfluous sock_owned_by_user() code
block contained within.
Reported-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
CC: Damian Lukowski <damian@tvk.rwth-aachen.de>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp_ipv4.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -415,6 +415,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb
!icsk->icsk_backoff)
break;
+ if (sock_owned_by_user(sk))
+ break;
+
icsk->icsk_backoff--;
inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
icsk->icsk_backoff;
@@ -429,11 +432,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb
if (remaining) {
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
remaining, TCP_RTO_MAX);
- } else if (sock_owned_by_user(sk)) {
- /* RTO revert clocked out retransmission,
- * but socket is locked. Will defer. */
- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
- HZ/20, TCP_RTO_MAX);
} else {
/* RTO revert clocked out retransmission.
* Will retransmit now */
^ permalink raw reply [flat|nested] 177+ messages in thread* [054/152] tcp: Increase TCP_MAXSEG socket option minimum.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (52 preceding siblings ...)
2011-01-06 0:22 ` [053/152] tcp: Dont change unlocked socket state in tcp_v4_err() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [055/152] tcp: Make TCP_MAXSEG minimum more correct Greg KH
` (98 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2 ]
As noted by Steve Chen, since commit
f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS
requested by user") we can end up with a situation where
tcp_select_initial_window() does a divide by a zero (or
even negative) mss value.
The problem is that sometimes we effectively subtract
TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss.
Fix this by increasing the minimum from 8 to 64.
Reported-by: Steve Chen <schen@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock
/* Values greater than interface MTU won't take effect. However
* at the point when this call is done we typically don't yet
* know which interface is going to be used */
- if (val < 8 || val > MAX_TCP_WINDOW) {
+ if (val < 64 || val > MAX_TCP_WINDOW) {
err = -EINVAL;
break;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [055/152] tcp: Make TCP_MAXSEG minimum more correct.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (53 preceding siblings ...)
2011-01-06 0:22 ` [054/152] tcp: Increase TCP_MAXSEG socket option minimum Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [056/152] tcp: Bug fix in initialization of receive window Greg KH
` (97 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit c39508d6f118308355468314ff414644115a07f3 ]
Use TCP_MIN_MSS instead of constant 64.
Reported-by: Min Zhang <mzhang@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock
/* Values greater than interface MTU won't take effect. However
* at the point when this call is done we typically don't yet
* know which interface is going to be used */
- if (val < 64 || val > MAX_TCP_WINDOW) {
+ if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
err = -EINVAL;
break;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [056/152] tcp: Bug fix in initialization of receive window.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (54 preceding siblings ...)
2011-01-06 0:22 ` [055/152] tcp: Make TCP_MAXSEG minimum more correct Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [057/152] tcp: avoid a possible divide by zero Greg KH
` (96 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Nandita Dukkipati,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nandita Dukkipati <nanditad@google.com>
[ Upstream commit b1afde60f2b9ee8444fba4e012dc99a3b28d224d ]
The bug has to do with boundary checks on the initial receive window.
If the initial receive window falls between init_cwnd and the
receive window specified by the user, the initial window is incorrectly
brought down to init_cwnd. The correct behavior is to allow it to
remain unchanged.
Signed-off-by: Nandita Dukkipati <nanditad@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp_output.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -237,11 +237,10 @@ void tcp_select_initial_window(int __spa
/* when initializing use the value from init_rcv_wnd
* rather than the default from above
*/
- if (init_rcv_wnd &&
- (*rcv_wnd > init_rcv_wnd * mss))
- *rcv_wnd = init_rcv_wnd * mss;
- else if (*rcv_wnd > init_cwnd * mss)
- *rcv_wnd = init_cwnd * mss;
+ if (init_rcv_wnd)
+ *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+ else
+ *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
}
/* Set the clamp no higher than max representable value */
^ permalink raw reply [flat|nested] 177+ messages in thread* [057/152] tcp: avoid a possible divide by zero
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (55 preceding siblings ...)
2011-01-06 0:22 ` [056/152] tcp: Bug fix in initialization of receive window Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [058/152] tcp: protect sysctl_tcp_cookie_size reads Greg KH
` (95 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c ]
sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in
tcp_tso_should_defer(). Make sure we dont allow a divide by zero by
reading sysctl_tcp_tso_win_divisor exactly once.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp_output.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1518,6 +1518,7 @@ static int tcp_tso_should_defer(struct s
struct tcp_sock *tp = tcp_sk(sk);
const struct inet_connection_sock *icsk = inet_csk(sk);
u32 send_win, cong_win, limit, in_flight;
+ int win_divisor;
if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
goto send_now;
@@ -1549,13 +1550,14 @@ static int tcp_tso_should_defer(struct s
if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
goto send_now;
- if (sysctl_tcp_tso_win_divisor) {
+ win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
+ if (win_divisor) {
u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
/* If at least some fraction of a window is available,
* just use it.
*/
- chunk /= sysctl_tcp_tso_win_divisor;
+ chunk /= win_divisor;
if (limit >= chunk)
goto send_now;
} else {
^ permalink raw reply [flat|nested] 177+ messages in thread* [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (56 preceding siblings ...)
2011-01-06 0:22 ` [057/152] tcp: avoid a possible divide by zero Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-07 4:08 ` William Allen Simpson
2011-01-06 0:22 ` [059/152] 8139cp: fix checksum broken Greg KH
` (94 subsequent siblings)
152 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet, Ben Hutchings,
William Allen Simpson, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit f19872575ff7819a3723154657a497d9bca66b33 ]
Make sure sysctl_tcp_cookie_size is read once in
tcp_cookie_size_check(), or we might return an illegal value to caller
if sysctl_tcp_cookie_size is changed by another cpu.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Cc: William Allen Simpson <william.allen.simpson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp_output.c | 27 +++++++++++++++------------
1 file changed, 15 insertions(+), 12 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -391,27 +391,30 @@ struct tcp_out_options {
*/
static u8 tcp_cookie_size_check(u8 desired)
{
- if (desired > 0) {
+ int cookie_size;
+
+ if (desired > 0)
/* previously specified */
return desired;
- }
- if (sysctl_tcp_cookie_size <= 0) {
+
+ cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+ if (cookie_size <= 0)
/* no default specified */
return 0;
- }
- if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+
+ if (cookie_size <= TCP_COOKIE_MIN)
/* value too small, specify minimum */
return TCP_COOKIE_MIN;
- }
- if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+
+ if (cookie_size >= TCP_COOKIE_MAX)
/* value too large, specify maximum */
return TCP_COOKIE_MAX;
- }
- if (0x1 & sysctl_tcp_cookie_size) {
+
+ if (cookie_size & 1)
/* 8-bit multiple, illegal, fix it */
- return (u8)(sysctl_tcp_cookie_size + 0x1);
- }
- return (u8)sysctl_tcp_cookie_size;
+ cookie_size++;
+
+ return (u8)cookie_size;
}
/* Write previously computed TCP options to the packet.
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-06 0:22 ` [058/152] tcp: protect sysctl_tcp_cookie_size reads Greg KH
@ 2011-01-07 4:08 ` William Allen Simpson
2011-01-07 8:30 ` Eric Dumazet
0 siblings, 1 reply; 177+ messages in thread
From: William Allen Simpson @ 2011-01-07 4:08 UTC (permalink / raw)
To: Greg KH
Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan,
Eric Dumazet, Ben Hutchings, David S. Miller
Thank you for bringing this to my attention. There's been quite a few
changes in the 18 months since this function was originally written.
The overall purpose of the patch seems OK, although most of the patch
has nothing to do with the purported fix.
That is, somebody preferred to alter conditions and remove braces. Seems
harder to read to me! I'm surprised that this passed checkpatch.pl?
On 1/5/11 7:22 PM, Greg KH wrote:
> 2.6.36-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
>
>
> From: Eric Dumazet<eric.dumazet@gmail.com>
>
> [ Upstream commit f19872575ff7819a3723154657a497d9bca66b33 ]
>
> Make sure sysctl_tcp_cookie_size is read once in
> tcp_cookie_size_check(), or we might return an illegal value to caller
> if sysctl_tcp_cookie_size is changed by another cpu.
>
> Signed-off-by: Eric Dumazet<eric.dumazet@gmail.com>
> Cc: Ben Hutchings<bhutchings@solarflare.com>
> Cc: William Allen Simpson<william.allen.simpson@gmail.com>
> Signed-off-by: David S. Miller<davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman<gregkh@suse.de>
> ---
> net/ipv4/tcp_output.c | 27 +++++++++++++++------------
> 1 file changed, 15 insertions(+), 12 deletions(-)
>
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
> @@ -391,27 +391,30 @@ struct tcp_out_options {
> */
> static u8 tcp_cookie_size_check(u8 desired)
> {
> - if (desired> 0) {
> + int cookie_size;
> +
> + if (desired> 0)
> /* previously specified */
> return desired;
> - }
> - if (sysctl_tcp_cookie_size<= 0) {
> +
> + cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
> + if (cookie_size<= 0)
> /* no default specified */
> return 0;
> - }
> - if (sysctl_tcp_cookie_size<= TCP_COOKIE_MIN) {
> +
> + if (cookie_size<= TCP_COOKIE_MIN)
> /* value too small, specify minimum */
> return TCP_COOKIE_MIN;
> - }
> - if (sysctl_tcp_cookie_size>= TCP_COOKIE_MAX) {
> +
> + if (cookie_size>= TCP_COOKIE_MAX)
> /* value too large, specify maximum */
> return TCP_COOKIE_MAX;
> - }
> - if (0x1& sysctl_tcp_cookie_size) {
> +
> + if (cookie_size& 1)
> /* 8-bit multiple, illegal, fix it */
> - return (u8)(sysctl_tcp_cookie_size + 0x1);
> - }
> - return (u8)sysctl_tcp_cookie_size;
> + cookie_size++;
> +
> + return (u8)cookie_size;
> }
>
> /* Write previously computed TCP options to the packet.
>
>
>
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-07 4:08 ` William Allen Simpson
@ 2011-01-07 8:30 ` Eric Dumazet
2011-01-07 13:05 ` William Allen Simpson
0 siblings, 1 reply; 177+ messages in thread
From: Eric Dumazet @ 2011-01-07 8:30 UTC (permalink / raw)
To: William Allen Simpson
Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm,
alan, Ben Hutchings, David S. Miller
Le jeudi 06 janvier 2011 à 23:08 -0500, William Allen Simpson a écrit :
> Thank you for bringing this to my attention. There's been quite a few
> changes in the 18 months since this function was originally written.
>
> The overall purpose of the patch seems OK, although most of the patch
> has nothing to do with the purported fix.
>
> That is, somebody preferred to alter conditions and remove braces. Seems
> harder to read to me! I'm surprised that this passed checkpatch.pl?
>
Hi William, here is somebody talking to you.
This part of the code was exactly what you wrote, with no change.
http://patchwork.ozlabs.org/patch/40126/
Are you telling us somebody else added bug to your code ?
This is not the case, obviously.
After bug fix and cleanup code looks good, and even checkpatch.pl is
fine with it. No need for useless brackets around "return XXX;"
If I remember well, I did the cleanup so that my patch could not trigger
checkpatch.pl errors/warnings. Not that I am a particular checkpatch
fan, but I know some people are.
By the way, you were CCed when I sent one month ago the mail to
David/netdev. And no reaction from you at that time.
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-07 8:30 ` Eric Dumazet
@ 2011-01-07 13:05 ` William Allen Simpson
2011-01-07 13:25 ` Eric Dumazet
2011-01-07 13:36 ` Pekka Enberg
0 siblings, 2 replies; 177+ messages in thread
From: William Allen Simpson @ 2011-01-07 13:05 UTC (permalink / raw)
To: Eric Dumazet
Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm,
alan, Ben Hutchings, David S. Miller
On 1/7/11 3:30 AM, Eric Dumazet wrote:
> Are you telling us somebody else added bug to your code ?
> This is not the case, obviously.
>
As I noted, "There's been quite a few changes" -- one of which was a major
change to sysctls. As one of the reviewers of this code, you didn't mention
this ACCESS_ONCE() function, so I'm assuming it didn't exist at that time.
> After bug fix and cleanup code
As I noted, "most of the patch has nothing to do with the purported fix."
That makes the patch hard to read and evaluate.
Moreover, I remember being castigated (by you and others) for combining bug
fixes with cleanup code. And I'm not sure this counts as "cleanup" code.
> looks good,
As the saying goes, beauty is in the eye of the beholder. Trading a blank
line for a trailing brace is neither here nor there. Screen space used
remains the same.
> and even checkpatch.pl is
> fine with it. No need for useless brackets around "return XXX;"
My instructors would have flunked me for not including braces around
multi-line sequences; it was one of the great no-no's of the '70s. Perhaps
that's not the case anymore with modern colorful visual syntax checkers?
> If I remember well, I did the cleanup so that my patch could not trigger
> checkpatch.pl errors/warnings. Not that I am a particular checkpatch
> fan, but I know some people are.
>
As a relative Linux kernel newbie, I scrupulously followed patch
instructions. Those instructions mandated running checkpatch.
If there are now "checkpatch.pl errors/warnings" on that code, checkpatch
must have changed. At the time, all multi-line sequences were required to
be enclosed in braces.
I still think that's a better idea, looks better, and makes maintenance
easier in the long term. YMMV.
> By the way, you were CCed when I sent one month ago the mail to
> David/netdev. And no reaction from you at that time.
>
Amazingly enough, my life is not centered around Linux on a day-to-day
basis. Young folks like you are trying to make a name for yourselves in
the Linux world -- apparently, by being exceptionally abrasive.
Your helpful comments are/were appreciated.
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-07 13:05 ` William Allen Simpson
@ 2011-01-07 13:25 ` Eric Dumazet
2011-01-07 13:36 ` Pekka Enberg
1 sibling, 0 replies; 177+ messages in thread
From: Eric Dumazet @ 2011-01-07 13:25 UTC (permalink / raw)
To: William Allen Simpson
Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm,
alan, Ben Hutchings, David S. Miller
Le vendredi 07 janvier 2011 à 08:05 -0500, William Allen Simpson a
écrit :
> Your helpful comments are/were appreciated.
You are very welcome.
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-07 13:05 ` William Allen Simpson
2011-01-07 13:25 ` Eric Dumazet
@ 2011-01-07 13:36 ` Pekka Enberg
2011-01-08 11:58 ` William Allen Simpson
1 sibling, 1 reply; 177+ messages in thread
From: Pekka Enberg @ 2011-01-07 13:36 UTC (permalink / raw)
To: William Allen Simpson
Cc: Eric Dumazet, Greg KH, linux-kernel, stable, stable-review,
torvalds, akpm, alan, Ben Hutchings, David S. Miller
Hi William,
On Fri, Jan 7, 2011 at 3:05 PM, William Allen Simpson
<william.allen.simpson@gmail.com> wrote:
> My instructors would have flunked me for not including braces around
> multi-line sequences; it was one of the great no-no's of the '70s. Perhaps
> that's not the case anymore with modern colorful visual syntax checkers?
That's because your instructors hadn't read Documentation/CodingStyle
which didn't appear until the '90s.
Pekka
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-07 13:36 ` Pekka Enberg
@ 2011-01-08 11:58 ` William Allen Simpson
2011-01-08 12:57 ` William Allen Simpson
0 siblings, 1 reply; 177+ messages in thread
From: William Allen Simpson @ 2011-01-08 11:58 UTC (permalink / raw)
To: Pekka Enberg
Cc: Eric Dumazet, Greg KH, linux-kernel, stable, stable-review,
torvalds, akpm, alan, Ben Hutchings, David S. Miller
[-- Attachment #1: Type: text/plain, Size: 1170 bytes --]
On 1/7/11 8:36 AM, Pekka Enberg wrote:
> On Fri, Jan 7, 2011 at 3:05 PM, William Allen Simpson
> <william.allen.simpson@gmail.com> wrote:
>> My instructors would have flunked me for not including braces around
>> multi-line sequences; it was one of the great no-no's of the '70s. Perhaps
>> that's not the case anymore with modern colorful visual syntax checkers?
>
> That's because your instructors hadn't read Documentation/CodingStyle
> which didn't appear until the '90s.
>
Hi, Pekka.
OTOH, I *have* read Documentation/CodingStyle a cople year back, and then
re-checked it again today.... Out of curiosity, as I haven't done a Linux
patch in many months, I cloned linux-2.6 and checked out v2.6.36-rc8 (I don't
know where 2.6.36-stable is kept).
Note this patch is cleaner and more readable; lines that are changed have
one-to-one correspondence.
Eric was *not* *truthful* saying there were "checkpatch.pl errors/warnings" in
my code.
===
scripts/checkpatch.pl ~/sysctl_tcp_cookie_size-read-once.patch
total: 0 errors, 0 warnings, 36 lines checked
/home/test/sysctl_tcp_cookie_size-read-once.patch has no obvious style
problems and is ready for submission.
[-- Attachment #2: sysctl_tcp_cookie_size-read-once.patch --]
[-- Type: text/plain, Size: 1629 bytes --]
>From bd6f04cbee4c924e07cf3a1819a24acc3cc2490b Mon Sep 17 00:00:00 2001
From: William Allen Simpson <william.allen.simpson@gmail.com>
Date: Sat, 8 Jan 2011 05:58:21 -0500
Subject: [PATCH] sysctl_tcp_cookie_size read once
Read sysctl_tcp_cookie_size only once in tcp_cookie_size_check(),
as it might be concurrently changed by another cpu.
Signed-off-by: William.Allen.Simpson@gmail.com
---
net/ipv4/tcp_output.c | 15 +++++++++------
1 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index de3bd84..49be4e3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -392,27 +392,30 @@ struct tcp_out_options {
*/
static u8 tcp_cookie_size_check(u8 desired)
{
+ int cookie_size;
+
if (desired > 0) {
/* previously specified */
return desired;
}
- if (sysctl_tcp_cookie_size <= 0) {
+ cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+ if (cookie_size <= 0) {
/* no default specified */
return 0;
}
- if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+ if (cookie_size <= TCP_COOKIE_MIN) {
/* value too small, specify minimum */
return TCP_COOKIE_MIN;
}
- if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+ if (cookie_size >= TCP_COOKIE_MAX) {
/* value too large, specify maximum */
return TCP_COOKIE_MAX;
}
- if (0x1 & sysctl_tcp_cookie_size) {
+ if (cookie_size & 0x1) {
/* 8-bit multiple, illegal, fix it */
- return (u8)(sysctl_tcp_cookie_size + 0x1);
+ cookie_size += 0x1;
}
- return (u8)sysctl_tcp_cookie_size;
+ return (u8)cookie_size;
}
/* Write previously computed TCP options to the packet.
--
1.7.1
^ permalink raw reply related [flat|nested] 177+ messages in thread* Re: [058/152] tcp: protect sysctl_tcp_cookie_size reads
2011-01-08 11:58 ` William Allen Simpson
@ 2011-01-08 12:57 ` William Allen Simpson
0 siblings, 0 replies; 177+ messages in thread
From: William Allen Simpson @ 2011-01-08 12:57 UTC (permalink / raw)
To: Pekka Enberg
Cc: Eric Dumazet, Greg KH, linux-kernel, stable, stable-review,
torvalds, akpm, alan, Ben Hutchings, David S. Miller
[-- Attachment #1: Type: text/plain, Size: 633 bytes --]
On 1/8/11 6:58 AM, William Allen Simpson wrote:
> Eric was *not* *truthful* saying there were "checkpatch.pl errors/warnings" in
> my code.
>
I've received a private email complaining that I've not properly attributed
the origin of the patch. Given a person has already lied to me about this,
I'm not sure. When it comes to personal integrity, it's "one strike and
you're out"!
Since Eric had previously reviewed the original code, surely any such error
would have been found by him at that time. Perhaps he made a mistake?
However, I'm happy to add a Reported-by line. If this is an error, hopefully
somebody will correct it.
[-- Attachment #2: sysctl_tcp_cookie_size-read-once.patch --]
[-- Type: text/plain, Size: 1680 bytes --]
>From bd6f04cbee4c924e07cf3a1819a24acc3cc2490b Mon Sep 17 00:00:00 2001
From: William Allen Simpson <william.allen.simpson@gmail.com>
Date: Sat, 8 Jan 2011 05:58:21 -0500
Subject: [PATCH] sysctl_tcp_cookie_size read once
Read sysctl_tcp_cookie_size only once in tcp_cookie_size_check(),
as it might be concurrently changed by another cpu.
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: William.Allen.Simpson@gmail.com
---
net/ipv4/tcp_output.c | 15 +++++++++------
1 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index de3bd84..49be4e3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -392,27 +392,30 @@ struct tcp_out_options {
*/
static u8 tcp_cookie_size_check(u8 desired)
{
+ int cookie_size;
+
if (desired > 0) {
/* previously specified */
return desired;
}
- if (sysctl_tcp_cookie_size <= 0) {
+ cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+ if (cookie_size <= 0) {
/* no default specified */
return 0;
}
- if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+ if (cookie_size <= TCP_COOKIE_MIN) {
/* value too small, specify minimum */
return TCP_COOKIE_MIN;
}
- if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+ if (cookie_size >= TCP_COOKIE_MAX) {
/* value too large, specify maximum */
return TCP_COOKIE_MAX;
}
- if (0x1 & sysctl_tcp_cookie_size) {
+ if (cookie_size & 0x1) {
/* 8-bit multiple, illegal, fix it */
- return (u8)(sysctl_tcp_cookie_size + 0x1);
+ cookie_size += 0x1;
}
- return (u8)sysctl_tcp_cookie_size;
+ return (u8)cookie_size;
}
/* Write previously computed TCP options to the packet.
--
1.7.1
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [059/152] 8139cp: fix checksum broken
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (57 preceding siblings ...)
2011-01-06 0:22 ` [058/152] tcp: protect sysctl_tcp_cookie_size reads Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [060/152] r8169: fix sleeping while holding spinlock Greg KH
` (93 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Shan Wei, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Shan Wei <shanwei@cn.fujitsu.com>
[ Upstream commit 24b7ea9f6c9787fad885442ed0cc010f1aa69cca ]
I am not family with RealTek RTL-8139C+ series 10/100 PCI Ethernet driver.
I try to guess the meaning of RxProtoIP and IPFail.
RxProtoIP stands for received IPv4 packet that upper protocol is not tcp and udp.
!(status & IPFail) is true means that driver correctly to check checksum in IPv4 header.
If these are right, driver will set ip_summed with CHECKSUM_UNNECESSARY for other
upper protocol, e.g. sctp, igmp protocol. This will cause protocol stack ignores
checksum check for packets with invalid checksum.
This patch is only compile-test.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/8139cp.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok
{
unsigned int protocol = (status >> 16) & 0x3;
- if (likely((protocol == RxProtoTCP) && (!(status & TCPFail))))
+ if (((protocol == RxProtoTCP) && !(status & TCPFail)) ||
+ ((protocol == RxProtoUDP) && !(status & UDPFail)))
return 1;
- else if ((protocol == RxProtoUDP) && (!(status & UDPFail)))
- return 1;
- else if ((protocol == RxProtoIP) && (!(status & IPFail)))
- return 1;
- return 0;
+ else
+ return 0;
}
static int cp_rx_poll(struct napi_struct *napi, int budget)
^ permalink raw reply [flat|nested] 177+ messages in thread* [060/152] r8169: fix sleeping while holding spinlock.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (58 preceding siblings ...)
2011-01-06 0:22 ` [059/152] 8139cp: fix checksum broken Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [061/152] af_unix: limit unix_tot_inflight Greg KH
` (92 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel J Blueman,
Rafael J. Wysocki, Andrew Hendry, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1016 bytes --]
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: françois romieu <romieu@fr.zoreil.com>
[ Upstream commit ea80907ff066edd1dd43c5fe90ae6677d15e6384 ]
As device_set_wakeup_enable can now sleep, move the call to outside
the critical section.
Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/r8169.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -855,10 +855,10 @@ static int rtl8169_set_wol(struct net_de
else
tp->features &= ~RTL_FEATURE_WOL;
__rtl8169_set_wol(tp, wol->wolopts);
- device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
-
spin_unlock_irq(&tp->lock);
+ device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
+
return 0;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [061/152] af_unix: limit unix_tot_inflight
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (59 preceding siblings ...)
2011-01-06 0:22 ` [060/152] r8169: fix sleeping while holding spinlock Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [062/152] af_unix: limit recursion level Greg KH
` (91 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit 9915672d41273f5b77f1b3c29b391ffb7732b84b ]
Vegard Nossum found a unix socket OOM was possible, posting an exploit
program.
My analysis is we can eat all LOWMEM memory before unix_gc() being
called from unix_release_sock(). Moreover, the thread blocked in
unix_gc() can consume huge amount of time to perform cleanup because of
huge working set.
One way to handle this is to have a sensible limit on unix_tot_inflight,
tested from wait_for_unix_gc() and to force a call to unix_gc() if this
limit is hit.
This solves the OOM and also reduce overall latencies, and should not
slowdown normal workloads.
Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/unix/garbage.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struc
}
static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
void wait_for_unix_gc(void)
{
+ /*
+ * If number of inflight sockets is insane,
+ * force a garbage collect right now.
+ */
+ if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+ unix_gc();
wait_event(unix_gc_wait, gc_in_progress == false);
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [062/152] af_unix: limit recursion level
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (60 preceding siblings ...)
2011-01-06 0:22 ` [061/152] af_unix: limit unix_tot_inflight Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [063/152] net: ax25: fix information leak to userland Greg KH
` (90 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 5138 bytes --]
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit 25888e30319f8896fc656fc68643e6a078263060 ]
Its easy to eat all kernel memory and trigger NMI watchdog, using an
exploit program that queues unix sockets on top of others.
lkml ref : http://lkml.org/lkml/2010/11/25/8
This mechanism is used in applications, one choice we have is to have a
recursion limit.
Other limits might be needed as well (if we queue other types of files),
since the passfd mechanism is currently limited by socket receive queue
sizes only.
Add a recursion_level to unix socket, allowing up to 4 levels.
Each time we send an unix socket through sendfd mechanism, we copy its
recursion level (plus one) to receiver. This recursion level is cleared
when socket receive queue is emptied.
Reported-by: Марк Коренберг <socketpair@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/net/af_unix.h | 2 ++
net/unix/af_unix.c | 37 ++++++++++++++++++++++++++++++++-----
net/unix/garbage.c | 2 +-
3 files changed, 35 insertions(+), 6 deletions(-)
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *f
extern void unix_notinflight(struct file *fp);
extern void unix_gc(void);
extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
#define UNIX_HASH_SIZE 256
@@ -56,6 +57,7 @@ struct unix_sock {
spinlock_t lock;
unsigned int gc_candidate : 1;
unsigned int gc_maybe_cycle : 1;
+ unsigned char recursion_level;
struct socket_wq peer_wq;
};
#define unix_sk(__sk) ((struct unix_sock *)__sk)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_
sock_wfree(skb);
}
+#define MAX_RECURSION_LEVEL 4
+
static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
{
int i;
+ unsigned char max_level = 0;
+ int unix_sock_count = 0;
+
+ for (i = scm->fp->count - 1; i >= 0; i--) {
+ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+ if (sk) {
+ unix_sock_count++;
+ max_level = max(max_level,
+ unix_sk(sk)->recursion_level);
+ }
+ }
+ if (unlikely(max_level > MAX_RECURSION_LEVEL))
+ return -ETOOMANYREFS;
/*
* Need to duplicate file references for the sake of garbage
@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_co
if (!UNIXCB(skb).fp)
return -ENOMEM;
- for (i = scm->fp->count-1; i >= 0; i--)
- unix_inflight(scm->fp->fp[i]);
- return 0;
+ if (unix_sock_count) {
+ for (i = scm->fp->count - 1; i >= 0; i--)
+ unix_inflight(scm->fp->fp[i]);
+ }
+ return max_level;
}
static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kio
struct sk_buff *skb;
long timeo;
struct scm_cookie tmp_scm;
+ int max_level;
if (NULL == siocb->scm)
siocb->scm = &tmp_scm;
@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kio
goto out;
err = unix_scm_to_skb(siocb->scm, skb, true);
- if (err)
+ if (err < 0)
goto out_free;
+ max_level = err + 1;
unix_get_secdata(siocb->scm, skb);
skb_reset_transport_header(skb);
@@ -1512,6 +1532,8 @@ restart:
}
skb_queue_tail(&other->sk_receive_queue, skb);
+ if (max_level > unix_sk(other)->recursion_level)
+ unix_sk(other)->recursion_level = max_level;
unix_state_unlock(other);
other->sk_data_ready(other, len);
sock_put(other);
@@ -1542,6 +1564,7 @@ static int unix_stream_sendmsg(struct ki
int sent = 0;
struct scm_cookie tmp_scm;
bool fds_sent = false;
+ int max_level;
if (NULL == siocb->scm)
siocb->scm = &tmp_scm;
@@ -1605,10 +1628,11 @@ static int unix_stream_sendmsg(struct ki
/* Only send the fds in the first buffer */
err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
- if (err) {
+ if (err < 0) {
kfree_skb(skb);
goto out_err;
}
+ max_level = err + 1;
fds_sent = true;
err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1624,6 +1648,8 @@ static int unix_stream_sendmsg(struct ki
goto pipe_err_free;
skb_queue_tail(&other->sk_receive_queue, skb);
+ if (max_level > unix_sk(other)->recursion_level)
+ unix_sk(other)->recursion_level = max_level;
unix_state_unlock(other);
other->sk_data_ready(other, size);
sent += size;
@@ -1840,6 +1866,7 @@ static int unix_stream_recvmsg(struct ki
unix_state_lock(sk);
skb = skb_dequeue(&sk->sk_receive_queue);
if (skb == NULL) {
+ unix_sk(sk)->recursion_level = 0;
if (copied >= target)
goto unlock;
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_w
unsigned int unix_tot_inflight;
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
{
struct sock *u_sock = NULL;
struct inode *inode = filp->f_path.dentry->d_inode;
^ permalink raw reply [flat|nested] 177+ messages in thread* [063/152] net: ax25: fix information leak to userland
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (61 preceding siblings ...)
2011-01-06 0:22 ` [062/152] af_unix: limit recursion level Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug Greg KH
` (89 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vasiliy Kulikov,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vasiliy Kulikov <segooon@gmail.com>
[ Upstream commit fe10ae53384e48c51996941b7720ee16995cbcb7 ]
Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
field of fsa struct, also the struct has padding bytes between
sax25_call and sax25_ndigis fields. This structure is then copied to
userland. It leads to leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ax25/af_ax25.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *s
ax25_cb *ax25;
int err = 0;
+ memset(fsa, 0, sizeof(fsa));
lock_sock(sk);
ax25 = ax25_sk(sk);
@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *s
fsa->fsa_ax25.sax25_family = AF_AX25;
fsa->fsa_ax25.sax25_call = ax25->dest_addr;
- fsa->fsa_ax25.sax25_ndigis = 0;
if (ax25->digipeat != NULL) {
ndigi = ax25->digipeat->ndigi;
^ permalink raw reply [flat|nested] 177+ messages in thread* [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (62 preceding siblings ...)
2011-01-06 0:22 ` [063/152] net: ax25: fix information leak to userland Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 5:29 ` Sathya.Perla
2011-01-07 19:39 ` [stable] " Paul Gortmaker
2011-01-06 0:22 ` [065/152] bonding: Fix slave selection bug Greg KH
` (88 subsequent siblings)
152 siblings, 2 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Sathya Perla,
Subbu Seetharaman, Sarveshwar Bandi, Ajit Khaparde, Joe Jin,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joe Jin <joe.jin@oracle.com>
[ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ]
Regarding benet be_cmd_multicast_set() function, now using
netdev_for_each_mc_addr() helper for mac address copy, but
when copying to req->mac[] did not increase of the index.
Cc: Sathya Perla <sathyap@serverengines.com>
Cc: Subbu Seetharaman <subbus@serverengines.com>
Cc: Sarveshwar Bandi <sarveshwarb@serverengines.com>
Cc: Ajit Khaparde <ajitk@serverengines.com>
Signed-off-by: Joe Jin <joe.jin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/benet/be_cmds.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapt
i = 0;
netdev_for_each_mc_addr(ha, netdev)
- memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+ memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
} else {
req->promiscuous = 1;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* RE: [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug
2011-01-06 0:22 ` [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug Greg KH
@ 2011-01-06 5:29 ` Sathya.Perla
2011-01-07 19:39 ` [stable] " Paul Gortmaker
1 sibling, 0 replies; 177+ messages in thread
From: Sathya.Perla @ 2011-01-06 5:29 UTC (permalink / raw)
To: gregkh, linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, subbu.seetharaman,
Sarveshwar.Bandi, Ajit.Khaparde, joe.jin, davem
The patch below is fine. Thanks.
-Sathya
-----Original Message-----
From: Greg KH [mailto:gregkh@suse.de]
Sent: Thursday, January 06, 2011 5:53 AM
To: linux-kernel@vger.kernel.org; stable@kernel.org
Cc: stable-review@kernel.org; torvalds@linux-foundation.org; akpm@linux-foundation.org; alan@lxorguk.ukuu.org.uk; Perla, Sathya; Seetharaman, Subramanian; Bandi, Sarveshwar; Khaparde, Ajit; Joe Jin; David S. Miller
Subject: [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joe Jin <joe.jin@oracle.com>
[ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ]
Regarding benet be_cmd_multicast_set() function, now using
netdev_for_each_mc_addr() helper for mac address copy, but
when copying to req->mac[] did not increase of the index.
Cc: Sathya Perla <sathyap@serverengines.com>
Cc: Subbu Seetharaman <subbus@serverengines.com>
Cc: Sarveshwar Bandi <sarveshwarb@serverengines.com>
Cc: Ajit Khaparde <ajitk@serverengines.com>
Signed-off-by: Joe Jin <joe.jin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/benet/be_cmds.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapt
i = 0;
netdev_for_each_mc_addr(ha, netdev)
- memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+ memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
} else {
req->promiscuous = 1;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [stable] [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug
2011-01-06 0:22 ` [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug Greg KH
2011-01-06 5:29 ` Sathya.Perla
@ 2011-01-07 19:39 ` Paul Gortmaker
2011-01-07 21:24 ` Greg KH
1 sibling, 1 reply; 177+ messages in thread
From: Paul Gortmaker @ 2011-01-07 19:39 UTC (permalink / raw)
To: Greg KH
Cc: linux-kernel, stable, Sathya Perla, Ajit Khaparde,
David S. Miller, Joe Jin, Subbu Seetharaman, Sarveshwar Bandi,
akpm, torvalds, stable-review, alan
[[stable] [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug] On 05/01/2011 (Wed 16:22) Greg KH wrote:
> 2.6.36-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
>
>
> From: Joe Jin <joe.jin@oracle.com>
>
> [ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ]
This one should be 408cc293c29ada769ae772420a39961320da1854.
Figured I'd run reviewbot on the others and check for valid IDs.
There are a couple others that have the same issue:
0066
bridge-fix-IPv6-queries-for-bridge-multicast-snoopin.patch
should be 76d661586c8131453ba75a2e027c1f21511a893a
0072
l2tp-Fix-modalias-of-l2tp_ip.patch
should be e8d34a884e4ff118920bb57664def8a73b1b784f
0073
x25-decrement-netdev-reference-counts-on-unload.patch
should be 171995e5d82dcc92bea37a7d2a2ecc21068a0f19
0076
net-Fix-header-size-check-for-GSO-case-in-recvmsg-af.patch
should be 1f18b7176e2e41fada24584ce3c80e9abfaca52b
Thanks,
Paul.
>
> Regarding benet be_cmd_multicast_set() function, now using
> netdev_for_each_mc_addr() helper for mac address copy, but
> when copying to req->mac[] did not increase of the index.
>
> Cc: Sathya Perla <sathyap@serverengines.com>
> Cc: Subbu Seetharaman <subbus@serverengines.com>
> Cc: Sarveshwar Bandi <sarveshwarb@serverengines.com>
> Cc: Ajit Khaparde <ajitk@serverengines.com>
> Signed-off-by: Joe Jin <joe.jin@oracle.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
> drivers/net/benet/be_cmds.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/net/benet/be_cmds.c
> +++ b/drivers/net/benet/be_cmds.c
> @@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapt
>
> i = 0;
> netdev_for_each_mc_addr(ha, netdev)
> - memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
> + memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
> } else {
> req->promiscuous = 1;
> }
>
>
> _______________________________________________
> stable mailing list
> stable@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/stable
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [stable] [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug
2011-01-07 19:39 ` [stable] " Paul Gortmaker
@ 2011-01-07 21:24 ` Greg KH
0 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-07 21:24 UTC (permalink / raw)
To: Paul Gortmaker
Cc: linux-kernel, stable, Sathya Perla, Ajit Khaparde,
David S. Miller, Joe Jin, Subbu Seetharaman, Sarveshwar Bandi,
akpm, torvalds, stable-review, alan
On Fri, Jan 07, 2011 at 02:39:07PM -0500, Paul Gortmaker wrote:
> [[stable] [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug] On 05/01/2011 (Wed 16:22) Greg KH wrote:
>
> > 2.6.36-stable review patch. If anyone has any objections, please let us know.
> >
> > ------------------
> >
> >
> > From: Joe Jin <joe.jin@oracle.com>
> >
> > [ Upstream commit 3fd40d0ceac9c234243730f4d7a6ffdb2fd3023a ]
>
> This one should be 408cc293c29ada769ae772420a39961320da1854.
>
> Figured I'd run reviewbot on the others and check for valid IDs.
> There are a couple others that have the same issue:
>
> 0066
> bridge-fix-IPv6-queries-for-bridge-multicast-snoopin.patch
> should be 76d661586c8131453ba75a2e027c1f21511a893a
>
> 0072
> l2tp-Fix-modalias-of-l2tp_ip.patch
> should be e8d34a884e4ff118920bb57664def8a73b1b784f
>
> 0073
> x25-decrement-netdev-reference-counts-on-unload.patch
> should be 171995e5d82dcc92bea37a7d2a2ecc21068a0f19
>
> 0076
> net-Fix-header-size-check-for-GSO-case-in-recvmsg-af.patch
> should be 1f18b7176e2e41fada24584ce3c80e9abfaca52b
Thanks, I'll go fix them up.
David, looks like something broke in your scripts :(
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* [065/152] bonding: Fix slave selection bug.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (63 preceding siblings ...)
2011-01-06 0:22 ` [064/152] driver/net/benet: fix be_cmd_multicast_set() memcpy bug Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [066/152] bridge: fix IPv6 queries for bridge multicast snooping Greg KH
` (87 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Hillf Danton,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Hillf Danton <dhillf@gmail.com>
[ Upstream commit af3e5bd5f650163c2e12297f572910a1af1b8236 ]
The returned slave is incorrect, if the net device under check is not
charged yet by the master.
Signed-off-by: Hillf Danton <dhillf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/bonding/bonding.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -240,11 +240,11 @@ static inline struct slave *bond_get_sla
bond_for_each_slave(bond, slave, i) {
if (slave->dev == slave_dev) {
- break;
+ return slave;
}
}
- return slave;
+ return 0;
}
static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
^ permalink raw reply [flat|nested] 177+ messages in thread* [066/152] bridge: fix IPv6 queries for bridge multicast snooping
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (64 preceding siblings ...)
2011-01-06 0:22 ` [065/152] bonding: Fix slave selection bug Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [067/152] cls_cgroup: Fix crash on module unload Greg KH
` (86 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, David L Stevens, Herbert Xu,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Stevens <dlstevens@us.ibm.com>
[ Upstream commit 04bdf0c9a451863e50fff627713a900a2cabb998 ]
This patch fixes a missing ntohs() for bridge IPv6 multicast snooping.
Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/bridge/br_multicast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -437,7 +437,7 @@ static struct sk_buff *br_ip6_multicast_
ip6h = ipv6_hdr(skb);
*(__force __be32 *)ip6h = htonl(0x60000000);
- ip6h->payload_len = 8 + sizeof(*mldq);
+ ip6h->payload_len = htons(8 + sizeof(*mldq));
ip6h->nexthdr = IPPROTO_HOPOPTS;
ip6h->hop_limit = 1;
ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
^ permalink raw reply [flat|nested] 177+ messages in thread* [067/152] cls_cgroup: Fix crash on module unload
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (65 preceding siblings ...)
2011-01-06 0:22 ` [066/152] bridge: fix IPv6 queries for bridge multicast snooping Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [068/152] filter: fix sk_filter rcu handling Greg KH
` (85 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Herbert Xu, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit c00b2c9e79466d61979cd21af526cc6d5d0ee04f ]
Somewhere along the lines net_cls_subsys_id became a macro when
cls_cgroup is built as a module. Not only did it make cls_cgroup
completely useless, it also causes it to crash on module unload.
This patch fixes this by removing that macro.
Thanks to Eric Dumazet for diagnosing this problem.
Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/sched/cls_cgroup.c | 2 --
1 file changed, 2 deletions(-)
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -34,8 +34,6 @@ struct cgroup_subsys net_cls_subsys = {
.populate = cgrp_populate,
#ifdef CONFIG_NET_CLS_CGROUP
.subsys_id = net_cls_subsys_id,
-#else
-#define net_cls_subsys_id net_cls_subsys.subsys_id
#endif
.module = THIS_MODULE,
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [068/152] filter: fix sk_filter rcu handling
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (66 preceding siblings ...)
2011-01-06 0:22 ` [067/152] cls_cgroup: Fix crash on module unload Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR Greg KH
` (84 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 ]
Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and
sk_clone() in commit 47e958eac280c263397
Problem is we can have several clones sharing a common sk_filter, and
these clones might want to sk_filter_attach() their own filters at the
same time, and can overwrite old_filter->rcu, corrupting RCU queues.
We can not use filter->rcu without being sure no other thread could do
the same thing.
Switch code to a more conventional ref-counting technique : Do the
atomic decrement immediately and queue one rcu call back when last
reference is released.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/net/sock.h | 4 +++-
net/core/filter.c | 19 ++++++-------------
2 files changed, 9 insertions(+), 14 deletions(-)
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1155,6 +1155,8 @@ extern void sk_common_release(struct soc
/* Initialise core socket variables */
extern void sock_init_data(struct socket *sock, struct sock *sk);
+extern void sk_filter_release_rcu(struct rcu_head *rcu);
+
/**
* sk_filter_release - release a socket filter
* @fp: filter to remove
@@ -1165,7 +1167,7 @@ extern void sock_init_data(struct socket
static inline void sk_filter_release(struct sk_filter *fp)
{
if (atomic_dec_and_test(&fp->refcnt))
- kfree(fp);
+ call_rcu_bh(&fp->rcu, sk_filter_release_rcu);
}
static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *fi
EXPORT_SYMBOL(sk_chk_filter);
/**
- * sk_filter_rcu_release: Release a socket filter by rcu_head
+ * sk_filter_release_rcu - Release a socket filter by rcu_head
* @rcu: rcu_head that contains the sk_filter to free
*/
-static void sk_filter_rcu_release(struct rcu_head *rcu)
+void sk_filter_release_rcu(struct rcu_head *rcu)
{
struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
- sk_filter_release(fp);
-}
-
-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
-{
- unsigned int size = sk_filter_len(fp);
-
- atomic_sub(size, &sk->sk_omem_alloc);
- call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+ kfree(fp);
}
+EXPORT_SYMBOL(sk_filter_release_rcu);
/**
* sk_attach_filter - attach a socket filter
@@ -650,7 +643,7 @@ int sk_attach_filter(struct sock_fprog *
rcu_read_unlock_bh();
if (old_fp)
- sk_filter_delayed_uncharge(sk, old_fp);
+ sk_filter_uncharge(sk, old_fp);
return 0;
}
EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -664,7 +657,7 @@ int sk_detach_filter(struct sock *sk)
filter = rcu_dereference_bh(sk->sk_filter);
if (filter) {
rcu_assign_pointer(sk->sk_filter, NULL);
- sk_filter_delayed_uncharge(sk, filter);
+ sk_filter_uncharge(sk, filter);
ret = 0;
}
rcu_read_unlock_bh();
^ permalink raw reply [flat|nested] 177+ messages in thread* [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (67 preceding siblings ...)
2011-01-06 0:22 ` [068/152] filter: fix sk_filter rcu handling Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-07 19:10 ` [stable] " Paul Gortmaker
2011-01-06 0:22 ` [070/152] econet: Fix crash in aun_incoming() Greg KH
` (83 subsequent siblings)
152 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Nelson Elhage,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nelson Elhage <nelhage@ksplice.com>
[ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ]
We need to drop the mutex and do a dev_put, so set an error code and break like
the other paths, instead of returning directly.
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/econet/af_econet.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -661,8 +661,10 @@ static int ec_dev_ioctl(struct socket *s
err = 0;
switch (cmd) {
case SIOCSIFADDR:
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
+ if (!capable(CAP_NET_ADMIN)) {
+ err = -EPERM;
+ break;
+ }
edev = dev->ec_ptr;
if (edev == NULL) {
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.
2011-01-06 0:22 ` [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR Greg KH
@ 2011-01-07 19:10 ` Paul Gortmaker
2011-01-07 19:19 ` Greg KH
0 siblings, 1 reply; 177+ messages in thread
From: Paul Gortmaker @ 2011-01-07 19:10 UTC (permalink / raw)
To: Greg KH
Cc: linux-kernel, stable, Nelson Elhage, David S. Miller, akpm,
torvalds, stable-review, alan
[[stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.] On 05/01/2011 (Wed 16:22) Greg KH wrote:
> 2.6.36-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
>
>
> From: Nelson Elhage <nelhage@ksplice.com>
>
> [ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ]
I think the upstream # got mangled somehow. Looking at the tree, I
think the upstream is 0c62fc6dd02c8d793c75ae76a9b6881fc36388ad.
The ID listed currently gives me a "bad object".
Thanks,
Paul.
>
> We need to drop the mutex and do a dev_put, so set an error code and break like
> the other paths, instead of returning directly.
>
> Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
> net/econet/af_econet.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> --- a/net/econet/af_econet.c
> +++ b/net/econet/af_econet.c
> @@ -661,8 +661,10 @@ static int ec_dev_ioctl(struct socket *s
> err = 0;
> switch (cmd) {
> case SIOCSIFADDR:
> - if (!capable(CAP_NET_ADMIN))
> - return -EPERM;
> + if (!capable(CAP_NET_ADMIN)) {
> + err = -EPERM;
> + break;
> + }
>
> edev = dev->ec_ptr;
> if (edev == NULL) {
>
>
> _______________________________________________
> stable mailing list
> stable@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/stable
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.
2011-01-07 19:10 ` [stable] " Paul Gortmaker
@ 2011-01-07 19:19 ` Greg KH
2011-01-08 1:33 ` David Miller
0 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-07 19:19 UTC (permalink / raw)
To: Paul Gortmaker
Cc: linux-kernel, stable, Nelson Elhage, David S. Miller, akpm,
torvalds, stable-review, alan
On Fri, Jan 07, 2011 at 02:10:36PM -0500, Paul Gortmaker wrote:
> [[stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.] On 05/01/2011 (Wed 16:22) Greg KH wrote:
>
> > 2.6.36-stable review patch. If anyone has any objections, please let us know.
> >
> > ------------------
> >
> >
> > From: Nelson Elhage <nelhage@ksplice.com>
> >
> > [ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ]
>
> I think the upstream # got mangled somehow. Looking at the tree, I
> think the upstream is 0c62fc6dd02c8d793c75ae76a9b6881fc36388ad.
>
> The ID listed currently gives me a "bad object".
Nice catch, I don't know what happened here, must be something in
David's scripts, not mine :)
I'll go edit the changelog before I commit it later today, thanks.
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.
2011-01-07 19:19 ` Greg KH
@ 2011-01-08 1:33 ` David Miller
0 siblings, 0 replies; 177+ messages in thread
From: David Miller @ 2011-01-08 1:33 UTC (permalink / raw)
To: gregkh
Cc: paul.gortmaker, linux-kernel, stable, nelhage, akpm, torvalds,
stable-review, alan
From: Greg KH <gregkh@suse.de>
Date: Fri, 7 Jan 2011 11:19:30 -0800
> On Fri, Jan 07, 2011 at 02:10:36PM -0500, Paul Gortmaker wrote:
>> [[stable] [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.] On 05/01/2011 (Wed 16:22) Greg KH wrote:
>>
>> > 2.6.36-stable review patch. If anyone has any objections, please let us know.
>> >
>> > ------------------
>> >
>> >
>> > From: Nelson Elhage <nelhage@ksplice.com>
>> >
>> > [ Upstream commit f24b8bedf70c524775eabd51570c3fa7708a97b7 ]
>>
>> I think the upstream # got mangled somehow. Looking at the tree, I
>> think the upstream is 0c62fc6dd02c8d793c75ae76a9b6881fc36388ad.
>>
>> The ID listed currently gives me a "bad object".
>
> Nice catch, I don't know what happened here, must be something in
> David's scripts, not mine :)
>
> I'll go edit the changelog before I commit it later today, thanks.
That script is called my brain as I generate these by hand. :-)
Thanks for catching this and fixing it.
^ permalink raw reply [flat|nested] 177+ messages in thread
* [070/152] econet: Fix crash in aun_incoming().
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (68 preceding siblings ...)
2011-01-06 0:22 ` [069/152] econet: Do the correct cleanup after an unprivileged SIOCSIFADDR Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [071/152] ifb: goto resched directly if error happens and dp->tq isnt empty Greg KH
` (82 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David S. Miller <davem@davemloft.net>
[ Upstream commit 4e085e76cbe558b79b54cbab772f61185879bc64 ]
Unconditional use of skb->dev won't work here,
try to fetch the econet device via skb_dst()->dev
instead.
Suggested by Eric Dumazet.
Reported-by: Nelson Elhage <nelhage@ksplice.com>
Tested-by: Nelson Elhage <nelhage@ksplice.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/econet/af_econet.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -851,9 +851,13 @@ static void aun_incoming(struct sk_buff
{
struct iphdr *ip = ip_hdr(skb);
unsigned char stn = ntohl(ip->saddr) & 0xff;
+ struct dst_entry *dst = skb_dst(skb);
+ struct ec_device *edev = NULL;
struct sock *sk = NULL;
struct sk_buff *newskb;
- struct ec_device *edev = skb->dev->ec_ptr;
+
+ if (dst)
+ edev = dst->dev->ec_ptr;
if (! edev)
goto bad;
^ permalink raw reply [flat|nested] 177+ messages in thread* [071/152] ifb: goto resched directly if error happens and dp->tq isnt empty
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (69 preceding siblings ...)
2011-01-06 0:22 ` [070/152] econet: Fix crash in aun_incoming() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [072/152] l2tp: Fix modalias of l2tp_ip Greg KH
` (81 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Changli Gao,
Jamal Hadi Salim, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Changli Gao <xiaosuo@gmail.com>
[ Upstream commit 75c1c82566f23dd539fb7ccbf57a1caa7ba82628 ]
If we break the loop when there are still skbs in tq and no skb in
rq, the skbs will be left in txq until new skbs are enqueued into rq.
In rare cases, no new skb is queued, then these skbs will stay in rq
forever.
After this patch, if tq isn't empty when we break the loop, we goto
resched directly.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/ifb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev
rcu_read_unlock();
dev_kfree_skb(skb);
stats->tx_dropped++;
+ if (skb_queue_len(&dp->tq) != 0)
+ goto resched;
break;
}
rcu_read_unlock();
^ permalink raw reply [flat|nested] 177+ messages in thread* [072/152] l2tp: Fix modalias of l2tp_ip
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (70 preceding siblings ...)
2011-01-06 0:22 ` [071/152] ifb: goto resched directly if error happens and dp->tq isnt empty Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [073/152] x25: decrement netdev reference counts on unload Greg KH
` (80 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Michal Marek,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michal Marek <mmarek@suse.cz>
[ Upstream commit 3e5653f0bc5150a2cc67b707130344ce05fb440e ]
Using the SOCK_DGRAM enum results in
"net-pf-2-proto-SOCK_DGRAM-type-115", so use the numeric value like it
is done in net/dccp.
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/l2tp/l2tp_ip.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -676,4 +676,8 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
MODULE_DESCRIPTION("L2TP over IP");
MODULE_VERSION("1.0");
-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP);
+
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+ * enums
+ */
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
^ permalink raw reply [flat|nested] 177+ messages in thread* [073/152] x25: decrement netdev reference counts on unload
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (71 preceding siblings ...)
2011-01-06 0:22 ` [072/152] l2tp: Fix modalias of l2tp_ip Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [074/152] tehuti: Firmware filename is tehuti/bdx.bin Greg KH
` (79 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Apollon Oikonomopoulos,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Apollon Oikonomopoulos <apollon@noc.grnet.gr>
[ Upstream commit 33ce2b3d81dca76f589641b7a675c28f0f6375b1 ]
x25 does not decrement the network device reference counts on module unload.
Thus unregistering any pre-existing interface after unloading the x25 module
hangs and results in
unregister_netdevice: waiting for tap0 to become free. Usage count = 1
This patch decrements the reference counts of all interfaces in x25_link_free,
the way it is already done in x25_link_device_down for NETDEV_DOWN events.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/x25/x25_link.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -394,6 +394,7 @@ void __exit x25_link_free(void)
list_for_each_safe(entry, tmp, &x25_neigh_list) {
nb = list_entry(entry, struct x25_neigh, node);
__x25_remove_neigh(nb);
+ dev_put(nb->dev);
}
write_unlock_bh(&x25_neigh_list_lock);
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [074/152] tehuti: Firmware filename is tehuti/bdx.bin
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (72 preceding siblings ...)
2011-01-06 0:22 ` [073/152] x25: decrement netdev reference counts on unload Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [075/152] net/dst: dst_dev_event() called after other notifiers Greg KH
` (78 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ben Hutchings,
Andy Gospodarek, David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
[ Upstream commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 ]
My conversion of tehuti to use request_firmware() was confused about
the filename of the firmware blob. Change the driver to match the
blob.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/tehuti.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *
ENTER;
master = READ_REG(priv, regINIT_SEMAPHORE);
if (!READ_REG(priv, regINIT_STATUS) && master) {
- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
+ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
if (rc)
goto out;
bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
@@ -2516,4 +2516,4 @@ module_exit(bdx_module_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(BDX_DRV_DESC);
-MODULE_FIRMWARE("tehuti/firmware.bin");
+MODULE_FIRMWARE("tehuti/bdx.bin");
^ permalink raw reply [flat|nested] 177+ messages in thread* [075/152] net/dst: dst_dev_event() called after other notifiers
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (73 preceding siblings ...)
2011-01-06 0:22 ` [074/152] tehuti: Firmware filename is tehuti/bdx.bin Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [076/152] net: Fix header size check for GSO case in recvmsg (af_packet) Greg KH
` (77 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit 332dd96f7ac15e937088fe11f15cfe0210e8edd1 ]
Followup of commit ef885afbf8a37689 (net: use rcu_barrier() in
rollback_registered_many)
dst_dev_event() scans a garbage dst list that might be feeded by various
network notifiers at device dismantle time.
Its important to call dst_dev_event() after other notifiers, or we might
enter the infamous msleep(250) in netdev_wait_allrefs(), and wait one
second before calling again call_netdevice_notifiers(NETDEV_UNREGISTER,
dev) to properly remove last device references.
Use priority -10 to let dst_dev_notifier be called after other network
notifiers (they have the default 0 priority)
Reported-by: Ben Greear <greearb@candelatech.com>
Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reported-by: Octavian Purdila <opurdila@ixiacom.com>
Reported-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/core/dst.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -343,6 +343,7 @@ static int dst_dev_event(struct notifier
static struct notifier_block dst_dev_notifier = {
.notifier_call = dst_dev_event,
+ .priority = -10, /* must be called after other network notifiers */
};
void __init dst_init(void)
^ permalink raw reply [flat|nested] 177+ messages in thread* [076/152] net: Fix header size check for GSO case in recvmsg (af_packet)
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (74 preceding siblings ...)
2011-01-06 0:22 ` [075/152] net/dst: dst_dev_event() called after other notifiers Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [077/152] net: fix skb_defer_rx_timestamp() Greg KH
` (76 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mariusz Kozlowski,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mariusz Kozlowski <mk@lab.zgora.pl>
[ Upstream commit 54dd76848bf67b9fa40ac0340e5ee9c2876d5393 ]
Parameter 'len' is size_t type so it will never get negative.
Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/packet/af_packet.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1610,9 +1610,11 @@ static int packet_recvmsg(struct kiocb *
err = -EINVAL;
vnet_hdr_len = sizeof(vnet_hdr);
- if ((len -= vnet_hdr_len) < 0)
+ if (len < vnet_hdr_len)
goto out_free;
+ len -= vnet_hdr_len;
+
if (skb_is_gso(skb)) {
struct skb_shared_info *sinfo = skb_shinfo(skb);
^ permalink raw reply [flat|nested] 177+ messages in thread* [077/152] net: fix skb_defer_rx_timestamp()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (75 preceding siblings ...)
2011-01-06 0:22 ` [076/152] net: Fix header size check for GSO case in recvmsg (af_packet) Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [078/152] net: packet: fix information leak to userland Greg KH
` (75 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Dumazet,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
[ Upstream commit a19faf0250e09b16cac169354126404bc8aa342b ]
After commit c1f19b51d1d8 (net: support time stamping in phy devices.),
kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and
skb_defer_rx_timestamp() handles a packet without an ethernet header.
Fixes kernel bugzilla #24102
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102
Reported-and-tested-by: Andrew Watts <akwatts@ymail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/core/timestamping.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_bu
struct phy_device *phydev;
unsigned int type;
- skb_push(skb, ETH_HLEN);
+ if (skb_headroom(skb) < ETH_HLEN)
+ return false;
+ __skb_push(skb, ETH_HLEN);
type = classify(skb);
- skb_pull(skb, ETH_HLEN);
+ __skb_pull(skb, ETH_HLEN);
switch (type) {
case PTP_CLASS_V1_IPV4:
^ permalink raw reply [flat|nested] 177+ messages in thread* [078/152] net: packet: fix information leak to userland
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (76 preceding siblings ...)
2011-01-06 0:22 ` [077/152] net: fix skb_defer_rx_timestamp() Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [079/152] pppoe.c: Fix kernel panic caused by __pppoe_xmit Greg KH
` (74 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vasiliy Kulikov,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vasiliy Kulikov <segooon@gmail.com>
[ Upstream commit 67286640f638f5ad41a946b9a3dc75327950248f ]
packet_getname_spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13. This structure is then copied
to userland. It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().
The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll. Set it to zero.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/packet/af_packet.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1721,7 +1721,7 @@ static int packet_getname_spkt(struct so
rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
if (dev)
- strlcpy(uaddr->sa_data, dev->name, 15);
+ strncpy(uaddr->sa_data, dev->name, 14);
else
memset(uaddr->sa_data, 0, 14);
rcu_read_unlock();
@@ -1744,6 +1744,7 @@ static int packet_getname(struct socket
sll->sll_family = AF_PACKET;
sll->sll_ifindex = po->ifindex;
sll->sll_protocol = po->num;
+ sll->sll_pkttype = 0;
rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
if (dev) {
^ permalink raw reply [flat|nested] 177+ messages in thread* [079/152] pppoe.c: Fix kernel panic caused by __pppoe_xmit
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (77 preceding siblings ...)
2011-01-06 0:22 ` [078/152] net: packet: fix information leak to userland Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:22 ` [080/152] ACPICA: Fix Scope() op in module level code Greg KH
` (73 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Jarek Poplawski, Andrej Ota,
David S. Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrej Ota <andrej@ota.si>
[ Upstream commit 2a27a03d3a891e87ca33d27a858b4db734a4cbab ]
__pppoe_xmit function return value was invalid resulting in
additional call to kfree_skb on already freed skb. This resulted in
memory corruption and consequent kernel panic after PPPoE peer
terminated the link.
This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b.
Reported-by: Gorik Van Steenberge <gvs@zemos.net>
Reported-by: Daniel Kenzelmann <kernel.bugzilla@kenzelmann.dyndns.info>
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
Reported-by: Pawel Staszewski <pstaszewski@artcom.pl>
Diagnosed-by: Andrej Ota <andrej@ota.si>
Diagnosed-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
Tested-by: Pawel Staszewski <pstaszewski@artcom.pl>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: Andrej Ota <andrej@ota.si>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/pppoe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk,
abort:
kfree_skb(skb);
- return 0;
+ return 1;
}
/************************************************************************
^ permalink raw reply [flat|nested] 177+ messages in thread* [080/152] ACPICA: Fix Scope() op in module level code
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (78 preceding siblings ...)
2011-01-06 0:22 ` [079/152] pppoe.c: Fix kernel panic caused by __pppoe_xmit Greg KH
@ 2011-01-06 0:22 ` Greg KH
2011-01-06 0:23 ` [081/152] nouveau: Acknowledge HPD irq in handler, not bottom half Greg KH
` (72 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Bob Moore, Lin Ming,
Len Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Bob Moore <robert.moore@intel.com>
commit 8df3fc981dc12d9fdcaef4100a2193b605024d7a upstream.
Some Panasonic Toughbooks create nodes in module level code.
Module level code is the executable AML code outside of control method,
for example, below AML code creates a node \_SB.PCI0.GFX0.DD02.CUBL
If (\_OSI ("Windows 2006"))
{
Scope (\_SB.PCI0.GFX0.DD02)
{
Name (CUBL, Ones)
...
}
}
Scope() op does not actually create a new object, it refers to an
existing object(\_SB.PCI0.GFX0.DD02 in above example). However, for
Scope(), we want to indeed open a new scope, so the child nodes(CUBL in
above example) can be created correctly under it.
https://bugzilla.kernel.org/show_bug.cgi?id=19462
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/acpi/acpica/dswexec.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/drivers/acpi/acpica/dswexec.c
+++ b/drivers/acpi/acpica/dswexec.c
@@ -300,10 +300,25 @@ acpi_ds_exec_begin_op(struct acpi_walk_s
* we must enter this object into the namespace. The created
* object is temporary and will be deleted upon completion of
* the execution of this method.
+ *
+ * Note 10/2010: Except for the Scope() op. This opcode does
+ * not actually create a new object, it refers to an existing
+ * object. However, for Scope(), we want to indeed open a
+ * new scope.
*/
- status = acpi_ds_load2_begin_op(walk_state, NULL);
+ if (op->common.aml_opcode != AML_SCOPE_OP) {
+ status =
+ acpi_ds_load2_begin_op(walk_state, NULL);
+ } else {
+ status =
+ acpi_ds_scope_stack_push(op->named.node,
+ op->named.node->
+ type, walk_state);
+ if (ACPI_FAILURE(status)) {
+ return_ACPI_STATUS(status);
+ }
+ }
}
-
break;
case AML_CLASS_EXECUTE:
^ permalink raw reply [flat|nested] 177+ messages in thread* [081/152] nouveau: Acknowledge HPD irq in handler, not bottom half
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (79 preceding siblings ...)
2011-01-06 0:22 ` [080/152] ACPICA: Fix Scope() op in module level code Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [082/152] printk: Fix wake_up_klogd() vs cpu hotplug Greg KH
` (71 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Andy Lutomirski, Ben Skeggs
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andy Lutomirski <luto@mit.edu>
commit ab838338a2a9e0cb8346eb0cab9977be13e8dce5 upstream.
The old code generated an interrupt storm bad enough to completely
take down my system.
Signed-off-by: Andy Lutomirski <luto@mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/nouveau/nouveau_drv.h | 6 +++++
drivers/gpu/drm/nouveau/nouveau_irq.c | 1
drivers/gpu/drm/nouveau/nv50_display.c | 35 ++++++++++++++++++++++++---------
3 files changed, 33 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -531,6 +531,12 @@ struct drm_nouveau_private {
struct work_struct irq_work;
struct work_struct hpd_work;
+ struct {
+ spinlock_t lock;
+ uint32_t hpd0_bits;
+ uint32_t hpd1_bits;
+ } hpd_state;
+
struct list_head vbl_waiting;
struct {
--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -52,6 +52,7 @@ nouveau_irq_preinstall(struct drm_device
if (dev_priv->card_type >= NV_50) {
INIT_WORK(&dev_priv->irq_work, nv50_display_irq_handler_bh);
INIT_WORK(&dev_priv->hpd_work, nv50_display_irq_hotplug_bh);
+ spin_lock_init(&dev_priv->hpd_state.lock);
INIT_LIST_HEAD(&dev_priv->vbl_waiting);
}
}
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1012,11 +1012,18 @@ nv50_display_irq_hotplug_bh(struct work_
struct drm_connector *connector;
const uint32_t gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
uint32_t unplug_mask, plug_mask, change_mask;
- uint32_t hpd0, hpd1 = 0;
+ uint32_t hpd0, hpd1;
- hpd0 = nv_rd32(dev, 0xe054) & nv_rd32(dev, 0xe050);
+ spin_lock_irq(&dev_priv->hpd_state.lock);
+ hpd0 = dev_priv->hpd_state.hpd0_bits;
+ dev_priv->hpd_state.hpd0_bits = 0;
+ hpd1 = dev_priv->hpd_state.hpd1_bits;
+ dev_priv->hpd_state.hpd1_bits = 0;
+ spin_unlock_irq(&dev_priv->hpd_state.lock);
+
+ hpd0 &= nv_rd32(dev, 0xe050);
if (dev_priv->chipset >= 0x90)
- hpd1 = nv_rd32(dev, 0xe074) & nv_rd32(dev, 0xe070);
+ hpd1 &= nv_rd32(dev, 0xe070);
plug_mask = (hpd0 & 0x0000ffff) | (hpd1 << 16);
unplug_mask = (hpd0 >> 16) | (hpd1 & 0xffff0000);
@@ -1058,10 +1065,6 @@ nv50_display_irq_hotplug_bh(struct work_
helper->dpms(connector->encoder, DRM_MODE_DPMS_OFF);
}
- nv_wr32(dev, 0xe054, nv_rd32(dev, 0xe054));
- if (dev_priv->chipset >= 0x90)
- nv_wr32(dev, 0xe074, nv_rd32(dev, 0xe074));
-
drm_helper_hpd_irq_event(dev);
}
@@ -1072,8 +1075,22 @@ nv50_display_irq_handler(struct drm_devi
uint32_t delayed = 0;
if (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_HOTPLUG) {
- if (!work_pending(&dev_priv->hpd_work))
- queue_work(dev_priv->wq, &dev_priv->hpd_work);
+ uint32_t hpd0_bits, hpd1_bits = 0;
+
+ hpd0_bits = nv_rd32(dev, 0xe054);
+ nv_wr32(dev, 0xe054, hpd0_bits);
+
+ if (dev_priv->chipset >= 0x90) {
+ hpd1_bits = nv_rd32(dev, 0xe074);
+ nv_wr32(dev, 0xe074, hpd1_bits);
+ }
+
+ spin_lock(&dev_priv->hpd_state.lock);
+ dev_priv->hpd_state.hpd0_bits |= hpd0_bits;
+ dev_priv->hpd_state.hpd1_bits |= hpd1_bits;
+ spin_unlock(&dev_priv->hpd_state.lock);
+
+ queue_work(dev_priv->wq, &dev_priv->hpd_work);
}
while (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_DISPLAY) {
^ permalink raw reply [flat|nested] 177+ messages in thread* [082/152] printk: Fix wake_up_klogd() vs cpu hotplug
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (80 preceding siblings ...)
2011-01-06 0:23 ` [081/152] nouveau: Acknowledge HPD irq in handler, not bottom half Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [083/152] xen: Provide a variant of __RING_SIZE() that is an integer constant expression Greg KH
` (70 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Heiko Carstens, Eric Dumazet,
Peter Zijlstra, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit 49f4138346b3cec2706adff02658fe27ceb1e46f upstream.
wake_up_klogd() may get called from preemptible context but uses
__raw_get_cpu_var() to write to a per cpu variable. If it gets preempted
between getting the address and writing to it, the cpu in question could be
offline if the process gets scheduled back and hence writes to the per cpu data
of an offline cpu.
This buggy behaviour was introduced with fa33507a "printk: robustify
printk, fix #2" which was supposed to fix a "using smp_processor_id() in
preemptible" warning.
Let's use this_cpu_write() instead which disables preemption and makes sure
that the outlined scenario cannot happen.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <20101126124247.GC7023@osiris.boeblingen.de.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/printk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1070,7 +1070,7 @@ int printk_needs_cpu(int cpu)
void wake_up_klogd(void)
{
if (waitqueue_active(&log_wait))
- __raw_get_cpu_var(printk_pending) = 1;
+ this_cpu_write(printk_pending, 1);
}
/**
^ permalink raw reply [flat|nested] 177+ messages in thread* [083/152] xen: Provide a variant of __RING_SIZE() that is an integer constant expression
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (81 preceding siblings ...)
2011-01-06 0:23 ` [082/152] printk: Fix wake_up_klogd() vs cpu hotplug Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [084/152] sched: Cure more NO_HZ load average woes Greg KH
` (69 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Jan Beulich,
Jeremy Fitzhardinge, Jens Axboe, David Miller
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeremy Fitzhardinge <jeremy@goop.org>
commit 667c78afaec0ac500908e191e8f236e9578d7b1f upstream.
Without this, gcc 4.5 won't compile xen-netfront and xen-blkfront, where
this is being used to specify array sizes.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/block/xen-blkfront.c | 2 +-
drivers/net/xen-netfront.c | 4 ++--
include/xen/interface/io/ring.h | 11 +++++++++--
3 files changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -71,7 +71,7 @@ struct blk_shadow {
static const struct block_device_operations xlvbd_block_fops;
-#define BLK_RING_SIZE __RING_SIZE((struct blkif_sring *)0, PAGE_SIZE)
+#define BLK_RING_SIZE __CONST_RING_SIZE(blkif, PAGE_SIZE)
/*
* We have one of these per vbd, whether ide, scsi or 'other'. They
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -66,8 +66,8 @@ struct netfront_cb {
#define GRANT_INVALID_REF 0
-#define NET_TX_RING_SIZE __RING_SIZE((struct xen_netif_tx_sring *)0, PAGE_SIZE)
-#define NET_RX_RING_SIZE __RING_SIZE((struct xen_netif_rx_sring *)0, PAGE_SIZE)
+#define NET_TX_RING_SIZE __CONST_RING_SIZE(xen_netif_tx, PAGE_SIZE)
+#define NET_RX_RING_SIZE __CONST_RING_SIZE(xen_netif_rx, PAGE_SIZE)
#define TX_MAX_TARGET min_t(int, NET_RX_RING_SIZE, 256)
struct netfront_info {
--- a/include/xen/interface/io/ring.h
+++ b/include/xen/interface/io/ring.h
@@ -24,8 +24,15 @@ typedef unsigned int RING_IDX;
* A ring contains as many entries as will fit, rounded down to the nearest
* power of two (so we can mask with (size-1) to loop around).
*/
-#define __RING_SIZE(_s, _sz) \
- (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
+#define __CONST_RING_SIZE(_s, _sz) \
+ (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \
+ sizeof(((struct _s##_sring *)0)->ring[0])))
+
+/*
+ * The same for passing in an actual pointer instead of a name tag.
+ */
+#define __RING_SIZE(_s, _sz) \
+ (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
/*
* Macros to make the correct C datatypes for a new kind of ring.
^ permalink raw reply [flat|nested] 177+ messages in thread* [084/152] sched: Cure more NO_HZ load average woes
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (82 preceding siblings ...)
2011-01-06 0:23 ` [083/152] xen: Provide a variant of __RING_SIZE() that is an integer constant expression Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [085/152] ACPI: EC: Add another dmi match entry for MSI hardware Greg KH
` (68 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra,
Chase Douglas, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Peter Zijlstra <a.p.zijlstra@chello.nl>
commit 0f004f5a696a9434b7214d0d3cbd0525ee77d428 upstream.
There's a long-running regression that proved difficult to fix and
which is hitting certain people and is rather annoying in its effects.
Damien reported that after 74f5187ac8 (sched: Cure load average vs
NO_HZ woes) his load average is unnaturally high, he also noted that
even with that patch reverted the load avgerage numbers are not
correct.
The problem is that the previous patch only solved half the NO_HZ
problem, it addressed the part of going into NO_HZ mode, not of
comming out of NO_HZ mode. This patch implements that missing half.
When comming out of NO_HZ mode there are two important things to take
care of:
- Folding the pending idle delta into the global active count.
- Correctly aging the averages for the idle-duration.
So with this patch the NO_HZ interaction should be complete and
behaviour between CONFIG_NO_HZ=[yn] should be equivalent.
Furthermore, this patch slightly changes the load average computation
by adding a rounding term to the fixed point multiplication.
Reported-by: Damien Wyart <damien.wyart@free.fr>
Reported-by: Tim McGrath <tmhikaru@gmail.com>
Tested-by: Damien Wyart <damien.wyart@free.fr>
Tested-by: Orion Poplawski <orion@cora.nwra.com>
Tested-by: Kyle McMartin <kyle@mcmartin.ca>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Chase Douglas <chase.douglas@canonical.com>
LKML-Reference: <1291129145.32004.874.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/sched.h | 2
kernel/sched.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++----
kernel/timer.c | 2
3 files changed, 141 insertions(+), 13 deletions(-)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -143,7 +143,7 @@ extern unsigned long nr_iowait_cpu(int c
extern unsigned long this_cpu_load(void);
-extern void calc_global_load(void);
+extern void calc_global_load(unsigned long ticks);
extern unsigned long get_parent_ip(unsigned long addr);
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2967,6 +2967,15 @@ static long calc_load_fold_active(struct
return delta;
}
+static unsigned long
+calc_load(unsigned long load, unsigned long exp, unsigned long active)
+{
+ load *= exp;
+ load += active * (FIXED_1 - exp);
+ load += 1UL << (FSHIFT - 1);
+ return load >> FSHIFT;
+}
+
#ifdef CONFIG_NO_HZ
/*
* For NO_HZ we delay the active fold to the next LOAD_FREQ update.
@@ -2996,6 +3005,128 @@ static long calc_load_fold_idle(void)
return delta;
}
+
+/**
+ * fixed_power_int - compute: x^n, in O(log n) time
+ *
+ * @x: base of the power
+ * @frac_bits: fractional bits of @x
+ * @n: power to raise @x to.
+ *
+ * By exploiting the relation between the definition of the natural power
+ * function: x^n := x*x*...*x (x multiplied by itself for n times), and
+ * the binary encoding of numbers used by computers: n := \Sum n_i * 2^i,
+ * (where: n_i \elem {0, 1}, the binary vector representing n),
+ * we find: x^n := x^(\Sum n_i * 2^i) := \Prod x^(n_i * 2^i), which is
+ * of course trivially computable in O(log_2 n), the length of our binary
+ * vector.
+ */
+static unsigned long
+fixed_power_int(unsigned long x, unsigned int frac_bits, unsigned int n)
+{
+ unsigned long result = 1UL << frac_bits;
+
+ if (n) for (;;) {
+ if (n & 1) {
+ result *= x;
+ result += 1UL << (frac_bits - 1);
+ result >>= frac_bits;
+ }
+ n >>= 1;
+ if (!n)
+ break;
+ x *= x;
+ x += 1UL << (frac_bits - 1);
+ x >>= frac_bits;
+ }
+
+ return result;
+}
+
+/*
+ * a1 = a0 * e + a * (1 - e)
+ *
+ * a2 = a1 * e + a * (1 - e)
+ * = (a0 * e + a * (1 - e)) * e + a * (1 - e)
+ * = a0 * e^2 + a * (1 - e) * (1 + e)
+ *
+ * a3 = a2 * e + a * (1 - e)
+ * = (a0 * e^2 + a * (1 - e) * (1 + e)) * e + a * (1 - e)
+ * = a0 * e^3 + a * (1 - e) * (1 + e + e^2)
+ *
+ * ...
+ *
+ * an = a0 * e^n + a * (1 - e) * (1 + e + ... + e^n-1) [1]
+ * = a0 * e^n + a * (1 - e) * (1 - e^n)/(1 - e)
+ * = a0 * e^n + a * (1 - e^n)
+ *
+ * [1] application of the geometric series:
+ *
+ * n 1 - x^(n+1)
+ * S_n := \Sum x^i = -------------
+ * i=0 1 - x
+ */
+static unsigned long
+calc_load_n(unsigned long load, unsigned long exp,
+ unsigned long active, unsigned int n)
+{
+
+ return calc_load(load, fixed_power_int(exp, FSHIFT, n), active);
+}
+
+/*
+ * NO_HZ can leave us missing all per-cpu ticks calling
+ * calc_load_account_active(), but since an idle CPU folds its delta into
+ * calc_load_tasks_idle per calc_load_account_idle(), all we need to do is fold
+ * in the pending idle delta if our idle period crossed a load cycle boundary.
+ *
+ * Once we've updated the global active value, we need to apply the exponential
+ * weights adjusted to the number of cycles missed.
+ */
+static void calc_global_nohz(unsigned long ticks)
+{
+ long delta, active, n;
+
+ if (time_before(jiffies, calc_load_update))
+ return;
+
+ /*
+ * If we crossed a calc_load_update boundary, make sure to fold
+ * any pending idle changes, the respective CPUs might have
+ * missed the tick driven calc_load_account_active() update
+ * due to NO_HZ.
+ */
+ delta = calc_load_fold_idle();
+ if (delta)
+ atomic_long_add(delta, &calc_load_tasks);
+
+ /*
+ * If we were idle for multiple load cycles, apply them.
+ */
+ if (ticks >= LOAD_FREQ) {
+ n = ticks / LOAD_FREQ;
+
+ active = atomic_long_read(&calc_load_tasks);
+ active = active > 0 ? active * FIXED_1 : 0;
+
+ avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
+ avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
+ avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
+
+ calc_load_update += n * LOAD_FREQ;
+ }
+
+ /*
+ * Its possible the remainder of the above division also crosses
+ * a LOAD_FREQ period, the regular check in calc_global_load()
+ * which comes after this will take care of that.
+ *
+ * Consider us being 11 ticks before a cycle completion, and us
+ * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will
+ * age us 4 cycles, and the test in calc_global_load() will
+ * pick up the final one.
+ */
+}
#else
static void calc_load_account_idle(struct rq *this_rq)
{
@@ -3005,6 +3136,10 @@ static inline long calc_load_fold_idle(v
{
return 0;
}
+
+static void calc_global_nohz(unsigned long ticks)
+{
+}
#endif
/**
@@ -3022,24 +3157,17 @@ void get_avenrun(unsigned long *loads, u
loads[2] = (avenrun[2] + offset) << shift;
}
-static unsigned long
-calc_load(unsigned long load, unsigned long exp, unsigned long active)
-{
- load *= exp;
- load += active * (FIXED_1 - exp);
- return load >> FSHIFT;
-}
-
/*
* calc_load - update the avenrun load estimates 10 ticks after the
* CPUs have updated calc_load_tasks.
*/
-void calc_global_load(void)
+void calc_global_load(unsigned long ticks)
{
- unsigned long upd = calc_load_update + 10;
long active;
- if (time_before(jiffies, upd))
+ calc_global_nohz(ticks);
+
+ if (time_before(jiffies, calc_load_update + 10))
return;
active = atomic_long_read(&calc_load_tasks);
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1322,7 +1322,7 @@ void do_timer(unsigned long ticks)
{
jiffies_64 += ticks;
update_wall_time();
- calc_global_load();
+ calc_global_load(ticks);
}
#ifdef __ARCH_WANT_SYS_ALARM
^ permalink raw reply [flat|nested] 177+ messages in thread* [085/152] ACPI: EC: Add another dmi match entry for MSI hardware
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (83 preceding siblings ...)
2011-01-06 0:23 ` [084/152] sched: Cure more NO_HZ load average woes Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [086/152] MIPS: jz4740: qi_lb60: Fix gpio for the 6th row of the keyboard matrix Greg KH
` (67 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alexey Starikovskiy,
Len Brown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alexey Starikovskiy <astarikovskiy@suse.de>
commit a5dc4f898c2a0f66e2cefada6c687db82ba2fcbc upstream.
http://bugzilla.kernel.org/show_bug.cgi?id=15418
Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/acpi/ec.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -929,6 +929,9 @@ static struct dmi_system_id __initdata e
ec_flag_msi, "MSI hardware", {
DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star")}, NULL},
{
+ ec_flag_msi, "MSI hardware", {
+ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR")}, NULL},
+ {
ec_validate_ecdt, "ASUS hardware", {
DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL},
{},
^ permalink raw reply [flat|nested] 177+ messages in thread* [086/152] MIPS: jz4740: qi_lb60: Fix gpio for the 6th row of the keyboard matrix
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (84 preceding siblings ...)
2011-01-06 0:23 ` [085/152] ACPI: EC: Add another dmi match entry for MSI hardware Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [087/152] PM / Runtime: Fix pm_runtime_suspended() Greg KH
` (66 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Lars-Peter Clausen,
linux-mips, Ralf Baechle
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit fe749aab1d21cbb4d87527a7df8799583c233496 upstream.
This patch fixes the gpio number for the 6th row of the keyboard matrix.
(And fixes a typo in my name...)
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: linux-mips@linux-mips.org
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/mips/jz4740/board-qi_lb60.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/mips/jz4740/board-qi_lb60.c
+++ b/arch/mips/jz4740/board-qi_lb60.c
@@ -5,7 +5,7 @@
*
* Copyright (c) 2009 Qi Hardware inc.,
* Author: Xiangfu Liu <xiangfu@qi-hardware.com>
- * Copyright 2010, Lars-Petrer Clausen <lars@metafoo.de>
+ * Copyright 2010, Lars-Peter Clausen <lars@metafoo.de>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 or later
@@ -235,7 +235,7 @@ static const unsigned int qi_lb60_keypad
QI_LB60_GPIO_KEYIN(3),
QI_LB60_GPIO_KEYIN(4),
QI_LB60_GPIO_KEYIN(5),
- QI_LB60_GPIO_KEYIN(7),
+ QI_LB60_GPIO_KEYIN(6),
QI_LB60_GPIO_KEYIN8,
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [087/152] PM / Runtime: Fix pm_runtime_suspended()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (85 preceding siblings ...)
2011-01-06 0:23 ` [086/152] MIPS: jz4740: qi_lb60: Fix gpio for the 6th row of the keyboard matrix Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [088/152] inotify: stop kernel memory leak on file creation failure Greg KH
` (65 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Rafael J. Wysocki
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rafael J. Wysocki <rjw@sisk.pl>
commit f08f5a0add20834d3f3d876dfe08005a5df656db upstream.
There are some situations (e.g. in __pm_generic_call()), where
pm_runtime_suspended() is used to decide whether or not to execute
a device's (system) ->suspend() callback. The callback is not
executed if pm_runtime_suspended() returns true, but it does so
for devices that don't even support runtime PM, because the
power.disable_depth device field is ignored by it. This leads to
problems (i.e. devices are not suspened when they should), so rework
pm_runtime_suspended() so that it returns false if the device's
power.disable_depth field is different from zero.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
Documentation/power/runtime_pm.txt | 4 ++--
include/linux/pm_runtime.h | 3 ++-
2 files changed, 4 insertions(+), 3 deletions(-)
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -336,8 +336,8 @@ drivers/base/power/runtime.c and include
zero)
bool pm_runtime_suspended(struct device *dev);
- - return true if the device's runtime PM status is 'suspended', or false
- otherwise
+ - return true if the device's runtime PM status is 'suspended' and its
+ 'power.disable_depth' field is equal to zero, or false otherwise
void pm_runtime_allow(struct device *dev);
- set the power.runtime_auto flag for the device and decrease its usage
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -67,7 +67,8 @@ static inline void device_set_run_wake(s
static inline bool pm_runtime_suspended(struct device *dev)
{
- return dev->power.runtime_status == RPM_SUSPENDED;
+ return dev->power.runtime_status == RPM_SUSPENDED
+ && !dev->power.disable_depth;
}
#else /* !CONFIG_PM_RUNTIME */
^ permalink raw reply [flat|nested] 177+ messages in thread* [088/152] inotify: stop kernel memory leak on file creation failure
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (86 preceding siblings ...)
2011-01-06 0:23 ` [087/152] PM / Runtime: Fix pm_runtime_suspended() Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [089/152] orinoco: fix TKIP countermeasure behaviour Greg KH
` (64 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Eric Paris
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Paris <eparis@redhat.com>
commit a2ae4cc9a16e211c8a128ba10d22a85431f093ab upstream.
If inotify_init is unable to allocate a new file for the new inotify
group we leak the new group. This patch drops the reference on the
group on file allocation failure.
Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/notify/inotify/inotify_user.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -751,6 +751,7 @@ SYSCALL_DEFINE1(inotify_init1, int, flag
if (ret >= 0)
return ret;
+ fsnotify_put_group(group);
atomic_dec(&user->inotify_devs);
out_free_uid:
free_uid(user);
^ permalink raw reply [flat|nested] 177+ messages in thread* [089/152] orinoco: fix TKIP countermeasure behaviour
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (87 preceding siblings ...)
2011-01-06 0:23 ` [088/152] inotify: stop kernel memory leak on file creation failure Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [090/152] orinoco: clear countermeasure setting on commit Greg KH
` (63 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Kilroy <kilroyd@googlemail.com>
commit 0a54917c3fc295cb61f3fb52373c173fd3b69f48 upstream.
Enable the port when disabling countermeasures, and disable it on
enabling countermeasures.
This bug causes the response of the system to certain attacks to be
ineffective.
It also prevents wpa_supplicant from getting scan results, as
wpa_supplicant disables countermeasures on startup - preventing the
hardware from scanning.
wpa_supplicant works with ap_mode=2 despite this bug because the commit
handler re-enables the port.
The log tends to look like:
State: DISCONNECTED -> SCANNING
Starting AP scan for wildcard SSID
Scan requested (ret=0) - scan timeout 5 seconds
EAPOL: disable timer tick
EAPOL: Supplicant port status: Unauthorized
Scan timeout - try to get results
Failed to get scan results
Failed to get scan results - try scanning again
Setting scan request: 1 sec 0 usec
Starting AP scan for wildcard SSID
Scan requested (ret=-1) - scan timeout 5 seconds
Failed to initiate AP scan.
Reported by: Giacomo Comes <comes@naic.edu>
Signed-off by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/orinoco/wext.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -904,10 +904,10 @@ static int orinoco_ioctl_set_auth(struct
*/
if (param->value) {
priv->tkip_cm_active = 1;
- ret = hermes_enable_port(hw, 0);
+ ret = hermes_disable_port(hw, 0);
} else {
priv->tkip_cm_active = 0;
- ret = hermes_disable_port(hw, 0);
+ ret = hermes_enable_port(hw, 0);
}
break;
^ permalink raw reply [flat|nested] 177+ messages in thread* [090/152] orinoco: clear countermeasure setting on commit
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (88 preceding siblings ...)
2011-01-06 0:23 ` [089/152] orinoco: fix TKIP countermeasure behaviour Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [091/152] x86, amd: Fix panic on AMD CPU family 0x15 Greg KH
` (62 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Kilroy <kilroyd@googlemail.com>
commit ba34fcee476d11e7c9df95932787a22a96ff6e68 upstream.
... and interface up.
In these situations, you are usually trying to connect to a new AP, so
keeping TKIP countermeasures active is confusing. This is already how
the driver behaves (inadvertently). However, querying SIOCGIWAUTH may
tell userspace that countermeasures are active when they aren't.
Clear the setting so that the reporting matches what the driver has
done..
Signed-off by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/orinoco/main.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -1813,6 +1813,12 @@ static int __orinoco_commit(struct orino
struct net_device *dev = priv->ndev;
int err = 0;
+ /* If we've called commit, we are reconfiguring or bringing the
+ * interface up. Maintaining countermeasures across this would
+ * be confusing, so note that we've disabled them. The port will
+ * be enabled later in orinoco_commit or __orinoco_up. */
+ priv->tkip_cm_active = 0;
+
err = orinoco_hw_program_rids(priv);
/* FIXME: what about netif_tx_lock */
^ permalink raw reply [flat|nested] 177+ messages in thread* [091/152] x86, amd: Fix panic on AMD CPU family 0x15
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (89 preceding siblings ...)
2011-01-06 0:23 ` [090/152] orinoco: clear countermeasure setting on commit Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [092/152] md: fix bug with re-adding of partially recovered device Greg KH
` (61 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Andreas Herrmann
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andreas Herrmann <andreas.herrmann3@amd.com>
[The mainline kernel doesn't have this problem. Commit "(23588c3) x86,
amd: Add support for CPUID topology extension of AMD CPUs" removed the
family check. But 2.6.32.y needs to be fixed.]
This CPU family check is not required -- existence of the NodeId MSR
is indicated by a CPUID feature flag which is already checked in
amd_fixup_dcm() -- and it needlessly prevents amd_fixup_dcm() to be
called for newer AMD CPUs.
In worst case this can lead to a panic in the scheduler code for AMD
family 0x15 multi-node AMD CPUs. I just have a picture of VGA console
output so I can't copy-and-paste it herein, but the call stack of such
a panic looked like:
do_divide_error
...
find_busiest_group
run_rebalance_domains
...
apic_timer_interrupt
...
cpu_idle
The mainline kernel doesn't have this problem. Commit "(23588c3) x86,
amd: Add support for CPUID topology extension of AMD CPUs" removed the
family check. But 2.6.32.y needs to be fixed.
Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/cpu/amd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -305,8 +305,7 @@ static void __cpuinit amd_detect_cmp(str
/* use socket ID also for last level cache */
per_cpu(cpu_llc_id, cpu) = c->phys_proc_id;
/* fixup topology information on multi-node processors */
- if ((c->x86 == 0x10) && (c->x86_model == 9))
- amd_fixup_dcm(c);
+ amd_fixup_dcm(c);
#endif
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [092/152] md: fix bug with re-adding of partially recovered device.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (90 preceding siblings ...)
2011-01-06 0:23 ` [091/152] x86, amd: Fix panic on AMD CPU family 0x15 Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [093/152] md: protect against NULL reference when waiting to start a raid10 Greg KH
` (60 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <neilb@suse.de>
commit 1a855a0606653d2d82506281e2c686bacb4b2f45 upstream.
With v0.90 metadata, a hot-spare does not become a full member of the
array until recovery is complete. So if we re-add such a device to
the array, we know that all of it is as up-to-date as the event count
would suggest, and so it a bitmap-based recovery is possible.
However with v1.x metadata, the hot-spare immediately becomes a full
member of the array, but it record how much of the device has been
recovered. If the array is stopped and re-assembled recovery starts
from this point.
When such a device is hot-added to an array we currently lose the 'how
much is recovered' information and incorrectly included it as a full
in-sync member (after bitmap-based fixup).
This is wrong and unsafe and could corrupt data.
So be more careful about setting saved_raid_disk - which is what
guides the re-adding of devices back into an array.
The new code matches the code in slot_store which does a similar
thing, which is encouraging.
This is suitable for any -stable kernel.
Reported-by: "Dailey, Nate" <Nate.Dailey@stratus.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/md/md.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5150,7 +5150,7 @@ static int add_new_disk(mddev_t * mddev,
PTR_ERR(rdev));
return PTR_ERR(rdev);
}
- /* set save_raid_disk if appropriate */
+ /* set saved_raid_disk if appropriate */
if (!mddev->persistent) {
if (info->state & (1<<MD_DISK_SYNC) &&
info->raid_disk < mddev->raid_disks)
@@ -5160,7 +5160,10 @@ static int add_new_disk(mddev_t * mddev,
} else
super_types[mddev->major_version].
validate_super(mddev, rdev);
- rdev->saved_raid_disk = rdev->raid_disk;
+ if (test_bit(In_sync, &rdev->flags))
+ rdev->saved_raid_disk = rdev->raid_disk;
+ else
+ rdev->saved_raid_disk = -1;
clear_bit(In_sync, &rdev->flags); /* just to be sure */
if (info->state & (1<<MD_DISK_WRITEMOSTLY))
^ permalink raw reply [flat|nested] 177+ messages in thread* [093/152] md: protect against NULL reference when waiting to start a raid10.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (91 preceding siblings ...)
2011-01-06 0:23 ` [092/152] md: fix bug with re-adding of partially recovered device Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [094/152] tracing: Fix panic when lseek() called on "trace" opened for writing Greg KH
` (59 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <neilb@suse.de>
commit 589a594be1fb8815b3f18e517be696c48664f728 upstream.
When we fail to start a raid10 for some reason, we call
md_unregister_thread to kill the thread that was created.
Unfortunately md_thread() will then make one call into the handler
(raid10d) even though md_wakeup_thread has not been called. This is
not safe and as md_unregister_thread is called after mddev->private
has been set to NULL, it will definitely cause a NULL dereference.
So fix this at both ends:
- md_thread should only call the handler if THREAD_WAKEUP has been
set.
- raid10 should call md_unregister_thread before setting things
to NULL just like all the other raid modules do.
This is applicable to 2.6.35 and later.
Reported-by: "Citizen" <citizen_lee@thecus.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/md/md.c | 5 ++---
drivers/md/raid10.c | 2 +-
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6040,9 +6040,8 @@ static int md_thread(void * arg)
|| kthread_should_stop(),
thread->timeout);
- clear_bit(THREAD_WAKEUP, &thread->flags);
-
- thread->run(thread->mddev);
+ if (test_and_clear_bit(THREAD_WAKEUP, &thread->flags))
+ thread->run(thread->mddev);
}
return 0;
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2396,13 +2396,13 @@ static int run(mddev_t *mddev)
return 0;
out_free_conf:
+ md_unregister_thread(mddev->thread);
if (conf->r10bio_pool)
mempool_destroy(conf->r10bio_pool);
safe_put_page(conf->tmppage);
kfree(conf->mirrors);
kfree(conf);
mddev->private = NULL;
- md_unregister_thread(mddev->thread);
out:
return -EIO;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [094/152] tracing: Fix panic when lseek() called on "trace" opened for writing
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (92 preceding siblings ...)
2011-01-06 0:23 ` [093/152] md: protect against NULL reference when waiting to start a raid10 Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [095/152] arch/tile: handle CLONE_SETTLS in copy_thread(), not user space Greg KH
` (58 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Slava Pestov, Steven Rostedt
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Slava Pestov <slavapestov@google.com>
commit 364829b1263b44aa60383824e4c1289d83d78ca7 upstream.
The file_ops struct for the "trace" special file defined llseek as seq_lseek().
However, if the file was opened for writing only, seq_open() was not called,
and the seek would dereference a null pointer, file->private_data.
This patch introduces a new wrapper for seq_lseek() which checks if the file
descriptor is opened for reading first. If not, it does nothing.
Signed-off-by: Slava Pestov <slavapestov@google.com>
LKML-Reference: <1290640396-24179-1-git-send-email-slavapestov@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/trace/trace.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2320,11 +2320,19 @@ tracing_write_stub(struct file *filp, co
return count;
}
+static loff_t tracing_seek(struct file *file, loff_t offset, int origin)
+{
+ if (file->f_mode & FMODE_READ)
+ return seq_lseek(file, offset, origin);
+ else
+ return 0;
+}
+
static const struct file_operations tracing_fops = {
.open = tracing_open,
.read = seq_read,
.write = tracing_write_stub,
- .llseek = seq_lseek,
+ .llseek = tracing_seek,
.release = tracing_release,
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [095/152] arch/tile: handle CLONE_SETTLS in copy_thread(), not user space
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (93 preceding siblings ...)
2011-01-06 0:23 ` [094/152] tracing: Fix panic when lseek() called on "trace" opened for writing Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [096/152] x86, gcc-4.6: Use gcc -m options when building vdso Greg KH
` (57 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Chris Metcalf
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Metcalf <cmetcalf@tilera.com>
commit bc4cf2bb271b2d557fc510426755da786fc985be upstream.
Previously we were just setting up the "tp" register in the
new task as started by clone() in libc. However, this is not
quite right, since in principle a signal might be delivered to
the new task before it had its TLS set up. (Of course, this race
window still exists for resetting the libc getpid() cached value
in the new task, in principle. But in any case, we are now doing
this exactly the way all other architectures do it.)
This change is important for 2.6.37 since the tile glibc we will
be submitting upstream will not set TLS in user space any more,
so it will only work on a kernel that has this fix. It should
also be taken for 2.6.36.x in the stable tree if possible.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/tile/kernel/process.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -212,6 +212,13 @@ int copy_thread(unsigned long clone_flag
childregs->sp = sp; /* override with new user stack pointer */
/*
+ * If CLONE_SETTLS is set, set "tp" in the new task to "r4",
+ * which is passed in as arg #5 to sys_clone().
+ */
+ if (clone_flags & CLONE_SETTLS)
+ childregs->tp = regs->regs[4];
+
+ /*
* Copy the callee-saved registers from the passed pt_regs struct
* into the context-switch callee-saved registers area.
* We have to restore the callee-saved registers since we may
^ permalink raw reply [flat|nested] 177+ messages in thread* [096/152] x86, gcc-4.6: Use gcc -m options when building vdso
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (94 preceding siblings ...)
2011-01-06 0:23 ` [095/152] arch/tile: handle CLONE_SETTLS in copy_thread(), not user space Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [097/152] x86: Enable the intr-remap fault handling after local APIC setup Greg KH
` (56 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: H. Peter Anvin <hpa@linux.intel.com>
commit de2a8cf98ecdde25231d6c5e7901e2cffaf32af9 upstream.
The vdso Makefile passes linker-style -m options not to the linker but
to gcc. This happens to work with earlier gcc, but fails with gcc
4.6. Pass gcc-style -m options, instead.
Note: all currently supported versions of gcc supports -m32, so there
is no reason to conditionalize it any more.
Reported-by: H. J. Lu <hjl.tools@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
LKML-Reference: <tip-*@git.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/vdso/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -25,7 +25,7 @@ targets += vdso.so vdso.so.dbg vdso.lds
export CPPFLAGS_vdso.lds += -P -C
-VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -Wl,-soname=linux-vdso.so.1 \
+VDSO_LDFLAGS_vdso.lds = -m64 -Wl,-soname=linux-vdso.so.1 \
-Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096
$(obj)/vdso.o: $(src)/vdso.S $(obj)/vdso.so
@@ -69,7 +69,7 @@ vdso32.so-$(VDSO32-y) += sysenter
vdso32-images = $(vdso32.so-y:%=vdso32-%.so)
CPPFLAGS_vdso32.lds = $(CPPFLAGS_vdso.lds)
-VDSO_LDFLAGS_vdso32.lds = -m elf_i386 -Wl,-soname=linux-gate.so.1
+VDSO_LDFLAGS_vdso32.lds = -m32 -Wl,-soname=linux-gate.so.1
# This makes sure the $(obj) subdirectory exists even though vdso32/
# is not a kbuild sub-make subdirectory.
^ permalink raw reply [flat|nested] 177+ messages in thread* [097/152] x86: Enable the intr-remap fault handling after local APIC setup
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (95 preceding siblings ...)
2011-01-06 0:23 ` [096/152] x86, gcc-4.6: Use gcc -m options when building vdso Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [098/152] x86, vt-d: Handle previous faults after enabling fault handling Greg KH
` (55 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Kenji Kaneshige,
Suresh Siddha, Chris Wright, H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
commit 7f7fbf45c6b748074546f7f16b9488ca71de99c1 upstream.
Interrupt-remapping gets enabled very early in the boot, as it determines the
apic mode that the processor can use. And the current code enables the vt-d
fault handling before the setup_local_APIC(). And hence the APIC LDR registers
and data structure in the memory may not be initialized. So the vt-d fault
handling in logical xapic/x2apic modes were broken.
Fix this by enabling the vt-d fault handling in the end_local_APIC_setup()
A cleaner fix of enabling fault handling while enabling intr-remapping
will be addressed for v2.6.38. [ Enabling intr-remapping determines the
usage of x2apic mode and the apic mode determines the fault-handling
configuration. ]
Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
LKML-Reference: <20101201062244.541996375@intel.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/apic/apic.c | 8 ++++++++
arch/x86/kernel/apic/probe_64.c | 7 -------
2 files changed, 8 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1340,6 +1340,14 @@ void __cpuinit end_local_APIC_setup(void
setup_apic_nmi_watchdog(NULL);
apic_pm_activate();
+
+ /*
+ * Now that local APIC setup is completed for BP, configure the fault
+ * handling for interrupt remapping.
+ */
+ if (!smp_processor_id() && intr_remapping_enabled)
+ enable_drhd_fault_handling();
+
}
#ifdef CONFIG_X86_X2APIC
--- a/arch/x86/kernel/apic/probe_64.c
+++ b/arch/x86/kernel/apic/probe_64.c
@@ -76,13 +76,6 @@ void __init default_setup_apic_routing(v
/* need to update phys_pkg_id */
apic->phys_pkg_id = apicid_phys_pkg_id;
}
-
- /*
- * Now that apic routing model is selected, configure the
- * fault handling for intr remapping.
- */
- if (intr_remapping_enabled)
- enable_drhd_fault_handling();
}
/* Same for both flat and physical. */
^ permalink raw reply [flat|nested] 177+ messages in thread* [098/152] x86, vt-d: Handle previous faults after enabling fault handling
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (96 preceding siblings ...)
2011-01-06 0:23 ` [097/152] x86: Enable the intr-remap fault handling after local APIC setup Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [099/152] x86, vt-d: Fix the vt-d fault handling irq migration in the x2apic mode Greg KH
` (54 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Suresh Siddha, Chris Wright,
H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <suresh.b.siddha@intel.com>
commit 7f99d946e71e71d484b7543b49e990508e70d0c0 upstream.
Fault handling is getting enabled after enabling the interrupt-remapping (as
the success of interrupt-remapping can affect the apic mode and hence the
fault handling mode).
Hence there can potentially be some faults between the window of enabling
interrupt-remapping in the vt-d and the fault-handling of the vt-d units.
Handle any previous faults after enabling the vt-d fault handling.
For v2.6.38 cleanup, need to check if we can remove the dmar_fault() in the
enable_intr_remapping() and see if we can enable fault handling along with
enabling intr-remapping.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <20101201062244.630417138@intel.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/pci/dmar.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -1414,6 +1414,11 @@ int __init enable_drhd_fault_handling(vo
(unsigned long long)drhd->reg_base_addr, ret);
return -1;
}
+
+ /*
+ * Clear any previous faults.
+ */
+ dmar_fault(iommu->irq, iommu);
}
return 0;
^ permalink raw reply [flat|nested] 177+ messages in thread* [099/152] x86, vt-d: Fix the vt-d fault handling irq migration in the x2apic mode
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (97 preceding siblings ...)
2011-01-06 0:23 ` [098/152] x86, vt-d: Handle previous faults after enabling fault handling Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [100/152] x86, vt-d: Quirk for masking vtd spec errors to platform error handling logic Greg KH
` (53 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Kenji Kaneshige,
Suresh Siddha, Chris Wright, H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
commit 086e8ced65d9bcc4a8e8f1cd39b09640f2883f90 upstream.
In x2apic mode, we need to set the upper address register of the fault
handling interrupt register of the vt-d hardware. Without this
irq migration of the vt-d fault handling interrupt is broken.
Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
LKML-Reference: <1291225233.2648.39.camel@sbsiddha-MOBL3>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Tested-by: Takao Indoh <indou.takao@jp.fujitsu.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/apic/io_apic.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -3626,6 +3626,7 @@ static int dmar_msi_set_affinity(unsigne
msg.data |= MSI_DATA_VECTOR(cfg->vector);
msg.address_lo &= ~MSI_ADDR_DEST_ID_MASK;
msg.address_lo |= MSI_ADDR_DEST_ID(dest);
+ msg.address_hi = MSI_ADDR_BASE_HI | MSI_ADDR_EXT_DEST_ID(dest);
dmar_msi_write(irq, &msg);
^ permalink raw reply [flat|nested] 177+ messages in thread* [100/152] x86, vt-d: Quirk for masking vtd spec errors to platform error handling logic
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (98 preceding siblings ...)
2011-01-06 0:23 ` [099/152] x86, vt-d: Fix the vt-d fault handling irq migration in the x2apic mode Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [101/152] rt2x00: Fix max TX power settings Greg KH
` (52 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Suresh Siddha, Chris Wright,
Kenji Kaneshige, H. Peter Anvin
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <suresh.b.siddha@intel.com>
commit 254e42006c893f45bca48f313536fcba12206418 upstream.
On platforms with Intel 7500 chipset, there were some reports of system
hang/NMI's during kexec/kdump in the presence of interrupt-remapping enabled.
During kdump, there is a window where the devices might be still using old
kernel's interrupt information, while the kdump kernel is coming up. This can
cause vt-d faults as the interrupt configuration from the old kernel map to
null IRTE entries in the new kernel etc. (with out interrupt-remapping enabled,
we still have the same issue but in this case we will see benign spurious
interrupt hit the new kernel).
Based on platform config settings, these platforms seem to generate NMI/SMI
when a vt-d fault happens and there were reports that the resulting SMI causes
the system to hang.
Fix it by masking vt-d spec defined errors to platform error reporting logic.
VT-d spec related errors are already handled by the VT-d OS code, so need to
report the same error through other channels.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <1291667190.2675.8.camel@sbsiddha-MOBL3.sc.intel.com>
Reported-by: Max Asbock <masbock@linux.vnet.ibm.com>
Reported-and-tested-by: Takao Indoh <indou.takao@jp.fujitsu.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Acked-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/pci/quirks.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2714,6 +2714,29 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RI
DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
#endif /*CONFIG_MMC_RICOH_MMC*/
+#if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
+#define VTUNCERRMSK_REG 0x1ac
+#define VTD_MSK_SPEC_ERRORS (1 << 31)
+/*
+ * This is a quirk for masking vt-d spec defined errors to platform error
+ * handling logic. With out this, platforms using Intel 7500, 5500 chipsets
+ * (and the derivative chipsets like X58 etc) seem to generate NMI/SMI (based
+ * on the RAS config settings of the platform) when a vt-d fault happens.
+ * The resulting SMI caused the system to hang.
+ *
+ * VT-d spec related errors are already handled by the VT-d OS code, so no
+ * need to report the same error through other channels.
+ */
+static void vtd_mask_spec_errors(struct pci_dev *dev)
+{
+ u32 word;
+
+ pci_read_config_dword(dev, VTUNCERRMSK_REG, &word);
+ pci_write_config_dword(dev, VTUNCERRMSK_REG, word | VTD_MSK_SPEC_ERRORS);
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x342e, vtd_mask_spec_errors);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+#endif
static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
struct pci_fixup *end)
^ permalink raw reply [flat|nested] 177+ messages in thread* [101/152] rt2x00: Fix max TX power settings
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (99 preceding siblings ...)
2011-01-06 0:23 ` [100/152] x86, vt-d: Quirk for masking vtd spec errors to platform error handling logic Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [102/152] ALSA: hda - Enable jack sense for Thinkpad Edge 11 Greg KH
` (51 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ivo van Doorn, Helmut Schaa,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ivo van Doorn <ivdoorn@gmail.com>
commit 8d1331b37d5b656a7a8e561f8e9d7661dd00c910 upstream.
During initialization each driver reads the default TX power
for each individual channel. However mac80211 only accepts the
maximum value (which is also handled as default value).
As a result, the TX power of the device was being limited to
the default value, which is often quite low compared to the
real maximum acceptable value.
This patch allows each driver to set the maximum value on a
per-channel basis which is forwarded to mac80211. The default
value will be preserved for now, in case we want to update
mac80211 to differentiate between the maximum and default txpower.
This fixes bug complaining about limited TX power values like:
https://bugzilla.kernel.org/show_bug.cgi?id=16358
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/rt2x00/rt2400pci.c | 6 ++-
drivers/net/wireless/rt2x00/rt2500pci.c | 12 ++++--
drivers/net/wireless/rt2x00/rt2500usb.c | 12 ++++--
drivers/net/wireless/rt2x00/rt2800.h | 7 +++
drivers/net/wireless/rt2x00/rt2800lib.c | 59 ++++++++++++++++++--------------
drivers/net/wireless/rt2x00/rt2x00.h | 5 +-
drivers/net/wireless/rt2x00/rt2x00dev.c | 2 -
drivers/net/wireless/rt2x00/rt61pci.c | 12 ++++--
drivers/net/wireless/rt2x00/rt73usb.c | 12 ++++--
9 files changed, 82 insertions(+), 45 deletions(-)
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1488,8 +1488,10 @@ static int rt2400pci_probe_hw_mode(struc
spec->channels_info = info;
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
- for (i = 0; i < 14; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 0; i < 14; i++) {
+ info[i].max_power = TXPOWER_FROM_DEV(MAX_TXPOWER);
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
return 0;
}
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1802,12 +1802,16 @@ static int rt2500pci_probe_hw_mode(struc
spec->channels_info = info;
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
- for (i = 0; i < 14; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 0; i < 14; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
if (spec->num_channels > 14) {
- for (i = 14; i < spec->num_channels; i++)
- info[i].tx_power1 = DEFAULT_TXPOWER;
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = DEFAULT_TXPOWER;
+ }
}
return 0;
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1705,12 +1705,16 @@ static int rt2500usb_probe_hw_mode(struc
spec->channels_info = info;
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
- for (i = 0; i < 14; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 0; i < 14; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
if (spec->num_channels > 14) {
- for (i = 14; i < spec->num_channels; i++)
- info[i].tx_power1 = DEFAULT_TXPOWER;
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = DEFAULT_TXPOWER;
+ }
}
return 0;
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1841,6 +1841,13 @@ struct mac_iveiv_entry {
#define EEPROM_RSSI_A2_LNA_A2 FIELD16(0xff00)
/*
+ * EEPROM Maximum TX power values
+ */
+#define EEPROM_MAX_TX_POWER 0x0027
+#define EEPROM_MAX_TX_POWER_24GHZ FIELD16(0x00ff)
+#define EEPROM_MAX_TX_POWER_5GHZ FIELD16(0xff00)
+
+/*
* EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
* This is delta in 40MHZ.
* VALUE: Tx Power dalta value (MAX=4)
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1120,27 +1120,27 @@ static void rt2800_config_channel_rf2xxx
* double meaning, and we should set a 7DBm boost flag.
*/
rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
- (info->tx_power1 >= 0));
+ (info->default_power1 >= 0));
- if (info->tx_power1 < 0)
- info->tx_power1 += 7;
+ if (info->default_power1 < 0)
+ info->default_power1 += 7;
rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
- TXPOWER_A_TO_DEV(info->tx_power1));
+ TXPOWER_A_TO_DEV(info->default_power1));
rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
- (info->tx_power2 >= 0));
+ (info->default_power2 >= 0));
- if (info->tx_power2 < 0)
- info->tx_power2 += 7;
+ if (info->default_power2 < 0)
+ info->default_power2 += 7;
rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
- TXPOWER_A_TO_DEV(info->tx_power2));
+ TXPOWER_A_TO_DEV(info->default_power2));
} else {
rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
- TXPOWER_G_TO_DEV(info->tx_power1));
+ TXPOWER_G_TO_DEV(info->default_power1));
rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
- TXPOWER_G_TO_DEV(info->tx_power2));
+ TXPOWER_G_TO_DEV(info->default_power2));
}
rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
@@ -1180,13 +1180,11 @@ static void rt2800_config_channel_rf3xxx
rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
rt2800_rfcsr_read(rt2x00dev, 12, &rfcsr);
- rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
- TXPOWER_G_TO_DEV(info->tx_power1));
+ rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER, info->default_power1);
rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
rt2800_rfcsr_read(rt2x00dev, 13, &rfcsr);
- rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER,
- TXPOWER_G_TO_DEV(info->tx_power2));
+ rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER, info->default_power2);
rt2800_rfcsr_write(rt2x00dev, 13, rfcsr);
rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
@@ -2516,6 +2514,13 @@ int rt2800_validate_eeprom(struct rt2x00
default_lna_gain);
rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+ rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &word);
+ if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_24GHZ) == 0xff)
+ rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_24GHZ, MAX_G_TXPOWER);
+ if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_5GHZ) == 0xff)
+ rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_5GHZ, MAX_A_TXPOWER);
+ rt2x00_eeprom_write(rt2x00dev, EEPROM_MAX_TX_POWER, word);
+
return 0;
}
EXPORT_SYMBOL_GPL(rt2800_validate_eeprom);
@@ -2755,9 +2760,10 @@ int rt2800_probe_hw_mode(struct rt2x00_d
{
struct hw_mode_spec *spec = &rt2x00dev->spec;
struct channel_info *info;
- char *tx_power1;
- char *tx_power2;
+ char *default_power1;
+ char *default_power2;
unsigned int i;
+ unsigned short max_power;
u16 eeprom;
/*
@@ -2871,21 +2877,26 @@ int rt2800_probe_hw_mode(struct rt2x00_d
spec->channels_info = info;
- tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
- tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+ rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &eeprom);
+ max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_24GHZ);
+ default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+ default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
for (i = 0; i < 14; i++) {
- info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
- info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+ info[i].max_power = max_power;
+ info[i].default_power1 = TXPOWER_G_FROM_DEV(default_power1[i]);
+ info[i].default_power2 = TXPOWER_G_FROM_DEV(default_power2[i]);
}
if (spec->num_channels > 14) {
- tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
- tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+ max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_5GHZ);
+ default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+ default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
for (i = 14; i < spec->num_channels; i++) {
- info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
- info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+ info[i].max_power = max_power;
+ info[i].default_power1 = TXPOWER_A_FROM_DEV(default_power1[i]);
+ info[i].default_power2 = TXPOWER_A_FROM_DEV(default_power2[i]);
}
}
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -212,8 +212,9 @@ struct channel_info {
unsigned int flags;
#define GEOGRAPHY_ALLOWED 0x00000001
- short tx_power1;
- short tx_power2;
+ short max_power;
+ short default_power1;
+ short default_power2;
};
/*
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -710,7 +710,7 @@ static int rt2x00lib_probe_hw_modes(stru
for (i = 0; i < spec->num_channels; i++) {
rt2x00lib_channel(&channels[i],
spec->channels[i].channel,
- spec->channels_info[i].tx_power1, i);
+ spec->channels_info[i].max_power, i);
}
/*
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2661,13 +2661,17 @@ static int rt61pci_probe_hw_mode(struct
spec->channels_info = info;
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
- for (i = 0; i < 14; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 0; i < 14; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
if (spec->num_channels > 14) {
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
- for (i = 14; i < spec->num_channels; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
}
return 0;
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2091,13 +2091,17 @@ static int rt73usb_probe_hw_mode(struct
spec->channels_info = info;
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
- for (i = 0; i < 14; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 0; i < 14; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
if (spec->num_channels > 14) {
tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
- for (i = 14; i < spec->num_channels; i++)
- info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+ info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+ }
}
return 0;
^ permalink raw reply [flat|nested] 177+ messages in thread* [102/152] ALSA: hda - Enable jack sense for Thinkpad Edge 11
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (100 preceding siblings ...)
2011-01-06 0:23 ` [101/152] rt2x00: Fix max TX power settings Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [103/152] Input: synaptics - fix handling of 2-button ClickPads Greg KH
` (50 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Manoj Iyer, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Manoj Iyer <manoj.iyer@canonical.com>
commit 6027277e77df2d2893d906c42f5c9f9abcb731e0 upstream.
Add a quirk entry for Thinkpad Edge 11 as well as other TP Edge models.
Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3099,6 +3099,7 @@ static struct snd_pci_quirk cxt5066_cfg_
SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
SND_PCI_QUIRK(0x17aa, 0x21b3, "Thinkpad Edge 13 (197)", CXT5066_IDEAPAD),
SND_PCI_QUIRK(0x17aa, 0x21b4, "Thinkpad Edge", CXT5066_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21c8, "Thinkpad Edge 11", CXT5066_IDEAPAD),
SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G series", CXT5066_IDEAPAD),
SND_PCI_QUIRK(0x17aa, 0x390a, "Lenovo S10-3t", CXT5066_IDEAPAD),
^ permalink raw reply [flat|nested] 177+ messages in thread* [103/152] Input: synaptics - fix handling of 2-button ClickPads
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (101 preceding siblings ...)
2011-01-06 0:23 ` [102/152] ALSA: hda - Enable jack sense for Thinkpad Edge 11 Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [104/152] install_special_mapping skips security_file_mmap check Greg KH
` (49 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Yan Li, Dmitry Torokhov
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yan Li <yan.i.li@intel.com>
commit 3bfa321e662edf90fb8123a02c987c2965fa50bb upstream.
Lenovo S10-3t's ClickPad is a 2-button ClickPad that reports BTN_LEFT
and BTN_RIGHT as normal touchpad, unlike the 1-button ClickPad used in
HP mini 210 that reports solely BTN_MIDDLE.
In 0xc0-cap response, the 1-button ClickPad has the 20-bit set while
2-button ClickPad has the 8-bit set.
This patch makes the kernel only handle 1-button ClickPad specially,
and treat 2-button ClickPad in the same fashion as regular touchpads.
This fixes kernel bug #18122 and MeeGo bug #4807.
Signed-off-by: Yan Li <yan.i.li@intel.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/input/mouse/synaptics.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -51,7 +51,8 @@
#define SYN_EXT_CAP_REQUESTS(c) (((c) & 0x700000) >> 20)
#define SYN_CAP_MULTI_BUTTON_NO(ec) (((ec) & 0x00f000) >> 12)
#define SYN_CAP_PRODUCT_ID(ec) (((ec) & 0xff0000) >> 16)
-#define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100100)
+#define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
+#define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
#define SYN_CAP_MAX_DIMENSIONS(ex0c) ((ex0c) & 0x020000)
/* synaptics modes query bits */
^ permalink raw reply [flat|nested] 177+ messages in thread* [104/152] install_special_mapping skips security_file_mmap check.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (102 preceding siblings ...)
2011-01-06 0:23 ` [103/152] Input: synaptics - fix handling of 2-button ClickPads Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [105/152] USB: misc: uss720.c: add another vendor/product ID Greg KH
` (48 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Tavis Ormandy, Kees Cook,
Robert Swiecki
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tavis Ormandy <taviso@cmpxchg8b.com>
commit 462e635e5b73ba9a4c03913b77138cd57ce4b050 upstream.
The install_special_mapping routine (used, for example, to setup the
vdso) skips the security check before insert_vm_struct, allowing a local
attacker to bypass the mmap_min_addr security restriction by limiting
the available pages for special mappings.
bprm_mm_init() also skips the check, and although I don't think this can
be used to bypass any restrictions, I don't see any reason not to have
the security check.
$ uname -m
x86_64
$ cat /proc/sys/vm/mmap_min_addr
65536
$ cat install_special_mapping.s
section .bss
resb BSS_SIZE
section .text
global _start
_start:
mov eax, __NR_pause
int 0x80
$ nasm -D__NR_pause=29 -DBSS_SIZE=0xfffed000 -f elf -o install_special_mapping.o install_special_mapping.s
$ ld -m elf_i386 -Ttext=0x10000 -Tbss=0x11000 -o install_special_mapping install_special_mapping.o
$ ./install_special_mapping &
[1] 14303
$ cat /proc/14303/maps
0000f000-00010000 r-xp 00000000 00:00 0 [vdso]
00010000-00011000 r-xp 00001000 00:19 2453665 /home/taviso/install_special_mapping
00011000-ffffe000 rwxp 00000000 00:00 0 [stack]
It's worth noting that Red Hat are shipping with mmap_min_addr set to
4096.
Signed-off-by: Tavis Ormandy <taviso@google.com>
Acked-by: Kees Cook <kees@ubuntu.com>
Acked-by: Robert Swiecki <swiecki@google.com>
[ Changed to not drop the error code - akpm ]
Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/exec.c | 5 +++++
mm/mmap.c | 16 ++++++++++++----
2 files changed, 17 insertions(+), 4 deletions(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -268,6 +268,11 @@ static int __bprm_mm_init(struct linux_b
vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
INIT_LIST_HEAD(&vma->anon_vma_chain);
+
+ err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+ if (err)
+ goto err;
+
err = insert_vm_struct(mm, vma);
if (err)
goto err;
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2460,6 +2460,7 @@ int install_special_mapping(struct mm_st
unsigned long addr, unsigned long len,
unsigned long vm_flags, struct page **pages)
{
+ int ret;
struct vm_area_struct *vma;
vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
@@ -2477,16 +2478,23 @@ int install_special_mapping(struct mm_st
vma->vm_ops = &special_mapping_vmops;
vma->vm_private_data = pages;
- if (unlikely(insert_vm_struct(mm, vma))) {
- kmem_cache_free(vm_area_cachep, vma);
- return -ENOMEM;
- }
+ ret = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+ if (ret)
+ goto out;
+
+ ret = insert_vm_struct(mm, vma);
+ if (ret)
+ goto out;
mm->total_vm += len >> PAGE_SHIFT;
perf_event_mmap(vma);
return 0;
+
+out:
+ kmem_cache_free(vm_area_cachep, vma);
+ return ret;
}
static DEFINE_MUTEX(mm_all_locks_mutex);
^ permalink raw reply [flat|nested] 177+ messages in thread* [105/152] USB: misc: uss720.c: add another vendor/product ID
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (103 preceding siblings ...)
2011-01-06 0:23 ` [104/152] install_special_mapping skips security_file_mmap check Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [106/152] USB: ftdi_sio: Add D.O.Tec PID Greg KH
` (47 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Thomas Sailer
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Sailer <t.sailer@alumni.ethz.ch>
commit ecc1624a2fff45780959efbcb73ace18fdb3c58d upstream.
Fabio Battaglia report that he has another cable that works with this
driver, so this patch adds its vendor/product ID.
Signed-off-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/misc/uss720.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -3,7 +3,7 @@
/*
* uss720.c -- USS720 USB Parport Cable.
*
- * Copyright (C) 1999, 2005
+ * Copyright (C) 1999, 2005, 2010
* Thomas Sailer (t.sailer@alumni.ethz.ch)
*
* This program is free software; you can redistribute it and/or modify
@@ -776,6 +776,8 @@ static const struct usb_device_id uss720
{ USB_DEVICE(0x0557, 0x2001) },
{ USB_DEVICE(0x0729, 0x1284) },
{ USB_DEVICE(0x1293, 0x0002) },
+ { USB_DEVICE(0x1293, 0x0002) },
+ { USB_DEVICE(0x050d, 0x0002) },
{ } /* Terminating entry */
};
^ permalink raw reply [flat|nested] 177+ messages in thread* [106/152] USB: ftdi_sio: Add D.O.Tec PID
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (104 preceding siblings ...)
2011-01-06 0:23 ` [105/152] USB: misc: uss720.c: add another vendor/product ID Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [107/152] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3 Greg KH
` (46 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Florian Faber
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Florian Faber <faberman@linuxproaudio.org>
commit 5363cdc3c5da9bd431552cf5989ab481596f0c6d upstream.
Add FTDI PID to identify D.O.Tec devices correctly.
Signed-off-by: Florian Faber <faberman@linuxproaudio.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
2 files changed, 6 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -796,6 +796,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ }, /* Optional parameter entry */
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1081,6 +1081,11 @@
#define MJSG_HD_RADIO_PID 0x937C
/*
+ * D.O.Tec products (http://www.directout.eu)
+ */
+#define FTDI_DOTEC_PID 0x9868
+
+/*
* Xverve Signalyzer tools (http://www.signalyzer.com/)
*/
#define XVERVE_SIGNALYZER_ST_PID 0xBCA0
^ permalink raw reply [flat|nested] 177+ messages in thread* [107/152] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (105 preceding siblings ...)
2011-01-06 0:23 ` [106/152] USB: ftdi_sio: Add D.O.Tec PID Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [108/152] Revert "USB: gadget: Allow function access to device ID data during bind()" Greg KH
` (45 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vitaly Kuznetsov, Alan Stern,
Matthew Dharm
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vitaly Kuznetsov <vitty@altlinux.ru>
commit d73a9b3001f29271c2e9f2a806b05a431c5d9591 upstream.
Add an unusual_devs entry for the Samsung YP-CP3 MP4 player.
User was getting the following errors in dmesg:
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: USB disconnect, address 2
sd 3:0:0:0: [sdb] Assuming drive cache: write through
sdb:<2>ldm_validate_partition_table(): Disk read failed.
Dev sdb: unable to read RDB block 0
unable to read partition table
Signed-off-by: Vitaly Kuznetsov <vitty@altlinux.ru>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -481,6 +481,13 @@ UNUSUAL_DEV( 0x04e8, 0x507c, 0x0220, 0x
US_SC_DEVICE, US_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64),
+/* Reported by Vitaly Kuznetsov <vitty@altlinux.ru> */
+UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x9999,
+ "Samsung",
+ "YP-CP3",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+
/* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
* Device uses standards-violating 32-byte Bulk Command Block Wrappers and
* reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
^ permalink raw reply [flat|nested] 177+ messages in thread* [108/152] Revert "USB: gadget: Allow function access to device ID data during bind()"
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (106 preceding siblings ...)
2011-01-06 0:23 ` [107/152] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3 Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [109/152] p54usb: add 5 more USBIDs Greg KH
` (44 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Robert Lukassen
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Greg Kroah-Hartman <gregkh@suse.de>
commit dbb442b85a1d82f91cfe0524c4f9b3a5196a10ca upstream.
This reverts commit 1ab83238740ff1e1773d5c13ecac43c60cf4aec4.
Turns out this doesn't allow for the device ids to be overridden
properly, so we need to revert the thing.
Reported-by: Jef Driesen <jefdriesen@telenet.be>
Cc: Robert Lukassen <Robert.Lukassen@tomtom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/gadget/composite.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1083,14 +1083,6 @@ static int composite_bind(struct usb_gad
*/
usb_ep_autoconfig_reset(cdev->gadget);
- /* standardized runtime overrides for device ID data */
- if (idVendor)
- cdev->desc.idVendor = cpu_to_le16(idVendor);
- if (idProduct)
- cdev->desc.idProduct = cpu_to_le16(idProduct);
- if (bcdDevice)
- cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
-
/* composite gadget needs to assign strings for whole device (like
* serial number), register function drivers, potentially update
* power state and consumption, etc
@@ -1102,6 +1094,14 @@ static int composite_bind(struct usb_gad
cdev->desc = *composite->dev;
cdev->desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
+ /* standardized runtime overrides for device ID data */
+ if (idVendor)
+ cdev->desc.idVendor = cpu_to_le16(idVendor);
+ if (idProduct)
+ cdev->desc.idProduct = cpu_to_le16(idProduct);
+ if (bcdDevice)
+ cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
+
/* strings can't be assigned before bind() allocates the
* releavnt identifiers
*/
^ permalink raw reply [flat|nested] 177+ messages in thread* [109/152] p54usb: add 5 more USBIDs
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (107 preceding siblings ...)
2011-01-06 0:23 ` [108/152] Revert "USB: gadget: Allow function access to device ID data during bind()" Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [110/152] p54usb: New USB ID for Gemtek WUBI-100GW Greg KH
` (43 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Christian Lamparter,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 16cad7fba037b34ca32cc0adac65bc089d969fb8 upstream.
This patch adds five more USBIDs to the table.
Source:
http://www.linuxant.com/pipermail/driverloader/2005q3/002307.html
http://wireless.kernel.org/en/users/Drivers/p54/devices (by M. Davis)
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/p54/p54usb.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -43,6 +43,7 @@ MODULE_FIRMWARE("isl3887usb");
static struct usb_device_id p54u_table[] __devinitdata = {
/* Version 1 devices (pci chip + net2280) */
+ {USB_DEVICE(0x0411, 0x0050)}, /* Buffalo WLI2-USB2-G54 */
{USB_DEVICE(0x045e, 0x00c2)}, /* Microsoft MN-710 */
{USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
{USB_DEVICE(0x06b9, 0x0120)}, /* Thomson SpeedTouch 120g */
@@ -56,9 +57,12 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
{USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
{USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
+ {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
{USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
{USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
+ {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
{USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
+ {USB_DEVICE(0x182d, 0x096b)}, /* Sitecom WL-107 */
{USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
{USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
{USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
@@ -94,6 +98,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
{USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
{USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
+ {USB_DEVICE(0x2001, 0x3705)}, /* D-Link DWL-G120 rev C1 */
{USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
{USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */
{USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */
^ permalink raw reply [flat|nested] 177+ messages in thread* [110/152] p54usb: New USB ID for Gemtek WUBI-100GW
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (108 preceding siblings ...)
2011-01-06 0:23 ` [109/152] p54usb: add 5 more USBIDs Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [111/152] n_gsm: Fix message length handling when building header Greg KH
` (42 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Larry Finger, Eduardo Costa,
John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eduardo Costa <ecosta.tmp@gmail.com>
commit 56e6417b49132d4f56e9f2241d31942b90b46315 upstream.
This USB ID is for the WUBI-100GW 802.11g Wireless LAN USB Device that
uses p54usb.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Eduardo Costa <ecosta.tmp@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -61,6 +61,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
{USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
{USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
+ {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */
{USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
{USB_DEVICE(0x182d, 0x096b)}, /* Sitecom WL-107 */
{USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
^ permalink raw reply [flat|nested] 177+ messages in thread* [111/152] n_gsm: Fix message length handling when building header
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (109 preceding siblings ...)
2011-01-06 0:23 ` [110/152] p54usb: New USB ID for Gemtek WUBI-100GW Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [112/152] n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked Greg KH
` (41 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ken Mills, Alan Cox
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ken Mills <ken.k.mills@intel.com>
commit be7a7411d63ccad165d66fe8e0b11b2ee336159b upstream.
Fix message length handling when building header
When the message length is greater than 127, the length field in the header
is built incorrectly. According to the spec, when the length is less than 128
the length field is a single byte formatted as: bbbbbbb1. When it is greater
than 127 then the field is two bytes of the format: bbbbbbb0 bbbbbbbb.
Signed-off-by: Ken Mills <ken.k.mills@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/n_gsm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_
if (msg->len < 128)
*--dp = (msg->len << 1) | EA;
else {
- *--dp = (msg->len >> 6) | EA;
- *--dp = (msg->len & 127) << 1;
+ *--dp = (msg->len >> 7); /* bits 7 - 15 */
+ *--dp = (msg->len & 127) << 1; /* bits 0 - 6 */
}
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [112/152] n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (110 preceding siblings ...)
2011-01-06 0:23 ` [111/152] n_gsm: Fix message length handling when building header Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [113/152] xhci: Fix issue with port array setup and buggy hosts Greg KH
` (40 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ken Mills, Alan Cox
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ken Mills <ken.k.mills@intel.com>
commit 093d804611b9a38fe59753b37c29f840518406a9 upstream.
gsm_data_alloc buffer allocation could fail and it is not being checked.
Add check for allocated buffer and return if the buffer allocation
fails.
Signed-off-by: Ken Mills <ken.k.mills@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/n_gsm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm
{
struct gsm_msg *msg;
msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);
+ if (msg == NULL)
+ return;
msg->data[0] = (cmd & 0xFE) << 1 | EA; /* Clear C/R */
msg->data[1] = (dlen << 1) | EA;
memcpy(msg->data + 2, data, dlen);
^ permalink raw reply [flat|nested] 177+ messages in thread* [113/152] xhci: Fix issue with port array setup and buggy hosts.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (111 preceding siblings ...)
2011-01-06 0:23 ` [112/152] n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [114/152] gpio: Fix null pointer dereference while accessing rdc321x platform_data Greg KH
` (39 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
commit f8bbeabc34aa945ab4275abc9a4dfde0aea798ca upstream.
Fix two bugs with the port array setup.
The first bug will only show up with broken xHCI hosts with Extended
Capabilities registers that have duplicate port speed entries for the same
port. The idea with the original code was to set the port_array entry to
-1 if the duplicate port speed entry said the port was a different speed
than the original port speed entry. That would mean that later, the port
would not be exposed to the USB core. Unfortunately, I forgot a continue
statement, and the port_array entry would just be overwritten in the next
line.
The second bug would happen if there are conflicting port speed registers
(so that some entry in port_array is -1), or one of the hardware port
registers was not described in the port speed registers (so that some
entry in port_array is 0). The code that sets up the usb2_ports array
would accidentally claim those ports. That wouldn't really cause any
user-visible issues, but it is a bug.
This patch should go into the stable trees that have the port array and
USB 3.0 port disabling prevention patches.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/host/xhci-mem.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1677,6 +1677,7 @@ static void xhci_add_in_port(struct xhci
xhci->port_array[i] = (u8) -1;
}
/* FIXME: Should we disable the port? */
+ continue;
}
xhci->port_array[i] = major_revision;
if (major_revision == 0x03)
@@ -1755,16 +1756,20 @@ static int xhci_setup_port_arrays(struct
return -ENOMEM;
port_index = 0;
- for (i = 0; i < num_ports; i++)
- if (xhci->port_array[i] != 0x03) {
- xhci->usb2_ports[port_index] =
- &xhci->op_regs->port_status_base +
- NUM_PORT_REGS*i;
- xhci_dbg(xhci, "USB 2.0 port at index %u, "
- "addr = %p\n", i,
- xhci->usb2_ports[port_index]);
- port_index++;
- }
+ for (i = 0; i < num_ports; i++) {
+ if (xhci->port_array[i] == 0x03 ||
+ xhci->port_array[i] == 0 ||
+ xhci->port_array[i] == -1)
+ continue;
+
+ xhci->usb2_ports[port_index] =
+ &xhci->op_regs->port_status_base +
+ NUM_PORT_REGS*i;
+ xhci_dbg(xhci, "USB 2.0 port at index %u, "
+ "addr = %p\n", i,
+ xhci->usb2_ports[port_index]);
+ port_index++;
+ }
}
if (xhci->num_usb3_ports) {
xhci->usb3_ports = kmalloc(sizeof(*xhci->usb3_ports)*
^ permalink raw reply [flat|nested] 177+ messages in thread* [114/152] gpio: Fix null pointer dereference while accessing rdc321x platform_data
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (112 preceding siblings ...)
2011-01-06 0:23 ` [113/152] xhci: Fix issue with port array setup and buggy hosts Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [115/152] cs5535-gpio: dont apply errata #36 to edge detect GPIOs Greg KH
` (38 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Florian Fainelli,
Samuel Ortiz
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Florian Fainelli <florian@openwrt.org>
commit fa6469cb5b2d16703464c344b943e2c025cb7858 upstream.
rdc321x-gpio currently fetches its driver specific data by using the
platform_device->platform_data pointer, this is wrong because the mfd
device which registers our platform_device has been added using
mfd_add_device() which sets the platform_device->driver_data pointer
instead.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpio/rdc321x-gpio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpio/rdc321x-gpio.c
+++ b/drivers/gpio/rdc321x-gpio.c
@@ -135,7 +135,7 @@ static int __devinit rdc321x_gpio_probe(
struct rdc321x_gpio *rdc321x_gpio_dev;
struct rdc321x_gpio_pdata *pdata;
- pdata = pdev->dev.platform_data;
+ pdata = platform_get_drvdata(pdev);
if (!pdata) {
dev_err(&pdev->dev, "no platform data supplied\n");
return -ENODEV;
^ permalink raw reply [flat|nested] 177+ messages in thread* [115/152] cs5535-gpio: dont apply errata #36 to edge detect GPIOs
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (113 preceding siblings ...)
2011-01-06 0:23 ` [114/152] gpio: Fix null pointer dereference while accessing rdc321x platform_data Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [116/152] cs5535-gpio: handle GPIO regs where higher (clear) bits are set Greg KH
` (37 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Andres Salomon
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andres Salomon <dilinger@queued.net>
commit 001851659354cce436b749a793f3512a53394d80 upstream.
The edge detect status GPIOs function differently from the other atomic
model CS5536 GPIO registers; writing 1 to the high bits clears the GPIO,
but writing 1 to the lower bits also clears the bit.
This means that read-modify-write doesn't actually work for it, so don't
apply the errata here. If a negative edge status gets lost after
resume.. well, we tried our best!
Tested-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpio/cs5535-gpio.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/gpio/cs5535-gpio.c
+++ b/drivers/gpio/cs5535-gpio.c
@@ -56,15 +56,22 @@ static struct cs5535_gpio_chip {
* registers, see include/linux/cs5535.h.
*/
-static void errata_outl(u32 val, unsigned long addr)
+static void errata_outl(struct cs5535_gpio_chip *chip, u32 val,
+ unsigned int reg)
{
+ unsigned long addr = chip->base + 0x80 + reg;
+
/*
* According to the CS5536 errata (#36), after suspend
* a write to the high bank GPIO register will clear all
* non-selected bits; the recommended workaround is a
* read-modify-write operation.
+ *
+ * Don't apply this errata to the edge status GPIOs, as writing
+ * to their lower bits will clear them.
*/
- val |= inl(addr);
+ if (reg != GPIO_POSITIVE_EDGE_STS && reg != GPIO_NEGATIVE_EDGE_STS)
+ val |= inl(addr);
outl(val, addr);
}
@@ -76,7 +83,7 @@ static void __cs5535_gpio_set(struct cs5
outl(1 << offset, chip->base + reg);
else
/* high bank register */
- errata_outl(1 << (offset - 16), chip->base + 0x80 + reg);
+ errata_outl(chip, 1 << (offset - 16), reg);
}
void cs5535_gpio_set(unsigned offset, unsigned int reg)
@@ -98,7 +105,7 @@ static void __cs5535_gpio_clear(struct c
outl(1 << (offset + 16), chip->base + reg);
else
/* high bank register */
- errata_outl(1 << offset, chip->base + 0x80 + reg);
+ errata_outl(chip, 1 << offset, reg);
}
void cs5535_gpio_clear(unsigned offset, unsigned int reg)
^ permalink raw reply [flat|nested] 177+ messages in thread* [116/152] cs5535-gpio: handle GPIO regs where higher (clear) bits are set
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (114 preceding siblings ...)
2011-01-06 0:23 ` [115/152] cs5535-gpio: dont apply errata #36 to edge detect GPIOs Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [117/152] mmc: at91_mci: fix multiblock SDIO transfers Greg KH
` (36 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Andres Salomon
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andres Salomon <dilinger@queued.net>
commit 44658a11f312fb9217674cb90b1a11cbe17fd18d upstream.
The default for non-READ_BACK GPIO regs is to have the clear bits set;
this means that our original errata fix was too simplistic. This
changes it to the following behavior:
- when setting GPIOs, ignore the higher order bits (they're for
clearing, we don't need to care about them).
- when clearing GPIOs, keep all the bits, but unset (via XOR) the
lower order bit that negates the clear bit that we care about. That
is, if we're clearing GPIO 26 (val = 0x04000000), we first XOR what's
currently in the register with 0x0400 (GPIO 26's SET bit), and then
OR that with the GPIO 26's CLEAR bit.
Tested-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpio/cs5535-gpio.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/gpio/cs5535-gpio.c
+++ b/drivers/gpio/cs5535-gpio.c
@@ -70,8 +70,12 @@ static void errata_outl(struct cs5535_gp
* Don't apply this errata to the edge status GPIOs, as writing
* to their lower bits will clear them.
*/
- if (reg != GPIO_POSITIVE_EDGE_STS && reg != GPIO_NEGATIVE_EDGE_STS)
- val |= inl(addr);
+ if (reg != GPIO_POSITIVE_EDGE_STS && reg != GPIO_NEGATIVE_EDGE_STS) {
+ if (val & 0xffff)
+ val |= (inl(addr) & 0xffff); /* ignore the high bits */
+ else
+ val |= (inl(addr) ^ (val >> 16));
+ }
outl(val, addr);
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [117/152] mmc: at91_mci: fix multiblock SDIO transfers
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (115 preceding siblings ...)
2011-01-06 0:23 ` [116/152] cs5535-gpio: handle GPIO regs where higher (clear) bits are set Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [118/152] mmc: atmel-mci: " Greg KH
` (35 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Yauhen Kharuzhy,
Nicolas Ferre, Jean-Christophe PLAGNIOL-VILLARD, Chris Ball
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yauhen Kharuzhy <yauhen.kharuzhy@promwad.com>
commit a2255ff45143001fecbc5e5a4b58fcb999d393ae upstream.
The AT91 MCI has special SDIO transfer types: SDIO block and SDIO byte
transfers, but at91_mci driver doesn't use them and handles all SDIO
transfers as ordinary MMC block transfers. This causes problems for
multiple-block SDIO transfers (in particular for 256-bytes blocks).
Fix this situation by checking the opcode for SDIO CMD53 and setting
the transfer type in the AT91_MCI_CMDR register properly.
This patch was tested with libertas SDIO driver: problem with TX
timeouts on big packets was eliminated.
Signed-off-by: Yauhen Kharuzhy <yauhen.kharuzhy@promwad.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/arm/mach-at91/include/mach/at91_mci.h | 2 ++
drivers/mmc/host/at91_mci.c | 13 +++++++++----
2 files changed, 11 insertions(+), 4 deletions(-)
--- a/arch/arm/mach-at91/include/mach/at91_mci.h
+++ b/arch/arm/mach-at91/include/mach/at91_mci.h
@@ -74,6 +74,8 @@
#define AT91_MCI_TRTYP_BLOCK (0 << 19)
#define AT91_MCI_TRTYP_MULTIPLE (1 << 19)
#define AT91_MCI_TRTYP_STREAM (2 << 19)
+#define AT91_MCI_TRTYP_SDIO_BYTE (4 << 19)
+#define AT91_MCI_TRTYP_SDIO_BLOCK (5 << 19)
#define AT91_MCI_BLKR 0x18 /* Block Register */
#define AT91_MCI_BLKR_BCNT(n) ((0xffff & (n)) << 0) /* Block count */
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -69,6 +69,7 @@
#include <linux/highmem.h>
#include <linux/mmc/host.h>
+#include <linux/mmc/sdio.h>
#include <asm/io.h>
#include <asm/irq.h>
@@ -493,10 +494,14 @@ static void at91_mci_send_command(struct
else if (data->flags & MMC_DATA_WRITE)
cmdr |= AT91_MCI_TRCMD_START;
- if (data->flags & MMC_DATA_STREAM)
- cmdr |= AT91_MCI_TRTYP_STREAM;
- if (data->blocks > 1)
- cmdr |= AT91_MCI_TRTYP_MULTIPLE;
+ if (cmd->opcode == SD_IO_RW_EXTENDED) {
+ cmdr |= AT91_MCI_TRTYP_SDIO_BLOCK;
+ } else {
+ if (data->flags & MMC_DATA_STREAM)
+ cmdr |= AT91_MCI_TRTYP_STREAM;
+ if (data->blocks > 1)
+ cmdr |= AT91_MCI_TRTYP_MULTIPLE;
+ }
}
else {
block_length = 0;
^ permalink raw reply [flat|nested] 177+ messages in thread* [118/152] mmc: atmel-mci: fix multiblock SDIO transfers
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (116 preceding siblings ...)
2011-01-06 0:23 ` [117/152] mmc: at91_mci: fix multiblock SDIO transfers Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [119/152] mmc: Fix re-probing with PM_POST_RESTORE notification Greg KH
` (34 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Nicolas Ferre,
Jean-Christophe PLAGNIOL-VILLARD, Chris Ball
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nicolas Ferre <nicolas.ferre@atmel.com>
commit 2f1d791882d21a4002a719fb016a1ac21c8bd6b7 upstream.
Based on report made by Yauhen in:
"MMC: Fix multiblock SDIO transfers in AT91 MCI" patch,
I report those changes to the brother driver: atmel-mci.
So, this patch sets SDIO transfer types: SDIO block and SDIO byte
transfers instead of using ordinary MMC block transfers.
It is checking opcode for SDIO CMD53 and setting transfer
type in MCI_CMDR register properly.
Reported-by: Yauhen Kharuzhy <yauhen.kharuzhy@promwad.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mmc/host/atmel-mci.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -26,6 +26,7 @@
#include <linux/stat.h>
#include <linux/mmc/host.h>
+#include <linux/mmc/sdio.h>
#include <mach/atmel-mci.h>
#include <linux/atmel-mci.h>
@@ -532,12 +533,17 @@ static u32 atmci_prepare_command(struct
data = cmd->data;
if (data) {
cmdr |= MCI_CMDR_START_XFER;
- if (data->flags & MMC_DATA_STREAM)
- cmdr |= MCI_CMDR_STREAM;
- else if (data->blocks > 1)
- cmdr |= MCI_CMDR_MULTI_BLOCK;
- else
- cmdr |= MCI_CMDR_BLOCK;
+
+ if (cmd->opcode == SD_IO_RW_EXTENDED) {
+ cmdr |= MCI_CMDR_SDIO_BLOCK;
+ } else {
+ if (data->flags & MMC_DATA_STREAM)
+ cmdr |= MCI_CMDR_STREAM;
+ else if (data->blocks > 1)
+ cmdr |= MCI_CMDR_MULTI_BLOCK;
+ else
+ cmdr |= MCI_CMDR_BLOCK;
+ }
if (data->flags & MMC_DATA_READ)
cmdr |= MCI_CMDR_TRDIR_READ;
^ permalink raw reply [flat|nested] 177+ messages in thread* [119/152] mmc: Fix re-probing with PM_POST_RESTORE notification
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (117 preceding siblings ...)
2011-01-06 0:23 ` [118/152] mmc: atmel-mci: " Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [120/152] fix freeing user_struct in user cache Greg KH
` (33 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Takashi Iwai, Chris Ball
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 274476f8fe0b6ac9bac542cc39de12c3dd0f43f6 upstream.
In the error-path where PM notifies PM_POST_RESTORE, the rescan-blockage
should be cleared as well. Otherwise it'll be never re-probed.
Also, as a bonus, this fixes a bug in S4 with user-mode suspend in the
current code, as it sends PM_POST_RESTORE instead of
PM_POST_HIBERNATION wrongly.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mmc/core/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1720,6 +1720,7 @@ int mmc_pm_notify(struct notifier_block
case PM_POST_SUSPEND:
case PM_POST_HIBERNATION:
+ case PM_POST_RESTORE:
spin_lock_irqsave(&host->lock, flags);
host->rescan_disable = 0;
^ permalink raw reply [flat|nested] 177+ messages in thread* [120/152] fix freeing user_struct in user cache
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (118 preceding siblings ...)
2011-01-06 0:23 ` [119/152] mmc: Fix re-probing with PM_POST_RESTORE notification Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [121/152] rtc: rs5c372: fix buffer size Greg KH
` (32 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Hillf Danton, Serge Hallyn
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Hillf Danton <dhillf@gmail.com>
commit 4ef9e11d6867f88951e30db910fa015300e31871 upstream.
When racing on adding into user cache, the new allocated from mm slab
is freed without putting user namespace.
Since the user namespace is already operated by getting, putting has
to be issued.
Signed-off-by: Hillf Danton <dhillf@gmail.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/user.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -157,6 +157,7 @@ struct user_struct *alloc_uid(struct use
spin_lock_irq(&uidhash_lock);
up = uid_hash_find(uid, hashent);
if (up) {
+ put_user_ns(ns);
key_put(new->uid_keyring);
key_put(new->session_keyring);
kmem_cache_free(uid_cachep, new);
^ permalink raw reply [flat|nested] 177+ messages in thread* [121/152] rtc: rs5c372: fix buffer size
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (119 preceding siblings ...)
2011-01-06 0:23 ` [120/152] fix freeing user_struct in user cache Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [122/152] RAMOOPS: Dont overflow over non-allocated regions Greg KH
` (31 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Wolfram Sang,
Alessandro Zummo
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Wolfram Sang <w.sang@pengutronix.de>
commit 118364948fad7b6c0469ef2d3ddaee447d7a0b5f upstream.
Match the buffer size to the amount of initialized values. Before, it was
one too big and thus destroyed the neighbouring register causing the clock
to run at false speeds.
Reported-by: Andre van Rooyen <a.v.rooyen@sercom.nl>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/rtc/rtc-rs5c372.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -207,7 +207,7 @@ static int rs5c372_get_datetime(struct i
static int rs5c372_set_datetime(struct i2c_client *client, struct rtc_time *tm)
{
struct rs5c372 *rs5c = i2c_get_clientdata(client);
- unsigned char buf[8];
+ unsigned char buf[7];
int addr;
dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d "
^ permalink raw reply [flat|nested] 177+ messages in thread* [122/152] RAMOOPS: Dont overflow over non-allocated regions
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (120 preceding siblings ...)
2011-01-06 0:23 ` [121/152] rtc: rs5c372: fix buffer size Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [123/152] watchdog: Fix null pointer dereference while accessing rdc321x platform_data Greg KH
` (30 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ahmed S. Darwish,
Marco Stornelli
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ahmed S. Darwish <darwish.07@gmail.com>
commit 1873bb8115e678ad9fd0aac9dbbc68383bc36e06 upstream.
The current code mis-calculates the ramoops header size, leading to an
overflow over the next record at best, or over a non-allocated region at
worst. Fix that calculation.
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: Marco Stornelli <marco.stornelli@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/ramoops.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/char/ramoops.c
+++ b/drivers/char/ramoops.c
@@ -27,7 +27,6 @@
#include <linux/ioport.h>
#define RAMOOPS_KERNMSG_HDR "===="
-#define RAMOOPS_HEADER_SIZE (5 + sizeof(struct timeval))
#define RECORD_SIZE 4096
@@ -63,8 +62,8 @@ static void ramoops_do_dump(struct kmsg_
struct ramoops_context, dump);
unsigned long s1_start, s2_start;
unsigned long l1_cpy, l2_cpy;
- int res;
- char *buf;
+ int res, hdr_size;
+ char *buf, *buf_orig;
struct timeval timestamp;
/* Only dump oopses if dump_oops is set */
@@ -72,6 +71,8 @@ static void ramoops_do_dump(struct kmsg_
return;
buf = (char *)(cxt->virt_addr + (cxt->count * RECORD_SIZE));
+ buf_orig = buf;
+
memset(buf, '\0', RECORD_SIZE);
res = sprintf(buf, "%s", RAMOOPS_KERNMSG_HDR);
buf += res;
@@ -79,8 +80,9 @@ static void ramoops_do_dump(struct kmsg_
res = sprintf(buf, "%lu.%lu\n", (long)timestamp.tv_sec, (long)timestamp.tv_usec);
buf += res;
- l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE));
- l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE) - l2_cpy);
+ hdr_size = buf - buf_orig;
+ l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - hdr_size));
+ l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - hdr_size) - l2_cpy);
s2_start = l2 - l2_cpy;
s1_start = l1 - l1_cpy;
^ permalink raw reply [flat|nested] 177+ messages in thread* [123/152] watchdog: Fix null pointer dereference while accessing rdc321x platform_data
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (121 preceding siblings ...)
2011-01-06 0:23 ` [122/152] RAMOOPS: Dont overflow over non-allocated regions Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [124/152] watchdog: Improve initialisation error message and documentation Greg KH
` (29 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Florian Fainelli,
Samuel Ortiz
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Florian Fainelli <florian@openwrt.org>
commit 3b3c1f24e96c411a95daabb6af9e09c5381f713b upstream.
rdc321x-wdt currently fetches its driver specific data by using the
platform_device->platform_data pointer, this is wrong because the mfd
device which registers our platform_device has been added using
mfd_add_device() which sets the platform_device->driver_data pointer
instead.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/watchdog/rdc321x_wdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -231,7 +231,7 @@ static int __devinit rdc321x_wdt_probe(s
struct resource *r;
struct rdc321x_wdt_pdata *pdata;
- pdata = pdev->dev.platform_data;
+ pdata = platform_get_drvdata(pdev);
if (!pdata) {
dev_err(&pdev->dev, "no platform data supplied\n");
return -ENODEV;
^ permalink raw reply [flat|nested] 177+ messages in thread* [124/152] watchdog: Improve initialisation error message and documentation
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (122 preceding siblings ...)
2011-01-06 0:23 ` [123/152] watchdog: Fix null pointer dereference while accessing rdc321x platform_data Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [125/152] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU Greg KH
` (28 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, 599368,
608138, Don Zickus, Frederic Weisbecker, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 551423748a4eba55f2eb0fc250d757986471f187 upstream.
The error message 'NMI watchdog failed to create perf event...'
does not make it clear that this is a fatal error for the
watchdog. It also currently prints the error value as a
pointer, rather than extracting the error code with PTR_ERR().
Fix that.
Add a note to the description of the 'nowatchdog' kernel
parameter to associate it with this message.
Reported-by: Cesare Leonardi <celeonar@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: 599368@bugs.debian.org
Cc: 608138@bugs.debian.org
Cc: Don Zickus <dzickus@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
LKML-Reference: <1294009362.3167.126.camel@localhost>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
Documentation/kernel-parameters.txt | 2 +-
kernel/watchdog.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1745,7 +1745,7 @@ and is between 256 and 4096 characters.
nousb [USB] Disable the USB subsystem
- nowatchdog [KNL] Disable the lockup detector.
+ nowatchdog [KNL] Disable the lockup detector (NMI watchdog).
nowb [ARM]
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -377,7 +377,8 @@ static int watchdog_nmi_enable(int cpu)
goto out_save;
}
- printk(KERN_ERR "NMI watchdog failed to create perf event on cpu%i: %p\n", cpu, event);
+ printk(KERN_ERR "NMI watchdog disabled for cpu%i: unable to create perf event: %ld\n",
+ cpu, PTR_ERR(event));
return -1;
/* success path */
^ permalink raw reply [flat|nested] 177+ messages in thread* [125/152] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (123 preceding siblings ...)
2011-01-06 0:23 ` [124/152] watchdog: Improve initialisation error message and documentation Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [126/152] mfd: Support additional parent IDs for wm831x Greg KH
` (27 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Robert Richter,
oprofile-list@lists.sourceforge.net, Peter Zijlstra,
Frederic Weisbecker, Rafael J. Wysocki, Dan Carpenter,
Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Robert Richter <robert.richter@amd.com>
commit c7c25802b39c443b3745cfa973dc49a97a3491f8 upstream.
Disable preemption in init_ibs(). The function only checks the
ibs capabilities and sets up pci devices (if necessary). It runs
only on one cpu but operates with the local APIC and some MSRs,
thus it is better to disable preemption.
[ 7.034377] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/483
[ 7.034385] caller is setup_APIC_eilvt+0x155/0x180
[ 7.034389] Pid: 483, comm: modprobe Not tainted 2.6.37-rc1-20101110+ #1
[ 7.034392] Call Trace:
[ 7.034400] [<ffffffff812a2b72>] debug_smp_processor_id+0xd2/0xf0
[ 7.034404] [<ffffffff8101e985>] setup_APIC_eilvt+0x155/0x180
[ ... ]
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22812
Reported-by: <atswartz@gmail.com>
Signed-off-by: Robert Richter <robert.richter@amd.com>
Cc: oprofile-list@lists.sourceforge.net <oprofile-list@lists.sourceforge.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <20110103111514.GM4739@erda.amd.com>
[ small cleanups ]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/oprofile/op_model_amd.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
--- a/arch/x86/oprofile/op_model_amd.c
+++ b/arch/x86/oprofile/op_model_amd.c
@@ -484,21 +484,29 @@ static int __init_ibs_nmi(void)
return 0;
}
-/* initialize the APIC for the IBS interrupts if available */
+/*
+ * check and reserve APIC extended interrupt LVT offset for IBS if
+ * available
+ *
+ * init_ibs() preforms implicitly cpu-local operations, so pin this
+ * thread to its current CPU
+ */
+
static void init_ibs(void)
{
- ibs_caps = get_ibs_caps();
+ preempt_disable();
+ ibs_caps = get_ibs_caps();
if (!ibs_caps)
- return;
+ goto out;
- if (__init_ibs_nmi()) {
+ if (__init_ibs_nmi() < 0)
ibs_caps = 0;
- return;
- }
+ else
+ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n",
- (unsigned)ibs_caps);
+out:
+ preempt_enable();
}
static int (*create_arch_files)(struct super_block *sb, struct dentry *root);
^ permalink raw reply [flat|nested] 177+ messages in thread* [126/152] mfd: Support additional parent IDs for wm831x
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (124 preceding siblings ...)
2011-01-06 0:23 ` [125/152] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [127/152] mfd: Supply IRQ base for WM832x devices Greg KH
` (26 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mark Brown, Samuel Ortiz
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
commit b93cef556162b0f33399bfe5f307c54f51554e09 upstream.
Some newer device revisions add a second parent ID. Support this in
the device validity checks done at startup.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mfd/wm831x-core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -1464,7 +1464,11 @@ static int wm831x_device_init(struct wm8
dev_err(wm831x->dev, "Failed to read parent ID: %d\n", ret);
goto err;
}
- if (ret != 0x6204) {
+ switch (ret) {
+ case 0x6204:
+ case 0x6246:
+ break;
+ default:
dev_err(wm831x->dev, "Device is not a WM831x: ID %x\n", ret);
ret = -EINVAL;
goto err;
^ permalink raw reply [flat|nested] 177+ messages in thread* [127/152] mfd: Supply IRQ base for WM832x devices
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (125 preceding siblings ...)
2011-01-06 0:23 ` [126/152] mfd: Support additional parent IDs for wm831x Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [128/152] drm/radeon/kms/evergreen: reset the grbm blocks at resume and init Greg KH
` (25 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mark Brown, Samuel Ortiz
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
commit bd7c72ed18d719c1fb0fdf6ff9042d8ab78fdf71 upstream.
Without this the IRQ base will not be correctly configured for the
subdevices.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mfd/wm831x-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -1621,7 +1621,7 @@ static int wm831x_device_init(struct wm8
case WM8321:
ret = mfd_add_devices(wm831x->dev, -1,
wm8320_devs, ARRAY_SIZE(wm8320_devs),
- NULL, 0);
+ NULL, wm831x->irq_base);
break;
default:
^ permalink raw reply [flat|nested] 177+ messages in thread* [128/152] drm/radeon/kms/evergreen: reset the grbm blocks at resume and init
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (126 preceding siblings ...)
2011-01-06 0:23 ` [127/152] mfd: Supply IRQ base for WM832x devices Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [129/152] drm/radeon/kms: fix evergreen asic reset Greg KH
` (24 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit 86f5c9edbb3bac37cc8cee6528a929005ba72aad upstream.
This fixes module reloading and resume as the gfx block seems to
be left in a bad state in some cases.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/evergreen.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2097,6 +2097,11 @@ int evergreen_resume(struct radeon_devic
{
int r;
+ /* reset the asic, the gfx blocks are often in a bad state
+ * after the driver is unloaded or after a resume
+ */
+ if (radeon_asic_reset(rdev))
+ dev_warn(rdev->dev, "GPU reset failed !\n");
/* Do not reset GPU before posting, on rv770 hw unlike on r500 hw,
* posting will perform necessary task to bring back GPU into good
* shape.
@@ -2193,6 +2198,11 @@ int evergreen_init(struct radeon_device
r = radeon_atombios_init(rdev);
if (r)
return r;
+ /* reset the asic, the gfx blocks are often in a bad state
+ * after the driver is unloaded or after a resume
+ */
+ if (radeon_asic_reset(rdev))
+ dev_warn(rdev->dev, "GPU reset failed !\n");
/* Post card if necessary */
if (!evergreen_card_posted(rdev)) {
if (!rdev->bios) {
^ permalink raw reply [flat|nested] 177+ messages in thread* [129/152] drm/radeon/kms: fix evergreen asic reset
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (127 preceding siblings ...)
2011-01-06 0:23 ` [128/152] drm/radeon/kms/evergreen: reset the grbm blocks at resume and init Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [130/152] drm/radeon/kms: reorder display resume to avoid problems Greg KH
` (23 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit 9f0c4f9c2f835eee1bbb93f96bf9483d56f1892b upstream.
Only reset the grbm blocks, srbm tends to lock the GPU
if not done properly and in most cases is not necessary.
Also, no need to call asic init after reset the grbm blocks.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/evergreen.c | 15 ---------------
1 file changed, 15 deletions(-)
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1423,7 +1423,6 @@ bool evergreen_gpu_is_lockup(struct rade
static int evergreen_gpu_soft_reset(struct radeon_device *rdev)
{
struct evergreen_mc_save save;
- u32 srbm_reset = 0;
u32 grbm_reset = 0;
dev_info(rdev->dev, "GPU softreset \n");
@@ -1462,16 +1461,6 @@ static int evergreen_gpu_soft_reset(stru
udelay(50);
WREG32(GRBM_SOFT_RESET, 0);
(void)RREG32(GRBM_SOFT_RESET);
-
- /* reset all the system blocks */
- srbm_reset = SRBM_SOFT_RESET_ALL_MASK;
-
- dev_info(rdev->dev, " SRBM_SOFT_RESET=0x%08X\n", srbm_reset);
- WREG32(SRBM_SOFT_RESET, srbm_reset);
- (void)RREG32(SRBM_SOFT_RESET);
- udelay(50);
- WREG32(SRBM_SOFT_RESET, 0);
- (void)RREG32(SRBM_SOFT_RESET);
/* Wait a little for things to settle down */
udelay(50);
dev_info(rdev->dev, " GRBM_STATUS=0x%08X\n",
@@ -1482,10 +1471,6 @@ static int evergreen_gpu_soft_reset(stru
RREG32(GRBM_STATUS_SE1));
dev_info(rdev->dev, " SRBM_STATUS=0x%08X\n",
RREG32(SRBM_STATUS));
- /* After reset we need to reinit the asic as GPU often endup in an
- * incoherent state.
- */
- atom_asic_init(rdev->mode_info.atom_context);
evergreen_mc_resume(rdev, &save);
return 0;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [130/152] drm/radeon/kms: reorder display resume to avoid problems
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (128 preceding siblings ...)
2011-01-06 0:23 ` [129/152] drm/radeon/kms: fix evergreen asic reset Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [131/152] drm/i915/dp: Fix I2C/EDID handling with active DisplayPort to DVI converter Greg KH
` (22 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit a93f344d3c04e4b84490c65f2a574387c593be40 upstream.
On resume, we were attemping to unblank the displays before the
timing and plls had be reprogrammed which led to atom timeouts
waiting for things that are not yet programmed. Re-program
the mode first, then reset the dpms state.
This fixes the infamous atombios timeouts on resume.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/atombios_crtc.c | 3 ++-
drivers/gpu/drm/radeon/radeon_device.c | 9 ++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -253,7 +253,8 @@ void atombios_crtc_dpms(struct drm_crtc
case DRM_MODE_DPMS_SUSPEND:
case DRM_MODE_DPMS_OFF:
drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
- atombios_blank_crtc(crtc, ATOM_ENABLE);
+ if (radeon_crtc->enabled)
+ atombios_blank_crtc(crtc, ATOM_ENABLE);
if (ASIC_IS_DCE3(rdev))
atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
atombios_enable_crtc(crtc, ATOM_DISABLE);
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -829,11 +829,6 @@ int radeon_resume_kms(struct drm_device
radeon_pm_resume(rdev);
radeon_restore_bios_scratch_regs(rdev);
- /* turn on display hw */
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
- }
-
radeon_fbdev_set_suspend(rdev, 0);
release_console_sem();
@@ -841,6 +836,10 @@ int radeon_resume_kms(struct drm_device
radeon_hpd_init(rdev);
/* blat the mode back in */
drm_helper_resume_force_mode(dev);
+ /* turn on display hw */
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ }
return 0;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [131/152] drm/i915/dp: Fix I2C/EDID handling with active DisplayPort to DVI converter
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (129 preceding siblings ...)
2011-01-06 0:23 ` [130/152] drm/radeon/kms: reorder display resume to avoid problems Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks Greg KH
` (21 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, David Flynn, Chris Wilson
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Flynn <davidf@rd.bbc.co.uk>
commit 8316f33766a82907c694267ff911e45e256f09f9 upstream.
The DisplayPort standard (1.1a) states that:
The I2C-over-AUX Reply field is valid only when Native AUX CH Reply
field is AUX_ACK (00). When Native AUX CH Reply field is not 00, then,
I2C-over-AUX Reply field must be 00 and be ignored.
This fixes broken EDID reading when using an active DisplayPort to
duallink DVI converter. If the AUX CH replier chooses to defer the
transaction, a short read occurs and erroneous data is returned as
the i2c reply due to a lack of length checking and failure to check
for AUX ACK.
As a result, broken EDIDs can look like:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: bc bc bc ff bc bc bc ff bc bc bc ac bc bc bc 45 ???.???.???????E
10: bc bc bc 10 bc bc bc 34 bc bc bc ee bc bc bc 4c ???????4???????L
20: bc bc bc 50 bc bc bc 00 bc bc bc 40 bc bc bc 00 ???P???.???@???.
30: bc bc bc 01 bc bc bc 01 bc bc bc a0 bc bc bc 40 ???????????????@
40: bc bc bc 00 bc bc bc 00 bc bc bc 00 bc bc bc 55 ???.???.???.???U
50: bc bc bc 35 bc bc bc 31 bc bc bc 20 bc bc bc fc ???5???1??? ????
60: bc bc bc 4c bc bc bc 34 bc bc bc 46 bc bc bc 00 ???L???4???F???.
70: bc bc bc 38 bc bc bc 11 bc bc bc 20 bc bc bc 20 ???8??????? ???
80: bc bc bc ff bc bc bc ff bc bc bc ff bc bc bc ff ???.???.???.???.
...
which can lead to:
[drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder
[drm:drm_edid_block_valid] *ERROR* Raw EDID:
<3>30 30 30 30 30 30 30 32 38 32 30 32 63 63 31 61 000000028202cc1a
<3>28 00 02 8c 00 00 00 00 18 00 00 00 00 00 00 00 (...............
<3>20 4c 61 73 74 20 62 65 61 63 6f 6e 3a 20 33 32 Last beacon: 32
<3>32 30 6d 73 20 61 67 6f 46 00 05 8c 00 00 00 00 20ms agoF.......
<3>36 00 00 00 00 00 00 00 00 0c 57 69 2d 46 69 20 6.........Wi-Fi
<3>52 6f 75 74 65 72 01 08 82 84 8b 96 24 30 48 6c Router......$0Hl
<3>03 01 01 06 02 00 00 2a 01 00 2f 01 00 32 04 0c .......*../..2..
<3>12 18 60 dd 09 00 10 18 02 00 00 01 00 00 18 00 ..`.............
Signed-off-by: David Flynn <davidf@rd.bbc.co.uk>
[ickle: fix up some surrounding checkpatch warnings]
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/intel_dp.c | 37 ++++++++++++++++++++++++++++++-------
1 file changed, 30 insertions(+), 7 deletions(-)
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -425,6 +425,7 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *
uint16_t address = algo_data->address;
uint8_t msg[5];
uint8_t reply[2];
+ unsigned retry;
int msg_bytes;
int reply_bytes;
int ret;
@@ -459,14 +460,33 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *
break;
}
- for (;;) {
- ret = intel_dp_aux_ch(intel_dp,
- msg, msg_bytes,
- reply, reply_bytes);
+ for (retry = 0; retry < 5; retry++) {
+ ret = intel_dp_aux_ch(intel_dp,
+ msg, msg_bytes,
+ reply, reply_bytes);
if (ret < 0) {
DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
return ret;
}
+
+ switch (reply[0] & AUX_NATIVE_REPLY_MASK) {
+ case AUX_NATIVE_REPLY_ACK:
+ /* I2C-over-AUX Reply field is only valid
+ * when paired with AUX ACK.
+ */
+ break;
+ case AUX_NATIVE_REPLY_NACK:
+ DRM_DEBUG_KMS("aux_ch native nack\n");
+ return -EREMOTEIO;
+ case AUX_NATIVE_REPLY_DEFER:
+ udelay(100);
+ continue;
+ default:
+ DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
+ reply[0]);
+ return -EREMOTEIO;
+ }
+
switch (reply[0] & AUX_I2C_REPLY_MASK) {
case AUX_I2C_REPLY_ACK:
if (mode == MODE_I2C_READ) {
@@ -474,17 +494,20 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *
}
return reply_bytes - 1;
case AUX_I2C_REPLY_NACK:
- DRM_DEBUG_KMS("aux_ch nack\n");
+ DRM_DEBUG_KMS("aux_i2c nack\n");
return -EREMOTEIO;
case AUX_I2C_REPLY_DEFER:
- DRM_DEBUG_KMS("aux_ch defer\n");
+ DRM_DEBUG_KMS("aux_i2c defer\n");
udelay(100);
break;
default:
- DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
+ DRM_ERROR("aux_i2c invalid reply 0x%02x\n", reply[0]);
return -EREMOTEIO;
}
}
+
+ DRM_ERROR("too many retries, giving up\n");
+ return -EREMOTEIO;
}
static int
^ permalink raw reply [flat|nested] 177+ messages in thread* [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (130 preceding siblings ...)
2011-01-06 0:23 ` [131/152] drm/i915/dp: Fix I2C/EDID handling with active DisplayPort to DVI converter Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-07 20:18 ` François Valenduc
2011-01-06 0:23 ` [133/152] drm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915 Greg KH
` (20 subsequent siblings)
152 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Chris Wilson
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 448f53a1ede54eb854d036abf54573281412d650 upstream.
Fixes the lack of output on the LVDS panel of the Lenovo U160.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31596
Reported-and-tested-by: Dirk Gouders <gouders@et.bocholt.fh-gelsenkirchen.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/intel_bios.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -276,7 +276,7 @@ parse_general_features(struct drm_i915_p
general->ssc_freq ? 66 : 48;
else if (IS_IRONLAKE(dev_priv->dev) || IS_GEN6(dev))
dev_priv->lvds_ssc_freq =
- general->ssc_freq ? 100 : 120;
+ general->ssc_freq ? 120 : 100;
else
dev_priv->lvds_ssc_freq =
general->ssc_freq ? 100 : 96;
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks
2011-01-06 0:23 ` [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks Greg KH
@ 2011-01-07 20:18 ` François Valenduc
2011-01-07 21:23 ` Greg KH
0 siblings, 1 reply; 177+ messages in thread
From: François Valenduc @ 2011-01-07 20:18 UTC (permalink / raw)
To: gregkh, linux-kernel
Le 06/01/11 01:23, Greg KH a écrit :
> 2.6.36-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
>
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> commit 448f53a1ede54eb854d036abf54573281412d650 upstream.
>
> Fixes the lack of output on the LVDS panel of the Lenovo U160.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31596
> Reported-and-tested-by: Dirk Gouders <gouders@et.bocholt.fh-gelsenkirchen.de>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
> drivers/gpu/drm/i915/intel_bios.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/gpu/drm/i915/intel_bios.c
> +++ b/drivers/gpu/drm/i915/intel_bios.c
> @@ -276,7 +276,7 @@ parse_general_features(struct drm_i915_p
> general->ssc_freq ? 66 : 48;
> else if (IS_IRONLAKE(dev_priv->dev) || IS_GEN6(dev))
> dev_priv->lvds_ssc_freq =
> - general->ssc_freq ? 100 : 120;
> + general->ssc_freq ? 120 : 100;
> else
> dev_priv->lvds_ssc_freq =
> general->ssc_freq ? 100 : 96;
>
>
This commit gives a black screen on many computers and has been reverted
between 2.6.37-rc8 and 2.6.37. Why has this been added to this review ?
Thanks,
François Valenduc
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks
2011-01-07 20:18 ` François Valenduc
@ 2011-01-07 21:23 ` Greg KH
0 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-07 21:23 UTC (permalink / raw)
To: François Valenduc; +Cc: linux-kernel
On Fri, Jan 07, 2011 at 09:18:40PM +0100, François Valenduc wrote:
> Le 06/01/11 01:23, Greg KH a écrit :
> > 2.6.36-stable review patch. If anyone has any objections, please let us know.
> >
> > ------------------
> >
> > From: Chris Wilson <chris@chris-wilson.co.uk>
> >
> > commit 448f53a1ede54eb854d036abf54573281412d650 upstream.
> >
> > Fixes the lack of output on the LVDS panel of the Lenovo U160.
> >
> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31596
> > Reported-and-tested-by: Dirk Gouders <gouders@et.bocholt.fh-gelsenkirchen.de>
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> >
> > ---
> > drivers/gpu/drm/i915/intel_bios.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > --- a/drivers/gpu/drm/i915/intel_bios.c
> > +++ b/drivers/gpu/drm/i915/intel_bios.c
> > @@ -276,7 +276,7 @@ parse_general_features(struct drm_i915_p
> > general->ssc_freq ? 66 : 48;
> > else if (IS_IRONLAKE(dev_priv->dev) || IS_GEN6(dev))
> > dev_priv->lvds_ssc_freq =
> > - general->ssc_freq ? 100 : 120;
> > + general->ssc_freq ? 120 : 100;
> > else
> > dev_priv->lvds_ssc_freq =
> > general->ssc_freq ? 100 : 96;
> >
> >
>
> This commit gives a black screen on many computers and has been reverted
> between 2.6.37-rc8 and 2.6.37. Why has this been added to this review ?
Because it was marked as a -stable patch.
If it's been reverted (and I now see that it has), I should drop it from
this tree. I'll go do that right now.
Thanks for pointing it out.
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* [133/152] drm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915.
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (131 preceding siblings ...)
2011-01-06 0:23 ` [132/152] drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [134/152] memcg: fix wrong VM_BUG_ON() in try_charge()s mm->owner check Greg KH
` (19 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Eric Anholt, Chris Wilson
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Anholt <eric@anholt.net>
commit 63ee41d794d9c555f84205517a68509848988760 upstream.
The IPS driver is designed to be able to run detached from i915 and
just not enable GPU turbo in that case, in order to avoid module
dependencies between the two drivers. This means that we don't know
what the load order between the two is going to be, and we had
previously only supported IPS after (optionally) i915, but not i915
after IPS. If the wrong order was chosen, you'd get no GPU turbo, and
something like half the possible graphics performance.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/i915_dma.c | 23 +++++++++++++++++++++++
drivers/platform/x86/intel_ips.c | 36 +++++++++++++++++++++++++++++++++---
drivers/platform/x86/intel_ips.h | 21 +++++++++++++++++++++
3 files changed, 77 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -34,6 +34,7 @@
#include "i915_drm.h"
#include "i915_drv.h"
#include "i915_trace.h"
+#include "../../../platform/x86/intel_ips.h"
#include <linux/pci.h>
#include <linux/vgaarb.h>
#include <linux/acpi.h>
@@ -2047,6 +2048,26 @@ out_unlock:
EXPORT_SYMBOL_GPL(i915_gpu_turbo_disable);
/**
+ * Tells the intel_ips driver that the i915 driver is now loaded, if
+ * IPS got loaded first.
+ *
+ * This awkward dance is so that neither module has to depend on the
+ * other in order for IPS to do the appropriate communication of
+ * GPU turbo limits to i915.
+ */
+static void
+ips_ping_for_i915_load(void)
+{
+ void (*link)(void);
+
+ link = symbol_get(ips_link_to_i915_driver);
+ if (link) {
+ link();
+ symbol_put(ips_link_to_i915_driver);
+ }
+}
+
+/**
* i915_driver_load - setup chip and create an initial config
* @dev: DRM device
* @flags: startup flags
@@ -2234,6 +2255,8 @@ int i915_driver_load(struct drm_device *
/* XXX Prevent module unload due to memory corruption bugs. */
__module_get(THIS_MODULE);
+ ips_ping_for_i915_load();
+
return 0;
out_workqueue_free:
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -75,6 +75,7 @@
#include <drm/i915_drm.h>
#include <asm/msr.h>
#include <asm/processor.h>
+#include "intel_ips.h"
#define PCI_DEVICE_ID_INTEL_THERMAL_SENSOR 0x3b32
@@ -245,6 +246,7 @@
#define thm_writel(off, val) writel((val), ips->regmap + (off))
static const int IPS_ADJUST_PERIOD = 5000; /* ms */
+static bool late_i915_load = false;
/* For initial average collection */
static const int IPS_SAMPLE_PERIOD = 200; /* ms */
@@ -339,6 +341,9 @@ struct ips_driver {
u64 orig_turbo_ratios;
};
+static bool
+ips_gpu_turbo_enabled(struct ips_driver *ips);
+
/**
* ips_cpu_busy - is CPU busy?
* @ips: IPS driver struct
@@ -517,7 +522,7 @@ static void ips_disable_cpu_turbo(struct
*/
static bool ips_gpu_busy(struct ips_driver *ips)
{
- if (!ips->gpu_turbo_enabled)
+ if (!ips_gpu_turbo_enabled(ips))
return false;
return ips->gpu_busy();
@@ -532,7 +537,7 @@ static bool ips_gpu_busy(struct ips_driv
*/
static void ips_gpu_raise(struct ips_driver *ips)
{
- if (!ips->gpu_turbo_enabled)
+ if (!ips_gpu_turbo_enabled(ips))
return;
if (!ips->gpu_raise())
@@ -549,7 +554,7 @@ static void ips_gpu_raise(struct ips_dri
*/
static void ips_gpu_lower(struct ips_driver *ips)
{
- if (!ips->gpu_turbo_enabled)
+ if (!ips_gpu_turbo_enabled(ips))
return;
if (!ips->gpu_lower())
@@ -1454,6 +1459,31 @@ out_err:
return false;
}
+static bool
+ips_gpu_turbo_enabled(struct ips_driver *ips)
+{
+ if (!ips->gpu_busy && late_i915_load) {
+ if (ips_get_i915_syms(ips)) {
+ dev_info(&ips->dev->dev,
+ "i915 driver attached, reenabling gpu turbo\n");
+ ips->gpu_turbo_enabled = !(thm_readl(THM_HTS) & HTS_GTD_DIS);
+ }
+ }
+
+ return ips->gpu_turbo_enabled;
+}
+
+void
+ips_link_to_i915_driver()
+{
+ /* We can't cleanly get at the various ips_driver structs from
+ * this caller (the i915 driver), so just set a flag saying
+ * that it's time to try getting the symbols again.
+ */
+ late_i915_load = true;
+}
+EXPORT_SYMBOL_GPL(ips_link_to_i915_driver);
+
static DEFINE_PCI_DEVICE_TABLE(ips_id_table) = {
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_THERMAL_SENSOR), },
--- /dev/null
+++ b/drivers/platform/x86/intel_ips.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2010 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ */
+
+void ips_link_to_i915_driver(void);
^ permalink raw reply [flat|nested] 177+ messages in thread* [134/152] memcg: fix wrong VM_BUG_ON() in try_charge()s mm->owner check
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (132 preceding siblings ...)
2011-01-06 0:23 ` [133/152] drm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915 Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [135/152] sound: Prevent buffer overflow in OSS load_mixer_volumes Greg KH
` (18 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daisuke Nishimura,
KOSAKI Motohiro, KAMEZAWA Hiroyuki, Hugh Dickins
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
commit ebb76ce16daf6908dc030dec1c00827d37129fe5 upstream.
At __mem_cgroup_try_charge(), VM_BUG_ON(!mm->owner) is checked.
But as commented in mem_cgroup_from_task(), mm->owner can be NULL
in some racy case. This check of VM_BUG_ON() is bad.
A possible story to hit this is at swapoff()->try_to_unuse(). It passes
mm_struct to mem_cgroup_try_charge_swapin() while mm->owner is NULL. If we
can't get proper mem_cgroup from swap_cgroup information, mm->owner is used
as charge target and we see NULL.
Cc: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Reported-by: Hugh Dickins <hughd@google.com>
Reported-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Reviewed-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
mm/memcontrol.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1730,19 +1730,18 @@ again:
rcu_read_lock();
p = rcu_dereference(mm->owner);
- VM_BUG_ON(!p);
/*
- * because we don't have task_lock(), "p" can exit while
- * we're here. In that case, "mem" can point to root
- * cgroup but never be NULL. (and task_struct itself is freed
- * by RCU, cgroup itself is RCU safe.) Then, we have small
- * risk here to get wrong cgroup. But such kind of mis-account
- * by race always happens because we don't have cgroup_mutex().
- * It's overkill and we allow that small race, here.
+ * Because we don't have task_lock(), "p" can exit.
+ * In that case, "mem" can point to root or p can be NULL with
+ * race with swapoff. Then, we have small risk of mis-accouning.
+ * But such kind of mis-account by race always happens because
+ * we don't have cgroup_mutex(). It's overkill and we allo that
+ * small race, here.
+ * (*) swapoff at el will charge against mm-struct not against
+ * task-struct. So, mm->owner can be NULL.
*/
mem = mem_cgroup_from_task(p);
- VM_BUG_ON(!mem);
- if (mem_cgroup_is_root(mem)) {
+ if (!mem || mem_cgroup_is_root(mem)) {
rcu_read_unlock();
goto done;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [135/152] sound: Prevent buffer overflow in OSS load_mixer_volumes
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (133 preceding siblings ...)
2011-01-06 0:23 ` [134/152] memcg: fix wrong VM_BUG_ON() in try_charge()s mm->owner check Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [136/152] KVM: enlarge number of possible CPUID leaves Greg KH
` (17 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Dan Rosenberg, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Rosenberg <drosenberg@vsecurity.com>
commit d81a12bc29ae4038770e05dce4ab7f26fd5880fb upstream.
The load_mixer_volumes() function, which can be triggered by
unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
a buffer overflow. Because the provided "name" argument isn't
guaranteed to be NULL terminated at the expected 32 bytes, it's possible
to overflow past the end of the last element in the mixer_vols array.
Further exploitation can result in an arbitrary kernel write (via
subsequent calls to load_mixer_volumes()) leading to privilege
escalation, or arbitrary kernel reads via get_mixer_levels(). In
addition, the strcmp() may leak bytes beyond the mixer_vols array.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/oss/soundcard.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -86,7 +86,7 @@ int *load_mixer_volumes(char *name, int
int i, n;
for (i = 0; i < num_mixer_volumes; i++) {
- if (strcmp(name, mixer_vols[i].name) == 0) {
+ if (strncmp(name, mixer_vols[i].name, 32) == 0) {
if (present)
mixer_vols[i].num = i;
return mixer_vols[i].levels;
@@ -98,7 +98,7 @@ int *load_mixer_volumes(char *name, int
}
n = num_mixer_volumes++;
- strcpy(mixer_vols[n].name, name);
+ strncpy(mixer_vols[n].name, name, 32);
if (present)
mixer_vols[n].num = n;
^ permalink raw reply [flat|nested] 177+ messages in thread* [136/152] KVM: enlarge number of possible CPUID leaves
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (134 preceding siblings ...)
2011-01-06 0:23 ` [135/152] sound: Prevent buffer overflow in OSS load_mixer_volumes Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [137/152] KVM: SVM: Do not report xsave in supported cpuid Greg KH
` (16 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Andre Przywara, Avi Kivity
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andre Przywara <andre.przywara@amd.com>
commit 73c1160ce377d8fc6d84cb630ebf9658808bec49 upstream.
Currently the number of CPUID leaves KVM handles is limited to 40.
My desktop machine (AthlonII) already has 35 and future CPUs will
expand this well beyond the limit. Extend the limit to 80 to make
room for future processors.
KVM-Stable-Tag.
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/include/asm/kvm_host.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -79,7 +79,7 @@
#define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
#define KVM_MIN_FREE_MMU_PAGES 5
#define KVM_REFILL_PAGES 25
-#define KVM_MAX_CPUID_ENTRIES 40
+#define KVM_MAX_CPUID_ENTRIES 80
#define KVM_NR_FIXED_MTRR_REGION 88
#define KVM_NR_VAR_MTRR 8
^ permalink raw reply [flat|nested] 177+ messages in thread* [137/152] KVM: SVM: Do not report xsave in supported cpuid
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (135 preceding siblings ...)
2011-01-06 0:23 ` [136/152] KVM: enlarge number of possible CPUID leaves Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [138/152] KVM: Fix OSXSAVE after migration Greg KH
` (15 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joerg Roedel <joerg.roedel@amd.com>
commit 24d1b15f72abe3465e871d11cfc9dc34d1aab8b2 upstream.
To support xsave properly for the guest the SVM module need
software support for it. As long as this is not present do
not report the xsave as supported feature in cpuid.
As a side-effect this patch moves the bit() helper function
into the x86.h file so that it can be used in svm.c too.
KVM-Stable-Tag.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kvm/svm.c | 4 ++++
arch/x86/kvm/vmx.c | 5 -----
arch/x86/kvm/x86.c | 5 -----
arch/x86/kvm/x86.h | 5 +++++
4 files changed, 9 insertions(+), 10 deletions(-)
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3383,6 +3383,10 @@ static void svm_cpuid_update(struct kvm_
static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
{
switch (func) {
+ case 0x00000001:
+ /* Mask out xsave bit as long as it is not supported by SVM */
+ entry->ecx &= ~(bit(X86_FEATURE_XSAVE));
+ break;
case 0x80000001:
if (nested)
entry->ecx |= (1 << 2); /* Set SVM bit */
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4248,11 +4248,6 @@ static int vmx_get_lpage_level(void)
return PT_PDPE_LEVEL;
}
-static inline u32 bit(int bitno)
-{
- return 1 << (bitno & 31);
-}
-
static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
{
struct kvm_cpuid_entry2 *best;
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -153,11 +153,6 @@ struct kvm_stats_debugfs_item debugfs_en
u64 __read_mostly host_xcr0;
-static inline u32 bit(int bitno)
-{
- return 1 << (bitno & 31);
-}
-
static void kvm_on_user_return(struct user_return_notifier *urn)
{
unsigned slot;
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -65,6 +65,11 @@ static inline int is_paging(struct kvm_v
return kvm_read_cr0_bits(vcpu, X86_CR0_PG);
}
+static inline u32 bit(int bitno)
+{
+ return 1 << (bitno & 31);
+}
+
void kvm_before_handle_nmi(struct kvm_vcpu *vcpu);
void kvm_after_handle_nmi(struct kvm_vcpu *vcpu);
^ permalink raw reply [flat|nested] 177+ messages in thread* [138/152] KVM: Fix OSXSAVE after migration
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (136 preceding siblings ...)
2011-01-06 0:23 ` [137/152] KVM: SVM: Do not report xsave in supported cpuid Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [139/152] mv_xor: fix race in tasklet function Greg KH
` (14 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Sheng Yang, Avi Kivity
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sheng Yang <sheng@linux.intel.com>
commit 3ea3aa8cf67d3bbe00a19b6a4013d19efa7d0f41 upstream.
CPUID's OSXSAVE is a mirror of CR4.OSXSAVE bit. We need to update the CPUID
after migration.
KVM-Stable-Tag.
Signed-off-by: Sheng Yang <sheng@linux.intel.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kvm/x86.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5112,6 +5112,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct
mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4;
kvm_x86_ops->set_cr4(vcpu, sregs->cr4);
+ if (sregs->cr4 & X86_CR4_OSXSAVE)
+ update_cpuid(vcpu);
if (!is_long_mode(vcpu) && is_pae(vcpu)) {
load_pdptrs(vcpu, vcpu->arch.cr3);
mmu_reset_needed = 1;
^ permalink raw reply [flat|nested] 177+ messages in thread* [139/152] mv_xor: fix race in tasklet function
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (137 preceding siblings ...)
2011-01-06 0:23 ` [138/152] KVM: Fix OSXSAVE after migration Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:23 ` [140/152] ima: fix add LSM rule bug Greg KH
` (13 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Saeed Bishara, Dan Williams
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Saeed Bishara <saeed@marvell.com>
commit 8333f65ef094e47020cd01452b4637e7daf5a77f upstream.
use mv_xor_slot_cleanup() instead of __mv_xor_slot_cleanup() as the former function
aquires the spin lock that needed to protect the drivers data.
Signed-off-by: Saeed Bishara <saeed@marvell.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/dma/mv_xor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -449,7 +449,7 @@ mv_xor_slot_cleanup(struct mv_xor_chan *
static void mv_xor_tasklet(unsigned long data)
{
struct mv_xor_chan *chan = (struct mv_xor_chan *) data;
- __mv_xor_slot_cleanup(chan);
+ mv_xor_slot_cleanup(chan);
}
static struct mv_xor_desc_slot *
^ permalink raw reply [flat|nested] 177+ messages in thread* [140/152] ima: fix add LSM rule bug
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (138 preceding siblings ...)
2011-01-06 0:23 ` [139/152] mv_xor: fix race in tasklet function Greg KH
@ 2011-01-06 0:23 ` Greg KH
2011-01-06 0:24 ` [141/152] libata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr() Greg KH
` (12 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mimi Zohar, James Morris,
Serge Hallyn, David Safford
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
commit 867c20265459d30a01b021a9c1e81fb4c5832aa9 upstream.
If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.
This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.
Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.
default IMA TCB policy:
# PROC_SUPER_MAGIC
dont_measure fsmagic=0x9fa0
# SYSFS_MAGIC
dont_measure fsmagic=0x62656572
# DEBUGFS_MAGIC
dont_measure fsmagic=0x64626720
# TMPFS_MAGIC
dont_measure fsmagic=0x01021994
# SECURITYFS_MAGIC
dont_measure fsmagic=0x73636673
< LSM specific rule >
dont_measure obj_type=var_log_t
measure func=BPRM_CHECK
measure func=FILE_MMAP mask=MAY_EXEC
measure func=FILE_CHECK mask=MAY_READ uid=0
Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured. The patch
prevents the default TCB policy from being replaced.
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Cc: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: David Safford <safford@watson.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
security/integrity/ima/ima_policy.c | 2 ++
1 file changed, 2 insertions(+)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -253,6 +253,8 @@ static int ima_lsm_rule_init(struct ima_
result = security_filter_rule_init(entry->lsm[lsm_rule].type,
Audit_equal, args,
&entry->lsm[lsm_rule].rule);
+ if (!entry->lsm[lsm_rule].rule)
+ return -EINVAL;
return result;
}
^ permalink raw reply [flat|nested] 177+ messages in thread* [141/152] libata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (139 preceding siblings ...)
2011-01-06 0:23 ` [140/152] ima: fix add LSM rule bug Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [142/152] mac80211: fix mesh forwarding Greg KH
` (11 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 687a993339c4f3a63654746230da3aab8bbdbffd upstream.
While separating out BMDMA irq handler from SFF, commit c3b28894
(libata-sff: separate out BMDMA irq handler) incorrectly made
__ata_sff_port_intr() consider an IRQ to be an idle one if the host
state was transitioned to HSM_ST_ERR by ata_bmdma_port_intr().
This makes BMDMA drivers ignore IRQs reporting host bus error which
leads to timeouts instead of triggering EH immediately. Fix it by
making __ata_sff_port_intr() consider the IRQ to be an idle one iff
the state is HSM_ST_IDLE. This is equivalent to adding HSM_ST_ERR to
the "break"ing case but less error-prone.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Antonio Toma <antonio.toma@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/ata/libata-sff.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1532,11 +1532,10 @@ static unsigned int __ata_sff_port_intr(
if (!(qc->dev->flags & ATA_DFLAG_CDB_INTR))
return ata_sff_idle_irq(ap);
break;
- case HSM_ST:
- case HSM_ST_LAST:
- break;
- default:
+ case HSM_ST_IDLE:
return ata_sff_idle_irq(ap);
+ default:
+ break;
}
/* check main status, clearing INTRQ if needed */
^ permalink raw reply [flat|nested] 177+ messages in thread* [142/152] mac80211: fix mesh forwarding
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (140 preceding siblings ...)
2011-01-06 0:24 ` [141/152] libata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr() Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [143/152] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120 Greg KH
` (10 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Johannes Berg,
Javier Cardona, John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 upstream.
Under memory pressure, the mac80211 mesh code
may helpfully print a message that it failed
to clone a mesh frame and then will proceed
to crash trying to use it anyway. Fix that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/mac80211/rx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1712,9 +1712,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
fwd_skb = skb_copy(skb, GFP_ATOMIC);
- if (!fwd_skb && net_ratelimit())
+ if (!fwd_skb && net_ratelimit()) {
printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
sdata->name);
+ goto out;
+ }
fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1752,6 +1754,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
}
}
+ out:
if (is_multicast_ether_addr(hdr->addr1) ||
sdata->dev->flags & IFF_PROMISC)
return RX_CONTINUE;
^ permalink raw reply [flat|nested] 177+ messages in thread* [143/152] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (141 preceding siblings ...)
2011-01-06 0:24 ` [142/152] mac80211: fix mesh forwarding Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [144/152] Sched: fix skip_clock_update optimization Greg KH
` (9 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel T Chen <crimsun@ubuntu.com>
commit e03fa055bc126e536c7f65862e08a9b143138ea9 upstream.
Sjoerd Simons reports that, without using position_fix=1, recording
experiences overruns. Work around that by applying the LPIB quirk
for his hardware.
Reported-and-tested-by: Sjoerd Simons <sjoerd@debian.org>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2302,6 +2302,7 @@ static struct snd_pci_quirk position_fix
SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
^ permalink raw reply [flat|nested] 177+ messages in thread* [144/152] Sched: fix skip_clock_update optimization
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (142 preceding siblings ...)
2011-01-06 0:24 ` [143/152] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120 Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [145/152] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead Greg KH
` (8 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mike Galbraith,
Peter Zijlstra, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Galbraith <efault@gmx.de>
commit f26f9aff6aaf67e9a430d16c266f91b13a5bff64 upstream.
idle_balance() drops/retakes rq->lock, leaving the previous task
vulnerable to set_tsk_need_resched(). Clear it after we return
from balancing instead, and in setup_thread_stack() as well, so
no successfully descheduled or never scheduled task has it set.
Need resched confused the skip_clock_update logic, which assumes
that the next call to update_rq_clock() will come nearly immediately
after being set. Make the optimization robust against the waking
a sleeper before it sucessfully deschedules case by checking that
the current task has not been dequeued before setting the flag,
since it is that useless clock update we're trying to save, and
clear unconditionally in schedule() proper instead of conditionally
in put_prev_task().
Signed-off-by: Mike Galbraith <efault@gmx.de>
Reported-by: Bjoern B. Brandenburg <bbb.lst@gmail.com>
Tested-by: Yong Zhang <yong.zhang0@gmail.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <1291802742.1417.9.camel@marge.simson.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/fork.c | 1 +
kernel/sched.c | 6 +++---
2 files changed, 4 insertions(+), 3 deletions(-)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -272,6 +272,7 @@ static struct task_struct *dup_task_stru
setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
+ clear_tsk_need_resched(tsk);
stackend = end_of_stack(tsk);
*stackend = STACK_END_MAGIC; /* for overflow detection */
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -566,7 +566,7 @@ void check_preempt_curr(struct rq *rq, s
* A queue event has occurred, and we're going to schedule. In
* this case, we can save a useless back to back clock update.
*/
- if (test_tsk_need_resched(p))
+ if (rq->curr->se.on_rq && test_tsk_need_resched(rq->curr))
rq->skip_clock_update = 1;
}
@@ -3821,7 +3821,6 @@ static void put_prev_task(struct rq *rq,
{
if (prev->se.on_rq)
update_rq_clock(rq);
- rq->skip_clock_update = 0;
prev->sched_class->put_prev_task(rq, prev);
}
@@ -3883,7 +3882,6 @@ need_resched_nonpreemptible:
hrtick_clear(rq);
raw_spin_lock_irq(&rq->lock);
- clear_tsk_need_resched(prev);
switch_count = &prev->nivcsw;
if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
@@ -3915,6 +3913,8 @@ need_resched_nonpreemptible:
put_prev_task(rq, prev);
next = pick_next_task(rq);
+ clear_tsk_need_resched(prev);
+ rq->skip_clock_update = 0;
if (likely(prev != next)) {
sched_info_switch(prev, next);
^ permalink raw reply [flat|nested] 177+ messages in thread* [145/152] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (143 preceding siblings ...)
2011-01-06 0:24 ` [144/152] Sched: fix skip_clock_update optimization Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [146/152] x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree() Greg KH
` (7 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Martin K. Petersen,
Mike Snitzer, Jens Axboe
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Martin K. Petersen <martin.petersen@oracle.com>
commit e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 upstream.
When stacking devices, a request_queue is not always available. This
forced us to have a no_cluster flag in the queue_limits that could be
used as a carrier until the request_queue had been set up for a
metadevice.
There were several problems with that approach. First of all it was up
to the stacking device to remember to set queue flag after stacking had
completed. Also, the queue flag and the queue limits had to be kept in
sync at all times. We got that wrong, which could lead to us issuing
commands that went beyond the max scatterlist limit set by the driver.
The proper fix is to avoid having two flags for tracking the same thing.
We deprecate QUEUE_FLAG_CLUSTER and use the queue limit directly in the
block layer merging functions. The queue_limit 'no_cluster' is turned
into 'cluster' to avoid double negatives and to ease stacking.
Clustering defaults to being enabled as before. The queue flag logic is
removed from the stacking function, and explicitly setting the cluster
flag is no longer necessary in DM and MD.
Reported-by: Ed Lin <ed.lin@promise.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
block/blk-merge.c | 6 +++---
block/blk-settings.c | 25 ++-----------------------
block/blk-sysfs.c | 2 +-
drivers/md/dm-table.c | 5 -----
drivers/md/md.c | 3 ---
drivers/scsi/scsi_lib.c | 3 +--
include/linux/blkdev.h | 9 ++++++---
7 files changed, 13 insertions(+), 40 deletions(-)
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -21,7 +21,7 @@ static unsigned int __blk_recalc_rq_segm
return 0;
fbio = bio;
- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+ cluster = blk_queue_cluster(q);
seg_size = 0;
nr_phys_segs = 0;
for_each_bio(bio) {
@@ -87,7 +87,7 @@ EXPORT_SYMBOL(blk_recount_segments);
static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio,
struct bio *nxt)
{
- if (!test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
+ if (!blk_queue_cluster(q))
return 0;
if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
@@ -123,7 +123,7 @@ int blk_rq_map_sg(struct request_queue *
int nsegs, cluster;
nsegs = 0;
- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+ cluster = blk_queue_cluster(q);
/*
* for each bio in rq
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -125,7 +125,7 @@ void blk_set_default_limits(struct queue
lim->alignment_offset = 0;
lim->io_opt = 0;
lim->misaligned = 0;
- lim->no_cluster = 0;
+ lim->cluster = 1;
}
EXPORT_SYMBOL(blk_set_default_limits);
@@ -468,15 +468,6 @@ EXPORT_SYMBOL(blk_queue_io_opt);
void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
{
blk_stack_limits(&t->limits, &b->limits, 0);
-
- if (!t->queue_lock)
- WARN_ON_ONCE(1);
- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
- unsigned long flags;
- spin_lock_irqsave(t->queue_lock, flags);
- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
- spin_unlock_irqrestore(t->queue_lock, flags);
- }
}
EXPORT_SYMBOL(blk_queue_stack_limits);
@@ -547,7 +538,7 @@ int blk_stack_limits(struct queue_limits
t->io_min = max(t->io_min, b->io_min);
t->io_opt = lcm(t->io_opt, b->io_opt);
- t->no_cluster |= b->no_cluster;
+ t->cluster &= b->cluster;
t->discard_zeroes_data &= b->discard_zeroes_data;
/* Physical block size a multiple of the logical block size? */
@@ -643,7 +634,6 @@ void disk_stack_limits(struct gendisk *d
sector_t offset)
{
struct request_queue *t = disk->queue;
- struct request_queue *b = bdev_get_queue(bdev);
if (bdev_stack_limits(&t->limits, bdev, offset >> 9) < 0) {
char top[BDEVNAME_SIZE], bottom[BDEVNAME_SIZE];
@@ -654,17 +644,6 @@ void disk_stack_limits(struct gendisk *d
printk(KERN_NOTICE "%s: Warning: Device %s is misaligned\n",
top, bottom);
}
-
- if (!t->queue_lock)
- WARN_ON_ONCE(1);
- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
- unsigned long flags;
-
- spin_lock_irqsave(t->queue_lock, flags);
- if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags))
- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
- spin_unlock_irqrestore(t->queue_lock, flags);
- }
}
EXPORT_SYMBOL(disk_stack_limits);
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -114,7 +114,7 @@ static ssize_t queue_max_segments_show(s
static ssize_t queue_max_segment_size_show(struct request_queue *q, char *page)
{
- if (test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
+ if (blk_queue_cluster(q))
return queue_var_show(queue_max_segment_size(q), (page));
return queue_var_show(PAGE_CACHE_SIZE, (page));
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1136,11 +1136,6 @@ void dm_table_set_restrictions(struct dm
*/
q->limits = *limits;
- if (limits->no_cluster)
- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
- else
- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, q);
-
if (!dm_table_supports_discards(t))
queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, q);
else
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4289,9 +4289,6 @@ static int md_alloc(dev_t dev, char *nam
goto abort;
mddev->queue->queuedata = mddev;
- /* Can be unlocked because the queue is new: no concurrency */
- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, mddev->queue);
-
blk_queue_make_request(mddev->queue, md_make_request);
disk = alloc_disk(1 << shift);
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1632,9 +1632,8 @@ struct request_queue *__scsi_alloc_queue
blk_queue_max_segment_size(q, dma_get_max_seg_size(dev));
- /* New queue, no concurrency on queue_flags */
if (!shost->use_clustering)
- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
+ q->limits.cluster = 0;
/*
* set a reasonable default alignment on word boundaries: the
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -246,7 +246,7 @@ struct queue_limits {
unsigned char misaligned;
unsigned char discard_misaligned;
- unsigned char no_cluster;
+ unsigned char cluster;
signed char discard_zeroes_data;
};
@@ -369,7 +369,6 @@ struct request_queue
#endif
};
-#define QUEUE_FLAG_CLUSTER 0 /* cluster several segments into 1 */
#define QUEUE_FLAG_QUEUED 1 /* uses generic tag queueing */
#define QUEUE_FLAG_STOPPED 2 /* queue is stopped */
#define QUEUE_FLAG_SYNCFULL 3 /* read queue has been filled */
@@ -392,7 +391,6 @@ struct request_queue
#define QUEUE_FLAG_SECDISCARD 19 /* supports SECDISCARD */
#define QUEUE_FLAG_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \
- (1 << QUEUE_FLAG_CLUSTER) | \
(1 << QUEUE_FLAG_STACKABLE) | \
(1 << QUEUE_FLAG_SAME_COMP) | \
(1 << QUEUE_FLAG_ADD_RANDOM))
@@ -550,6 +548,11 @@ enum {
#define rq_data_dir(rq) ((rq)->cmd_flags & 1)
+static inline unsigned int blk_queue_cluster(struct request_queue *q)
+{
+ return q->limits.cluster;
+}
+
/*
* We regard a request as sync, if either a read or a sync write
*/
^ permalink raw reply [flat|nested] 177+ messages in thread* [146/152] x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree()
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (144 preceding siblings ...)
2011-01-06 0:24 ` [145/152] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [147/152] posix-cpu-timers: workaround to suppress the problems with mt exec Greg KH
` (6 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Jesper Juhl, Tigran Aivazian,
Shaohua Li, Ingo Molnar
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesper Juhl <jj@chaosbits.net>
commit 5cdd2de0a76d0ac47f107c8a7b32d75d25768dc1 upstream.
In arch/x86/kernel/microcode_intel.c::generic_load_microcode()
we have this:
while (leftover) {
...
if (get_ucode_data(mc, ucode_ptr, mc_size) ||
microcode_sanity_check(mc) < 0) {
vfree(mc);
break;
}
...
}
if (mc)
vfree(mc);
This will cause a double free of 'mc'. This patch fixes that by
just removing the vfree() call in the loop since 'mc' will be
freed nicely just after we break out of the loop.
There's also a second change in the patch. I noticed a lot of
checks for pointers being NULL before passing them to vfree().
That's completely redundant since vfree() deals gracefully with
being passed a NULL pointer. Removing the redundant checks
yields a nice size decrease for the object file.
Size before the patch:
text data bss dec hex filename
4578 240 1032 5850 16da arch/x86/kernel/microcode_intel.o
Size after the patch:
text data bss dec hex filename
4489 240 984 5713 1651 arch/x86/kernel/microcode_intel.o
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
Cc: Shaohua Li <shaohua.li@intel.com>
LKML-Reference: <alpine.LNX.2.00.1012251946100.10759@swampdragon.chaosbits.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/microcode_intel.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
--- a/arch/x86/kernel/microcode_intel.c
+++ b/arch/x86/kernel/microcode_intel.c
@@ -364,8 +364,7 @@ static enum ucode_state generic_load_mic
/* For performance reasons, reuse mc area when possible */
if (!mc || mc_size > curr_mc_size) {
- if (mc)
- vfree(mc);
+ vfree(mc);
mc = vmalloc(mc_size);
if (!mc)
break;
@@ -374,13 +373,11 @@ static enum ucode_state generic_load_mic
if (get_ucode_data(mc, ucode_ptr, mc_size) ||
microcode_sanity_check(mc) < 0) {
- vfree(mc);
break;
}
if (get_matching_microcode(&uci->cpu_sig, mc, new_rev)) {
- if (new_mc)
- vfree(new_mc);
+ vfree(new_mc);
new_rev = mc_header.rev;
new_mc = mc;
mc = NULL; /* trigger new vmalloc */
@@ -390,12 +387,10 @@ static enum ucode_state generic_load_mic
leftover -= mc_size;
}
- if (mc)
- vfree(mc);
+ vfree(mc);
if (leftover) {
- if (new_mc)
- vfree(new_mc);
+ vfree(new_mc);
state = UCODE_ERROR;
goto out;
}
@@ -405,8 +400,7 @@ static enum ucode_state generic_load_mic
goto out;
}
- if (uci->mc)
- vfree(uci->mc);
+ vfree(uci->mc);
uci->mc = (struct microcode_intel *)new_mc;
pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
^ permalink raw reply [flat|nested] 177+ messages in thread* [147/152] posix-cpu-timers: workaround to suppress the problems with mt exec
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (145 preceding siblings ...)
2011-01-06 0:24 ` [146/152] x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree() Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [148/152] [media] mx2_camera: fix pixel clock polarity configuration Greg KH
` (5 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit e0a70217107e6f9844628120412cb27bb4cea194 upstream.
posix-cpu-timers.c correctly assumes that the dying process does
posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
timers from signal->cpu_timers list.
But, it also assumes that timer->it.cpu.task is always the group
leader, and thus the dead ->task means the dead thread group.
This is obviously not true after de_thread() changes the leader.
After that almost every posix_cpu_timer_ method has problems.
It is not simple to fix this bug correctly. First of all, I think
that timer->it.cpu should use struct pid instead of task_struct.
Also, the locking should be reworked completely. In particular,
tasklist_lock should not be used at all. This all needs a lot of
nontrivial and hard-to-test changes.
Change __exit_signal() to do posix_cpu_timers_exit_group() when
the old leader dies during exec. This is not the fix, just the
temporary hack to hide the problem for 2.6.37 and stable. IOW,
this is obviously wrong but this is what we currently have anyway:
cpu timers do not work after mt exec.
In theory this change adds another race. The exiting leader can
detach the timers which were attached to the new leader. However,
the window between de_thread() and release_task() is small, we
can pretend that sys_timer_create() was called before de_thread().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/exit.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -95,6 +95,14 @@ static void __exit_signal(struct task_st
sig->tty = NULL;
} else {
/*
+ * This can only happen if the caller is de_thread().
+ * FIXME: this is the temporary hack, we should teach
+ * posix-cpu-timers to handle this case correctly.
+ */
+ if (unlikely(has_group_leader_pid(tsk)))
+ posix_cpu_timers_exit_group(tsk);
+
+ /*
* If there is any task waiting for the group exit
* then notify it:
*/
^ permalink raw reply [flat|nested] 177+ messages in thread* [148/152] [media] mx2_camera: fix pixel clock polarity configuration
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (146 preceding siblings ...)
2011-01-06 0:24 ` [147/152] posix-cpu-timers: workaround to suppress the problems with mt exec Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [149/152] [media] Dont export format_by_forcc on two different drivers Greg KH
` (4 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Baruch Siach,
Guennadi Liakhovetski, Mauro Carvalho Chehab
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Baruch Siach <baruch@tkos.co.il>
commit 42cc37fe20cc680fb58fe12ae5ba718d683b8ca2 upstream.
When SOCAM_PCLK_SAMPLE_FALLING, just leave CSICR1_REDGE unset, otherwise we get
the inverted behaviour.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/mx2_camera.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -791,8 +791,6 @@ static int mx2_camera_set_bus_param(stru
if (common_flags & SOCAM_PCLK_SAMPLE_RISING)
csicr1 |= CSICR1_REDGE;
- if (common_flags & SOCAM_PCLK_SAMPLE_FALLING)
- csicr1 |= CSICR1_INV_PCLK;
if (common_flags & SOCAM_VSYNC_ACTIVE_HIGH)
csicr1 |= CSICR1_SOF_POL;
if (common_flags & SOCAM_HSYNC_ACTIVE_HIGH)
^ permalink raw reply [flat|nested] 177+ messages in thread* [149/152] [media] Dont export format_by_forcc on two different drivers
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (147 preceding siblings ...)
2011-01-06 0:24 ` [148/152] [media] mx2_camera: fix pixel clock polarity configuration Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [150/152] orinoco: initialise priv->hw before assigning the interrupt Greg KH
` (3 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mauro Carvalho Chehab
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mauro Carvalho Chehab <mchehab@redhat.com>
commit a757ee2216211278680dd8ac869aabe7b4a9970d upstream.
Drivers should append their name on exported symbols, to avoid
conflicts with allyesconfig:
drivers/staging/built-in.o: In function `format_by_fourcc':
/home/v4l/work_trees/linus/drivers/staging/cx25821/cx25821-video.c:96: multiple definition of `format_by_fourcc'
drivers/media/built-in.o:/home/v4l/work_trees/linus/drivers/media/common/saa7146_video.c:88: first defined here
Let's rename both occurences with a small shellscript:
for i in drivers/staging/cx25821/*.[ch]; do sed s,format_by_fourcc,cx25821_format_by_fourcc,g <$i >a && mv a $i; done
for i in drivers/media/common/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done
for i in include/media/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/common/saa7146_hlp.c | 8 ++++----
drivers/media/common/saa7146_video.c | 16 ++++++++--------
drivers/staging/cx25821/cx25821-video.c | 8 ++++----
drivers/staging/cx25821/cx25821-video.h | 2 +-
include/media/saa7146.h | 2 +-
5 files changed, 18 insertions(+), 18 deletions(-)
--- a/drivers/media/common/saa7146_hlp.c
+++ b/drivers/media/common/saa7146_hlp.c
@@ -558,7 +558,7 @@ static void saa7146_set_window(struct sa
static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int w_height, enum v4l2_field field, u32 pixelformat)
{
struct saa7146_vv *vv = dev->vv_data;
- struct saa7146_format *sfmt = format_by_fourcc(dev, pixelformat);
+ struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev, pixelformat);
int b_depth = vv->ov_fmt->depth;
int b_bpl = vv->ov_fb.fmt.bytesperline;
@@ -702,7 +702,7 @@ static int calculate_video_dma_grab_pack
struct saa7146_vv *vv = dev->vv_data;
struct saa7146_video_dma vdma1;
- struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+ struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
int width = buf->fmt->width;
int height = buf->fmt->height;
@@ -827,7 +827,7 @@ static int calculate_video_dma_grab_plan
struct saa7146_video_dma vdma2;
struct saa7146_video_dma vdma3;
- struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+ struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
int width = buf->fmt->width;
int height = buf->fmt->height;
@@ -994,7 +994,7 @@ static void program_capture_engine(struc
void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struct saa7146_buf *next)
{
- struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+ struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
struct saa7146_vv *vv = dev->vv_data;
u32 vdma1_prot_addr;
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -84,7 +84,7 @@ static struct saa7146_format formats[] =
static int NUM_FORMATS = sizeof(formats)/sizeof(struct saa7146_format);
-struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc)
+struct saa7146_format* saa7146_format_by_fourcc(struct saa7146_dev *dev, int fourcc)
{
int i, j = NUM_FORMATS;
@@ -266,7 +266,7 @@ static int saa7146_pgtable_build(struct
struct videobuf_dmabuf *dma=videobuf_to_dma(&buf->vb);
struct scatterlist *list = dma->sglist;
int length = dma->sglen;
- struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+ struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
DEB_EE(("dev:%p, buf:%p, sg_len:%d\n",dev,buf,length));
@@ -408,7 +408,7 @@ static int video_begin(struct saa7146_fh
}
}
- fmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+ fmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
/* we need to have a valid format set here */
BUG_ON(NULL == fmt);
@@ -460,7 +460,7 @@ static int video_end(struct saa7146_fh *
return -EBUSY;
}
- fmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+ fmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
/* we need to have a valid format set here */
BUG_ON(NULL == fmt);
@@ -536,7 +536,7 @@ static int vidioc_s_fbuf(struct file *fi
return -EPERM;
/* check args */
- fmt = format_by_fourcc(dev, fb->fmt.pixelformat);
+ fmt = saa7146_format_by_fourcc(dev, fb->fmt.pixelformat);
if (NULL == fmt)
return -EINVAL;
@@ -760,7 +760,7 @@ static int vidioc_try_fmt_vid_cap(struct
DEB_EE(("V4L2_BUF_TYPE_VIDEO_CAPTURE: dev:%p, fh:%p\n", dev, fh));
- fmt = format_by_fourcc(dev, f->fmt.pix.pixelformat);
+ fmt = saa7146_format_by_fourcc(dev, f->fmt.pix.pixelformat);
if (NULL == fmt)
return -EINVAL;
@@ -1264,7 +1264,7 @@ static int buffer_prepare(struct videobu
buf->fmt = &fh->video_fmt;
buf->vb.field = fh->video_fmt.field;
- sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+ sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
release_all_pagetables(dev, buf);
if( 0 != IS_PLANAR(sfmt->trans)) {
@@ -1378,7 +1378,7 @@ static int video_open(struct saa7146_dev
fh->video_fmt.pixelformat = V4L2_PIX_FMT_BGR24;
fh->video_fmt.bytesperline = 0;
fh->video_fmt.field = V4L2_FIELD_ANY;
- sfmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+ sfmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
fh->video_fmt.sizeimage = (fh->video_fmt.width * fh->video_fmt.height * sfmt->depth)/8;
videobuf_queue_sg_init(&fh->video_q, &video_qops,
--- a/drivers/staging/cx25821/cx25821-video.c
+++ b/drivers/staging/cx25821/cx25821-video.c
@@ -92,7 +92,7 @@ int cx25821_get_format_size(void)
return ARRAY_SIZE(formats);
}
-struct cx25821_fmt *format_by_fourcc(unsigned int fourcc)
+struct cx25821_fmt *cx25821_format_by_fourcc(unsigned int fourcc)
{
unsigned int i;
@@ -848,7 +848,7 @@ static int video_open(struct file *file)
pix_format =
(dev->channels[ch_id].pixel_formats ==
PIXEL_FRMT_411) ? V4L2_PIX_FMT_Y41P : V4L2_PIX_FMT_YUYV;
- fh->fmt = format_by_fourcc(pix_format);
+ fh->fmt = cx25821_format_by_fourcc(pix_format);
v4l2_prio_open(&dev->channels[ch_id].prio, &fh->prio);
@@ -1009,7 +1009,7 @@ static int vidioc_s_fmt_vid_cap(struct f
if (0 != err)
return err;
- fh->fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ fh->fmt = cx25821_format_by_fourcc(f->fmt.pix.pixelformat);
fh->vidq.field = f->fmt.pix.field;
/* check if width and height is valid based on set standard */
@@ -1117,7 +1117,7 @@ int cx25821_vidioc_try_fmt_vid_cap(struc
enum v4l2_field field;
unsigned int maxw, maxh;
- fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ fmt = cx25821_format_by_fourcc(f->fmt.pix.pixelformat);
if (NULL == fmt)
return -EINVAL;
--- a/drivers/staging/cx25821/cx25821-video.h
+++ b/drivers/staging/cx25821/cx25821-video.h
@@ -87,7 +87,7 @@ extern unsigned int vid_limit;
#define FORMAT_FLAGS_PACKED 0x01
extern struct cx25821_fmt formats[];
-extern struct cx25821_fmt *format_by_fourcc(unsigned int fourcc);
+extern struct cx25821_fmt *cx25821_format_by_fourcc(unsigned int fourcc);
extern struct cx25821_data timeout_data[MAX_VID_CHANNEL_NUM];
extern void cx25821_dump_video_queue(struct cx25821_dev *dev,
--- a/include/media/saa7146.h
+++ b/include/media/saa7146.h
@@ -161,7 +161,7 @@ extern struct list_head saa7146_devices;
extern struct mutex saa7146_devices_lock;
int saa7146_register_extension(struct saa7146_extension*);
int saa7146_unregister_extension(struct saa7146_extension*);
-struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc);
+struct saa7146_format* saa7146_format_by_fourcc(struct saa7146_dev *dev, int fourcc);
int saa7146_pgtable_alloc(struct pci_dev *pci, struct saa7146_pgtable *pt);
void saa7146_pgtable_free(struct pci_dev *pci, struct saa7146_pgtable *pt);
int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt, struct scatterlist *list, int length );
^ permalink raw reply [flat|nested] 177+ messages in thread* [150/152] orinoco: initialise priv->hw before assigning the interrupt
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (148 preceding siblings ...)
2011-01-06 0:24 ` [149/152] [media] Dont export format_by_forcc on two different drivers Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [151/152] [media] gspca - sonixj: Set the flag for some devices Greg KH
` (2 subsequent siblings)
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, John W. Linville
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Kilroy <kilroyd@googlemail.com>
commit 229bd792be0bad245b78ed8f119952733a4752e5 upstream.
The interrupt handler takes a lock - but since commit bcad6e80f3f this
lock goes through an indirection specified in the hermes_t structure.
We must therefore initialise the structure before setting up the
interrupt handler.
Fix orinoco_cs and spectrum_cs
<https://bugzilla.kernel.org/show_bug.cgi?id=23932>
Bisected by: Matt Domsch <Matt_Domsch@dell.com>
Signed-off by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/orinoco/orinoco_cs.c | 14 +++++++-------
drivers/net/wireless/orinoco/spectrum_cs.c | 14 +++++++-------
2 files changed, 14 insertions(+), 14 deletions(-)
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -248,20 +248,20 @@ orinoco_cs_config(struct pcmcia_device *
goto failed;
}
- ret = pcmcia_request_irq(link, orinoco_interrupt);
- if (ret)
- goto failed;
-
- /* We initialize the hermes structure before completing PCMCIA
- * configuration just in case the interrupt handler gets
- * called. */
mem = ioport_map(link->resource[0]->start,
resource_size(link->resource[0]));
if (!mem)
goto failed;
+ /* We initialize the hermes structure before completing PCMCIA
+ * configuration just in case the interrupt handler gets
+ * called. */
hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+ ret = pcmcia_request_irq(link, orinoco_interrupt);
+ if (ret)
+ goto failed;
+
/*
* This actually configures the PCMCIA socket -- setting up
* the I/O windows and the interrupt mapping, and putting the
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -310,21 +310,21 @@ spectrum_cs_config(struct pcmcia_device
goto failed;
}
- ret = pcmcia_request_irq(link, orinoco_interrupt);
- if (ret)
- goto failed;
-
- /* We initialize the hermes structure before completing PCMCIA
- * configuration just in case the interrupt handler gets
- * called. */
mem = ioport_map(link->resource[0]->start,
resource_size(link->resource[0]));
if (!mem)
goto failed;
+ /* We initialize the hermes structure before completing PCMCIA
+ * configuration just in case the interrupt handler gets
+ * called. */
hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
hw->eeprom_pda = true;
+ ret = pcmcia_request_irq(link, orinoco_interrupt);
+ if (ret)
+ goto failed;
+
/*
* This actually configures the PCMCIA socket -- setting up
* the I/O windows and the interrupt mapping, and putting the
^ permalink raw reply [flat|nested] 177+ messages in thread* [151/152] [media] gspca - sonixj: Set the flag for some devices
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (149 preceding siblings ...)
2011-01-06 0:24 ` [150/152] orinoco: initialise priv->hw before assigning the interrupt Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 0:24 ` [152/152] [media] gspca - sonixj: Add a flag in the driver_info table Greg KH
2011-01-06 13:42 ` [000/152] 2.6.36.3-stable review Alan Cox
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan,
Jean-François Moine, Mauro Carvalho Chehab
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1656 bytes --]
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean-Francois Moine <moinejf@free.fr>
commit b2272a49e7df37732d73988f00468ce31e1ebc92 upstream.
The flag PDN_INV indicates that the sensor pin S_PWR_DN has not the same
value as other webcams with the same sensor. For now, only two webcams have
been so detected: the Microsoft's VX1000 and VX3000.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/gspca/sonixj.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -87,6 +87,9 @@ enum sensors {
SENSOR_SP80708,
};
+/* device flags */
+#define PDN_INV 1 /* inverse pin S_PWR_DN / sn_xxx tables */
+
/* V4L2 controls supported by the driver */
static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
@@ -2990,8 +2993,8 @@ static const __devinitdata struct usb_de
{USB_DEVICE(0x0458, 0x7025), BS(SN9C120, MI0360)},
{USB_DEVICE(0x0458, 0x702e), BS(SN9C120, OV7660)},
#endif
- {USB_DEVICE(0x045e, 0x00f5), BS(SN9C105, OV7660)},
- {USB_DEVICE(0x045e, 0x00f7), BS(SN9C105, OV7660)},
+ {USB_DEVICE(0x045e, 0x00f5), BSF(SN9C105, OV7660, PDN_INV)},
+ {USB_DEVICE(0x045e, 0x00f7), BSF(SN9C105, OV7660, PDN_INV)},
{USB_DEVICE(0x0471, 0x0327), BS(SN9C105, MI0360)},
{USB_DEVICE(0x0471, 0x0328), BS(SN9C105, MI0360)},
{USB_DEVICE(0x0471, 0x0330), BS(SN9C105, MI0360)},
^ permalink raw reply [flat|nested] 177+ messages in thread* [152/152] [media] gspca - sonixj: Add a flag in the driver_info table
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (150 preceding siblings ...)
2011-01-06 0:24 ` [151/152] [media] gspca - sonixj: Set the flag for some devices Greg KH
@ 2011-01-06 0:24 ` Greg KH
2011-01-06 13:42 ` [000/152] 2.6.36.3-stable review Alan Cox
152 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-06 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan,
Jean-François Moine, Mauro Carvalho Chehab
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1532 bytes --]
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean-Francois Moine <moinejf@free.fr>
commit c6c14330717f9850b4b4c054b81424b9979cd07d upstream.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/gspca/sonixj.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -56,6 +56,7 @@ struct sd {
u8 jpegqual; /* webcam quality */
u8 reg18;
+ u8 flags;
s8 ag_cnt;
#define AG_CNT_START 13
@@ -1780,7 +1781,8 @@ static int sd_config(struct gspca_dev *g
struct cam *cam;
sd->bridge = id->driver_info >> 16;
- sd->sensor = id->driver_info;
+ sd->sensor = id->driver_info >> 8;
+ sd->flags = id->driver_info;
cam = &gspca_dev->cam;
if (sd->sensor == SENSOR_ADCM1700) {
@@ -2987,7 +2989,11 @@ static const struct sd_desc sd_desc = {
/* -- module initialisation -- */
#define BS(bridge, sensor) \
.driver_info = (BRIDGE_ ## bridge << 16) \
- | SENSOR_ ## sensor
+ | (SENSOR_ ## sensor << 8)
+#define BSF(bridge, sensor, flags) \
+ .driver_info = (BRIDGE_ ## bridge << 16) \
+ | (SENSOR_ ## sensor << 8) \
+ | (flags)
static const __devinitdata struct usb_device_id device_table[] = {
#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
{USB_DEVICE(0x0458, 0x7025), BS(SN9C120, MI0360)},
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [000/152] 2.6.36.3-stable review
2011-01-06 0:25 [000/152] 2.6.36.3-stable review Greg KH
` (151 preceding siblings ...)
2011-01-06 0:24 ` [152/152] [media] gspca - sonixj: Add a flag in the driver_info table Greg KH
@ 2011-01-06 13:42 ` Alan Cox
2011-01-06 21:57 ` Greg KH
152 siblings, 1 reply; 177+ messages in thread
From: Alan Cox @ 2011-01-06 13:42 UTC (permalink / raw)
To: Greg KH; +Cc: linux-kernel, stable, stable-review, torvalds, akpm
On Wed, 5 Jan 2011 16:25:00 -0800
Greg KH <gregkh@suse.de> wrote:
>
> This is the start of the stable review cycle for the 2.6.36.3 release.
> There are 152 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let us know. If anyone is a maintainer of the proper subsystem, and
> wants to add a Signed-off-by: line to the patch, please respond with it.
Look sane on first glance but we don't seem to have a revert for the
serial mess up yet ?
> 7a56aa45982bb87bfca98a2832b5ae782c03364a is the first bad commit
> commit 7a56aa45982bb87bfca98a2832b5ae782c03364a
> Author: Yegor Yefremov <yegor_sub1@visionsystems.de>
> Date: Wed Jun 16 16:29:55 2010 +0200
>
> serial: add UART_CAP_EFR and UART_CAP_SLEEP flags to 16C950 UARTs
> definition
>
> Adding UART_CAP_EFR and UART_CAP_SLEEP flags will enable sleep
> mode
> and automatic CTS flow control for 16C950 UARTs. It will also
> avoid
> capabilities detection warning like this:
>
> "ttyS0: detected caps 00000700 should be 00000100"
>
> Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Has been bisected by several people to be causing failures and reported ?
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: [000/152] 2.6.36.3-stable review
2011-01-06 13:42 ` [000/152] 2.6.36.3-stable review Alan Cox
@ 2011-01-06 21:57 ` Greg KH
2011-01-07 15:07 ` Pavel Machek
0 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-06 21:57 UTC (permalink / raw)
To: Alan Cox; +Cc: linux-kernel, stable, stable-review, torvalds, akpm
On Thu, Jan 06, 2011 at 01:42:54PM +0000, Alan Cox wrote:
> On Wed, 5 Jan 2011 16:25:00 -0800
> Greg KH <gregkh@suse.de> wrote:
>
> >
> > This is the start of the stable review cycle for the 2.6.36.3 release.
> > There are 152 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let us know. If anyone is a maintainer of the proper subsystem, and
> > wants to add a Signed-off-by: line to the patch, please respond with it.
>
> Look sane on first glance but we don't seem to have a revert for the
> serial mess up yet ?
>
> > 7a56aa45982bb87bfca98a2832b5ae782c03364a is the first bad commit
> > commit 7a56aa45982bb87bfca98a2832b5ae782c03364a
> > Author: Yegor Yefremov <yegor_sub1@visionsystems.de>
> > Date: Wed Jun 16 16:29:55 2010 +0200
> >
> > serial: add UART_CAP_EFR and UART_CAP_SLEEP flags to 16C950 UARTs
> > definition
> >
> > Adding UART_CAP_EFR and UART_CAP_SLEEP flags will enable sleep
> > mode
> > and automatic CTS flow control for 16C950 UARTs. It will also
> > avoid
> > capabilities detection warning like this:
> >
> > "ttyS0: detected caps 00000700 should be 00000100"
> >
> > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
>
> Has been bisected by several people to be causing failures and reported ?
Hm, I saw Pavel reported a problem, but I didn't get a definate "this
must be reverted" resolution from that thread. It looked like we should
just drop one of these flags perhaps?
I can revert it if it really is an issue, but it needs to be reverted in
Linus's tree first, before going to stable.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [000/152] 2.6.36.3-stable review
2011-01-06 21:57 ` Greg KH
@ 2011-01-07 15:07 ` Pavel Machek
2011-01-07 18:37 ` Greg KH
0 siblings, 1 reply; 177+ messages in thread
From: Pavel Machek @ 2011-01-07 15:07 UTC (permalink / raw)
To: Greg KH; +Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
> On Thu, Jan 06, 2011 at 01:42:54PM +0000, Alan Cox wrote:
> > On Wed, 5 Jan 2011 16:25:00 -0800
> > Greg KH <gregkh@suse.de> wrote:
> >
> > >
> > > This is the start of the stable review cycle for the 2.6.36.3 release.
> > > There are 152 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let us know. If anyone is a maintainer of the proper subsystem, and
> > > wants to add a Signed-off-by: line to the patch, please respond with it.
> >
> > Look sane on first glance but we don't seem to have a revert for the
> > serial mess up yet ?
> >
> > > 7a56aa45982bb87bfca98a2832b5ae782c03364a is the first bad commit
> > > commit 7a56aa45982bb87bfca98a2832b5ae782c03364a
> > > Author: Yegor Yefremov <yegor_sub1@visionsystems.de>
> > > Date: Wed Jun 16 16:29:55 2010 +0200
> > >
> > > serial: add UART_CAP_EFR and UART_CAP_SLEEP flags to 16C950 UARTs
> > > definition
> > >
> > > Adding UART_CAP_EFR and UART_CAP_SLEEP flags will enable sleep
> > > mode
> > > and automatic CTS flow control for 16C950 UARTs. It will also
> > > avoid
> > > capabilities detection warning like this:
> > >
> > > "ttyS0: detected caps 00000700 should be 00000100"
> > >
> > > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> >
> >
> > Has been bisected by several people to be causing failures and reported ?
>
> Hm, I saw Pavel reported a problem, but I didn't get a definate "this
> must be reverted" resolution from that thread. It looked like we should
> just drop one of these flags perhaps?
>
> I can revert it if it really is an issue, but it needs to be reverted in
> Linus's tree first, before going to stable.
Flow control flag seems to be responsible.
But... it hits me and then... me. So I'd like to see it resolved in
devel tree, but it may not 100% vital for stable.
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [000/152] 2.6.36.3-stable review
2011-01-07 15:07 ` Pavel Machek
@ 2011-01-07 18:37 ` Greg KH
2011-01-09 7:38 ` unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review) Pavel Machek
2011-01-23 13:06 ` Pavel Machek
0 siblings, 2 replies; 177+ messages in thread
From: Greg KH @ 2011-01-07 18:37 UTC (permalink / raw)
To: Pavel Machek
Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
On Fri, Jan 07, 2011 at 04:07:24PM +0100, Pavel Machek wrote:
> > On Thu, Jan 06, 2011 at 01:42:54PM +0000, Alan Cox wrote:
> > > On Wed, 5 Jan 2011 16:25:00 -0800
> > > Greg KH <gregkh@suse.de> wrote:
> > >
> > > >
> > > > This is the start of the stable review cycle for the 2.6.36.3 release.
> > > > There are 152 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let us know. If anyone is a maintainer of the proper subsystem, and
> > > > wants to add a Signed-off-by: line to the patch, please respond with it.
> > >
> > > Look sane on first glance but we don't seem to have a revert for the
> > > serial mess up yet ?
> > >
> > > > 7a56aa45982bb87bfca98a2832b5ae782c03364a is the first bad commit
> > > > commit 7a56aa45982bb87bfca98a2832b5ae782c03364a
> > > > Author: Yegor Yefremov <yegor_sub1@visionsystems.de>
> > > > Date: Wed Jun 16 16:29:55 2010 +0200
> > > >
> > > > serial: add UART_CAP_EFR and UART_CAP_SLEEP flags to 16C950 UARTs
> > > > definition
> > > >
> > > > Adding UART_CAP_EFR and UART_CAP_SLEEP flags will enable sleep
> > > > mode
> > > > and automatic CTS flow control for 16C950 UARTs. It will also
> > > > avoid
> > > > capabilities detection warning like this:
> > > >
> > > > "ttyS0: detected caps 00000700 should be 00000100"
> > > >
> > > > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> > > > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> > >
> > >
> > > Has been bisected by several people to be causing failures and reported ?
> >
> > Hm, I saw Pavel reported a problem, but I didn't get a definate "this
> > must be reverted" resolution from that thread. It looked like we should
> > just drop one of these flags perhaps?
> >
> > I can revert it if it really is an issue, but it needs to be reverted in
> > Linus's tree first, before going to stable.
>
> Flow control flag seems to be responsible.
>
> But... it hits me and then... me. So I'd like to see it resolved in
> devel tree, but it may not 100% vital for stable.
Ok, care to make up a patch I can apply for Linus's tree first that
works for you?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review)
2011-01-07 18:37 ` Greg KH
@ 2011-01-09 7:38 ` Pavel Machek
2011-01-23 13:06 ` Pavel Machek
1 sibling, 0 replies; 177+ messages in thread
From: Pavel Machek @ 2011-01-09 7:38 UTC (permalink / raw)
To: Greg KH; +Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
Unbreak Billionton CF bluetooth card. This actually fixes a regression
on zaurus.
Signed-off-by: Pavel Machek <pavel@ucw.cz>
---
> > Flow control flag seems to be responsible.
> >
> > But... it hits me and then... me. So I'd like to see it resolved in
> > devel tree, but it may not 100% vital for stable.
>
> Ok, care to make up a patch I can apply for Linus's tree first that
> works for you?
./drivers/serial - ./drivers/serial.ofic
diff -X /usr/src/linux/.gitignore -ur ./drivers/serial.ofic/8250.c ./drivers/serial/8250.c
--- ./drivers/serial.ofic/8250.c 2011-01-02 21:25:29.000000000 +0100
+++ ./drivers/serial/8250.c 2011-01-09 08:10:39.000000000 +0100
@@ -236,7 +236,8 @@
.fifo_size = 128,
.tx_loadsz = 128,
.fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
- .flags = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+ /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
},
[PORT_16654] = {
.name = "ST16654",
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 177+ messages in thread* unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review)
2011-01-07 18:37 ` Greg KH
2011-01-09 7:38 ` unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review) Pavel Machek
@ 2011-01-23 13:06 ` Pavel Machek
2011-01-23 16:31 ` Greg KH
1 sibling, 1 reply; 177+ messages in thread
From: Pavel Machek @ 2011-01-23 13:06 UTC (permalink / raw)
To: Greg KH; +Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
Unbreak Billionton CF bluetooth card. This actually fixes a regression
on zaurus.
Signed-off-by: Pavel Machek <pavel@ucw.cz>
---
(now fixed typo)
> > Flow control flag seems to be responsible.
> >
> > But... it hits me and then... me. So I'd like to see it resolved in
> > devel tree, but it may not 100% vital for stable.
>
> Ok, care to make up a patch I can apply for Linus's tree first that
> works for you?
./drivers/serial - ./drivers/serial.ofic
diff -X /usr/src/linux/.gitignore -ur ./drivers/serial.ofic/8250.c ./drivers/serial/8250.c
--- ./drivers/serial.ofic/8250.c 2011-01-02 21:25:29.000000000 +0100
+++ ./drivers/serial/8250.c 2011-01-09 08:10:39.000000000 +0100
@@ -236,7 +236,8 @@
.fifo_size = 128,
.tx_loadsz = 128,
.fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
- .flags = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+ /* UART_CAP_EFR breaks Billionton CF bluetooth card. */
+ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
},
[PORT_16654] = {
.name = "ST16654",
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 177+ messages in thread* Re: unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review)
2011-01-23 13:06 ` Pavel Machek
@ 2011-01-23 16:31 ` Greg KH
2011-01-23 17:08 ` Pavel Machek
0 siblings, 1 reply; 177+ messages in thread
From: Greg KH @ 2011-01-23 16:31 UTC (permalink / raw)
To: Pavel Machek
Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
On Sun, Jan 23, 2011 at 02:06:11PM +0100, Pavel Machek wrote:
> Unbreak Billionton CF bluetooth card. This actually fixes a regression
> on zaurus.
>
> Signed-off-by: Pavel Machek <pavel@ucw.cz>
>
> ---
>
> (now fixed typo)
So you mean the version that I just accepted into my tree is wrong?
What's wrong with it? Care to provide the diff between the two?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review)
2011-01-23 16:31 ` Greg KH
@ 2011-01-23 17:08 ` Pavel Machek
2011-01-23 17:59 ` Greg KH
0 siblings, 1 reply; 177+ messages in thread
From: Pavel Machek @ 2011-01-23 17:08 UTC (permalink / raw)
To: Greg KH; +Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
> On Sun, Jan 23, 2011 at 02:06:11PM +0100, Pavel Machek wrote:
> > Unbreak Billionton CF bluetooth card. This actually fixes a regression
> > on zaurus.
> >
> > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> >
> > ---
> >
> > (now fixed typo)
>
> So you mean the version that I just accepted into my tree is wrong?
> What's wrong with it? Care to provide the diff between the two?
Sorry about that. Typo is in comment -> not really important. Someone
spotted it, so... feel free to keep old version.
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: unbreak billionton CF card (was Re: [000/152] 2.6.36.3-stable review)
2011-01-23 17:08 ` Pavel Machek
@ 2011-01-23 17:59 ` Greg KH
0 siblings, 0 replies; 177+ messages in thread
From: Greg KH @ 2011-01-23 17:59 UTC (permalink / raw)
To: Pavel Machek
Cc: Alan Cox, linux-kernel, stable, stable-review, torvalds, akpm
On Sun, Jan 23, 2011 at 06:08:54PM +0100, Pavel Machek wrote:
> > On Sun, Jan 23, 2011 at 02:06:11PM +0100, Pavel Machek wrote:
> > > Unbreak Billionton CF bluetooth card. This actually fixes a regression
> > > on zaurus.
> > >
> > > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > >
> > > ---
> > >
> > > (now fixed typo)
> >
> > So you mean the version that I just accepted into my tree is wrong?
> > What's wrong with it? Care to provide the diff between the two?
>
> Sorry about that. Typo is in comment -> not really important. Someone
> spotted it, so... feel free to keep old version.
Great, I'll keep that one, it will get pushed to Linus soon.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread