* [ 001/115] USB: serial: option: Added support Olivetti Olicard 145
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
@ 2013-05-06 20:43 ` Greg Kroah-Hartman
2013-05-06 20:43 ` [ 002/115] USB: option: add a D-Link DWM-156 variant Greg Kroah-Hartman
` (114 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filippo Turato
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filippo Turato <nnj7585@gmail.com>
commit d19bf5cedfd7d53854a3bd699c98b467b139833b upstream.
This adds PID for Olivetti Olicard 145 in option.c
Signed-off-by: Filippo Turato <nnj7585@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -347,6 +347,7 @@ static void option_instat_callback(struc
/* Olivetti products */
#define OLIVETTI_VENDOR_ID 0x0b3c
#define OLIVETTI_PRODUCT_OLICARD100 0xc000
+#define OLIVETTI_PRODUCT_OLICARD145 0xc003
/* Celot products */
#define CELOT_VENDOR_ID 0x211f
@@ -1273,6 +1274,7 @@ static const struct usb_device_id option
{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 002/115] USB: option: add a D-Link DWM-156 variant
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
2013-05-06 20:43 ` [ 001/115] USB: serial: option: Added support Olivetti Olicard 145 Greg Kroah-Hartman
@ 2013-05-06 20:43 ` Greg Kroah-Hartman
2013-05-06 20:43 ` [ 003/115] staging: zsmalloc: Fix link error on ARM Greg Kroah-Hartman
` (113 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjørn Mork
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit a2a2d6c7f93e160b52a4ad0164db1f43f743ae0f upstream.
Adding support for a Mediatek based device labelled as
D-Link Model: DWM-156, H/W Ver: A7
Also adding two other device IDs found in the Debian(!)
packages included on the embedded device driver CD.
This is a composite MBIM + serial ports + card reader device:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2001 ProdID=7d01 Rev= 3.00
S: Manufacturer=D-Link,Inc
S: Product=D-Link DWM-156
C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=125us
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=500us
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1352,6 +1352,12 @@ static const struct usb_device_id option
{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
{ USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) }, /* D-Link DWM-156 (variant) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) }, /* D-Link DWM-156 (variant) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 003/115] staging: zsmalloc: Fix link error on ARM
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
2013-05-06 20:43 ` [ 001/115] USB: serial: option: Added support Olivetti Olicard 145 Greg Kroah-Hartman
2013-05-06 20:43 ` [ 002/115] USB: option: add a D-Link DWM-156 variant Greg Kroah-Hartman
@ 2013-05-06 20:43 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 004/115] ARM: omap3: cpuidle: enable time keeping Greg Kroah-Hartman
` (112 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joerg Roedel, Minchan Kim
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <joro@8bytes.org>
commit d95abbbb291bf5bce078148f53603ce9c0aa1d44 upstream.
Testing the arm chromebook config against the upstream
kernel produces a linker error for the zsmalloc module from
staging. The symbol flush_tlb_kernel_range is not available
there. Fix this by removing the reimplementation of
unmap_kernel_range in the zsmalloc module and using the
function directly. The unmap_kernel_range function is not
usable by modules, so also disallow building the driver as a
module for now.
Signed-off-by: Joerg Roedel <joro@8bytes.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zsmalloc/Kconfig | 2 +-
drivers/staging/zsmalloc/zsmalloc-main.c | 5 +----
2 files changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/staging/zsmalloc/Kconfig
+++ b/drivers/staging/zsmalloc/Kconfig
@@ -1,5 +1,5 @@
config ZSMALLOC
- tristate "Memory allocator for compressed pages"
+ bool "Memory allocator for compressed pages"
default n
help
zsmalloc is a slab-based memory allocator designed to store
--- a/drivers/staging/zsmalloc/zsmalloc-main.c
+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
@@ -656,11 +656,8 @@ static inline void __zs_unmap_object(str
struct page *pages[2], int off, int size)
{
unsigned long addr = (unsigned long)area->vm_addr;
- unsigned long end = addr + (PAGE_SIZE * 2);
- flush_cache_vunmap(addr, end);
- unmap_kernel_range_noflush(addr, PAGE_SIZE * 2);
- flush_tlb_kernel_range(addr, end);
+ unmap_kernel_range(addr, PAGE_SIZE * 2);
}
#else /* USE_PGTABLE_MAPPING */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 004/115] ARM: omap3: cpuidle: enable time keeping
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2013-05-06 20:43 ` [ 003/115] staging: zsmalloc: Fix link error on ARM Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 005/115] ARM: u300: fix ages old copy/paste bug Greg Kroah-Hartman
` (111 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Lezcano, Santosh Shilimkar,
Kevin Hilman
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <daniel.lezcano@linaro.org>
commit 0d97558901c446a989de202a5d9ae94ec53644e5 upstream.
The TIME_VALID flag is specified for the different states but
the time residency computation is not done, no tk flag, no time
computation in the idle function.
Set the en_core_tk_irqen flag to activate it.
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/cpuidle34xx.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-omap2/cpuidle34xx.c
+++ b/arch/arm/mach-omap2/cpuidle34xx.c
@@ -274,8 +274,9 @@ static int omap3_enter_idle_bm(struct cp
static DEFINE_PER_CPU(struct cpuidle_device, omap3_idle_dev);
static struct cpuidle_driver omap3_idle_driver = {
- .name = "omap3_idle",
- .owner = THIS_MODULE,
+ .name = "omap3_idle",
+ .owner = THIS_MODULE,
+ .en_core_tk_irqen = 1,
.states = {
{
.enter = omap3_enter_idle_bm,
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 005/115] ARM: u300: fix ages old copy/paste bug
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2013-05-06 20:44 ` [ 004/115] ARM: omap3: cpuidle: enable time keeping Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 006/115] ARM: at91/at91sam9260.dtsi: fix u(s)art pinctrl encoding Greg Kroah-Hartman
` (110 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Linus Walleij,
Olof Johansson
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 0259d9eb30d003af305626db2d8332805696e60d upstream.
The UART1 is on the fast AHB bridge, not on the slow bus.
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-u300/include/mach/u300-regs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-u300/include/mach/u300-regs.h
+++ b/arch/arm/mach-u300/include/mach/u300-regs.h
@@ -95,7 +95,7 @@
#define U300_SPI_BASE (U300_FAST_PER_PHYS_BASE+0x6000)
/* Fast UART1 on U335 only */
-#define U300_UART1_BASE (U300_SLOW_PER_PHYS_BASE+0x7000)
+#define U300_UART1_BASE (U300_FAST_PER_PHYS_BASE+0x7000)
/*
* SLOW peripherals
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 006/115] ARM: at91/at91sam9260.dtsi: fix u(s)art pinctrl encoding
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2013-05-06 20:44 ` [ 005/115] ARM: u300: fix ages old copy/paste bug Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 007/115] ARM: at91: remove partial parameter in bootargs for at91sam9x5ek.dtsi Greg Kroah-Hartman
` (109 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Douglas Gilbert, Nicolas Ferre
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Gilbert <dgilbert@interlog.com>
commit f10491fff07dcced77f8ab1b3bc1f8e18715bfb9 upstream.
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
[nicolas.ferre@atmel.com: fix rts/cts for usart3]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/at91sam9260.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -158,8 +158,8 @@
usart1 {
pinctrl_usart1: usart1-0 {
atmel,pins =
- <2 6 0x1 0x1 /* PB6 periph A with pullup */
- 2 7 0x1 0x0>; /* PB7 periph A */
+ <1 6 0x1 0x1 /* PB6 periph A with pullup */
+ 1 7 0x1 0x0>; /* PB7 periph A */
};
pinctrl_usart1_rts: usart1_rts-0 {
@@ -194,18 +194,18 @@
usart3 {
pinctrl_usart3: usart3-0 {
atmel,pins =
- <2 10 0x1 0x1 /* PB10 periph A with pullup */
- 2 11 0x1 0x0>; /* PB11 periph A */
+ <1 10 0x1 0x1 /* PB10 periph A with pullup */
+ 1 11 0x1 0x0>; /* PB11 periph A */
};
pinctrl_usart3_rts: usart3_rts-0 {
atmel,pins =
- <3 8 0x2 0x0>; /* PB8 periph B */
+ <2 8 0x2 0x0>; /* PC8 periph B */
};
pinctrl_usart3_cts: usart3_cts-0 {
atmel,pins =
- <3 10 0x2 0x0>; /* PB10 periph B */
+ <2 10 0x2 0x0>; /* PC10 periph B */
};
};
@@ -220,8 +220,8 @@
uart1 {
pinctrl_uart1: uart1-0 {
atmel,pins =
- <2 12 0x1 0x1 /* PB12 periph A with pullup */
- 2 13 0x1 0x0>; /* PB13 periph A */
+ <1 12 0x1 0x1 /* PB12 periph A with pullup */
+ 1 13 0x1 0x0>; /* PB13 periph A */
};
};
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 007/115] ARM: at91: remove partial parameter in bootargs for at91sam9x5ek.dtsi
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2013-05-06 20:44 ` [ 006/115] ARM: at91/at91sam9260.dtsi: fix u(s)art pinctrl encoding Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 008/115] ARM: at91: Fix typo in restart code panic message Greg Kroah-Hartman
` (108 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean-Christophe PLAGNIOL-VILLARD,
Nicolas Ferre
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@atmel.com>
commit b090e5f68c0353534880b95ea0df56b8c0230b8c upstream.
Remove the malformed "mem=" bootargs parameter in at91sam9x5ek.dtsi
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/at91sam9x5ek.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/at91sam9x5ek.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi
@@ -13,7 +13,7 @@
compatible = "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
chosen {
- bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
+ bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
};
ahb {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 008/115] ARM: at91: Fix typo in restart code panic message
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2013-05-06 20:44 ` [ 007/115] ARM: at91: remove partial parameter in bootargs for at91sam9x5ek.dtsi Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 009/115] ARM: at91/trivial: fix model name for SAM9G15-EK Greg Kroah-Hartman
` (107 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard,
Jean-Christophe PLAGNIOL-VILLARD, Nicolas Ferre
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <maxime.ripard@free-electrons.com>
commit e7619459d47a673af3433208a42f583af920e9db upstream.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-at91/setup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-at91/setup.c
+++ b/arch/arm/mach-at91/setup.c
@@ -333,7 +333,7 @@ static void at91_dt_rstc(void)
of_id = of_match_node(rstc_ids, np);
if (!of_id)
- panic("AT91: rtsc no restart function availlable\n");
+ panic("AT91: rtsc no restart function available\n");
arm_pm_restart = of_id->data;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 009/115] ARM: at91/trivial: fix model name for SAM9G15-EK
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2013-05-06 20:44 ` [ 008/115] ARM: at91: Fix typo in restart code panic message Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 010/115] ARM: at91/trivial: typos in compatible property Greg Kroah-Hartman
` (106 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean-Christophe PLAGNIOL-VILLARD,
Nicolas Ferre
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@atmel.com>
commit 88fcb59a06556bf10eac97d7abb913cccea2c830 upstream.
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/at91sam9g15ek.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/at91sam9g15ek.dts
+++ b/arch/arm/boot/dts/at91sam9g15ek.dts
@@ -11,6 +11,6 @@
/include/ "at91sam9x5ek.dtsi"
/ {
- model = "Atmel AT91SAM9G25-EK";
+ model = "Atmel AT91SAM9G15-EK";
compatible = "atmel,at91sam9g15ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
};
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 010/115] ARM: at91/trivial: typos in compatible property
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2013-05-06 20:44 ` [ 009/115] ARM: at91/trivial: fix model name for SAM9G15-EK Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 011/115] powerpc: Add isync to copy_and_flush Greg Kroah-Hartman
` (105 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean-Christophe PLAGNIOL-VILLARD,
Nicolas Ferre
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@atmel.com>
commit 2a5a461f179509142c661d79f878855798b85201 upstream.
- unneeded whitespace
- missing double quote
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/at91sam9g15.dtsi | 2 +-
arch/arm/boot/dts/at91sam9g25.dtsi | 2 +-
arch/arm/boot/dts/at91sam9g35.dtsi | 2 +-
arch/arm/boot/dts/at91sam9x25.dtsi | 2 +-
arch/arm/boot/dts/at91sam9x35.dtsi | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/boot/dts/at91sam9g15.dtsi
+++ b/arch/arm/boot/dts/at91sam9g15.dtsi
@@ -10,7 +10,7 @@
/ {
model = "Atmel AT91SAM9G15 SoC";
- compatible = "atmel, at91sam9g15, atmel,at91sam9x5";
+ compatible = "atmel,at91sam9g15", "atmel,at91sam9x5";
ahb {
apb {
--- a/arch/arm/boot/dts/at91sam9g25.dtsi
+++ b/arch/arm/boot/dts/at91sam9g25.dtsi
@@ -10,7 +10,7 @@
/ {
model = "Atmel AT91SAM9G25 SoC";
- compatible = "atmel, at91sam9g25, atmel,at91sam9x5";
+ compatible = "atmel,at91sam9g25", "atmel,at91sam9x5";
ahb {
apb {
--- a/arch/arm/boot/dts/at91sam9g35.dtsi
+++ b/arch/arm/boot/dts/at91sam9g35.dtsi
@@ -10,7 +10,7 @@
/ {
model = "Atmel AT91SAM9G35 SoC";
- compatible = "atmel, at91sam9g35, atmel,at91sam9x5";
+ compatible = "atmel,at91sam9g35", "atmel,at91sam9x5";
ahb {
apb {
--- a/arch/arm/boot/dts/at91sam9x25.dtsi
+++ b/arch/arm/boot/dts/at91sam9x25.dtsi
@@ -10,7 +10,7 @@
/ {
model = "Atmel AT91SAM9X25 SoC";
- compatible = "atmel, at91sam9x25, atmel,at91sam9x5";
+ compatible = "atmel,at91sam9x25", "atmel,at91sam9x5";
ahb {
apb {
--- a/arch/arm/boot/dts/at91sam9x35.dtsi
+++ b/arch/arm/boot/dts/at91sam9x35.dtsi
@@ -10,7 +10,7 @@
/ {
model = "Atmel AT91SAM9X35 SoC";
- compatible = "atmel, at91sam9x35, atmel,at91sam9x5";
+ compatible = "atmel,at91sam9x35", "atmel,at91sam9x5";
ahb {
apb {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 011/115] powerpc: Add isync to copy_and_flush
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2013-05-06 20:44 ` [ 010/115] ARM: at91/trivial: typos in compatible property Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 012/115] powerpc: Fix hardware IRQs with MMU on exceptions when HV=0 Greg Kroah-Hartman
` (104 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Neuling,
Benjamin Herrenschmidt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <michael.neuling@au1.ibm.com>
commit 29ce3c5073057991217916abc25628e906911757 upstream.
In __after_prom_start we copy the kernel down to zero in two calls to
copy_and_flush. After the first call (copy from 0 to copy_to_here:)
we jump to the newly copied code soon after.
Unfortunately there's no isync between the copy of this code and the
jump to it. Hence it's possible that stale instructions could still be
in the icache or pipeline before we branch to it.
We've seen this on real machines and it's results in no console output
after:
calling quiesce...
returning from prom_init
The below adds an isync to ensure that the copy and flushing has
completed before any branching to the new instructions occurs.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/head_64.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -509,6 +509,7 @@ _GLOBAL(copy_and_flush)
sync
addi r5,r5,8
addi r6,r6,8
+ isync
blr
.align 8
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 012/115] powerpc: Fix hardware IRQs with MMU on exceptions when HV=0
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2013-05-06 20:44 ` [ 011/115] powerpc: Add isync to copy_and_flush Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 013/115] powerpc/power8: Fix secondary CPUs hanging on boot for HV=0 Greg Kroah-Hartman
` (103 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Neuling,
Benjamin Herrenschmidt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit 3e96ca7f007ddb06b82a74a68585d1dbafa85ff1 upstream.
POWER8 allows us to take interrupts with the MMU on. This gives us a
second set of vectors offset at 0x4000.
Unfortunately when coping these vectors we missed checking for MSR HV
for hardware interrupts (0x500). This results in us trying to use
HSRR0/1 when HV=0, rather than SRR0/1 on HW IRQs
The below fixes this to check CPU_FTR_HVMODE when patching the code at
0x4500.
Also we remove the check for CPU_FTR_ARCH_206 since relocation on IRQs
are only available in arch 2.07 and beyond.
Thanks to benh for helping find this.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/exceptions-64s.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -797,7 +797,7 @@ hardware_interrupt_relon_hv:
_MASKABLE_RELON_EXCEPTION_PSERIES(0x502, hardware_interrupt, EXC_HV, SOFTEN_TEST_HV)
FTR_SECTION_ELSE
_MASKABLE_RELON_EXCEPTION_PSERIES(0x500, hardware_interrupt, EXC_STD, SOFTEN_TEST_PR)
- ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_206)
+ ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE)
STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment)
STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check)
STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable)
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 013/115] powerpc/power8: Fix secondary CPUs hanging on boot for HV=0
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2013-05-06 20:44 ` [ 012/115] powerpc: Fix hardware IRQs with MMU on exceptions when HV=0 Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 014/115] powerpc/spufs: Initialise inode->i_ino in spufs_new_inode() Greg Kroah-Hartman
` (102 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Neuling,
Benjamin Herrenschmidt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit 8c2a381734fc9718f127f4aba958e8a7958d4028 upstream.
In __restore_cpu_power8 we determine if we are HV and if not, we return
before setting HV only resources.
Unfortunately we forgot to restore the link register from r11 before
returning.
This will happen on boot and with secondary CPUs not coming online.
This adds the missing link register restore.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/cpu_setup_power.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -66,6 +66,7 @@ _GLOBAL(__restore_cpu_power8)
bl __init_FSCR
mfmsr r3
rldicl. r0,r3,4,63
+ mtlr r11
beqlr
li r0,0
mtspr SPRN_LPID,r0
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 014/115] powerpc/spufs: Initialise inode->i_ino in spufs_new_inode()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2013-05-06 20:44 ` [ 013/115] powerpc/power8: Fix secondary CPUs hanging on boot for HV=0 Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 015/115] iwlwifi: fix freeing uninitialized pointer Greg Kroah-Hartman
` (101 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Ellerman,
Benjamin Herrenschmidt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <michael@ellerman.id.au>
commit 6747e83235caecd30b186d1282e4eba7679f81b7 upstream.
In commit 85fe402 (fs: do not assign default i_ino in new_inode), the
initialisation of i_ino was removed from new_inode() and pushed down
into the callers. However spufs_new_inode() was not updated.
This exhibits as no files appearing in /spu, because all our dirents
have a zero inode, which readdir() seems to dislike.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/cell/spufs/inode.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -99,6 +99,7 @@ spufs_new_inode(struct super_block *sb,
if (!inode)
goto out;
+ inode->i_ino = get_next_ino();
inode->i_mode = mode;
inode->i_uid = current_fsuid();
inode->i_gid = current_fsgid();
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 015/115] iwlwifi: fix freeing uninitialized pointer
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2013-05-06 20:44 ` [ 014/115] powerpc/spufs: Initialise inode->i_ino in spufs_new_inode() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 016/115] iwlwifi: dvm: dont send zeroed LQ cmd Greg Kroah-Hartman
` (100 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stanislaw Gruszka, Emmanuel Grumbach,
Johannes Berg
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 3309ccf7fcebceef540ebe90c65d2f94d745a45b upstream.
If on iwl_dump_nic_event_log() error occurs before that function
initialize buf, we process uninitiated pointer in
iwl_dbgfs_log_event_read() and can hit "BUG at mm/slub.c:3409"
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=951241
Reported-by: ian.odette@eprize.com
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/dvm/debugfs.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(
size_t count, loff_t *ppos)
{
struct iwl_priv *priv = file->private_data;
- char *buf;
- int pos = 0;
- ssize_t ret = -ENOMEM;
+ char *buf = NULL;
+ ssize_t ret;
- ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true);
- if (buf) {
- ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
- kfree(buf);
- }
+ ret = iwl_dump_nic_event_log(priv, true, &buf, true);
+ if (ret < 0)
+ goto err;
+ ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
+err:
+ kfree(buf);
return ret;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 016/115] iwlwifi: dvm: dont send zeroed LQ cmd
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2013-05-06 20:44 ` [ 015/115] iwlwifi: fix freeing uninitialized pointer Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 017/115] mwifiex: Use pci_release_region() instead of a pci_release_regions() Greg Kroah-Hartman
` (99 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach, Johannes Berg
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
commit 63b77bf489881747c5118476918cc8c29378ee63 upstream.
When the stations are being restored because of unassoc
RXON, the LQ cmd may not have been initialized because it
is initialized only after association.
Sending zeroed LQ_CMD makes the fw unhappy: it raises
SYSASSERT_2078.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
[move zero_lq and make static const]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/dvm/sta.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -695,6 +695,7 @@ void iwl_clear_ucode_stations(struct iwl
void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
{
struct iwl_addsta_cmd sta_cmd;
+ static const struct iwl_link_quality_cmd zero_lq = {};
struct iwl_link_quality_cmd lq;
int i;
bool found = false;
@@ -733,7 +734,9 @@ void iwl_restore_stations(struct iwl_pri
else
memcpy(&lq, priv->stations[i].lq,
sizeof(struct iwl_link_quality_cmd));
- send_lq = true;
+
+ if (!memcmp(&lq, &zero_lq, sizeof(lq)))
+ send_lq = true;
}
spin_unlock_bh(&priv->sta_lock);
ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 017/115] mwifiex: Use pci_release_region() instead of a pci_release_regions()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2013-05-06 20:44 ` [ 016/115] iwlwifi: dvm: dont send zeroed LQ cmd Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 018/115] mwifiex: Call pci_release_region after calling pci_disable_device Greg Kroah-Hartman
` (98 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yogesh Ashok Powar, Amitkumar Karwar,
Avinash Patil, Bing Zhao, John W. Linville
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Ashok Powar <yogeshp@marvell.com>
commit c380aafb77b7435d010698fe3ca6d3e1cd745fde upstream.
PCI regions are associated with the device using
pci_request_region() call. Hence use pci_release_region()
instead of pci_release_regions().
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/pcie.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -2281,8 +2281,8 @@ static void mwifiex_pcie_cleanup(struct
if (pdev) {
pci_iounmap(pdev, card->pci_mmap);
pci_iounmap(pdev, card->pci_mmap1);
-
- pci_release_regions(pdev);
+ pci_release_region(pdev, 2);
+ pci_release_region(pdev, 0);
pci_disable_device(pdev);
pci_set_drvdata(pdev, NULL);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 018/115] mwifiex: Call pci_release_region after calling pci_disable_device
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2013-05-06 20:44 ` [ 017/115] mwifiex: Use pci_release_region() instead of a pci_release_regions() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 019/115] mac80211: fix station entry leak/warning while suspending Greg Kroah-Hartman
` (97 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Avinash Patil, Amitkumar Karwar,
Yogesh Ashok Powar, Bing Zhao, John W. Linville
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Ashok Powar <yogeshp@marvell.com>
commit 5b0d9b218b74042ff72bf4bfda6eeb2e4bf98397 upstream.
"drivers should call pci_release_region() AFTER
calling pci_disable_device()"
Please refer section 3.2 Request MMIO/IOP resources
in Documentation/PCI/pci.txt
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/pcie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -2281,9 +2281,9 @@ static void mwifiex_pcie_cleanup(struct
if (pdev) {
pci_iounmap(pdev, card->pci_mmap);
pci_iounmap(pdev, card->pci_mmap1);
+ pci_disable_device(pdev);
pci_release_region(pdev, 2);
pci_release_region(pdev, 0);
- pci_disable_device(pdev);
pci_set_drvdata(pdev, NULL);
}
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 019/115] mac80211: fix station entry leak/warning while suspending
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2013-05-06 20:44 ` [ 018/115] mwifiex: Call pci_release_region after calling pci_disable_device Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 020/115] mac80211: use synchronize_rcu() with rcu_barrier() Greg Kroah-Hartman
` (96 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit b20d34c458bc2bbd0a4624f2933581e01e72d875 upstream.
Since Stanislaw's patches, when suspending while connected,
cfg80211 will disconnect. This causes the AP station to be
removed, which uses call_rcu() to clean up. Due to needing
process context, this queues a work struct on the mac80211
workqueue. This will warn and fail when already suspended,
which can happen if the rcu call doesn't happen quickly.
To fix this, replace the synchronize_net() which is really
just synchronize_rcu_expedited() with rcu_barrier(), which
unlike synchronize_rcu() waits until RCU callback have run
and thus avoids this issue.
In theory, this can even happen without Stanislaw's change
to disconnect on suspend since userspace might disconnect
just before suspending, though then it's unlikely that the
call_rcu() will be delayed long enough.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/pm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -53,8 +53,8 @@ int __ieee80211_suspend(struct ieee80211
ieee80211_stop_queues_by_reason(hw,
IEEE80211_QUEUE_STOP_REASON_SUSPEND);
- /* flush out all packets */
- synchronize_net();
+ /* flush out all packets and station cleanup call_rcu()s */
+ rcu_barrier();
drv_flush(local, false);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 020/115] mac80211: use synchronize_rcu() with rcu_barrier()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2013-05-06 20:44 ` [ 019/115] mac80211: fix station entry leak/warning while suspending Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 021/115] usb/misc/appledisplay: Add 24" LED Cinema display Greg Kroah-Hartman
` (95 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Copeland, Paul E. McKenney,
Johannes Berg
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <me@bobcopeland.com>
commit 8ceb59557bdc373e532b87d4142ce27e04218f0e upstream.
The RCU docs used to state that rcu_barrier() included a wait
for an RCU grace period; however the comments for rcu_barrier()
as of commit f0a0e6f... "rcu: Clarify memory-ordering properties
of grace-period primitives" contradict this.
So add back synchronize_{rcu,net}() to where they once were,
but keep the rcu_barrier()s for the call_rcu() callbacks.
Signed-off-by: Bob Copeland <bob@cozybit.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/cfg.c | 1 +
net/mac80211/iface.c | 5 +++--
net/mac80211/pm.c | 1 +
3 files changed, 5 insertions(+), 2 deletions(-)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1034,6 +1034,7 @@ static int ieee80211_stop_ap(struct wiph
list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
sta_info_flush_defer(vlan);
sta_info_flush_defer(sdata);
+ synchronize_net();
rcu_barrier();
list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
sta_info_flush_cleanup(vlan);
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -844,11 +844,12 @@ static void ieee80211_do_stop(struct iee
*
* sta_info_flush_cleanup() requires rcu_barrier()
* first to wait for the station call_rcu() calls
- * to complete, here we need at least sychronize_rcu()
- * it to wait for the RX path in case it is using the
+ * to complete, and we also need synchronize_rcu()
+ * to wait for the RX path in case it is using the
* interface and enqueuing frames at this very time on
* another CPU.
*/
+ synchronize_rcu();
rcu_barrier();
sta_info_flush_cleanup(sdata);
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -54,6 +54,7 @@ int __ieee80211_suspend(struct ieee80211
IEEE80211_QUEUE_STOP_REASON_SUSPEND);
/* flush out all packets and station cleanup call_rcu()s */
+ synchronize_net();
rcu_barrier();
drv_flush(local, false);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 021/115] usb/misc/appledisplay: Add 24" LED Cinema display
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2013-05-06 20:44 ` [ 020/115] mac80211: use synchronize_rcu() with rcu_barrier() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 022/115] USB: add ftdi_sio USB ID for GDM Boost V1.x Greg Kroah-Hartman
` (94 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Jencks
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Jencks <ben@bjencks.net>
commit e7d3b6e22c871ba36d052ca99bc8ceca4d546a60 upstream.
Add the Apple 24" LED Cinema display to the supported devices.
Signed-off-by: Ben Jencks <ben@bjencks.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/appledisplay.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -63,6 +63,7 @@ static const struct usb_device_id appled
{ APPLEDISPLAY_DEVICE(0x9219) },
{ APPLEDISPLAY_DEVICE(0x921c) },
{ APPLEDISPLAY_DEVICE(0x921d) },
+ { APPLEDISPLAY_DEVICE(0x9236) },
/* Terminating entry */
{ }
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 022/115] USB: add ftdi_sio USB ID for GDM Boost V1.x
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2013-05-06 20:44 ` [ 021/115] usb/misc/appledisplay: Add 24" LED Cinema display Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 023/115] USB: ftdi_sio: correct ST Micro Connect Lite PIDs Greg Kroah-Hartman
` (93 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefani Seibold
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefani Seibold <stefani@seibold.net>
commit 58f8b6c4fa5a13cb2ddb400e26e9e65766d71e38 upstream.
This patch add a missing usb device id for the GDMBoost V1.x device
The patch is against 3.9-rc5
Signed-off-by: Stefani Seibold <stefani@seibold.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -189,6 +189,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) },
{ USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) },
{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -74,6 +74,7 @@
#define FTDI_OPENDCC_THROTTLE_PID 0xBFDA
#define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
#define FTDI_OPENDCC_GBM_PID 0xBFDC
+#define FTDI_OPENDCC_GBM_BOOST_PID 0xBFDD
/* NZR SEM 16+ USB (http://www.nzr.de) */
#define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 023/115] USB: ftdi_sio: correct ST Micro Connect Lite PIDs
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2013-05-06 20:44 ` [ 022/115] USB: add ftdi_sio USB ID for GDM Boost V1.x Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 024/115] USB: ftdi_sio: enable two UART ports on ST Microconnect Lite Greg Kroah-Hartman
` (92 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Adrian Thomasset
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Thomasset <adrian.thomasset@st.com>
commit 9f06d15f8db6946e41f73196a122b84a37938878 upstream.
The current ST Micro Connect Lite uses the FT4232H hi-speed quad USB
UART FTDI chip. It is also possible to drive STM reference targets
populated with an on-board JTAG debugger based on the FT2232H chip with
the same STMicroelectronics tools.
For this reason, the ST Micro Connect Lite PIDs should be
ST_STMCLT_2232_PID: 0x3746
ST_STMCLT_4232_PID: 0x3747
Signed-off-by: Adrian Thomasset <adrian.thomasset@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 4 +++-
drivers/usb/serial/ftdi_sio_ids.h | 3 ++-
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -871,7 +871,9 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+ { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID),
.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
{ USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1151,7 +1151,8 @@
* STMicroelectonics
*/
#define ST_VID 0x0483
-#define ST_STMCLT1030_PID 0x3747 /* ST Micro Connect Lite STMCLT1030 */
+#define ST_STMCLT_2232_PID 0x3746
+#define ST_STMCLT_4232_PID 0x3747
/*
* Papouch products (http://www.papouch.com/)
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 024/115] USB: ftdi_sio: enable two UART ports on ST Microconnect Lite
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2013-05-06 20:44 ` [ 023/115] USB: ftdi_sio: correct ST Micro Connect Lite PIDs Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 025/115] USB: io_ti: fix TIOCGSERIAL Greg Kroah-Hartman
` (91 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Adrian Thomasset
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Thomasset <adrian.thomasset@st.com>
commit 71d9a2b95fc9c9474d46d764336efd7a5a805555 upstream.
The FT4232H used in the ST Micro Connect Lite has four hi-speed UART ports.
The first two ports are reserved for the JTAG interface.
We enable by default ports 2 and 3 as UARTs (where port 2 is a
conventional RS-232 UART)
Signed-off-by: Adrian Thomasset <adrian.thomasset@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1795,20 +1795,24 @@ static int ftdi_8u2232c_probe(struct usb
}
/*
- * First and second port on STMCLiteadaptors is reserved for JTAG interface
- * and the forth port for pio
+ * First two ports on JTAG adaptors using an FT4232 such as STMicroelectronics's
+ * ST Micro Connect Lite are reserved for JTAG or other non-UART interfaces and
+ * can be accessed from userspace.
+ * The next two ports are enabled as UARTs by default, where port 2 is
+ * a conventional RS-232 UART.
*/
static int ftdi_stmclite_probe(struct usb_serial *serial)
{
struct usb_device *udev = serial->dev;
struct usb_interface *interface = serial->interface;
- if (interface == udev->actconfig->interface[2])
- return 0;
+ if (interface == udev->actconfig->interface[0] ||
+ interface == udev->actconfig->interface[1]) {
+ dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
+ return -ENODEV;
+ }
- dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
-
- return -ENODEV;
+ return 0;
}
/*
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 025/115] USB: io_ti: fix TIOCGSERIAL
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2013-05-06 20:44 ` [ 024/115] USB: ftdi_sio: enable two UART ports on ST Microconnect Lite Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 026/115] usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep Greg Kroah-Hartman
` (90 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit b6fd35ee5766143d6bc3c333edf374c336ebdca6 upstream.
Fix regression introduced by commit f40d78155 ("USB: io_ti: kill custom
closing_wait implementation") which made TIOCGSERIAL return the wrong
value for closing_wait.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_ti.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2392,7 +2392,7 @@ static int get_serial_info(struct edgepo
cwait = edge_port->port->port.closing_wait;
if (cwait != ASYNC_CLOSING_WAIT_NONE)
- cwait = jiffies_to_msecs(closing_wait) / 10;
+ cwait = jiffies_to_msecs(cwait) / 10;
memset(&tmp, 0, sizeof(tmp));
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 026/115] usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2013-05-06 20:44 ` [ 025/115] USB: io_ti: fix TIOCGSERIAL Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 027/115] usb: chipidea: udc: fix memory access of shared memory on armv5 machines Greg Kroah-Hartman
` (89 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stikkolorum, Hans de Goede,
Alan Stern
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 1361bf4b9f9ef45e628a5b89e0fd9bedfdcb7104 upstream.
When usbfs receives a ctrl-request from userspace it calls check_ctrlrecip,
which for a request with USB_RECIP_ENDPOINT tries to map this to an interface
to see if this interface is claimed, except for ctrl-requests with a type of
USB_TYPE_VENDOR.
When trying to use this device: http://www.akaipro.com/eiepro
redirected to a Windows vm running on qemu on top of Linux.
The windows driver makes a ctrl-req with USB_TYPE_CLASS and
USB_RECIP_ENDPOINT with index 0, and the mapping of the endpoint (0) to
the interface fails since ep 0 is the ctrl endpoint and thus never is
part of an interface.
This patch fixes this ctrl-req failing by skipping the checkintf call for
USB_RECIP_ENDPOINT ctrl-reqs on the ctrl endpoint.
Reported-by: Dave Stikkolorum <d.r.stikkolorum@hhs.nl>
Tested-by: Dave Stikkolorum <d.r.stikkolorum@hhs.nl>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/devio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -739,6 +739,8 @@ static int check_ctrlrecip(struct dev_st
index &= 0xff;
switch (requesttype & USB_RECIP_MASK) {
case USB_RECIP_ENDPOINT:
+ if ((index & ~USB_DIR_IN) == 0)
+ return 0;
ret = findintfep(ps->dev, index);
if (ret >= 0)
ret = checkintf(ps, ret);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 027/115] usb: chipidea: udc: fix memory access of shared memory on armv5 machines
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2013-05-06 20:44 ` [ 026/115] usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 028/115] usb: chipidea: udc: fix memory leak in _ep_nuke Greg Kroah-Hartman
` (88 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Grzeschik, Felipe Balbi,
Alexander Shishkin
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <m.grzeschik@pengutronix.de>
commit a9c174302b1590ef3ead485d804a303c5f89174b upstream.
The udc uses an shared dma memory space between hard and software. This
memory layout is described in ci13xxx_qh and ci13xxx_td which are marked
with the attribute ((packed)).
The compiler currently does not know about the alignment of the memory
layout, and will create strb and ldrb operations.
The Datasheet of the synopsys core describes, that some operations on
the mapped memory need to be atomic double word operations. I.e. the
next pointer addressing in the qhead, as otherwise the hardware will
read wrong data and totally stuck.
This is also possible while working with the current active td queue,
and preparing the td->ptr.next in software while the hardware is still
working with the current active td which is supposed to be changed:
writeb(0xde, &td->ptr.next + 0x0); /* strb */
writeb(0xad, &td->ptr.next + 0x1); /* strb */
<----- hardware reads value of td->ptr.next and get stuck!
writeb(0xbe, &td->ptr.next + 0x2); /* strb */
writeb(0xef, &td->ptr.next + 0x3); /* strb */
This appeares on armv5 machines where the hardware does not support
unaligned 32bit operations.
This patch adds the attribute ((aligned(4))) to the structures to tell
the compiler to use 32bit operations. It also adds an wmb() for the
prepared TD data before it gets enqueued into the qhead.
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/udc.c | 2 ++
drivers/usb/chipidea/udc.h | 4 ++--
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -461,6 +461,8 @@ static int _hardware_enqueue(struct ci13
mReq->ptr->page[i] =
(mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
+ wmb();
+
if (!list_empty(&mEp->qh.queue)) {
struct ci13xxx_req *mReqPrev;
int n = hw_ep_bit(mEp->num, mEp->dir);
--- a/drivers/usb/chipidea/udc.h
+++ b/drivers/usb/chipidea/udc.h
@@ -40,7 +40,7 @@ struct ci13xxx_td {
#define TD_CURR_OFFSET (0x0FFFUL << 0)
#define TD_FRAME_NUM (0x07FFUL << 0)
#define TD_RESERVED_MASK (0x0FFFUL << 0)
-} __attribute__ ((packed));
+} __attribute__ ((packed, aligned(4)));
/* DMA layout of queue heads */
struct ci13xxx_qh {
@@ -57,7 +57,7 @@ struct ci13xxx_qh {
/* 9 */
u32 RESERVED;
struct usb_ctrlrequest setup;
-} __attribute__ ((packed));
+} __attribute__ ((packed, aligned(4)));
/**
* struct ci13xxx_req - usb request representation
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 028/115] usb: chipidea: udc: fix memory leak in _ep_nuke
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2013-05-06 20:44 ` [ 027/115] usb: chipidea: udc: fix memory access of shared memory on armv5 machines Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 029/115] usb: remove redundant tdi_reset Greg Kroah-Hartman
` (87 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Grzeschik, Alexander Shishkin
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <m.grzeschik@pengutronix.de>
commit 7ca2cd291fd84ae499390f227a255ccba2780a81 upstream.
In hardware_enqueue code adds one extra td with dma_pool_alloc if
mReq->req.zero is true. When _ep_nuke will be called for that endpoint,
dma_pool_free will not be called to free that memory again. That patch
fixes this.
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/udc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -563,6 +563,12 @@ __acquires(mEp->lock)
struct ci13xxx_req *mReq = \
list_entry(mEp->qh.queue.next,
struct ci13xxx_req, queue);
+
+ if (mReq->zptr) {
+ dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
+ mReq->zptr = NULL;
+ }
+
list_del_init(&mReq->queue);
mReq->req.status = -ESHUTDOWN;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 029/115] usb: remove redundant tdi_reset
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2013-05-06 20:44 ` [ 028/115] usb: chipidea: udc: fix memory leak in _ep_nuke Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 030/115] usb-storage: CY7C68300A chips do not support Cypress ATACB Greg Kroah-Hartman
` (86 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Braun, Shengzhou Liu,
Alan Stern
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengzhou Liu <Shengzhou.Liu@freescale.com>
commit 61ac6ac8d662ac7ac67c864954d39d1b19948354 upstream.
We remove the redundant tdi_reset in ehci_setup since there
is already it in ehci_reset.
It was observed that the duplicated tdi_reset was causing
the PHY_CLK_VALID bit unstable.
Reported-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Shengzhou Liu <Shengzhou.Liu@freescale.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-hcd.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -670,9 +670,6 @@ int ehci_setup(struct usb_hcd *hcd)
if (retval)
return retval;
- if (ehci_is_TDI(ehci))
- tdi_reset(ehci);
-
ehci_reset(ehci);
return 0;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 030/115] usb-storage: CY7C68300A chips do not support Cypress ATACB
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2013-05-06 20:44 ` [ 029/115] usb: remove redundant tdi_reset Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 031/115] s390/memory hotplug: prevent offline of active memory increments Greg Kroah-Hartman
` (85 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tormod Volden
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tormod Volden <debian.tormod@gmail.com>
commit 671b4b2ba9266cbcfe7210a704e9ea487dcaa988 upstream.
Many cards based on CY7C68300A/B/C use the USB ID 04b4:6830 but only the
B and C variants (EZ-USB AT2LP) support the ATA Command Block
functionality, according to the data sheets. The A variant (EZ-USB AT2)
locks up if ATACB is attempted, until a typical 30 seconds timeout runs
out and a USB reset is performed.
https://bugs.launchpad.net/bugs/428469
It seems that one way to spot a CY7C68300A (at least where the card
manufacturer left Cypress' EEPROM default vaules, against Cypress'
recommendations) is to look at the USB string descriptor indices.
A http://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CY7C68300A.pdf
B http://www.farnell.com/datasheets/43456.pdf
C http://www.cypress.com/?rID=14189
Note that a CY7C68300B/C chip appears as CY7C68300A if it is running
in Backward Compatibility Mode, and if ATACB would be supported in this
case there is anyway no way to tell which chip it really is.
For 5 years my external USB drive has been locking up for half a minute
when plugged in and ata_id is run by udev, or anytime hdparm or similar
is run on it.
Finally looking at the /correct/ datasheet I think I found the reason. I
am aware the quirk in this patch is a bit hacky, but the hardware
manufacturers haven't made it easy for us.
Signed-off-by: Tormod Volden <debian.tormod@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/cypress_atacb.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/usb/storage/cypress_atacb.c
+++ b/drivers/usb/storage/cypress_atacb.c
@@ -248,14 +248,26 @@ static int cypress_probe(struct usb_inte
{
struct us_data *us;
int result;
+ struct usb_device *device;
result = usb_stor_probe1(&us, intf, id,
(id - cypress_usb_ids) + cypress_unusual_dev_list);
if (result)
return result;
- us->protocol_name = "Transparent SCSI with Cypress ATACB";
- us->proto_handler = cypress_atacb_passthrough;
+ /* Among CY7C68300 chips, the A revision does not support Cypress ATACB
+ * Filter out this revision from EEPROM default descriptor values
+ */
+ device = interface_to_usbdev(intf);
+ if (device->descriptor.iManufacturer != 0x38 ||
+ device->descriptor.iProduct != 0x4e ||
+ device->descriptor.iSerialNumber != 0x64) {
+ us->protocol_name = "Transparent SCSI with Cypress ATACB";
+ us->proto_handler = cypress_atacb_passthrough;
+ } else {
+ us->protocol_name = "Transparent SCSI";
+ us->proto_handler = usb_stor_transparent_scsi_command;
+ }
result = usb_stor_probe2(us);
return result;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 031/115] s390/memory hotplug: prevent offline of active memory increments
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2013-05-06 20:44 ` [ 030/115] usb-storage: CY7C68300A chips do not support Cypress ATACB Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 032/115] xen/time: Fix kasprintf splat when allocating timer%d IRQ line Greg Kroah-Hartman
` (84 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Gerald Schaefer,
Martin Schwidefsky
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit 94c163663fc1dcfc067a5fb3cc1446b9469975ce upstream.
In case a machine supports memory hotplug all active memory increments
present at IPL time have been initialized with a "usecount" of 1.
This is wrong if the memory increment size is larger than the memory
section size of the memory hotplug code. If that is the case the
usecount must be initialized with the number of memory sections that
fit into one memory increment.
Otherwise it is possible to put a memory increment into standby state
even if there are still active sections.
Afterwards addressing exceptions might happen which cause the kernel
to panic.
However even worse, if a memory increment was put into standby state
and afterwards into active state again, it's contents would have been
zeroed, leading to memory corruption.
This was only an issue for machines that support standby memory and
have at least 256GB memory.
This is broken since commit fdb1bb15 "[S390] sclp/memory hotplug: fix
initial usecount of increments".
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/char/sclp_cmd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -561,6 +561,8 @@ static void __init sclp_add_standby_memo
add_memory_merged(0);
}
+#define MEM_SCT_SIZE (1UL << SECTION_SIZE_BITS)
+
static void __init insert_increment(u16 rn, int standby, int assigned)
{
struct memory_increment *incr, *new_incr;
@@ -573,7 +575,7 @@ static void __init insert_increment(u16
new_incr->rn = rn;
new_incr->standby = standby;
if (!standby)
- new_incr->usecount = 1;
+ new_incr->usecount = rzm > MEM_SCT_SIZE ? rzm/MEM_SCT_SIZE : 1;
last_rn = 0;
prev = &sclp_mem_list;
list_for_each_entry(incr, &sclp_mem_list, list) {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 032/115] xen/time: Fix kasprintf splat when allocating timer%d IRQ line.
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2013-05-06 20:44 ` [ 031/115] s390/memory hotplug: prevent offline of active memory increments Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 033/115] xen/smp: Fix leakage of timer interrupt line for every CPU online/offline Greg Kroah-Hartman
` (83 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 7918c92ae9638eb8a6ec18e2b4a0de84557cccc8 upstream.
When we online the CPU, we get this splat:
smpboot: Booting Node 0 Processor 1 APIC 0x2
installing Xen timer for CPU 1
BUG: sleeping function called from invalid context at /home/konrad/ssd/konrad/linux/mm/slab.c:3179
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1
Pid: 0, comm: swapper/1 Not tainted 3.9.0-rc6upstream-00001-g3884fad #1
Call Trace:
[<ffffffff810c1fea>] __might_sleep+0xda/0x100
[<ffffffff81194617>] __kmalloc_track_caller+0x1e7/0x2c0
[<ffffffff81303758>] ? kasprintf+0x38/0x40
[<ffffffff813036eb>] kvasprintf+0x5b/0x90
[<ffffffff81303758>] kasprintf+0x38/0x40
[<ffffffff81044510>] xen_setup_timer+0x30/0xb0
[<ffffffff810445af>] xen_hvm_setup_cpu_clockevents+0x1f/0x30
[<ffffffff81666d0a>] start_secondary+0x19c/0x1a8
The solution to that is use kasprintf in the CPU hotplug path
that 'online's the CPU. That is, do it in in xen_hvm_cpu_notify,
and remove the call to in xen_hvm_setup_cpu_clockevents.
Unfortunatly the later is not a good idea as the bootup path
does not use xen_hvm_cpu_notify so we would end up never allocating
timer%d interrupt lines when booting. As such add the check for
atomic() to continue.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/enlighten.c | 5 ++++-
arch/x86/xen/time.c | 6 +++++-
2 files changed, 9 insertions(+), 2 deletions(-)
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1589,8 +1589,11 @@ static int __cpuinit xen_hvm_cpu_notify(
switch (action) {
case CPU_UP_PREPARE:
xen_vcpu_setup(cpu);
- if (xen_have_vector_callback)
+ if (xen_have_vector_callback) {
xen_init_lock_cpu(cpu);
+ if (xen_feature(XENFEAT_hvm_safe_pvclock))
+ xen_setup_timer(cpu);
+ }
break;
default:
break;
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -497,7 +497,11 @@ static void xen_hvm_setup_cpu_clockevent
{
int cpu = smp_processor_id();
xen_setup_runstate_info(cpu);
- xen_setup_timer(cpu);
+ /*
+ * xen_setup_timer(cpu) - snprintf is bad in atomic context. Hence
+ * doing it xen_hvm_cpu_notify (which gets called by smp_init during
+ * early bootup and also during CPU hotplug events).
+ */
xen_setup_cpu_clockevents();
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 033/115] xen/smp: Fix leakage of timer interrupt line for every CPU online/offline.
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2013-05-06 20:44 ` [ 032/115] xen/time: Fix kasprintf splat when allocating timer%d IRQ line Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 034/115] xen/smp/spinlock: Fix leakage of the spinlock " Greg Kroah-Hartman
` (82 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 888b65b4bc5e7fcbbb967023300cd5d44dba1950 upstream.
In the PVHVM path when we do CPU online/offline path we would
leak the timer%d IRQ line everytime we do a offline event. The
online path (xen_hvm_setup_cpu_clockevents via
x86_cpuinit.setup_percpu_clockev) would allocate a new interrupt
line for the timer%d.
But we would still use the old interrupt line leading to:
kernel BUG at /home/konrad/ssd/konrad/linux/kernel/hrtimer.c:1261!
invalid opcode: 0000 [#1] SMP
RIP: 0010:[<ffffffff810b9e21>] [<ffffffff810b9e21>] hrtimer_interrupt+0x261/0x270
.. snip..
<IRQ>
[<ffffffff810445ef>] xen_timer_interrupt+0x2f/0x1b0
[<ffffffff81104825>] ? stop_machine_cpu_stop+0xb5/0xf0
[<ffffffff8111434c>] handle_irq_event_percpu+0x7c/0x240
[<ffffffff811175b9>] handle_percpu_irq+0x49/0x70
[<ffffffff813a74a3>] __xen_evtchn_do_upcall+0x1c3/0x2f0
[<ffffffff813a760a>] xen_evtchn_do_upcall+0x2a/0x40
[<ffffffff8167c26d>] xen_hvm_callback_vector+0x6d/0x80
<EOI>
[<ffffffff81666d01>] ? start_secondary+0x193/0x1a8
[<ffffffff81666cfd>] ? start_secondary+0x18f/0x1a8
There is also the oddity (timer1) in the /proc/interrupts after
offlining CPU1:
64: 1121 0 xen-percpu-virq timer0
78: 0 0 xen-percpu-virq timer1
84: 0 2483 xen-percpu-virq timer2
This patch fixes it.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/smp.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -662,6 +662,7 @@ static void xen_hvm_cpu_die(unsigned int
unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL);
+ xen_teardown_timer(cpu);
native_cpu_die(cpu);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 034/115] xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2013-05-06 20:44 ` [ 033/115] xen/smp: Fix leakage of timer interrupt line for every CPU online/offline Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 035/115] serial_core.c: add put_device() after device_find_child() Greg Kroah-Hartman
` (81 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 66ff0fe9e7bda8aec99985b24daad03652f7304e upstream.
While we don't use the spinlock interrupt line (see for details
commit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 -
xen: disable PV spinlocks on HVM) - we should still do the proper
init / deinit sequence. We did not do that correctly and for the
CPU init for PVHVM guest we would allocate an interrupt line - but
failed to deallocate the old interrupt line.
This resulted in leakage of an irq_desc but more importantly this splat
as we online an offlined CPU:
genirq: Flags mismatch irq 71. 0002cc20 (spinlock1) vs. 0002cc20 (spinlock1)
Pid: 2542, comm: init.late Not tainted 3.9.0-rc6upstream #1
Call Trace:
[<ffffffff811156de>] __setup_irq+0x23e/0x4a0
[<ffffffff81194191>] ? kmem_cache_alloc_trace+0x221/0x250
[<ffffffff811161bb>] request_threaded_irq+0xfb/0x160
[<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
[<ffffffff813a8423>] bind_ipi_to_irqhandler+0xa3/0x160
[<ffffffff81303758>] ? kasprintf+0x38/0x40
[<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
[<ffffffff810cad35>] ? update_max_interval+0x15/0x40
[<ffffffff816605db>] xen_init_lock_cpu+0x3c/0x78
[<ffffffff81660029>] xen_hvm_cpu_notify+0x29/0x33
[<ffffffff81676bdd>] notifier_call_chain+0x4d/0x70
[<ffffffff810bb2a9>] __raw_notifier_call_chain+0x9/0x10
[<ffffffff8109402b>] __cpu_notify+0x1b/0x30
[<ffffffff8166834a>] _cpu_up+0xa0/0x14b
[<ffffffff816684ce>] cpu_up+0xd9/0xec
[<ffffffff8165f754>] store_online+0x94/0xd0
[<ffffffff8141d15b>] dev_attr_store+0x1b/0x20
[<ffffffff81218f44>] sysfs_write_file+0xf4/0x170
[<ffffffff811a2864>] vfs_write+0xb4/0x130
[<ffffffff811a302a>] sys_write+0x5a/0xa0
[<ffffffff8167ada9>] system_call_fastpath+0x16/0x1b
cpu 1 spinlock event irq -16
smpboot: Booting Node 0 Processor 1 APIC 0x2
And if one looks at the /proc/interrupts right after
offlining (CPU1):
70: 0 0 xen-percpu-ipi spinlock0
71: 0 0 xen-percpu-ipi spinlock1
77: 0 0 xen-percpu-ipi spinlock2
There is the oddity of the 'spinlock1' still being present.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/smp.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -662,6 +662,7 @@ static void xen_hvm_cpu_die(unsigned int
unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL);
+ xen_uninit_lock_cpu(cpu);
xen_teardown_timer(cpu);
native_cpu_die(cpu);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 035/115] serial_core.c: add put_device() after device_find_child()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2013-05-06 20:44 ` [ 034/115] xen/smp/spinlock: Fix leakage of the spinlock " Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 036/115] arm: set the page table freeing ceiling to TASK_SIZE Greg Kroah-Hartman
` (80 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Federico Vaga
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Federico Vaga <federico.vaga@gmail.com>
commit 5a65dcc04cda41f4122aacc37a5a348454645399 upstream.
The serial core uses device_find_child() but does not drop the reference to
the retrieved child after using it. This patch add the missing put_device().
What I have done to test this issue.
I used a machine with an AMBA PL011 serial driver. I tested the patch on
next-20120408 because the last branch [next-20120415] does not boot on this
board.
For test purpose, I added some pr_info() messages to print the refcount
after device_find_child() (lines: 1937,2009), and after put_device()
(lines: 1947, 2021).
Boot the machine *without* put_device(). Then:
echo reboot > /sys/power/disk
echo disk > /sys/power/state
[ 87.058575] uart_suspend_port:1937 refcount 4
[ 87.058582] uart_suspend_port:1947 refcount 4
[ 87.098083] uart_resume_port:2009refcount 5
[ 87.098088] uart_resume_port:2021 refcount 5
echo disk > /sys/power/state
[ 103.055574] uart_suspend_port:1937 refcount 6
[ 103.055580] uart_suspend_port:1947 refcount 6
[ 103.095322] uart_resume_port:2009 refcount 7
[ 103.095327] uart_resume_port:2021 refcount 7
echo disk > /sys/power/state
[ 252.459580] uart_suspend_port:1937 refcount 8
[ 252.459586] uart_suspend_port:1947 refcount 8
[ 252.499611] uart_resume_port:2009 refcount 9
[ 252.499616] uart_resume_port:2021 refcount 9
The refcount continuously increased.
Boot the machine *with* this patch. Then:
echo reboot > /sys/power/disk
echo disk > /sys/power/state
[ 159.333559] uart_suspend_port:1937 refcount 4
[ 159.333566] uart_suspend_port:1947 refcount 3
[ 159.372751] uart_resume_port:2009 refcount 4
[ 159.372755] uart_resume_port:2021 refcount 3
echo disk > /sys/power/state
[ 185.713614] uart_suspend_port:1937 refcount 4
[ 185.713621] uart_suspend_port:1947 refcount 3
[ 185.752935] uart_resume_port:2009 refcount 4
[ 185.752940] uart_resume_port:2021 refcount 3
echo disk > /sys/power/state
[ 207.458584] uart_suspend_port:1937 refcount 4
[ 207.458591] uart_suspend_port:1947 refcount 3
[ 207.498598] uart_resume_port:2009 refcount 4
[ 207.498605] uart_resume_port:2021 refcount 3
The refcount correctly handled.
Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1941,6 +1941,8 @@ int uart_suspend_port(struct uart_driver
mutex_unlock(&port->mutex);
return 0;
}
+ put_device(tty_dev);
+
if (console_suspend_enabled || !uart_console(uport))
uport->suspended = 1;
@@ -2006,9 +2008,11 @@ int uart_resume_port(struct uart_driver
disable_irq_wake(uport->irq);
uport->irq_wake = 0;
}
+ put_device(tty_dev);
mutex_unlock(&port->mutex);
return 0;
}
+ put_device(tty_dev);
uport->suspended = 0;
/*
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 036/115] arm: set the page table freeing ceiling to TASK_SIZE
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2013-05-06 20:44 ` [ 035/115] serial_core.c: add put_device() after device_find_child() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 037/115] gianfar: do not advertise any alarm capability Greg Kroah-Hartman
` (79 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Russell King,
Hugh Dickins, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 104ad3b32d7a71941c8ab2dee78eea38e8a23309 upstream.
ARM processors with LPAE enabled use 3 levels of page tables, with an
entry in the top level (pgd) covering 1GB of virtual space. Because of
the branch relocation limitations on ARM, the loadable modules are
mapped 16MB below PAGE_OFFSET, making the corresponding 1GB pgd shared
between kernel modules and user space.
If free_pgtables() is called with the default ceiling 0,
free_pgd_range() (and subsequently called functions) also frees the page
table shared between user space and kernel modules (which is normally
handled by the ARM-specific pgd_free() function). This patch changes
defines the ARM USER_PGTABLES_CEILING to TASK_SIZE when CONFIG_ARM_LPAE
is enabled.
Note that the pgd_free() function already checks the presence of the
shared pmd page allocated by pgd_alloc() and frees it, though with
ceiling 0 this wasn't necessary.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/pgtable.h | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -61,6 +61,15 @@ extern void __pgd_error(const char *file
#define FIRST_USER_ADDRESS PAGE_SIZE
/*
+ * Use TASK_SIZE as the ceiling argument for free_pgtables() and
+ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd
+ * page shared between user and kernel).
+ */
+#ifdef CONFIG_ARM_LPAE
+#define USER_PGTABLES_CEILING TASK_SIZE
+#endif
+
+/*
* The pgprot_* and protection_map entries will be fixed up in runtime
* to include the cachable and bufferable bits based on memory policy,
* as well as any architecture dependent bits like global/ASID and SMP
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 037/115] gianfar: do not advertise any alarm capability.
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2013-05-06 20:44 ` [ 036/115] arm: set the page table freeing ceiling to TASK_SIZE Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 038/115] tty: fix up atime/mtime mess, take three Greg Kroah-Hartman
` (78 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Cochran, Chris LaRocque,
David S. Miller
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <richardcochran@gmail.com>
commit cd4baaaa04b4aaa3b0ec4d13a6f3d203b92eadbd upstream.
An early draft of the PHC patch series included an alarm in the
gianfar driver. During the review process, the alarm code was dropped,
but the capability removal was overlooked. This patch fixes the issue
by advertising zero alarms.
This patch should be applied to every 3.x stable kernel.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Reported-by: Chris LaRocque <clarocq@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -127,7 +127,6 @@ struct gianfar_ptp_registers {
#define DRIVER "gianfar_ptp"
#define DEFAULT_CKSEL 1
-#define N_ALARM 1 /* first alarm is used internally to reset fipers */
#define N_EXT_TS 2
#define REG_SIZE sizeof(struct gianfar_ptp_registers)
@@ -410,7 +409,7 @@ static struct ptp_clock_info ptp_gianfar
.owner = THIS_MODULE,
.name = "gianfar clock",
.max_adj = 512000,
- .n_alarm = N_ALARM,
+ .n_alarm = 0,
.n_ext_ts = N_EXT_TS,
.n_per_out = 0,
.pps = 1,
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 038/115] tty: fix up atime/mtime mess, take three
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2013-05-06 20:44 ` [ 037/115] gianfar: do not advertise any alarm capability Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 039/115] fbcon: when font is freed, clear also vc_font.data Greg Kroah-Hartman
` (77 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Kirby, Jiri Slaby,
Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit b0b885657b6c8ef63a46bc9299b2a7715d19acde upstream.
We first tried to avoid updating atime/mtime entirely (commit
b0de59b5733d: "TTY: do not update atime/mtime on read/write"), and then
limited it to only update it occasionally (commit 37b7f3c76595: "TTY:
fix atime/mtime regression"), but it turns out that this was both
insufficient and overkill.
It was insufficient because we let people attach to the shared ptmx node
to see activity without even reading atime/mtime, and it was overkill
because the "only once a minute" means that you can't really tell an
idle person from an active one with 'w'.
So this tries to fix the problem properly. It marks the shared ptmx
node as un-notifiable, and it lowers the "only once a minute" to a few
seconds instead - still long enough that you can't time individual
keystrokes, but short enough that you can tell whether somebody is
active or not.
Reported-by: Simon Kirby <sim@hostway.ca>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/pty.c | 3 +++
drivers/tty/tty_io.c | 4 ++--
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -682,6 +682,9 @@ static int ptmx_open(struct inode *inode
nonseekable_open(inode, filp);
+ /* We refuse fsnotify events on ptmx, since it's a shared resource */
+ filp->f_mode |= FMODE_NONOTIFY;
+
retval = tty_alloc_file(filp);
if (retval)
return retval;
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -941,10 +941,10 @@ void start_tty(struct tty_struct *tty)
EXPORT_SYMBOL(start_tty);
+/* We limit tty time update visibility to every 8 seconds or so. */
static void tty_update_time(struct timespec *time)
{
- unsigned long sec = get_seconds();
- sec -= sec % 60;
+ unsigned long sec = get_seconds() & ~7;
if ((long)(sec - time->tv_sec) > 0)
time->tv_sec = sec;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 039/115] fbcon: when font is freed, clear also vc_font.data
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2013-05-06 20:44 ` [ 038/115] tty: fix up atime/mtime mess, take three Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 040/115] tracing: Use stack of calling function for stack tracer Greg Kroah-Hartman
` (76 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mika Kuoppala, Dave Airlie
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Kuoppala <mika.kuoppala@linux.intel.com>
commit e6637d5427d2af9f3f33b95447bfc5347e5ccd85 upstream.
commit ae1287865f5361fa138d4d3b1b6277908b54eac9
Author: Dave Airlie <airlied@redhat.com>
Date: Thu Jan 24 16:12:41 2013 +1000
fbcon: don't lose the console font across generic->chip driver switch
uses a pointer in vc->vc_font.data to load font into the new driver.
However if the font is actually freed, we need to clear the data
so that we don't reload font from dangling pointer.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=892340
Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/console/fbcon.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1228,6 +1228,8 @@ static void fbcon_deinit(struct vc_data
finished:
fbcon_free_font(p, free_font);
+ if (free_font)
+ vc->vc_font.data = NULL;
if (!con_is_bound(&fb_con))
fbcon_exit();
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 040/115] tracing: Use stack of calling function for stack tracer
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2013-05-06 20:44 ` [ 039/115] fbcon: when font is freed, clear also vc_font.data Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 041/115] tracing: Fix stack tracer with fentry use Greg Kroah-Hartman
` (75 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 87889501d0adfae10e3b0f0e6f2d7536eed9ae84 upstream.
Use the stack of stack_trace_call() instead of check_stack() as
the test pointer for max stack size. It makes it a bit cleaner
and a little more accurate.
Adding stable, as a later fix depends on this patch.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_stack.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -39,20 +39,21 @@ static DEFINE_MUTEX(stack_sysctl_mutex);
int stack_tracer_enabled;
static int last_stack_tracer_enabled;
-static inline void check_stack(void)
+static inline void
+check_stack(unsigned long *stack)
{
unsigned long this_size, flags;
unsigned long *p, *top, *start;
int i;
- this_size = ((unsigned long)&this_size) & (THREAD_SIZE-1);
+ this_size = ((unsigned long)stack) & (THREAD_SIZE-1);
this_size = THREAD_SIZE - this_size;
if (this_size <= max_stack_size)
return;
/* we do not handle interrupt stacks yet */
- if (!object_is_on_stack(&this_size))
+ if (!object_is_on_stack(stack))
return;
local_irq_save(flags);
@@ -73,7 +74,7 @@ static inline void check_stack(void)
* Now find where in the stack these are.
*/
i = 0;
- start = &this_size;
+ start = stack;
top = (unsigned long *)
(((unsigned long)start & ~(THREAD_SIZE-1)) + THREAD_SIZE);
@@ -113,6 +114,7 @@ static void
stack_trace_call(unsigned long ip, unsigned long parent_ip,
struct ftrace_ops *op, struct pt_regs *pt_regs)
{
+ unsigned long stack;
int cpu;
preempt_disable_notrace();
@@ -122,7 +124,7 @@ stack_trace_call(unsigned long ip, unsig
if (per_cpu(trace_active, cpu)++ != 0)
goto out;
- check_stack();
+ check_stack(&stack);
out:
per_cpu(trace_active, cpu)--;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 041/115] tracing: Fix stack tracer with fentry use
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2013-05-06 20:44 ` [ 040/115] tracing: Use stack of calling function for stack tracer Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 042/115] tracing: Remove most or all of stack tracer stack size from stack_max_size Greg Kroah-Hartman
` (74 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit d4ecbfc49b4b1d4b597fb5ba9e4fa25d62f105c5 upstream.
When gcc 4.6 on x86 is used, the function tracer will use the new
option -mfentry which does a call to "fentry" at every function
instead of "mcount". The significance of this is that fentry is
called as the first operation of the function instead of the mcount
usage of being called after the stack.
This causes the stack tracer to show some bogus results for the size
of the last function traced, as well as showing "ftrace_call" instead
of the function. This is due to the stack frame not being set up
by the function that is about to be traced.
# cat stack_trace
Depth Size Location (48 entries)
----- ---- --------
0) 4824 216 ftrace_call+0x5/0x2f
1) 4608 112 ____cache_alloc+0xb7/0x22d
2) 4496 80 kmem_cache_alloc+0x63/0x12f
The 216 size for ftrace_call includes both the ftrace_call stack
(which includes the saving of registers it does), as well as the
stack size of the parent.
To fix this, if CC_USING_FENTRY is defined, then the stack_tracer
will reserve the first item in stack_dump_trace[] array when
calling save_stack_trace(), and it will fill it in with the parent ip.
Then the code will look for the parent pointer on the stack and
give the real size of the parent's stack pointer:
# cat stack_trace
Depth Size Location (14 entries)
----- ---- --------
0) 2640 48 update_group_power+0x26/0x187
1) 2592 224 update_sd_lb_stats+0x2a5/0x4ac
2) 2368 160 find_busiest_group+0x31/0x1f1
3) 2208 256 load_balance+0xd9/0x662
I'm Cc'ing stable, although it's not urgent, as it only shows bogus
size for item #0, the rest of the trace is legit. It should still be
corrected in previous stable releases.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_stack.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -20,13 +20,27 @@
#define STACK_TRACE_ENTRIES 500
+/*
+ * If fentry is used, then the function being traced will
+ * jump to fentry directly before it sets up its stack frame.
+ * We need to ignore that one and record the parent. Since
+ * the stack frame for the traced function wasn't set up yet,
+ * the stack_trace wont see the parent. That needs to be added
+ * manually to stack_dump_trace[] as the first element.
+ */
+#ifdef CC_USING_FENTRY
+# define add_func 1
+#else
+# define add_func 0
+#endif
+
static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
{ [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };
static unsigned stack_dump_index[STACK_TRACE_ENTRIES];
static struct stack_trace max_stack_trace = {
- .max_entries = STACK_TRACE_ENTRIES,
- .entries = stack_dump_trace,
+ .max_entries = STACK_TRACE_ENTRIES - add_func,
+ .entries = &stack_dump_trace[add_func],
};
static unsigned long max_stack_size;
@@ -40,7 +54,7 @@ int stack_tracer_enabled;
static int last_stack_tracer_enabled;
static inline void
-check_stack(unsigned long *stack)
+check_stack(unsigned long ip, unsigned long *stack)
{
unsigned long this_size, flags;
unsigned long *p, *top, *start;
@@ -71,6 +85,17 @@ check_stack(unsigned long *stack)
save_stack_trace(&max_stack_trace);
/*
+ * When fentry is used, the traced function does not get
+ * its stack frame set up, and we lose the parent.
+ * Add that one in manally. We set up save_stack_trace()
+ * to not touch the first element in this case.
+ */
+ if (add_func) {
+ stack_dump_trace[0] = ip;
+ max_stack_trace.nr_entries++;
+ }
+
+ /*
* Now find where in the stack these are.
*/
i = 0;
@@ -124,7 +149,7 @@ stack_trace_call(unsigned long ip, unsig
if (per_cpu(trace_active, cpu)++ != 0)
goto out;
- check_stack(&stack);
+ check_stack(parent_ip, &stack);
out:
per_cpu(trace_active, cpu)--;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 042/115] tracing: Remove most or all of stack tracer stack size from stack_max_size
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2013-05-06 20:44 ` [ 041/115] tracing: Fix stack tracer with fentry use Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 043/115] tracing: Fix off-by-one on allocating stat->pages Greg Kroah-Hartman
` (73 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 4df297129f622bdc18935c856f42b9ddd18f9f28 upstream.
Currently, the depth reported in the stack tracer stack_trace file
does not match the stack_max_size file. This is because the stack_max_size
includes the overhead of stack tracer itself while the depth does not.
The first time a max is triggered, a calculation is not performed that
figures out the overhead of the stack tracer and subtracts it from
the stack_max_size variable. The overhead is stored and is subtracted
from the reported stack size for comparing for a new max.
Now the stack_max_size corresponds to the reported depth:
# cat stack_max_size
4640
# cat stack_trace
Depth Size Location (48 entries)
----- ---- --------
0) 4640 32 _raw_spin_lock+0x18/0x24
1) 4608 112 ____cache_alloc+0xb7/0x22d
2) 4496 80 kmem_cache_alloc+0x63/0x12f
3) 4416 16 mempool_alloc_slab+0x15/0x17
[...]
While testing against and older gcc on x86 that uses mcount instead
of fentry, I found that pasing in ip + MCOUNT_INSN_SIZE let the
stack trace show one more function deep which was missing before.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_stack.c | 75 ++++++++++++++++++++++++++++++++-------------
1 file changed, 54 insertions(+), 21 deletions(-)
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -20,27 +20,24 @@
#define STACK_TRACE_ENTRIES 500
-/*
- * If fentry is used, then the function being traced will
- * jump to fentry directly before it sets up its stack frame.
- * We need to ignore that one and record the parent. Since
- * the stack frame for the traced function wasn't set up yet,
- * the stack_trace wont see the parent. That needs to be added
- * manually to stack_dump_trace[] as the first element.
- */
#ifdef CC_USING_FENTRY
-# define add_func 1
+# define fentry 1
#else
-# define add_func 0
+# define fentry 0
#endif
static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
{ [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };
static unsigned stack_dump_index[STACK_TRACE_ENTRIES];
+/*
+ * Reserve one entry for the passed in ip. This will allow
+ * us to remove most or all of the stack size overhead
+ * added by the stack tracer itself.
+ */
static struct stack_trace max_stack_trace = {
- .max_entries = STACK_TRACE_ENTRIES - add_func,
- .entries = &stack_dump_trace[add_func],
+ .max_entries = STACK_TRACE_ENTRIES - 1,
+ .entries = &stack_dump_trace[1],
};
static unsigned long max_stack_size;
@@ -58,10 +55,14 @@ check_stack(unsigned long ip, unsigned l
{
unsigned long this_size, flags;
unsigned long *p, *top, *start;
+ static int tracer_frame;
+ int frame_size = ACCESS_ONCE(tracer_frame);
int i;
this_size = ((unsigned long)stack) & (THREAD_SIZE-1);
this_size = THREAD_SIZE - this_size;
+ /* Remove the frame of the tracer */
+ this_size -= frame_size;
if (this_size <= max_stack_size)
return;
@@ -73,6 +74,10 @@ check_stack(unsigned long ip, unsigned l
local_irq_save(flags);
arch_spin_lock(&max_stack_lock);
+ /* In case another CPU set the tracer_frame on us */
+ if (unlikely(!frame_size))
+ this_size -= tracer_frame;
+
/* a race could have already updated it */
if (this_size <= max_stack_size)
goto out;
@@ -85,15 +90,12 @@ check_stack(unsigned long ip, unsigned l
save_stack_trace(&max_stack_trace);
/*
- * When fentry is used, the traced function does not get
- * its stack frame set up, and we lose the parent.
- * Add that one in manally. We set up save_stack_trace()
- * to not touch the first element in this case.
+ * Add the passed in ip from the function tracer.
+ * Searching for this on the stack will skip over
+ * most of the overhead from the stack tracer itself.
*/
- if (add_func) {
- stack_dump_trace[0] = ip;
- max_stack_trace.nr_entries++;
- }
+ stack_dump_trace[0] = ip;
+ max_stack_trace.nr_entries++;
/*
* Now find where in the stack these are.
@@ -123,6 +125,18 @@ check_stack(unsigned long ip, unsigned l
found = 1;
/* Start the search from here */
start = p + 1;
+ /*
+ * We do not want to show the overhead
+ * of the stack tracer stack in the
+ * max stack. If we haven't figured
+ * out what that is, then figure it out
+ * now.
+ */
+ if (unlikely(!tracer_frame) && i == 1) {
+ tracer_frame = (p - stack) *
+ sizeof(unsigned long);
+ max_stack_size -= tracer_frame;
+ }
}
}
@@ -149,7 +163,26 @@ stack_trace_call(unsigned long ip, unsig
if (per_cpu(trace_active, cpu)++ != 0)
goto out;
- check_stack(parent_ip, &stack);
+ /*
+ * When fentry is used, the traced function does not get
+ * its stack frame set up, and we lose the parent.
+ * The ip is pretty useless because the function tracer
+ * was called before that function set up its stack frame.
+ * In this case, we use the parent ip.
+ *
+ * By adding the return address of either the parent ip
+ * or the current ip we can disregard most of the stack usage
+ * caused by the stack tracer itself.
+ *
+ * The function tracer always reports the address of where the
+ * mcount call was, but the stack will hold the return address.
+ */
+ if (fentry)
+ ip = parent_ip;
+ else
+ ip += MCOUNT_INSN_SIZE;
+
+ check_stack(ip, &stack);
out:
per_cpu(trace_active, cpu)--;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 043/115] tracing: Fix off-by-one on allocating stat->pages
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2013-05-06 20:44 ` [ 042/115] tracing: Remove most or all of stack tracer stack size from stack_max_size Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 044/115] tracing: Check return value of tracing_init_dentry() Greg Kroah-Hartman
` (72 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Frederic Weisbecker,
Namhyung Kim, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung.kim@lge.com>
commit 39e30cd1537937d3c00ef87e865324e981434e5b upstream.
The first page was allocated separately, so no need to start from 0.
Link: http://lkml.kernel.org/r/1364820385-32027-2-git-send-email-namhyung@kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Namhyung Kim <namhyung.kim@lge.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -676,7 +676,7 @@ int ftrace_profile_pages_init(struct ftr
pages = DIV_ROUND_UP(functions, PROFILES_PER_PAGE);
- for (i = 0; i < pages; i++) {
+ for (i = 1; i < pages; i++) {
pg->next = (void *)get_zeroed_page(GFP_KERNEL);
if (!pg->next)
goto out_free;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 044/115] tracing: Check return value of tracing_init_dentry()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2013-05-06 20:44 ` [ 043/115] tracing: Fix off-by-one on allocating stat->pages Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 045/115] tracing: Reset ftrace_graph_filter_enabled if count is zero Greg Kroah-Hartman
` (71 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Frederic Weisbecker,
Namhyung Kim, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung.kim@lge.com>
commit ed6f1c996bfe4b6e520cf7a74b51cd6988d84420 upstream.
Check return value and bail out if it's NULL.
Link: http://lkml.kernel.org/r/1365553093-10180-2-git-send-email-namhyung@kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Namhyung Kim <namhyung.kim@lge.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 2 ++
kernel/trace/trace_stack.c | 2 ++
kernel/trace/trace_stat.c | 2 ++
3 files changed, 6 insertions(+)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5028,6 +5028,8 @@ static __init int tracer_init_debugfs(vo
trace_access_lock_init();
d_tracer = tracing_init_dentry();
+ if (!d_tracer)
+ return 0;
trace_create_file("trace_options", 0644, d_tracer,
NULL, &tracing_iter_fops);
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -431,6 +431,8 @@ static __init int stack_trace_init(void)
struct dentry *d_tracer;
d_tracer = tracing_init_dentry();
+ if (!d_tracer)
+ return 0;
trace_create_file("stack_max_size", 0644, d_tracer,
&max_stack_size, &stack_max_size_fops);
--- a/kernel/trace/trace_stat.c
+++ b/kernel/trace/trace_stat.c
@@ -307,6 +307,8 @@ static int tracing_stat_init(void)
struct dentry *d_tracing;
d_tracing = tracing_init_dentry();
+ if (!d_tracing)
+ return 0;
stat_dir = debugfs_create_dir("trace_stat", d_tracing);
if (!stat_dir)
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 045/115] tracing: Reset ftrace_graph_filter_enabled if count is zero
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2013-05-06 20:44 ` [ 044/115] tracing: Check return value of tracing_init_dentry() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 046/115] i2c: xiic: must always write 16-bit words to TX_FIFO Greg Kroah-Hartman
` (70 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Frederic Weisbecker,
Ingo Molnar, Namhyung Kim, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung.kim@lge.com>
commit 9f50afccfdc15d95d7331acddcb0f7703df089ae upstream.
The ftrace_graph_count can be decreased with a "!" pattern, so that
the enabled flag should be updated too.
Link: http://lkml.kernel.org/r/1365663698-2413-1-git-send-email-namhyung@kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Namhyung Kim <namhyung.kim@lge.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3736,7 +3736,8 @@ out:
if (fail)
return -EINVAL;
- ftrace_graph_filter_enabled = 1;
+ ftrace_graph_filter_enabled = !!(*idx);
+
return 0;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 046/115] i2c: xiic: must always write 16-bit words to TX_FIFO
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2013-05-06 20:44 ` [ 045/115] tracing: Reset ftrace_graph_filter_enabled if count is zero Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 047/115] crypto: crc32-pclmul - Use gas macro for pclmulqdq Greg Kroah-Hartman
` (69 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wolfram Sang
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven A. Falco" <sfalco@harris.com>
commit c39e8e4354ce4daf23336de5daa28a3b01f00aa6 upstream.
The TX_FIFO register is 10 bits wide. The lower 8 bits are the data to be
written, while the upper two bits are flags to indicate stop/start.
The driver apparently attempted to optimize write access, by only writing a
byte in those cases where the stop/start bits are zero. However, we have
seen cases where the lower byte is duplicated onto the upper byte by the
hardware, which causes inadvertent stop/starts.
This patch changes the write access to the transmit FIFO to always be 16 bits
wide.
Signed off by: Steven A. Falco <sfalco@harris.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-xiic.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -312,10 +312,8 @@ static void xiic_fill_tx_fifo(struct xii
/* last message in transfer -> STOP */
data |= XIIC_TX_DYN_STOP_MASK;
dev_dbg(i2c->adap.dev.parent, "%s TX STOP\n", __func__);
-
- xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
- } else
- xiic_setreg8(i2c, XIIC_DTR_REG_OFFSET, data);
+ }
+ xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
}
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 047/115] crypto: crc32-pclmul - Use gas macro for pclmulqdq
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2013-05-06 20:44 ` [ 046/115] i2c: xiic: must always write 16-bit words to TX_FIFO Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 048/115] Drivers: hv: vmbus: Fix a bug in hv_need_to_signal() Greg Kroah-Hartman
` (68 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sandy Wu, Herbert Xu
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandy Wu <sandyw@twitter.com>
commit 57ae1b0532977b30184aaba04b6cafe0a284c21f upstream.
Occurs when CONFIG_CRYPTO_CRC32C_INTEL=y and CONFIG_CRYPTO_CRC32C_INTEL=y.
Older versions of bintuils do not support the pclmulqdq instruction. The
PCLMULQDQ gas macro is used instead.
Signed-off-by: Sandy Wu <sandyw@twitter.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
@@ -42,6 +42,7 @@
* SOFTWARE.
*/
+#include <asm/inst.h>
#include <linux/linkage.h>
## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
@@ -225,10 +226,10 @@ LABEL crc_ %i
movdqa (bufp), %xmm0 # 2 consts: K1:K2
movq crc_init, %xmm1 # CRC for block 1
- pclmulqdq $0x00,%xmm0,%xmm1 # Multiply by K2
+ PCLMULQDQ 0x00,%xmm0,%xmm1 # Multiply by K2
movq crc1, %xmm2 # CRC for block 2
- pclmulqdq $0x10, %xmm0, %xmm2 # Multiply by K1
+ PCLMULQDQ 0x10, %xmm0, %xmm2 # Multiply by K1
pxor %xmm2,%xmm1
movq %xmm1, %rax
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 048/115] Drivers: hv: vmbus: Fix a bug in hv_need_to_signal()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2013-05-06 20:44 ` [ 047/115] crypto: crc32-pclmul - Use gas macro for pclmulqdq Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 049/115] sysfs: fix use after free in case of concurrent read/write and readdir Greg Kroah-Hartman
` (67 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Haiyang Zhang,
Olaf Hering
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 288fa3e022eb85fa151e0f9bcd15caeb81679af6 upstream.
As part of updating the vmbus protocol, the function hv_need_to_signal()
was introduced. This functions helps optimize signalling from guest to
host. The newly added memory barrier is needed to ensure that we correctly
decide when to signal the host.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Olaf Hering <olh@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/ring_buffer.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -71,6 +71,7 @@ u32 hv_end_read(struct hv_ring_buffer_in
static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi)
{
+ smp_mb();
if (rbi->ring_buffer->interrupt_mask)
return false;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 049/115] sysfs: fix use after free in case of concurrent read/write and readdir
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2013-05-06 20:44 ` [ 048/115] Drivers: hv: vmbus: Fix a bug in hv_need_to_signal() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 050/115] Fix initialization of CMCI/CMCP interrupts Greg Kroah-Hartman
` (66 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Zefan, Ming Lei
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <ming.lei@canonical.com>
commit f7db5e7660b122142410dcf36ba903c73d473250 upstream.
The inode->i_mutex isn't hold when updating filp->f_pos
in read()/write(), so the filp->f_pos might be read as
0 or 1 in readdir() when there is concurrent read()/write()
on this same file, then may cause use after free in readdir().
The bug can be reproduced with Li Zefan's test code on the
link:
https://patchwork.kernel.org/patch/2160771/
This patch fixes the use after free under this situation.
Reported-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/sysfs/dir.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -1012,6 +1012,7 @@ static int sysfs_readdir(struct file * f
enum kobj_ns_type type;
const void *ns;
ino_t ino;
+ loff_t off;
type = sysfs_ns_type(parent_sd);
ns = sysfs_info(dentry->d_sb)->ns[type];
@@ -1034,6 +1035,7 @@ static int sysfs_readdir(struct file * f
return 0;
}
mutex_lock(&sysfs_mutex);
+ off = filp->f_pos;
for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
pos;
pos = sysfs_dir_next_pos(ns, parent_sd, filp->f_pos, pos)) {
@@ -1045,19 +1047,24 @@ static int sysfs_readdir(struct file * f
len = strlen(name);
ino = pos->s_ino;
type = dt_type(pos);
- filp->f_pos = pos->s_hash;
+ off = filp->f_pos = pos->s_hash;
filp->private_data = sysfs_get(pos);
mutex_unlock(&sysfs_mutex);
- ret = filldir(dirent, name, len, filp->f_pos, ino, type);
+ ret = filldir(dirent, name, len, off, ino, type);
mutex_lock(&sysfs_mutex);
if (ret < 0)
break;
}
mutex_unlock(&sysfs_mutex);
- if ((filp->f_pos > 1) && !pos) { /* EOF */
- filp->f_pos = INT_MAX;
+
+ /* don't reference last entry if its refcount is dropped */
+ if (!pos) {
filp->private_data = NULL;
+
+ /* EOF and not changed as 0 or 1 in read/write path */
+ if (off == filp->f_pos && off > 1)
+ filp->f_pos = INT_MAX;
}
return 0;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 050/115] Fix initialization of CMCI/CMCP interrupts
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2013-05-06 20:44 ` [ 049/115] sysfs: fix use after free in case of concurrent read/write and readdir Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 051/115] PCI / ACPI: Dont query OSC support with all possible controls Greg Kroah-Hartman
` (65 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fred Hartnett, Tony Luck
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <tony.luck@intel.com>
commit d303e9e98fce56cdb3c6f2ac92f626fc2bd51c77 upstream.
Back 2010 during a revamp of the irq code some initializations
were moved from ia64_mca_init() to ia64_mca_late_init() in
commit c75f2aa13f5b268aba369b5dc566088b5194377c
Cannot use register_percpu_irq() from ia64_mca_init()
But this was hideously wrong. First of all these initializations
are now down far too late. Specifically after all the other cpus
have been brought up and initialized their own CMC vectors from
smp_callin(). Also ia64_mca_late_init() may be called from any cpu
so the line:
ia64_mca_cmc_vector_setup(); /* Setup vector on BSP */
is generally not executed on the BSP, and so the CMC vector isn't
setup at all on that processor.
Make use of the arch_early_irq_init() hook to get this code executed
at just the right moment: not too early, not too late.
Reported-by: Fred Hartnett <fred.hartnett@hp.com>
Tested-by: Fred Hartnett <fred.hartnett@hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/ia64/include/asm/mca.h | 1 +
arch/ia64/kernel/irq.c | 8 ++++++++
arch/ia64/kernel/mca.c | 37 ++++++++++++++++++++++++-------------
3 files changed, 33 insertions(+), 13 deletions(-)
--- a/arch/ia64/include/asm/mca.h
+++ b/arch/ia64/include/asm/mca.h
@@ -143,6 +143,7 @@ extern unsigned long __per_cpu_mca[NR_CP
extern int cpe_vector;
extern int ia64_cpe_irq;
extern void ia64_mca_init(void);
+extern void ia64_mca_irq_init(void);
extern void ia64_mca_cpu_init(void *);
extern void ia64_os_mca_dispatch(void);
extern void ia64_os_mca_dispatch_end(void);
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -23,6 +23,8 @@
#include <linux/interrupt.h>
#include <linux/kernel_stat.h>
+#include <asm/mca.h>
+
/*
* 'what should we do if we get a hw irq event on an illegal vector'.
* each architecture has to answer this themselves.
@@ -83,6 +85,12 @@ bool is_affinity_mask_valid(const struct
#endif /* CONFIG_SMP */
+int __init arch_early_irq_init(void)
+{
+ ia64_mca_irq_init();
+ return 0;
+}
+
#ifdef CONFIG_HOTPLUG_CPU
unsigned int vectors_in_migration[NR_IRQS];
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -2074,22 +2074,16 @@ ia64_mca_init(void)
printk(KERN_INFO "MCA related initialization done\n");
}
+
/*
- * ia64_mca_late_init
- *
- * Opportunity to setup things that require initialization later
- * than ia64_mca_init. Setup a timer to poll for CPEs if the
- * platform doesn't support an interrupt driven mechanism.
- *
- * Inputs : None
- * Outputs : Status
+ * These pieces cannot be done in ia64_mca_init() because it is called before
+ * early_irq_init() which would wipe out our percpu irq registrations. But we
+ * cannot leave them until ia64_mca_late_init() because by then all the other
+ * processors have been brought online and have set their own CMC vectors to
+ * point at a non-existant action. Called from arch_early_irq_init().
*/
-static int __init
-ia64_mca_late_init(void)
+void __init ia64_mca_irq_init(void)
{
- if (!mca_init)
- return 0;
-
/*
* Configure the CMCI/P vector and handler. Interrupts for CMC are
* per-processor, so AP CMC interrupts are setup in smp_callin() (smpboot.c).
@@ -2108,6 +2102,23 @@ ia64_mca_late_init(void)
/* Setup the CPEI/P handler */
register_percpu_irq(IA64_CPEP_VECTOR, &mca_cpep_irqaction);
#endif
+}
+
+/*
+ * ia64_mca_late_init
+ *
+ * Opportunity to setup things that require initialization later
+ * than ia64_mca_init. Setup a timer to poll for CPEs if the
+ * platform doesn't support an interrupt driven mechanism.
+ *
+ * Inputs : None
+ * Outputs : Status
+ */
+static int __init
+ia64_mca_late_init(void)
+{
+ if (!mca_init)
+ return 0;
register_hotcpu_notifier(&mca_cpu_notifier);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 051/115] PCI / ACPI: Dont query OSC support with all possible controls
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2013-05-06 20:44 ` [ 050/115] Fix initialization of CMCI/CMCP interrupts Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 052/115] PCI/PM: Fix fallback to PCI_D0 in pci_platform_power_transition() Greg Kroah-Hartman
` (64 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yinghai Lu, Rafael J. Wysocki
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yinghai Lu <yinghai@kernel.org>
commit 545d6e189a41c94c11f55045a771118eccc9d9eb upstream.
Found problem on system that firmware that could handle pci aer.
Firmware get error reporting after pci injecting error, before os boots.
But after os boots, firmware can not get report anymore, even pci=noaer
is passed.
Root cause: BIOS _OSC has problem with query bit checking.
It turns out that BIOS vendor is copying example code from ACPI Spec.
In ACPI Spec 5.0, page 290:
If (Not(And(CDW1,1))) // Query flag clear?
{ // Disable GPEs for features granted native control.
If (And(CTRL,0x01)) // Hot plug control granted?
{
Store(0,HPCE) // clear the hot plug SCI enable bit
Store(1,HPCS) // clear the hot plug SCI status bit
}
...
}
When Query flag is set, And(CDW1,1) will be 1, Not(1) will return 0xfffffffe.
So it will get into code path that should be for control set only.
BIOS acpi code should be changed to "If (LEqual(And(CDW1,1), 0)))"
Current kernel code is using _OSC query to notify firmware about support
from OS and then use _OSC to set control bits.
During query support, current code is using all possible controls.
So will execute code that should be only for control set stage.
That will have problem when pci=noaer or aer firmware_first is used.
As firmware have that control set for os aer already in query support stage,
but later will not os aer handling.
We should avoid passing all possible controls, just use osc_control_set
instead.
That should workaround BIOS bugs with affected systems on the field
as more bios vendors are copying sample code from ACPI spec.
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/pci_root.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -201,8 +201,8 @@ static acpi_status acpi_pci_query_osc(st
*control &= OSC_PCI_CONTROL_MASKS;
capbuf[OSC_CONTROL_TYPE] = *control | root->osc_control_set;
} else {
- /* Run _OSC query for all possible controls. */
- capbuf[OSC_CONTROL_TYPE] = OSC_PCI_CONTROL_MASKS;
+ /* Run _OSC query only with existing controls. */
+ capbuf[OSC_CONTROL_TYPE] = root->osc_control_set;
}
status = acpi_pci_run_osc(root->device->handle, capbuf, &result);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 052/115] PCI/PM: Fix fallback to PCI_D0 in pci_platform_power_transition()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2013-05-06 20:44 ` [ 051/115] PCI / ACPI: Dont query OSC support with all possible controls Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 053/115] rt2x00: Fix transmit power troubles on some Ralink RT30xx cards Greg Kroah-Hartman
` (63 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris J. Benenati, Rafael J. Wysocki,
Bjorn Helgaas, Yinghai Lu
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 769ba7212f2059ca9fe0c73371e3d415c8c1c529 upstream.
Commit b51306c (PCI: Set device power state to PCI_D0 for device
without native PM support) modified pci_platform_power_transition()
by adding code causing dev->current_state for devices that don't
support native PCI PM but are power-manageable by the platform to be
changed to PCI_D0 regardless of the value returned by the preceding
platform_pci_set_power_state(). In particular, that also is done
if the platform_pci_set_power_state() has been successful, which
causes the correct power state of the device set by
pci_update_current_state() in that case to be overwritten by PCI_D0.
Fix that mistake by making the fallback to PCI_D0 only happen if
the platform_pci_set_power_state() has returned an error.
[bhelgaas: folded in Yinghai's simplification, added URL & stable info]
Reference: http://lkml.kernel.org/r/27806FC4E5928A408B78E88BBC67A2306F466BBA@ORSMSX101.amr.corp.intel.com
Reported-by: Chris J. Benenati <chris.j.benenati@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -646,15 +646,11 @@ static int pci_platform_power_transition
error = platform_pci_set_power_state(dev, state);
if (!error)
pci_update_current_state(dev, state);
- /* Fall back to PCI_D0 if native PM is not supported */
- if (!dev->pm_cap)
- dev->current_state = PCI_D0;
- } else {
+ } else
error = -ENODEV;
- /* Fall back to PCI_D0 if native PM is not supported */
- if (!dev->pm_cap)
- dev->current_state = PCI_D0;
- }
+
+ if (error && !dev->pm_cap) /* Fall back to PCI_D0 */
+ dev->current_state = PCI_D0;
return error;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 053/115] rt2x00: Fix transmit power troubles on some Ralink RT30xx cards
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2013-05-06 20:44 ` [ 052/115] PCI/PM: Fix fallback to PCI_D0 in pci_platform_power_transition() Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 054/115] Wrong asm register contraints in the futex implementation Greg Kroah-Hartman
` (62 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex A. Mihaylov,
Gertjan van Wingerde, Stanislaw Gruszka, John W. Linville
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Alex A. Mihaylov" <minimumlaw@rambler.ru>
commit 7e9dafd873034dd64ababcb858be424c4780ae13 upstream.
Some cards on Ralink RT30xx chipset not have correctly TX_MIXER_GAIN
value in them EEPROM/EFUSE. In this case, we must use default value,
but always used EEPROM/EFUSE value. As result we have tranmitt power
range from -10dBm to +6dBm instead 0dBm to +16dBm.
Correctly value in EEPROM/EFUSE is one or more for RT3070 and two or
more for other RT30xx chips.
Tested on Canyon CNP-WF518N1 usb Wi-Fi dongle and Jorjin WN8020 usb
embedded Wi-Fi module.
Signed-off-by: Alex A. Mihaylov <minimumlaw@rambler.ru>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2800lib.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -4436,6 +4436,8 @@ static int rt2800_init_rfcsr(struct rt2x
if (!rt2x00_rt(rt2x00dev, RT5390) &&
!rt2x00_rt(rt2x00dev, RT5392)) {
+ u8 min_gain = rt2x00_rt(rt2x00dev, RT3070) ? 1 : 2;
+
rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
rt2x00_set_field8(&rfcsr, RFCSR17_TX_LO1_EN, 0);
if (rt2x00_rt(rt2x00dev, RT3070) ||
@@ -4446,8 +4448,10 @@ static int rt2800_init_rfcsr(struct rt2x
&rt2x00dev->cap_flags))
rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
}
- rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
- drv_data->txmixer_gain_24g);
+ if (drv_data->txmixer_gain_24g >= min_gain) {
+ rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
+ drv_data->txmixer_gain_24g);
+ }
rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 054/115] Wrong asm register contraints in the futex implementation
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2013-05-06 20:44 ` [ 053/115] rt2x00: Fix transmit power troubles on some Ralink RT30xx cards Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 055/115] Wrong asm register contraints in the kvm implementation Greg Kroah-Hartman
` (61 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephan Schreiber, Tony Luck
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Schreiber <info@fs-driver.org>
commit 136f39ddc53db3bcee2befbe323a56d4fbf06da8 upstream.
The Linux Kernel contains some inline assembly source code which has
wrong asm register constraints in arch/ia64/include/asm/futex.h.
I observed this on Kernel 3.2.23 but it is also true on the most
recent Kernel 3.9-rc1.
File arch/ia64/include/asm/futex.h:
static inline int
futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
u32 oldval, u32 newval)
{
if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
return -EFAULT;
{
register unsigned long r8 __asm ("r8");
unsigned long prev;
__asm__ __volatile__(
" mf;; \n"
" mov %0=r0 \n"
" mov ar.ccv=%4;; \n"
"[1:] cmpxchg4.acq %1=[%2],%3,ar.ccv \n"
" .xdata4 \"__ex_table\", 1b-., 2f-. \n"
"[2:]"
: "=r" (r8), "=r" (prev)
: "r" (uaddr), "r" (newval),
"rO" ((long) (unsigned) oldval)
: "memory");
*uval = prev;
return r8;
}
}
The list of output registers is
: "=r" (r8), "=r" (prev)
The constraint "=r" means that the GCC has to maintain that these vars
are in registers and contain valid info when the program flow leaves
the assembly block (output registers).
But "=r" also means that GCC can put them in registers that are used
as input registers. Input registers are uaddr, newval, oldval on the
example.
The second assembly instruction
" mov %0=r0 \n"
is the first one which writes to a register; it sets %0 to 0. %0 means
the first register operand; it is r8 here. (The r0 is read-only and
always 0 on the Itanium; it can be used if an immediate zero value is
needed.)
This instruction might overwrite one of the other registers which are
still needed.
Whether it really happens depends on how GCC decides what registers it
uses and how it optimizes the code.
The objdump utility can give us disassembly.
The futex_atomic_cmpxchg_inatomic() function is inline, so we have to
look for a module that uses the funtion. This is the
cmpxchg_futex_value_locked() function in
kernel/futex.c:
static int cmpxchg_futex_value_locked(u32 *curval, u32 __user *uaddr,
u32 uval, u32 newval)
{
int ret;
pagefault_disable();
ret = futex_atomic_cmpxchg_inatomic(curval, uaddr, uval, newval);
pagefault_enable();
return ret;
}
Now the disassembly. At first from the Kernel package 3.2.23 which has
been compiled with GCC 4.4, remeber this Kernel seemed to work:
objdump -d linux-3.2.23/debian/build/build_ia64_none_mckinley/kernel/futex.o
0000000000000230 <cmpxchg_futex_value_locked>:
230: 0b 18 80 1b 18 21 [MMI] adds r3=3168,r13;;
236: 80 40 0d 00 42 00 adds r8=40,r3
23c: 00 00 04 00 nop.i 0x0;;
240: 0b 50 00 10 10 10 [MMI] ld4 r10=[r8];;
246: 90 08 28 00 42 00 adds r9=1,r10
24c: 00 00 04 00 nop.i 0x0;;
250: 09 00 00 00 01 00 [MMI] nop.m 0x0
256: 00 48 20 20 23 00 st4 [r8]=r9
25c: 00 00 04 00 nop.i 0x0;;
260: 08 10 80 06 00 21 [MMI] adds r2=32,r3
266: 00 00 00 02 00 00 nop.m 0x0
26c: 02 08 f1 52 extr.u r16=r33,0,61
270: 05 40 88 00 08 e0 [MLX] addp4 r8=r34,r0
276: ff ff 0f 00 00 e0 movl r15=0xfffffffbfff;;
27c: f1 f7 ff 65
280: 09 70 00 04 18 10 [MMI] ld8 r14=[r2]
286: 00 00 00 02 00 c0 nop.m 0x0
28c: f0 80 1c d0 cmp.ltu p6,p7=r15,r16;;
290: 08 40 fc 1d 09 3b [MMI] cmp.eq p8,p9=-1,r14
296: 00 00 00 02 00 40 nop.m 0x0
29c: e1 08 2d d0 cmp.ltu p10,p11=r14,r33
2a0: 56 01 10 00 40 10 [BBB] (p10) br.cond.spnt.few 2e0
<cmpxchg_futex_value_locked+0xb0>
2a6: 02 08 00 80 21 03 (p08) br.cond.dpnt.few 2b0
<cmpxchg_futex_value_locked+0x80>
2ac: 40 00 00 41 (p06) br.cond.spnt.few 2e0
<cmpxchg_futex_value_locked+0xb0>
2b0: 0a 00 00 00 22 00 [MMI] mf;;
2b6: 80 00 00 00 42 00 mov r8=r0
2bc: 00 00 04 00 nop.i 0x0
2c0: 0b 00 20 40 2a 04 [MMI] mov.m ar.ccv=r8;;
2c6: 10 1a 85 22 20 00 cmpxchg4.acq r33=[r33],r35,ar.ccv
2cc: 00 00 04 00 nop.i 0x0;;
2d0: 10 00 84 40 90 11 [MIB] st4 [r32]=r33
2d6: 00 00 00 02 00 00 nop.i 0x0
2dc: 20 00 00 40 br.few 2f0
<cmpxchg_futex_value_locked+0xc0>
2e0: 09 40 c8 f9 ff 27 [MMI] mov r8=-14
2e6: 00 00 00 02 00 00 nop.m 0x0
2ec: 00 00 04 00 nop.i 0x0;;
2f0: 0b 58 20 1a 19 21 [MMI] adds r11=3208,r13;;
2f6: 20 01 2c 20 20 00 ld4 r18=[r11]
2fc: 00 00 04 00 nop.i 0x0;;
300: 0b 88 fc 25 3f 23 [MMI] adds r17=-1,r18;;
306: 00 88 2c 20 23 00 st4 [r11]=r17
30c: 00 00 04 00 nop.i 0x0;;
310: 11 00 00 00 01 00 [MIB] nop.m 0x0
316: 00 00 00 02 00 80 nop.i 0x0
31c: 08 00 84 00 br.ret.sptk.many b0;;
The lines
2b0: 0a 00 00 00 22 00 [MMI] mf;;
2b6: 80 00 00 00 42 00 mov r8=r0
2bc: 00 00 04 00 nop.i 0x0
2c0: 0b 00 20 40 2a 04 [MMI] mov.m ar.ccv=r8;;
2c6: 10 1a 85 22 20 00 cmpxchg4.acq r33=[r33],r35,ar.ccv
2cc: 00 00 04 00 nop.i 0x0;;
are the instructions of the assembly block.
The line
2b6: 80 00 00 00 42 00 mov r8=r0
sets the r8 register to 0 and after that
2c0: 0b 00 20 40 2a 04 [MMI] mov.m ar.ccv=r8;;
prepares the 'oldvalue' for the cmpxchg but it takes it from r8. This
is wrong.
What happened here is what I explained above: An input register is
overwritten which is still needed.
The register operand constraints in futex.h are wrong.
(The problem doesn't occur when the Kernel is compiled with GCC 4.6.)
The attached patch fixes the register operand constraints in futex.h.
The code after patching of it:
static inline int
futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
u32 oldval, u32 newval)
{
if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
return -EFAULT;
{
register unsigned long r8 __asm ("r8") = 0;
unsigned long prev;
__asm__ __volatile__(
" mf;; \n"
" mov ar.ccv=%4;; \n"
"[1:] cmpxchg4.acq %1=[%2],%3,ar.ccv \n"
" .xdata4 \"__ex_table\", 1b-., 2f-. \n"
"[2:]"
: "+r" (r8), "=&r" (prev)
: "r" (uaddr), "r" (newval),
"rO" ((long) (unsigned) oldval)
: "memory");
*uval = prev;
return r8;
}
}
I also initialized the 'r8' var with the C programming language.
The _asm qualifier on the definition of the 'r8' var forces GCC to use
the r8 processor register for it.
I don't believe that we should use inline assembly for zeroing out a
local variable.
The constraint is
"+r" (r8)
what means that it is both an input register and an output register.
Note that the page fault handler will modify the r8 register which
will be the return value of the function.
The real fix is
"=&r" (prev)
The & means that GCC must not use any of the input registers to place
this output register in.
Patched the Kernel 3.2.23 and compiled it with GCC4.4:
0000000000000230 <cmpxchg_futex_value_locked>:
230: 0b 18 80 1b 18 21 [MMI] adds r3=3168,r13;;
236: 80 40 0d 00 42 00 adds r8=40,r3
23c: 00 00 04 00 nop.i 0x0;;
240: 0b 50 00 10 10 10 [MMI] ld4 r10=[r8];;
246: 90 08 28 00 42 00 adds r9=1,r10
24c: 00 00 04 00 nop.i 0x0;;
250: 09 00 00 00 01 00 [MMI] nop.m 0x0
256: 00 48 20 20 23 00 st4 [r8]=r9
25c: 00 00 04 00 nop.i 0x0;;
260: 08 10 80 06 00 21 [MMI] adds r2=32,r3
266: 20 12 01 10 40 00 addp4 r34=r34,r0
26c: 02 08 f1 52 extr.u r16=r33,0,61
270: 05 40 00 00 00 e1 [MLX] mov r8=r0
276: ff ff 0f 00 00 e0 movl r15=0xfffffffbfff;;
27c: f1 f7 ff 65
280: 09 70 00 04 18 10 [MMI] ld8 r14=[r2]
286: 00 00 00 02 00 c0 nop.m 0x0
28c: f0 80 1c d0 cmp.ltu p6,p7=r15,r16;;
290: 08 40 fc 1d 09 3b [MMI] cmp.eq p8,p9=-1,r14
296: 00 00 00 02 00 40 nop.m 0x0
29c: e1 08 2d d0 cmp.ltu p10,p11=r14,r33
2a0: 56 01 10 00 40 10 [BBB] (p10) br.cond.spnt.few 2e0
<cmpxchg_futex_value_locked+0xb0>
2a6: 02 08 00 80 21 03 (p08) br.cond.dpnt.few 2b0
<cmpxchg_futex_value_locked+0x80>
2ac: 40 00 00 41 (p06) br.cond.spnt.few 2e0
<cmpxchg_futex_value_locked+0xb0>
2b0: 0b 00 00 00 22 00 [MMI] mf;;
2b6: 00 10 81 54 08 00 mov.m ar.ccv=r34
2bc: 00 00 04 00 nop.i 0x0;;
2c0: 09 58 8c 42 11 10 [MMI] cmpxchg4.acq r11=[r33],r35,ar.ccv
2c6: 00 00 00 02 00 00 nop.m 0x0
2cc: 00 00 04 00 nop.i 0x0;;
2d0: 10 00 2c 40 90 11 [MIB] st4 [r32]=r11
2d6: 00 00 00 02 00 00 nop.i 0x0
2dc: 20 00 00 40 br.few 2f0
<cmpxchg_futex_value_locked+0xc0>
2e0: 09 40 c8 f9 ff 27 [MMI] mov r8=-14
2e6: 00 00 00 02 00 00 nop.m 0x0
2ec: 00 00 04 00 nop.i 0x0;;
2f0: 0b 88 20 1a 19 21 [MMI] adds r17=3208,r13;;
2f6: 30 01 44 20 20 00 ld4 r19=[r17]
2fc: 00 00 04 00 nop.i 0x0;;
300: 0b 90 fc 27 3f 23 [MMI] adds r18=-1,r19;;
306: 00 90 44 20 23 00 st4 [r17]=r18
30c: 00 00 04 00 nop.i 0x0;;
310: 11 00 00 00 01 00 [MIB] nop.m 0x0
316: 00 00 00 02 00 80 nop.i 0x0
31c: 08 00 84 00 br.ret.sptk.many b0;;
Much better.
There is a
270: 05 40 00 00 00 e1 [MLX] mov r8=r0
which was generated by C code r8 = 0. Below
2b6: 00 10 81 54 08 00 mov.m ar.ccv=r34
what means that oldval is no longer overwritten.
This is Debian bug#702641
(http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702641).
The patch is applicable on Kernel 3.9-rc1, 3.2.23 and many other versions.
Signed-off-by: Stephan Schreiber <info@fs-driver.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/ia64/include/asm/futex.h | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/arch/ia64/include/asm/futex.h
+++ b/arch/ia64/include/asm/futex.h
@@ -106,16 +106,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval,
return -EFAULT;
{
- register unsigned long r8 __asm ("r8");
+ register unsigned long r8 __asm ("r8") = 0;
unsigned long prev;
__asm__ __volatile__(
" mf;; \n"
- " mov %0=r0 \n"
" mov ar.ccv=%4;; \n"
"[1:] cmpxchg4.acq %1=[%2],%3,ar.ccv \n"
" .xdata4 \"__ex_table\", 1b-., 2f-. \n"
"[2:]"
- : "=r" (r8), "=r" (prev)
+ : "+r" (r8), "=&r" (prev)
: "r" (uaddr), "r" (newval),
"rO" ((long) (unsigned) oldval)
: "memory");
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 055/115] Wrong asm register contraints in the kvm implementation
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2013-05-06 20:44 ` [ 054/115] Wrong asm register contraints in the futex implementation Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 056/115] fs/fscache/stats.c: fix memory leak Greg Kroah-Hartman
` (60 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephan Schreiber, Tony Luck
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Schreiber <info@fs-driver.org>
commit de53e9caa4c6149ef4a78c2f83d7f5b655848767 upstream.
The Linux Kernel contains some inline assembly source code which has
wrong asm register constraints in arch/ia64/kvm/vtlb.c.
I observed this on Kernel 3.2.35 but it is also true on the most
recent Kernel 3.9-rc1.
File arch/ia64/kvm/vtlb.c:
u64 guest_vhpt_lookup(u64 iha, u64 *pte)
{
u64 ret;
struct thash_data *data;
data = __vtr_lookup(current_vcpu, iha, D_TLB);
if (data != NULL)
thash_vhpt_insert(current_vcpu, data->page_flags,
data->itir, iha, D_TLB);
asm volatile (
"rsm psr.ic|psr.i;;"
"srlz.d;;"
"ld8.s r9=[%1];;"
"tnat.nz p6,p7=r9;;"
"(p6) mov %0=1;"
"(p6) mov r9=r0;"
"(p7) extr.u r9=r9,0,53;;"
"(p7) mov %0=r0;"
"(p7) st8 [%2]=r9;;"
"ssm psr.ic;;"
"srlz.d;;"
"ssm psr.i;;"
"srlz.d;;"
: "=r"(ret) : "r"(iha), "r"(pte):"memory");
return ret;
}
The list of output registers is
: "=r"(ret) : "r"(iha), "r"(pte):"memory");
The constraint "=r" means that the GCC has to maintain that these vars
are in registers and contain valid info when the program flow leaves
the assembly block (output registers).
But "=r" also means that GCC can put them in registers that are used
as input registers. Input registers are iha, pte on the example.
If the predicate p7 is true, the 8th assembly instruction
"(p7) mov %0=r0;"
is the first one which writes to a register which is maintained by the
register constraints; it sets %0. %0 means the first register operand;
it is ret here.
This instruction might overwrite the %2 register (pte) which is needed
by the next instruction:
"(p7) st8 [%2]=r9;;"
Whether it really happens depends on how GCC decides what registers it
uses and how it optimizes the code.
The attached patch fixes the register operand constraints in
arch/ia64/kvm/vtlb.c.
The register constraints should be
: "=&r"(ret) : "r"(iha), "r"(pte):"memory");
The & means that GCC must not use any of the input registers to place
this output register in.
This is Debian bug#702639
(http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702639).
The patch is applicable on Kernel 3.9-rc1, 3.2.35 and many other versions.
Signed-off-by: Stephan Schreiber <info@fs-driver.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/ia64/kvm/vtlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/ia64/kvm/vtlb.c
+++ b/arch/ia64/kvm/vtlb.c
@@ -256,7 +256,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte)
"srlz.d;;"
"ssm psr.i;;"
"srlz.d;;"
- : "=r"(ret) : "r"(iha), "r"(pte):"memory");
+ : "=&r"(ret) : "r"(iha), "r"(pte) : "memory");
return ret;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 056/115] fs/fscache/stats.c: fix memory leak
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2013-05-06 20:44 ` [ 055/115] Wrong asm register contraints in the kvm implementation Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 057/115] mm: allow arch code to control the user page table ceiling Greg Kroah-Hartman
` (59 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anurup m, shyju pv, Sanil kumar,
Nataraj m, Li Zefan, David Howells, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anurup m <anurup.m@huawei.com>
commit ec686c9239b4d472052a271c505d04dae84214cc upstream.
There is a kernel memory leak observed when the proc file
/proc/fs/fscache/stats is read.
The reason is that in fscache_stats_open, single_open is called and the
respective release function is not called during release. Hence fix
with correct release function - single_release().
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=57101
Signed-off-by: Anurup m <anurup.m@huawei.com>
Cc: shyju pv <shyju.pv@huawei.com>
Cc: Sanil kumar <sanil.kumar@huawei.com>
Cc: Nataraj m <nataraj.m@huawei.com>
Cc: Li Zefan <lizefan@huawei.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fscache/stats.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -287,5 +287,5 @@ const struct file_operations fscache_sta
.open = fscache_stats_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = seq_release,
+ .release = single_release,
};
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 057/115] mm: allow arch code to control the user page table ceiling
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2013-05-06 20:44 ` [ 056/115] fs/fscache/stats.c: fix memory leak Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 058/115] TPM: Retry SaveState command in suspend path Greg Kroah-Hartman
` (58 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hugh Dickins, Catalin Marinas,
Russell King, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit 6ee8630e02be6dd89926ca0fbc21af68b23dc087 upstream.
On architectures where a pgd entry may be shared between user and kernel
(e.g. ARM+LPAE), freeing page tables needs a ceiling other than 0.
This patch introduces a generic USER_PGTABLES_CEILING that arch code can
override. It is the responsibility of the arch code setting the ceiling
to ensure the complete freeing of the page tables (usually in
pgd_free()).
[catalin.marinas@arm.com: commit log; shift_arg_pages(), asm-generic/pgtables.h changes]
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Russell King <linux@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exec.c | 4 ++--
include/asm-generic/pgtable.h | 10 ++++++++++
mm/mmap.c | 4 ++--
3 files changed, 14 insertions(+), 4 deletions(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -613,7 +613,7 @@ static int shift_arg_pages(struct vm_are
* when the old and new regions overlap clear from new_end.
*/
free_pgd_range(&tlb, new_end, old_end, new_end,
- vma->vm_next ? vma->vm_next->vm_start : 0);
+ vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
} else {
/*
* otherwise, clean from old_start; this is done to not touch
@@ -622,7 +622,7 @@ static int shift_arg_pages(struct vm_are
* for the others its just a little faster.
*/
free_pgd_range(&tlb, old_start, old_end, new_end,
- vma->vm_next ? vma->vm_next->vm_start : 0);
+ vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
}
tlb_finish_mmu(&tlb, new_end, old_end);
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -7,6 +7,16 @@
#include <linux/mm_types.h>
#include <linux/bug.h>
+/*
+ * On almost all architectures and configurations, 0 can be used as the
+ * upper ceiling to free_pgtables(): on many architectures it has the same
+ * effect as using TASK_SIZE. However, there is one configuration which
+ * must impose a more careful limit, to avoid freeing kernel pgtables.
+ */
+#ifndef USER_PGTABLES_CEILING
+#define USER_PGTABLES_CEILING 0UL
+#endif
+
#ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
extern int ptep_set_access_flags(struct vm_area_struct *vma,
unsigned long address, pte_t *ptep,
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2305,7 +2305,7 @@ static void unmap_region(struct mm_struc
update_hiwater_rss(mm);
unmap_vmas(&tlb, vma, start, end);
free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
- next ? next->vm_start : 0);
+ next ? next->vm_start : USER_PGTABLES_CEILING);
tlb_finish_mmu(&tlb, start, end);
}
@@ -2685,7 +2685,7 @@ void exit_mmap(struct mm_struct *mm)
/* Use -1 here to ensure all VMAs in the mm are unmapped */
unmap_vmas(&tlb, vma, 0, -1);
- free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
+ free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
tlb_finish_mmu(&tlb, 0, -1);
/*
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 058/115] TPM: Retry SaveState command in suspend path
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2013-05-06 20:44 ` [ 057/115] mm: allow arch code to control the user page table ceiling Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 059/115] ALSA: emu10k1: Fix dock firmware loading Greg Kroah-Hartman
` (57 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Duncan Laurie, Kent Yoder,
Dirk Hohndel
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duncan Laurie <dlaurie@chromium.org>
commit 32d33b29ba077d6b45de35f2181e0a7411b162f4 upstream.
If the TPM has already been sent a SaveState command before the driver
is loaded it may have problems sending that same command again later.
This issue is seen with the Chromebook Pixel due to a firmware bug in
the legacy mode boot path which is sending the SaveState command
before booting the kernel. More information is available at
http://crbug.com/203524
This change introduces a retry of the SaveState command in the suspend
path in order to work around this issue. A future firmware update
should fix this but this is also a trivial workaround in the driver
that has no effect on systems that do not show this problem.
When this does happen the TPM responds with a non-fatal TPM_RETRY code
that is defined in the specification:
The TPM is too busy to respond to the command immediately, but the
command could be resubmitted at a later time. The TPM MAY return
TPM_RETRY for any command at any time.
It can take several seconds before the TPM will respond again. I
measured a typical time between 3 and 4 seconds and the timeout is set
at a safe 5 seconds.
It is also possible to reproduce this with commands via /dev/tpm0.
The bug linked above has a python script attached which can be used to
test for this problem. I tested a variety of TPMs from Infineon,
Nuvoton, Atmel, and STMicro but was only able to reproduce this with
LPC and I2C TPMs from Infineon.
The TPM specification only loosely defines this behavior:
TPM Main Level 2 Part 3 v1.2 r116, section 3.3. TPM_SaveState:
The TPM MAY declare all preserved values invalid in response to any
command other than TPM_Init.
TCG PC Client BIOS Spec 1.21 section 8.3.1.
After issuing a TPM_SaveState command, the OS SHOULD NOT issue TPM
commands before transitioning to S3 without issuing another
TPM_SaveState command.
TCG PC Client TIS 1.21, section 4. Power Management:
The TPM_SaveState command allows a Static OS to indicate to the TPM
that the platform may enter a low power state where the TPM will be
required to enter into the D3 power state. The use of the term "may"
is significant in that there is no requirement for the platform to
actually enter the low power state after sending the TPM_SaveState
command. The software may, in fact, send subsequent commands after
sending the TPM_SaveState command.
Change-Id: I52b41e826412688e5b6c8ddd3bb16409939704e9
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Cc: Dirk Hohndel <dirk@hohndel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm.c | 31 +++++++++++++++++++++++++++----
drivers/char/tpm/tpm.h | 3 +++
2 files changed, 30 insertions(+), 4 deletions(-)
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1337,7 +1337,7 @@ int tpm_pm_suspend(struct device *dev)
{
struct tpm_chip *chip = dev_get_drvdata(dev);
struct tpm_cmd_t cmd;
- int rc;
+ int rc, try;
u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
@@ -1355,9 +1355,32 @@ int tpm_pm_suspend(struct device *dev)
}
/* now do the actual savestate */
- cmd.header.in = savestate_header;
- rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
- "sending savestate before suspend");
+ for (try = 0; try < TPM_RETRY; try++) {
+ cmd.header.in = savestate_header;
+ rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
+
+ /*
+ * If the TPM indicates that it is too busy to respond to
+ * this command then retry before giving up. It can take
+ * several seconds for this TPM to be ready.
+ *
+ * This can happen if the TPM has already been sent the
+ * SaveState command before the driver has loaded. TCG 1.2
+ * specification states that any communication after SaveState
+ * may cause the TPM to invalidate previously saved state.
+ */
+ if (rc != TPM_WARN_RETRY)
+ break;
+ msleep(TPM_TIMEOUT_RETRY);
+ }
+
+ if (rc)
+ dev_err(chip->dev,
+ "Error (%d) sending savestate before suspend\n", rc);
+ else if (try > 0)
+ dev_warn(chip->dev, "TPM savestate took %dms\n",
+ try * TPM_TIMEOUT_RETRY);
+
return rc;
}
EXPORT_SYMBOL_GPL(tpm_pm_suspend);
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -32,10 +32,12 @@ enum tpm_const {
TPM_MINOR = 224, /* officially assigned */
TPM_BUFSIZE = 4096,
TPM_NUM_DEVICES = 256,
+ TPM_RETRY = 50, /* 5 seconds */
};
enum tpm_timeout {
TPM_TIMEOUT = 5, /* msecs */
+ TPM_TIMEOUT_RETRY = 100 /* msecs */
};
/* TPM addresses */
@@ -44,6 +46,7 @@ enum tpm_addr {
TPM_ADDR = 0x4E,
};
+#define TPM_WARN_RETRY 0x800
#define TPM_WARN_DOING_SELFTEST 0x802
#define TPM_ERR_DEACTIVATED 0x6
#define TPM_ERR_DISABLED 0x7
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 059/115] ALSA: emu10k1: Fix dock firmware loading
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2013-05-06 20:44 ` [ 058/115] TPM: Retry SaveState command in suspend path Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 060/115] ALSA: snd-usb: try harder to find USB_DT_CS_ENDPOINT Greg Kroah-Hartman
` (56 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit e08b34e86dfdb72a62196ce0f03d33f48958d8b9 upstream.
The commit [b209c4df: ALSA: emu10k1: cache emu1010 firmware] broke the
firmware loading of the dock, just (mistakenly) ignoring a different
firmware for docks on some models. This patch revives them again.
Bugzilla: https://bugs.archlinux.org/task/34865
Reported-and-tested-by: Tobias Powalowski <tobias.powalowski@googlemail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/emu10k1.h | 1 +
sound/pci/emu10k1/emu10k1_main.c | 39 +++++++++++++++++++++++++++++++++------
2 files changed, 34 insertions(+), 6 deletions(-)
--- a/include/sound/emu10k1.h
+++ b/include/sound/emu10k1.h
@@ -1787,6 +1787,7 @@ struct snd_emu10k1 {
unsigned int next_free_voice;
const struct firmware *firmware;
+ const struct firmware *dock_fw;
#ifdef CONFIG_PM_SLEEP
unsigned int *saved_ptr;
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -657,14 +657,14 @@ static int snd_emu10k1_cardbus_init(stru
return 0;
}
-static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu)
+static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu,
+ const struct firmware *fw_entry)
{
int n, i;
int reg;
int value;
unsigned int write_post;
unsigned long flags;
- const struct firmware *fw_entry = emu->firmware;
if (!fw_entry)
return -EIO;
@@ -725,9 +725,34 @@ static int emu1010_firmware_thread(void
/* Return to Audio Dock programming mode */
snd_printk(KERN_INFO "emu1010: Loading Audio Dock Firmware\n");
snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, EMU_HANA_FPGA_CONFIG_AUDIODOCK);
- err = snd_emu1010_load_firmware(emu);
- if (err != 0)
- continue;
+
+ if (!emu->dock_fw) {
+ const char *filename = NULL;
+ switch (emu->card_capabilities->emu_model) {
+ case EMU_MODEL_EMU1010:
+ filename = DOCK_FILENAME;
+ break;
+ case EMU_MODEL_EMU1010B:
+ filename = MICRO_DOCK_FILENAME;
+ break;
+ case EMU_MODEL_EMU1616:
+ filename = MICRO_DOCK_FILENAME;
+ break;
+ }
+ if (filename) {
+ err = request_firmware(&emu->dock_fw,
+ filename,
+ &emu->pci->dev);
+ if (err)
+ continue;
+ }
+ }
+
+ if (emu->dock_fw) {
+ err = snd_emu1010_load_firmware(emu, emu->dock_fw);
+ if (err)
+ continue;
+ }
snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0);
snd_emu1010_fpga_read(emu, EMU_HANA_IRQ_STATUS, ®);
@@ -862,7 +887,7 @@ static int snd_emu10k1_emu1010_init(stru
filename, emu->firmware->size);
}
- err = snd_emu1010_load_firmware(emu);
+ err = snd_emu1010_load_firmware(emu, emu->firmware);
if (err != 0) {
snd_printk(KERN_INFO "emu1010: Loading Firmware failed\n");
return err;
@@ -1253,6 +1278,8 @@ static int snd_emu10k1_free(struct snd_e
kthread_stop(emu->emu1010.firmware_thread);
if (emu->firmware)
release_firmware(emu->firmware);
+ if (emu->dock_fw)
+ release_firmware(emu->dock_fw);
if (emu->irq >= 0)
free_irq(emu->irq, emu);
/* remove reserved page */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 060/115] ALSA: snd-usb: try harder to find USB_DT_CS_ENDPOINT
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2013-05-06 20:44 ` [ 059/115] ALSA: emu10k1: Fix dock firmware loading Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 061/115] ALSA: usb: Add quirk for 192KHz recording on E-Mu devices Greg Kroah-Hartman
` (55 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Mack, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit ebfc594c02148b6a85c2f178cf167a44a3c3ce10 upstream.
The USB_DT_CS_ENDPOINT class-specific endpoint descriptor is usually
stuffed directly after the standard USB endpoint descriptor, and this is
where the driver currently expects it to be.
There are, however, devices in the wild that have it the other way
around in their descriptor sets, so the USB_DT_CS_ENDPOINT comes
*before* the standard enpoint. Devices known to implement it that way
are "Sennheiser BTD-500" and Plantronics USB headsets.
When the driver can't find the USB_DT_CS_ENDPOINT, it won't be able to
change sample rates, as the bitmask for the validity of this command is
storen in bmAttributes of that descriptor.
Fix this by searching the entire interface instead of just the extra
bytes of the first endpoint, in case the latter fails.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Reported-and-tested-by: Torstein Hegge <hegge@resisty.net>
Reported-and-tested-by: Yves G <alsa-user@vivigatt.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/stream.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -396,6 +396,14 @@ static int parse_uac_endpoint_attributes
if (!csep && altsd->bNumEndpoints >= 2)
csep = snd_usb_find_desc(alts->endpoint[1].extra, alts->endpoint[1].extralen, NULL, USB_DT_CS_ENDPOINT);
+ /*
+ * If we can't locate the USB_DT_CS_ENDPOINT descriptor in the extra
+ * bytes after the first endpoint, go search the entire interface.
+ * Some devices have it directly *before* the standard endpoint.
+ */
+ if (!csep)
+ csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT);
+
if (!csep || csep->bLength < 7 ||
csep->bDescriptorSubtype != UAC_EP_GENERAL) {
snd_printk(KERN_WARNING "%d:%u:%d : no or invalid"
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 061/115] ALSA: usb: Add quirk for 192KHz recording on E-Mu devices
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2013-05-06 20:44 ` [ 060/115] ALSA: snd-usb: try harder to find USB_DT_CS_ENDPOINT Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 062/115] ALSA: usb-audio: disable autopm for MIDI devices Greg Kroah-Hartman
` (54 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Calvin Owens, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <jcalvinowens@gmail.com>
commit 1539d4f82ad534431cc67935e8e442ccf107d17d upstream.
When recording at 176.2KHz or 192Khz, the device adds a 32-bit length
header to the capture packets, which obviously needs to be ignored for
recording to work properly.
Userspace expected: L0 L1 L2 R0 R1 R2
...but actually got: R2 L0 L1 L2 R0 R1
Also, the last byte of the length header being interpreted as L0 of
the first sample caused spikes every 0.5ms, resulting in a loud 16KHz
tone (about the highest 'B' on a piano) being present throughout
captures.
Tested at all sample rates on an E-Mu 0404USB, and tested for
regressions on a generic USB headset.
Signed-off-by: Calvin Owens <jcalvinowens@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/card.h | 1 +
sound/usb/pcm.c | 2 +-
sound/usb/quirks.c | 1 +
sound/usb/stream.c | 1 +
4 files changed, 4 insertions(+), 1 deletion(-)
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -116,6 +116,7 @@ struct snd_usb_substream {
unsigned int altset_idx; /* USB data format: index of alternate setting */
unsigned int txfr_quirk:1; /* allow sub-frame alignment */
unsigned int fmt_type; /* USB audio format type (1-3) */
+ unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */
unsigned int running: 1; /* running status */
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1170,7 +1170,7 @@ static void retire_capture_urb(struct sn
stride = runtime->frame_bits >> 3;
for (i = 0; i < urb->number_of_packets; i++) {
- cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
+ cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset + subs->pkt_offset_adj;
if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
snd_printdd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
// continue;
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -837,6 +837,7 @@ static void set_format_emu_quirk(struct
break;
}
snd_emuusb_set_samplerate(subs->stream->chip, emu_samplerate_id);
+ subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0;
}
void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struc
subs->dev = as->chip->dev;
subs->txfr_quirk = as->chip->txfr_quirk;
subs->speed = snd_usb_get_speed(subs->dev);
+ subs->pkt_offset_adj = 0;
snd_usb_set_pcm_ops(as->pcm, stream);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 062/115] ALSA: usb-audio: disable autopm for MIDI devices
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2013-05-06 20:44 ` [ 061/115] ALSA: usb: Add quirk for 192KHz recording on E-Mu devices Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:44 ` [ 063/115] ALSA: usb-audio: Fix autopm error during probing Greg Kroah-Hartman
` (53 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Clemens Ladisch, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <clemens@ladisch.de>
commit cbc200bca4b51a8e2406d4b654d978f8503d430b upstream.
Commit 88a8516a2128 (ALSA: usbaudio: implement USB autosuspend)
introduced autopm for all USB audio/MIDI devices. However, many MIDI
devices, such as synthesizers, do not merely transmit MIDI messages but
use their MIDI inputs to control other functions. With autopm, these
devices would get powered down as soon as the last MIDI port device is
closed on the host.
Even some plain MIDI interfaces could get broken: they automatically
send Active Sensing messages while powered up, but as soon as these
messages cease, the receiving device would interpret this as an
accidental disconnection.
Commit f5f165418cab (ALSA: usb-audio: Fix missing autopm for MIDI input)
introduced another regression: some devices (e.g. the Roland GAIA SH-01)
are self-powered but do a reset whenever the USB interface's power state
changes.
To work around all this, just disable autopm for all USB MIDI devices.
Reported-by: Laurens Holst
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/midi.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -126,7 +126,6 @@ struct snd_usb_midi {
struct snd_usb_midi_in_endpoint *in;
} endpoints[MIDI_MAX_ENDPOINTS];
unsigned long input_triggered;
- bool autopm_reference;
unsigned int opened[2];
unsigned char disconnected;
unsigned char input_running;
@@ -1040,7 +1039,6 @@ static int substream_open(struct snd_raw
{
struct snd_usb_midi* umidi = substream->rmidi->private_data;
struct snd_kcontrol *ctl;
- int err;
down_read(&umidi->disc_rwsem);
if (umidi->disconnected) {
@@ -1051,13 +1049,6 @@ static int substream_open(struct snd_raw
mutex_lock(&umidi->mutex);
if (open) {
if (!umidi->opened[0] && !umidi->opened[1]) {
- err = usb_autopm_get_interface(umidi->iface);
- umidi->autopm_reference = err >= 0;
- if (err < 0 && err != -EACCES) {
- mutex_unlock(&umidi->mutex);
- up_read(&umidi->disc_rwsem);
- return -EIO;
- }
if (umidi->roland_load_ctl) {
ctl = umidi->roland_load_ctl;
ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
@@ -1080,8 +1071,6 @@ static int substream_open(struct snd_raw
snd_ctl_notify(umidi->card,
SNDRV_CTL_EVENT_MASK_INFO, &ctl->id);
}
- if (umidi->autopm_reference)
- usb_autopm_put_interface(umidi->iface);
}
}
mutex_unlock(&umidi->mutex);
@@ -2256,6 +2245,8 @@ int snd_usbmidi_create(struct snd_card *
return err;
}
+ usb_autopm_get_interface_no_resume(umidi->iface);
+
list_add_tail(&umidi->list, midi_list);
return 0;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 063/115] ALSA: usb-audio: Fix autopm error during probing
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2013-05-06 20:44 ` [ 062/115] ALSA: usb-audio: disable autopm for MIDI devices Greg Kroah-Hartman
@ 2013-05-06 20:44 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 064/115] ALSA: USB: adjust for changed 3.8 USB API Greg Kroah-Hartman
` (52 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 60af3d037eb8c670dcce31401501d1271e7c5d95 upstream.
We've got strange errors in get_ctl_value() in mixer.c during
probing, e.g. on Hercules RMX2 DJ Controller:
ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0xa00, type = 4
ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x200, wIndex = 0xa00, type = 4
....
It turned out that the culprit is autopm: snd_usb_autoresume() returns
-ENODEV when called during card->probing = 1.
Since the call itself during card->probing = 1 is valid, let's fix the
return value of snd_usb_autoresume() as success.
Reported-and-tested-by: Daniel Schürmann <daschuer@mixxx.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/card.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -627,7 +627,9 @@ int snd_usb_autoresume(struct snd_usb_au
int err = -ENODEV;
down_read(&chip->shutdown_rwsem);
- if (!chip->shutdown && !chip->probing)
+ if (chip->probing)
+ err = 0;
+ else if (!chip->shutdown)
err = usb_autopm_get_interface(chip->pm_intf);
up_read(&chip->shutdown_rwsem);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 064/115] ALSA: USB: adjust for changed 3.8 USB API
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2013-05-06 20:44 ` [ 063/115] ALSA: usb-audio: Fix autopm error during probing Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 065/115] ALSA: hda - Fix aamix activation with loopback control on VIA codecs Greg Kroah-Hartman
` (51 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Rayhawk, Clemens Ladisch,
Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <clemens@ladisch.de>
commit c75c5ab575af7db707689cdbb5a5c458e9a034bb upstream.
The recent changes in the USB API ("implement new semantics for
URB_ISO_ASAP") made the former meaning of the URB_ISO_ASAP flag the
default, and changed this flag to mean that URBs can be delayed.
This is not the behaviour wanted by any of the audio drivers because
it leads to discontinuous playback with very small period sizes.
Therefore, our URBs need to be submitted without this flag.
Reported-by: Joe Rayhawk <jrayhawk@fairlystable.org>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/6fire/pcm.c | 1 -
sound/usb/caiaq/audio.c | 3 ---
sound/usb/endpoint.c | 5 ++---
sound/usb/misc/ua101.c | 3 +--
sound/usb/usx2y/usb_stream.c | 1 -
sound/usb/usx2y/usbusx2yaudio.c | 1 -
sound/usb/usx2y/usx2yhwdeppcm.c | 1 -
7 files changed, 3 insertions(+), 12 deletions(-)
--- a/sound/usb/6fire/pcm.c
+++ b/sound/usb/6fire/pcm.c
@@ -575,7 +575,6 @@ static void usb6fire_pcm_init_urb(struct
urb->instance.pipe = in ? usb_rcvisocpipe(chip->dev, ep)
: usb_sndisocpipe(chip->dev, ep);
urb->instance.interval = 1;
- urb->instance.transfer_flags = URB_ISO_ASAP;
urb->instance.complete = handler;
urb->instance.context = urb;
urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB;
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -670,7 +670,6 @@ static void read_completed(struct urb *u
if (send_it) {
out->number_of_packets = outframe;
- out->transfer_flags = URB_ISO_ASAP;
usb_submit_urb(out, GFP_ATOMIC);
} else {
struct snd_usb_caiaq_cb_info *oinfo = out->context;
@@ -686,7 +685,6 @@ requeue:
}
urb->number_of_packets = FRAMES_PER_URB;
- urb->transfer_flags = URB_ISO_ASAP;
usb_submit_urb(urb, GFP_ATOMIC);
}
@@ -751,7 +749,6 @@ static struct urb **alloc_urbs(struct sn
* BYTES_PER_FRAME;
urbs[i]->context = &dev->data_cb_info[i];
urbs[i]->interval = 1;
- urbs[i]->transfer_flags = URB_ISO_ASAP;
urbs[i]->number_of_packets = FRAMES_PER_URB;
urbs[i]->complete = (dir == SNDRV_PCM_STREAM_CAPTURE) ?
read_completed : write_completed;
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -677,7 +677,7 @@ static int data_ep_set_params(struct snd
if (!u->urb->transfer_buffer)
goto out_of_memory;
u->urb->pipe = ep->pipe;
- u->urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
+ u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
u->urb->interval = 1 << ep->datainterval;
u->urb->context = u;
u->urb->complete = snd_complete_urb;
@@ -716,8 +716,7 @@ static int sync_ep_set_params(struct snd
u->urb->transfer_dma = ep->sync_dma + i * 4;
u->urb->transfer_buffer_length = 4;
u->urb->pipe = ep->pipe;
- u->urb->transfer_flags = URB_ISO_ASAP |
- URB_NO_TRANSFER_DMA_MAP;
+ u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
u->urb->number_of_packets = 1;
u->urb->interval = 1 << ep->syncinterval;
u->urb->context = u;
--- a/sound/usb/misc/ua101.c
+++ b/sound/usb/misc/ua101.c
@@ -1120,8 +1120,7 @@ static int alloc_stream_urbs(struct ua10
usb_init_urb(&urb->urb);
urb->urb.dev = ua->dev;
urb->urb.pipe = stream->usb_pipe;
- urb->urb.transfer_flags = URB_ISO_ASAP |
- URB_NO_TRANSFER_DMA_MAP;
+ urb->urb.transfer_flags = URB_NO_TRANSFER_DMA_MAP;
urb->urb.transfer_buffer = addr;
urb->urb.transfer_dma = dma;
urb->urb.transfer_buffer_length = max_packet_size;
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -69,7 +69,6 @@ static void init_pipe_urbs(struct usb_st
++u, transfer += transfer_length) {
struct urb *urb = urbs[u];
struct usb_iso_packet_descriptor *desc;
- urb->transfer_flags = URB_ISO_ASAP;
urb->transfer_buffer = transfer;
urb->dev = dev;
urb->pipe = pipe;
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -503,7 +503,6 @@ static int usX2Y_urbs_start(struct snd_u
if (0 == i)
atomic_set(&subs->state, state_STARTING3);
urb->dev = usX2Y->dev;
- urb->transfer_flags = URB_ISO_ASAP;
for (pack = 0; pack < nr_of_packs(); pack++) {
urb->iso_frame_desc[pack].offset = subs->maxpacksize * pack;
urb->iso_frame_desc[pack].length = subs->maxpacksize;
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -443,7 +443,6 @@ static int usX2Y_usbpcm_urbs_start(struc
if (0 == u)
atomic_set(&subs->state, state_STARTING3);
urb->dev = usX2Y->dev;
- urb->transfer_flags = URB_ISO_ASAP;
for (pack = 0; pack < nr_of_packs(); pack++) {
urb->iso_frame_desc[pack].offset = subs->maxpacksize * (pack + u * nr_of_packs());
urb->iso_frame_desc[pack].length = subs->maxpacksize;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 065/115] ALSA: hda - Fix aamix activation with loopback control on VIA codecs
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2013-05-06 20:45 ` [ 064/115] ALSA: USB: adjust for changed 3.8 USB API Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 066/115] ALSA: hda - Add the support for ALC286 codec Greg Kroah-Hartman
` (50 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lydia Wang, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 65033cc8d5ffd9b754e04da4be9cd1e8b61eeaff upstream.
When we have a loopback mixer control, this should manage the state
whether the output paths include the aamix or not. But the current
code blindly initializes the output paths with aamix = true, thus the
aamix is enabled unless the loopback mixer control is changed.
Also, update_aamix_paths() called by the loopback mixer control put
callback invokes snd_hda_activate_path() with aamix = true even for
disabling the mixing. This leaves the aamix path even though the
loopback control is turned off.
This patch fixes these issues:
- Introduced aamix_default() helper to indicate whether with_aamix is
true or false as default
- Fix the argument in update_aamix_paths() for disabling loopback
Reported-by: Lydia Wang <LydiaWang@viatech.com.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_generic.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -2072,6 +2072,14 @@ get_multiio_path(struct hda_codec *codec
static void update_automute_all(struct hda_codec *codec);
+/* Default value to be passed as aamix argument for snd_hda_activate_path();
+ * used for output paths
+ */
+static bool aamix_default(struct hda_gen_spec *spec)
+{
+ return !spec->have_aamix_ctl || spec->aamix_mode;
+}
+
static int set_multi_io(struct hda_codec *codec, int idx, bool output)
{
struct hda_gen_spec *spec = codec->spec;
@@ -2087,11 +2095,11 @@ static int set_multi_io(struct hda_codec
if (output) {
set_pin_target(codec, nid, PIN_OUT, true);
- snd_hda_activate_path(codec, path, true, true);
+ snd_hda_activate_path(codec, path, true, aamix_default(spec));
set_pin_eapd(codec, nid, true);
} else {
set_pin_eapd(codec, nid, false);
- snd_hda_activate_path(codec, path, false, true);
+ snd_hda_activate_path(codec, path, false, aamix_default(spec));
set_pin_target(codec, nid, spec->multi_io[idx].ctl_in, true);
path_power_down_sync(codec, path);
}
@@ -2182,8 +2190,8 @@ static void update_aamix_paths(struct hd
snd_hda_activate_path(codec, mix_path, true, true);
path_power_down_sync(codec, nomix_path);
} else {
- snd_hda_activate_path(codec, mix_path, false, true);
- snd_hda_activate_path(codec, nomix_path, true, true);
+ snd_hda_activate_path(codec, mix_path, false, false);
+ snd_hda_activate_path(codec, nomix_path, true, false);
path_power_down_sync(codec, mix_path);
}
}
@@ -4729,7 +4737,8 @@ static void set_output_and_unmute(struct
return;
pin = path->path[path->depth - 1];
restore_pin_ctl(codec, pin);
- snd_hda_activate_path(codec, path, path->active, true);
+ snd_hda_activate_path(codec, path, path->active,
+ aamix_default(codec->spec));
set_pin_eapd(codec, pin, path->active);
}
@@ -4779,7 +4788,8 @@ static void init_multi_io(struct hda_cod
if (!spec->multi_io[i].ctl_in)
spec->multi_io[i].ctl_in =
snd_hda_codec_get_pin_target(codec, pin);
- snd_hda_activate_path(codec, path, path->active, true);
+ snd_hda_activate_path(codec, path, path->active,
+ aamix_default(spec));
}
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 066/115] ALSA: hda - Add the support for ALC286 codec
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2013-05-06 20:45 ` [ 065/115] ALSA: hda - Fix aamix activation with loopback control on VIA codecs Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE Greg Kroah-Hartman
` (49 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 7fc7d047216aa4923d401c637be2ebc6e3d5bd9b upstream.
It's yet another ALC269-variant.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2515,6 +2515,7 @@ enum {
ALC269_TYPE_ALC280,
ALC269_TYPE_ALC282,
ALC269_TYPE_ALC284,
+ ALC269_TYPE_ALC286,
};
/*
@@ -2538,6 +2539,7 @@ static int alc269_parse_auto_config(stru
case ALC269_TYPE_ALC269VB:
case ALC269_TYPE_ALC269VD:
case ALC269_TYPE_ALC282:
+ case ALC269_TYPE_ALC286:
ssids = alc269_ssids;
break;
default:
@@ -3172,6 +3174,9 @@ static int patch_alc269(struct hda_codec
case 0x10ec0292:
spec->codec_variant = ALC269_TYPE_ALC284;
break;
+ case 0x10ec0286:
+ spec->codec_variant = ALC269_TYPE_ALC286;
+ break;
}
/* automatic parse from the BIOS config */
@@ -3878,6 +3883,7 @@ static const struct hda_codec_preset snd
{ .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 },
{ .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
+ { .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2013-05-06 20:45 ` [ 066/115] ALSA: hda - Add the support for ALC286 codec Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-07 0:00 ` Hugh Dickins
2013-05-06 20:45 ` [ 068/115] ASoC: max98088: Fix logging of hardware revision Greg Kroah-Hartman
` (48 subsequent siblings)
115 siblings, 1 reply; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Hugh Dickins,
Andrew Morton, Russell King
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 6aaa189f8712471a250bfdf8fc8d08277258b8ab upstream.
ARM processors with LPAE enabled use 3 levels of page tables, with an
entry in the top level (pgd) covering 1GB of virtual space. Because of
the branch relocation limitations on ARM, the loadable modules are
mapped 16MB below PAGE_OFFSET, making the corresponding 1GB pgd shared
between kernel modules and user space.
If free_pgtables() is called with the default ceiling 0,
free_pgd_range() (and subsequently called functions) also frees the page
table shared between user space and kernel modules (which is normally
handled by the ARM-specific pgd_free() function). This patch changes
defines the ARM USER_PGTABLES_CEILING to TASK_SIZE when CONFIG_ARM_LPAE
is enabled.
Note that the pgd_free() function already checks the presence of the
shared pmd page allocated by pgd_alloc() and frees it, though with
ceiling 0 this wasn't necessary.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/pgtable.h | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -70,6 +70,15 @@ extern void __pgd_error(const char *file
#endif
/*
+ * Use TASK_SIZE as the ceiling argument for free_pgtables() and
+ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd
+ * page shared between user and kernel).
+ */
+#ifdef CONFIG_ARM_LPAE
+#define USER_PGTABLES_CEILING TASK_SIZE
+#endif
+
+/*
* The pgprot_* and protection_map entries will be fixed up in runtime
* to include the cachable and bufferable bits based on memory policy,
* as well as any architecture dependent bits like global/ASID and SMP
^ permalink raw reply [flat|nested] 119+ messages in thread* Re: [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE
2013-05-06 20:45 ` [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE Greg Kroah-Hartman
@ 2013-05-07 0:00 ` Hugh Dickins
2013-05-07 17:23 ` Greg Kroah-Hartman
0 siblings, 1 reply; 119+ messages in thread
From: Hugh Dickins @ 2013-05-07 0:00 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Catalin Marinas, Andrew Morton,
Russell King
On Mon, 6 May 2013, Greg Kroah-Hartman wrote:
> 3.9-stable review patch. If anyone has any objections, please let me know.
NAK to 067/115 for 3.9, 063/104 for 3.8 and 38/63 for 3.4: they duplicate
036/115 for 3.9, 034/104 for 3.8 and 16/63 for 3.4.
Commit 6aaa189f8712471a250bfdf8fc8d08277258b8ab upstream is a duplicate of
commit 104ad3b32d7a71941c8ab2dee78eea38e8a23309 upstream; but whereas git
resolves the duplication in Linus's tree, they show up as a repeated
definition block in patch-3.9.1-rc1.
Why choose the Signed-off-by akpm version over the Signed-off-by rmk
version? No strong reason, and no disrespect to rmk: only because
036/115 etc pair with 057/115 etc, and rmk's version of that already
failed to apply in your tree because akpm's version got in first.
Hugh
>
> ------------------
>
> From: Catalin Marinas <catalin.marinas@arm.com>
>
> commit 6aaa189f8712471a250bfdf8fc8d08277258b8ab upstream.
>
> ARM processors with LPAE enabled use 3 levels of page tables, with an
> entry in the top level (pgd) covering 1GB of virtual space. Because of
> the branch relocation limitations on ARM, the loadable modules are
> mapped 16MB below PAGE_OFFSET, making the corresponding 1GB pgd shared
> between kernel modules and user space.
>
> If free_pgtables() is called with the default ceiling 0,
> free_pgd_range() (and subsequently called functions) also frees the page
> table shared between user space and kernel modules (which is normally
> handled by the ARM-specific pgd_free() function). This patch changes
> defines the ARM USER_PGTABLES_CEILING to TASK_SIZE when CONFIG_ARM_LPAE
> is enabled.
>
> Note that the pgd_free() function already checks the presence of the
> shared pmd page allocated by pgd_alloc() and frees it, though with
> ceiling 0 this wasn't necessary.
>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Hugh Dickins <hughd@google.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/arm/include/asm/pgtable.h | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> --- a/arch/arm/include/asm/pgtable.h
> +++ b/arch/arm/include/asm/pgtable.h
> @@ -70,6 +70,15 @@ extern void __pgd_error(const char *file
> #endif
>
> /*
> + * Use TASK_SIZE as the ceiling argument for free_pgtables() and
> + * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd
> + * page shared between user and kernel).
> + */
> +#ifdef CONFIG_ARM_LPAE
> +#define USER_PGTABLES_CEILING TASK_SIZE
> +#endif
> +
> +/*
> * The pgprot_* and protection_map entries will be fixed up in runtime
> * to include the cachable and bufferable bits based on memory policy,
> * as well as any architecture dependent bits like global/ASID and SMP
^ permalink raw reply [flat|nested] 119+ messages in thread* Re: [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE
2013-05-07 0:00 ` Hugh Dickins
@ 2013-05-07 17:23 ` Greg Kroah-Hartman
0 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-07 17:23 UTC (permalink / raw)
To: Hugh Dickins
Cc: linux-kernel, stable, Catalin Marinas, Andrew Morton,
Russell King
On Mon, May 06, 2013 at 05:00:39PM -0700, Hugh Dickins wrote:
> On Mon, 6 May 2013, Greg Kroah-Hartman wrote:
>
> > 3.9-stable review patch. If anyone has any objections, please let me know.
>
> NAK to 067/115 for 3.9, 063/104 for 3.8 and 38/63 for 3.4: they duplicate
> 036/115 for 3.9, 034/104 for 3.8 and 16/63 for 3.4.
>
> Commit 6aaa189f8712471a250bfdf8fc8d08277258b8ab upstream is a duplicate of
> commit 104ad3b32d7a71941c8ab2dee78eea38e8a23309 upstream; but whereas git
> resolves the duplication in Linus's tree, they show up as a repeated
> definition block in patch-3.9.1-rc1.
Ah, good catch, thanks, I'll go drop this patch from those trees, thanks
for letting me know.
greg k-h
^ permalink raw reply [flat|nested] 119+ messages in thread
* [ 068/115] ASoC: max98088: Fix logging of hardware revision.
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2013-05-06 20:45 ` [ 067/115] ARM: 7702/1: Set the page table freeing ceiling to TASK_SIZE Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 069/115] hrtimer: Fix ktime_add_ns() overflow on 32bit architectures Greg Kroah-Hartman
` (47 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dylan Reid, Mark Brown
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dylan Reid <dgreid@chromium.org>
commit 98682063549bedd6e2d2b6b7222f150c6fbce68c upstream.
The hardware revision of the codec is based at 0x40. Subtract that
before convering to ASCII. The same as it is done for 98095.
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/max98088.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/max98088.c
+++ b/sound/soc/codecs/max98088.c
@@ -2006,7 +2006,7 @@ static int max98088_probe(struct snd_soc
ret);
goto err_access;
}
- dev_info(codec->dev, "revision %c\n", ret + 'A');
+ dev_info(codec->dev, "revision %c\n", ret - 0x40 + 'A');
snd_soc_write(codec, M98088_REG_51_PWR_SYS, M98088_PWRSV);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 069/115] hrtimer: Fix ktime_add_ns() overflow on 32bit architectures
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2013-05-06 20:45 ` [ 068/115] ASoC: max98088: Fix logging of hardware revision Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 070/115] hrtimer: Add expiry time overflow check in hrtimer_interrupt Greg Kroah-Hartman
` (46 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Engraf, John Stultz
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Engraf <david.engraf@sysgo.com>
commit 51fd36f3fad8447c487137ae26b9d0b3ce77bb25 upstream.
One can trigger an overflow when using ktime_add_ns() on a 32bit
architecture not supporting CONFIG_KTIME_SCALAR.
When passing a very high value for u64 nsec, e.g. 7881299347898368000
the do_div() function converts this value to seconds (7881299347) which
is still to high to pass to the ktime_set() function as long. The result
in is a negative value.
The problem on my system occurs in the tick-sched.c,
tick_nohz_stop_sched_tick() when time_delta is set to
timekeeping_max_deferment(). The check for time_delta < KTIME_MAX is
valid, thus ktime_add_ns() is called with a too large value resulting in
a negative expire value. This leads to an endless loop in the ticker code:
time_delta: 7881299347898368000
expires = ktime_add_ns(last_update, time_delta)
expires: negative value
This fix caps the value to KTIME_MAX.
This error doesn't occurs on 64bit or architectures supporting
CONFIG_KTIME_SCALAR (e.g. ARM, x86-32).
Signed-off-by: David Engraf <david.engraf@sysgo.com>
[jstultz: Minor tweaks to commit message & header]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/hrtimer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -276,6 +276,10 @@ ktime_t ktime_add_ns(const ktime_t kt, u
} else {
unsigned long rem = do_div(nsec, NSEC_PER_SEC);
+ /* Make sure nsec fits into long */
+ if (unlikely(nsec > KTIME_SEC_MAX))
+ return (ktime_t){ .tv64 = KTIME_MAX };
+
tmp = ktime_set((long)nsec, rem);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 070/115] hrtimer: Add expiry time overflow check in hrtimer_interrupt
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2013-05-06 20:45 ` [ 069/115] hrtimer: Fix ktime_add_ns() overflow on 32bit architectures Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 071/115] swap: redirty page if page write fails on swap file Greg Kroah-Hartman
` (45 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rik van Riel, Thomas Gleixner,
Prarit Bhargava, John Stultz
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prarit Bhargava <prarit@redhat.com>
commit 8f294b5a139ee4b75e890ad5b443c93d1e558a8b upstream.
The settimeofday01 test in the LTP testsuite effectively does
gettimeofday(current time);
settimeofday(Jan 1, 1970 + 100 seconds);
settimeofday(current time);
This test causes a stack trace to be displayed on the console during the
setting of timeofday to Jan 1, 1970 + 100 seconds:
[ 131.066751] ------------[ cut here ]------------
[ 131.096448] WARNING: at kernel/time/clockevents.c:209 clockevents_program_event+0x135/0x140()
[ 131.104935] Hardware name: Dinar
[ 131.108150] Modules linked in: sg nfsv3 nfs_acl nfsv4 auth_rpcgss nfs dns_resolver fscache lockd sunrpc nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables kvm_amd kvm sp5100_tco bnx2 i2c_piix4 crc32c_intel k10temp fam15h_power ghash_clmulni_intel amd64_edac_mod pcspkr serio_raw edac_mce_amd edac_core microcode xfs libcrc32c sr_mod sd_mod cdrom ata_generic crc_t10dif pata_acpi radeon i2c_algo_bit drm_kms_helper ttm drm ahci pata_atiixp libahci libata usb_storage i2c_core dm_mirror dm_region_hash dm_log dm_mod
[ 131.176784] Pid: 0, comm: swapper/28 Not tainted 3.8.0+ #6
[ 131.182248] Call Trace:
[ 131.184684] <IRQ> [<ffffffff810612af>] warn_slowpath_common+0x7f/0xc0
[ 131.191312] [<ffffffff8106130a>] warn_slowpath_null+0x1a/0x20
[ 131.197131] [<ffffffff810b9fd5>] clockevents_program_event+0x135/0x140
[ 131.203721] [<ffffffff810bb584>] tick_program_event+0x24/0x30
[ 131.209534] [<ffffffff81089ab1>] hrtimer_interrupt+0x131/0x230
[ 131.215437] [<ffffffff814b9600>] ? cpufreq_p4_target+0x130/0x130
[ 131.221509] [<ffffffff81619119>] smp_apic_timer_interrupt+0x69/0x99
[ 131.227839] [<ffffffff8161805d>] apic_timer_interrupt+0x6d/0x80
[ 131.233816] <EOI> [<ffffffff81099745>] ? sched_clock_cpu+0xc5/0x120
[ 131.240267] [<ffffffff814b9ff0>] ? cpuidle_wrap_enter+0x50/0xa0
[ 131.246252] [<ffffffff814b9fe9>] ? cpuidle_wrap_enter+0x49/0xa0
[ 131.252238] [<ffffffff814ba050>] cpuidle_enter_tk+0x10/0x20
[ 131.257877] [<ffffffff814b9c89>] cpuidle_idle_call+0xa9/0x260
[ 131.263692] [<ffffffff8101c42f>] cpu_idle+0xaf/0x120
[ 131.268727] [<ffffffff815f8971>] start_secondary+0x255/0x257
[ 131.274449] ---[ end trace 1151a50552231615 ]---
When we change the system time to a low value like this, the value of
timekeeper->offs_real will be a negative value.
It seems that the WARN occurs because an hrtimer has been started in the time
between the releasing of the timekeeper lock and the IPI call (via a call to
on_each_cpu) in clock_was_set() in the do_settimeofday() code. The end result
is that a REALTIME_CLOCK timer has been added with softexpires = expires =
KTIME_MAX. The hrtimer_interrupt() fires/is called and the loop at
kernel/hrtimer.c:1289 is executed. In this loop the code subtracts the
clock base's offset (which was set to timekeeper->offs_real in
do_settimeofday()) from the current hrtimer_cpu_base->expiry value (which
was KTIME_MAX):
KTIME_MAX - (a negative value) = overflow
A simple check for an overflow can resolve this problem. Using KTIME_MAX
instead of the overflow value will result in the hrtimer function being run,
and the reprogramming of the timer after that.
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
[jstultz: Tweaked commit subject]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/hrtimer.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1314,6 +1314,8 @@ retry:
expires = ktime_sub(hrtimer_get_expires(timer),
base->offset);
+ if (expires.tv64 < 0)
+ expires.tv64 = KTIME_MAX;
if (expires.tv64 < expires_next.tv64)
expires_next = expires;
break;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 071/115] swap: redirty page if page write fails on swap file
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2013-05-06 20:45 ` [ 070/115] hrtimer: Add expiry time overflow check in hrtimer_interrupt Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 072/115] mm: swap: mark swap pages writeback before queueing for direct IO Greg Kroah-Hartman
` (44 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerome Marchand, Johannes Weiner,
Mel Gorman, Hugh Dickins, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Marchand <jmarchan@redhat.com>
commit 2d30d31ea3c5be426ce25607b9bd1835acb85e0a upstream.
Since commit 62c230bc1790 ("mm: add support for a filesystem to activate
swap files and use direct_IO for writing swap pages"), swap_writepage()
calls direct_IO on swap files. However, in that case the page isn't
redirtied if I/O fails, and is therefore handled afterwards as if it has
been successfully written to the swap file, leading to memory corruption
when the page is eventually swapped back in.
This patch sets the page dirty when direct_IO() fails. It fixes a
memory corruption that happened while using swap-over-NFS.
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_io.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -222,6 +222,8 @@ int swap_writepage(struct page *page, st
if (ret == PAGE_SIZE) {
count_vm_event(PSWPOUT);
ret = 0;
+ } else {
+ set_page_dirty(page);
}
return ret;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 072/115] mm: swap: mark swap pages writeback before queueing for direct IO
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2013-05-06 20:45 ` [ 071/115] swap: redirty page if page write fails on swap file Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 073/115] drivers/rtc/rtc-cmos.c: dont disable hpet emulation on suspend Greg Kroah-Hartman
` (43 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, Jerome Marchand,
Hugh Dickins, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@suse.de>
commit 0cdc444a67ccdbd58bfbcba865cb17a9f17a7691 upstream.
As pointed out by Andrew Morton, the swap-over-NFS writeback is not
setting PageWriteback before it is queued for direct IO. While swap
pages do not participate in BDI or process dirty accounting and the IO
is synchronous, the writeback bit is still required and not setting it
in this case was an oversight. swapoff depends on the page writeback to
synchronoise all pending writes on a swap page before it is reused.
Swapcache freeing and reuse depend on checking the PageWriteback under
lock to ensure the page is safe to reuse.
Direct IO handlers and the direct IO handler for NFS do not deal with
PageWriteback as they are synchronous writes. In the case of NFS, it
schedules pages (or a page in the case of swap) for IO and then waits
synchronously for IO to complete in nfs_direct_write(). It is
recognised that this is a slowdown from normal swap handling which is
asynchronous and uses a completion handler. Shoving PageWriteback
handling down into direct IO handlers looks like a bad fit to handle the
swap case although it may have to be dealt with some day if swap is
converted to use direct IO in general and bmap is finally done away
with. At that point it will be necessary to refit asynchronous direct
IO with completion handlers onto the swap subsystem.
As swapcache currently depends on PageWriteback to protect against
races, this patch sets PageWriteback under the page lock before queueing
it for direct IO. It is cleared when the direct IO handler returns. IO
errors are treated similarly to the direct-to-bio case except PageError
is not set as in the case of swap-over-NFS, it is likely to be a
transient error.
It was asked what prevents such a page being reclaimed in parallel.
With this patch applied, such a page will now be skipped (most of the
time) or blocked until the writeback completes. Reclaim checks
PageWriteback under the page lock before calling try_to_free_swap and
the page lock should prevent the page being requeued for IO before it is
freed.
This and Jerome's related patch should considered for -stable as far
back as 3.6 when swap-over-NFS was introduced.
[akpm@linux-foundation.org: use pr_err_ratelimited()]
[akpm@linux-foundation.org: remove hopefully-unneeded cast in printk]
Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_io.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -214,6 +214,7 @@ int swap_writepage(struct page *page, st
kiocb.ki_left = PAGE_SIZE;
kiocb.ki_nbytes = PAGE_SIZE;
+ set_page_writeback(page);
unlock_page(page);
ret = mapping->a_ops->direct_IO(KERNEL_WRITE,
&kiocb, &iov,
@@ -223,8 +224,22 @@ int swap_writepage(struct page *page, st
count_vm_event(PSWPOUT);
ret = 0;
} else {
+ /*
+ * In the case of swap-over-nfs, this can be a
+ * temporary failure if the system has limited
+ * memory for allocating transmit buffers.
+ * Mark the page dirty and avoid
+ * rotate_reclaimable_page but rate-limit the
+ * messages but do not flag PageError like
+ * the normal direct-to-bio case as it could
+ * be temporary.
+ */
set_page_dirty(page);
+ ClearPageReclaim(page);
+ pr_err_ratelimited("Write error on dio swapfile (%Lu)\n",
+ page_file_offset(page));
}
+ end_page_writeback(page);
return ret;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 073/115] drivers/rtc/rtc-cmos.c: dont disable hpet emulation on suspend
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2013-05-06 20:45 ` [ 072/115] mm: swap: mark swap pages writeback before queueing for direct IO Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 074/115] drivers/rtc/rtc-at91rm9200.c: fix missing iounmap Greg Kroah-Hartman
` (42 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Derek Basehore, Maxim Levitsky,
H. Peter Anvin, Thomas Gleixner, Ingo Molnar, Rafael J. Wysocki,
Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek Basehore <dbasehore@chromium.org>
commit e005715efaf674660ae59af83b13822567e3a758 upstream.
There's a bug where rtc alarms are ignored after the rtc cmos suspends
but before the system finishes suspend. Since hpet emulation is
disabled and it still handles the interrupts, a wake event is never
registered which is done from the rtc layer.
This patch reverts commit d1b2efa83fbf ("rtc: disable hpet emulation on
suspend") which disabled hpet emulation. To fix the problem mentioned
in that commit, hpet_rtc_timer_init() is called directly on resume.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-cmos.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -804,9 +804,8 @@ static int cmos_suspend(struct device *d
mask = RTC_IRQMASK;
tmp &= ~mask;
CMOS_WRITE(tmp, RTC_CONTROL);
+ hpet_mask_rtc_irq_bit(mask);
- /* shut down hpet emulation - we don't need it for alarm */
- hpet_mask_rtc_irq_bit(RTC_PIE|RTC_AIE|RTC_UIE);
cmos_checkintr(cmos, tmp);
}
spin_unlock_irq(&rtc_lock);
@@ -870,6 +869,7 @@ static int cmos_resume(struct device *de
rtc_update_irq(cmos->rtc, 1, mask);
tmp &= ~RTC_AIE;
hpet_mask_rtc_irq_bit(RTC_AIE);
+ hpet_rtc_timer_init();
} while (mask & RTC_AIE);
spin_unlock_irq(&rtc_lock);
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 074/115] drivers/rtc/rtc-at91rm9200.c: fix missing iounmap
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2013-05-06 20:45 ` [ 073/115] drivers/rtc/rtc-cmos.c: dont disable hpet emulation on suspend Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 075/115] libata: acpi: make ata_ap_acpi_handle not block Greg Kroah-Hartman
` (41 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Nicolas Ferre,
Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 3427de92ac70a064098ff843c72ac76c420bb1cb upstream.
Add missing iounmap to probe error path and remove.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-at91rm9200.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -297,7 +297,7 @@ static int __init at91_rtc_probe(struct
"at91_rtc", pdev);
if (ret) {
dev_err(&pdev->dev, "IRQ %d already in use.\n", irq);
- return ret;
+ goto err_unmap;
}
/* cpu init code should really have flagged this device as
@@ -309,13 +309,20 @@ static int __init at91_rtc_probe(struct
rtc = rtc_device_register(pdev->name, &pdev->dev,
&at91_rtc_ops, THIS_MODULE);
if (IS_ERR(rtc)) {
- free_irq(irq, pdev);
- return PTR_ERR(rtc);
+ ret = PTR_ERR(rtc);
+ goto err_free_irq;
}
platform_set_drvdata(pdev, rtc);
dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n");
return 0;
+
+err_free_irq:
+ free_irq(irq, pdev);
+err_unmap:
+ iounmap(at91_rtc_regs);
+
+ return ret;
}
/*
@@ -332,6 +339,7 @@ static int __exit at91_rtc_remove(struct
free_irq(irq, pdev);
rtc_device_unregister(rtc);
+ iounmap(at91_rtc_regs);
platform_set_drvdata(pdev, NULL);
return 0;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 075/115] libata: acpi: make ata_ap_acpi_handle not block
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2013-05-06 20:45 ` [ 074/115] drivers/rtc/rtc-at91rm9200.c: fix missing iounmap Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 076/115] ACPI: Fix wrong parameter passed to memblock_reserve Greg Kroah-Hartman
` (40 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aaron Lu, Jeff Garzik
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <aaron.lu@intel.com>
commit d66af4df0837f21bf267305dc5ccab2d29e24d86 upstream.
Since commit 30dcf76acc, ata_ap_acpi_handle will always do a namespace
walk, which requires acquiring an acpi namespace mutex. This made it
impossible to be used when calling path has held a spinlock.
For example, it can occur in the following code path for pata_acpi:
ata_scsi_queuecmd (ap->lock is acquired)
__ata_scsi_queuecmd
ata_scsi_translate
ata_qc_issue
pacpi_qc_issue
ata_acpi_stm
ata_ap_acpi_handle
acpi_get_child
acpi_walk_namespace
acpi_ut_acquire_mutex (acquire mutex while holding lock)
This caused scheduling while atomic bug, as reported in bug #56781.
Actually, ata_ap_acpi_handle doesn't have to walk the namespace every
time it is called, it can simply return the bound acpi handle on the
corresponding SCSI host. The reason previously it is not done this way
is, ata_ap_acpi_handle is used in the binding function
ata_acpi_bind_host by ata_acpi_gtm when the handle is not bound to the
SCSI host yet. Since we already have the ATA port's handle in its
binding function, we can simply use it instead of calling
ata_ap_acpi_handle there. So introduce a new function __ata_acpi_gtm,
where it will receive an acpi handle param in addition to the ATA port
which is solely used for debug statement. With this change, we can make
ata_ap_acpi_handle simply return the bound handle for SCSI host instead
of walking the acpi namespace now.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=56781
Reported-and-tested-by: <kenzopl@o2.pl>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-acpi.c | 45 +++++++++++++++++++++++++++------------------
1 file changed, 27 insertions(+), 18 deletions(-)
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -61,7 +61,8 @@ acpi_handle ata_ap_acpi_handle(struct at
if (ap->flags & ATA_FLAG_ACPI_SATA)
return NULL;
- return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev), ap->port_no);
+ return ap->scsi_host ?
+ DEVICE_ACPI_HANDLE(&ap->scsi_host->shost_gendev) : NULL;
}
EXPORT_SYMBOL(ata_ap_acpi_handle);
@@ -240,28 +241,15 @@ void ata_acpi_dissociate(struct ata_host
}
}
-/**
- * ata_acpi_gtm - execute _GTM
- * @ap: target ATA port
- * @gtm: out parameter for _GTM result
- *
- * Evaluate _GTM and store the result in @gtm.
- *
- * LOCKING:
- * EH context.
- *
- * RETURNS:
- * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
- */
-int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
+static int __ata_acpi_gtm(struct ata_port *ap, acpi_handle handle,
+ struct ata_acpi_gtm *gtm)
{
struct acpi_buffer output = { .length = ACPI_ALLOCATE_BUFFER };
union acpi_object *out_obj;
acpi_status status;
int rc = 0;
- status = acpi_evaluate_object(ata_ap_acpi_handle(ap), "_GTM", NULL,
- &output);
+ status = acpi_evaluate_object(handle, "_GTM", NULL, &output);
rc = -ENOENT;
if (status == AE_NOT_FOUND)
@@ -295,6 +283,27 @@ int ata_acpi_gtm(struct ata_port *ap, st
return rc;
}
+/**
+ * ata_acpi_gtm - execute _GTM
+ * @ap: target ATA port
+ * @gtm: out parameter for _GTM result
+ *
+ * Evaluate _GTM and store the result in @gtm.
+ *
+ * LOCKING:
+ * EH context.
+ *
+ * RETURNS:
+ * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
+ */
+int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
+{
+ if (ata_ap_acpi_handle(ap))
+ return __ata_acpi_gtm(ap, ata_ap_acpi_handle(ap), gtm);
+ else
+ return -EINVAL;
+}
+
EXPORT_SYMBOL_GPL(ata_acpi_gtm);
/**
@@ -1080,7 +1089,7 @@ static int ata_acpi_bind_host(struct ata
if (!*handle)
return -ENODEV;
- if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0)
+ if (__ata_acpi_gtm(ap, *handle, &ap->__acpi_init_gtm) == 0)
ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
return 0;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 076/115] ACPI: Fix wrong parameter passed to memblock_reserve
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2013-05-06 20:45 ` [ 075/115] libata: acpi: make ata_ap_acpi_handle not block Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 077/115] ACPI / thermal: do not always return THERMAL_TREND_RAISING for active trip points Greg Kroah-Hartman
` (39 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wang YanQing, Yinghai Lu,
Rafael J. Wysocki
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang YanQing <udknight@gmail.com>
commit a6432ded299726f123b93d0132fead200551535c upstream.
Commit 53aac44 (ACPI: Store valid ACPI tables passed via early initrd
in reserved memblock areas) introduced acpi_initrd_override() that
passes a wrong value as the second argument to memblock_reserve().
Namely, the second argument of memblock_reserve() is the size of the
region, not the address of the top of it, so make
acpi_initrd_override() pass the size in there as appropriate.
[rjw: Changelog]
Signed-off-by: Wang YanQing <udknight@gmail.com>
Acked-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/osl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -641,7 +641,7 @@ void __init acpi_initrd_override(void *d
* Both memblock_reserve and e820_add_region (via arch_reserve_mem_area)
* works fine.
*/
- memblock_reserve(acpi_tables_addr, acpi_tables_addr + all_tables_size);
+ memblock_reserve(acpi_tables_addr, all_tables_size);
arch_reserve_mem_area(acpi_tables_addr, all_tables_size);
p = early_ioremap(acpi_tables_addr, all_tables_size);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 077/115] ACPI / thermal: do not always return THERMAL_TREND_RAISING for active trip points
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2013-05-06 20:45 ` [ 076/115] ACPI: Fix wrong parameter passed to memblock_reserve Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 078/115] cgroup: fix an off-by-one bug which may trigger BUG_ON() Greg Kroah-Hartman
` (38 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Rui, Matthias,
Ville Syrjälä, Rafael J. Wysocki
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
commit 94a409319561ec1847fd9bf996a2d5843ad00932 upstream.
Commit 4ae46be "Thermal: Introduce thermal_zone_trip_update()"
introduced a regression causing the fan to be always on even when
the system is idle.
My original idea in that commit is that:
- when the current temperature is above the trip point,
keep the fan on, even if the temperature is dropping.
- when the current temperature is below the trip point,
turn on the fan when the temperature is raising,
turn off the fan when the temperature is dropping.
But this is what the code actually does:
- when the current temperature is above the trip point,
the fan keeps on.
- when the current temperature is below the trip point,
the fan is always on because thermal_get_trend()
in driver/acpi/thermal.c returns THERMAL_TREND_RAISING.
Thus the fan keeps running even if the system is idle.
Fix this in drivers/acpi/thermal.c.
[rjw: Changelog]
References: https://bugzilla.kernel.org/show_bug.cgi?id=56591
References: https://bugzilla.kernel.org/show_bug.cgi?id=56601
References: https://bugzilla.kernel.org/show_bug.cgi?id=50041#c45
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Tested-by: Matthias <morpheusxyz123@yahoo.de>
Tested-by: Ville Syrjälä <syrjala@sci.fi>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/thermal.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -723,9 +723,19 @@ static int thermal_get_trend(struct ther
return -EINVAL;
if (type == THERMAL_TRIP_ACTIVE) {
- /* aggressive active cooling */
- *trend = THERMAL_TREND_RAISING;
- return 0;
+ unsigned long trip_temp;
+ unsigned long temp = KELVIN_TO_MILLICELSIUS(tz->temperature,
+ tz->kelvin_offset);
+ if (thermal_get_trip_temp(thermal, trip, &trip_temp))
+ return -EINVAL;
+
+ if (temp > trip_temp) {
+ *trend = THERMAL_TREND_RAISING;
+ return 0;
+ } else {
+ /* Fall back on default trend */
+ return -EINVAL;
+ }
}
/*
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 078/115] cgroup: fix an off-by-one bug which may trigger BUG_ON()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2013-05-06 20:45 ` [ 077/115] ACPI / thermal: do not always return THERMAL_TREND_RAISING for active trip points Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 079/115] cgroup: fix broken file xattrs Greg Kroah-Hartman
` (37 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Zefan, Tejun Heo
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zefan <lizefan@huawei.com>
commit 3ac1707a13a3da9cfc8f242a15b2fae6df2c5f88 upstream.
The 3rd parameter of flex_array_prealloc() is the number of elements,
not the index of the last element.
The effect of the bug is, when opening cgroup.procs, a flex array will
be allocated and all elements of the array is allocated with
GFP_KERNEL flag, but the last one is GFP_ATOMIC, and if we fail to
allocate memory for it, it'll trigger a BUG_ON().
Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2065,7 +2065,7 @@ static int cgroup_attach_proc(struct cgr
if (!group)
return -ENOMEM;
/* pre-allocate to guarantee space while iterating in rcu read-side. */
- retval = flex_array_prealloc(group, 0, group_size - 1, GFP_KERNEL);
+ retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
if (retval)
goto out_free_group_list;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 079/115] cgroup: fix broken file xattrs
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2013-05-06 20:45 ` [ 078/115] cgroup: fix an off-by-one bug which may trigger BUG_ON() Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 080/115] localmodconfig: Process source kconfig files as they are found Greg Kroah-Hartman
` (36 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kodanev, Li Zefan, Tejun Heo
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zefan <lizefan@huawei.com>
commit 712317ad97f41e738e1a19aa0a6392a78a84094e upstream.
We should store file xattrs in struct cfent instead of struct cftype,
because cftype is a type while cfent is object instance of cftype.
For example each cgroup has a tasks file, and each tasks file is
associated with a uniq cfent, but all those files share the same
struct cftype.
Alexey Kodanev reported a crash, which can be reproduced:
# mount -t cgroup -o xattr /sys/fs/cgroup
# mkdir /sys/fs/cgroup/test
# setfattr -n trusted.value -v test_value /sys/fs/cgroup/tasks
# rmdir /sys/fs/cgroup/test
# umount /sys/fs/cgroup
oops!
In this case, simple_xattrs_free() will free the same struct simple_xattrs
twice.
tj: Dropped unused local variable @cft from cgroup_diput().
Reported-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cgroup.h | 3 ---
kernel/cgroup.c | 11 ++++++-----
2 files changed, 6 insertions(+), 8 deletions(-)
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -304,9 +304,6 @@ struct cftype {
/* CFTYPE_* flags */
unsigned int flags;
- /* file xattrs */
- struct simple_xattrs xattrs;
-
int (*open)(struct inode *inode, struct file *file);
ssize_t (*read)(struct cgroup *cgrp, struct cftype *cft,
struct file *file,
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -162,6 +162,9 @@ struct cfent {
struct list_head node;
struct dentry *dentry;
struct cftype *type;
+
+ /* file xattrs */
+ struct simple_xattrs xattrs;
};
/*
@@ -910,13 +913,12 @@ static void cgroup_diput(struct dentry *
} else {
struct cfent *cfe = __d_cfe(dentry);
struct cgroup *cgrp = dentry->d_parent->d_fsdata;
- struct cftype *cft = cfe->type;
WARN_ONCE(!list_empty(&cfe->node) &&
cgrp != &cgrp->root->top_cgroup,
"cfe still linked for %s\n", cfe->type->name);
+ simple_xattrs_free(&cfe->xattrs);
kfree(cfe);
- simple_xattrs_free(&cft->xattrs);
}
iput(inode);
}
@@ -2551,7 +2553,7 @@ static struct simple_xattrs *__d_xattrs(
if (S_ISDIR(dentry->d_inode->i_mode))
return &__d_cgrp(dentry)->xattrs;
else
- return &__d_cft(dentry)->xattrs;
+ return &__d_cfe(dentry)->xattrs;
}
static inline int xattr_enabled(struct dentry *dentry)
@@ -2727,8 +2729,6 @@ static int cgroup_add_file(struct cgroup
umode_t mode;
char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
- simple_xattrs_init(&cft->xattrs);
-
if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
strcpy(name, subsys->name);
strcat(name, ".");
@@ -2753,6 +2753,7 @@ static int cgroup_add_file(struct cgroup
cfe->type = (void *)cft;
cfe->dentry = dentry;
dentry->d_fsdata = cfe;
+ simple_xattrs_init(&cfe->xattrs);
list_add_tail(&cfe->node, &parent->files);
cfe = NULL;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 080/115] localmodconfig: Process source kconfig files as they are found
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2013-05-06 20:45 ` [ 079/115] cgroup: fix broken file xattrs Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 081/115] clockevents: Set dummy handler on CPU_DEAD shutdown Greg Kroah-Hartman
` (35 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robert P. J. Day, Steven Rostedt
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit ced9cb1af1e3486cc14dca755a1b3fbadf06e90b upstream.
A bug was reported that caused localmodconfig to not keep all the
dependencies of ATH9K. This was caused by the kconfig file:
In drivers/net/wireless/ath/Kconfig:
---
if ATH_CARDS
config ATH_DEBUG
bool "Atheros wireless debugging"
---help---
Say Y, if you want to debug atheros wireless drivers.
Right now only ath9k makes use of this.
source "drivers/net/wireless/ath/ath5k/Kconfig"
source "drivers/net/wireless/ath/ath9k/Kconfig"
source "drivers/net/wireless/ath/carl9170/Kconfig"
source "drivers/net/wireless/ath/ath6kl/Kconfig"
source "drivers/net/wireless/ath/ar5523/Kconfig"
source "drivers/net/wireless/ath/wil6210/Kconfig"
endif
---
The current way kconfig works, it processes new source files after the
first file is completed. It creates an array of new source config files
and when the one file is finished, it continues with the next file.
Unfortunately, this means that it loses the fact that the source file is
within an "if" statement, and this means that each of these source file's
configs will not have the proper dependencies set.
As ATH9K requires ATH_CARDS set, the localmodconfig did not see that
dependency, and did not enable ATH_CARDS. When the oldconfig was run, it
forced ATH9K to be disabled.
Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1304291022320.9234@oneiric
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/kconfig/streamline_config.pl | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -156,7 +156,6 @@ sub read_kconfig {
my $state = "NONE";
my $config;
- my @kconfigs;
my $cont = 0;
my $line;
@@ -190,7 +189,13 @@ sub read_kconfig {
# collect any Kconfig sources
if (/^source\s*"(.*)"/) {
- $kconfigs[$#kconfigs+1] = $1;
+ my $kconfig = $1;
+ # prevent reading twice.
+ if (!defined($read_kconfigs{$kconfig})) {
+ $read_kconfigs{$kconfig} = 1;
+ read_kconfig($kconfig);
+ }
+ next;
}
# configs found
@@ -250,14 +255,6 @@ sub read_kconfig {
}
}
close($kinfile);
-
- # read in any configs that were found.
- foreach my $kconfig (@kconfigs) {
- if (!defined($read_kconfigs{$kconfig})) {
- $read_kconfigs{$kconfig} = 1;
- read_kconfig($kconfig);
- }
- }
}
if ($kconfig) {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 081/115] clockevents: Set dummy handler on CPU_DEAD shutdown
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2013-05-06 20:45 ` [ 080/115] localmodconfig: Process source kconfig files as they are found Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 082/115] sata_highbank: Rename proc_name to the module name Greg Kroah-Hartman
` (34 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vitaliy Fillipov, Ben Hutchings,
Thomas Gleixner, 700333
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 6f7a05d7018de222e40ca003721037a530979974 upstream.
Vitaliy reported that a per cpu HPET timer interrupt crashes the
system during hibernation. What happens is that the per cpu HPET timer
gets shut down when the nonboot cpus are stopped. When the nonboot
cpus are onlined again the HPET code sets up the MSI interrupt which
fires before the clock event device is registered. The event handler
is still set to hrtimer_interrupt, which then crashes the machine due
to highres mode not being active.
See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700333
There is no real good way to avoid that in the HPET code. The HPET
code alrady has a mechanism to detect spurious interrupts when event
handler == NULL for a similar reason.
We can handle that in the clockevent/tick layer and replace the
previous functional handler with a dummy handler like we do in
tick_setup_new_device().
The original clockevents code did this in clockevents_exchange_device(),
but that got removed by commit 7c1e76897 (clockevents: prevent
clockevent event_handler ending up handler_noop) which forgot to fix
it up in tick_shutdown(). Same issue with the broadcast device.
Reported-by: Vitaliy Fillipov <vitalif@yourcmc.ru>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: 700333@bugs.debian.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/tick-broadcast.c | 4 ++++
kernel/time/tick-common.c | 1 +
2 files changed, 5 insertions(+)
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -67,6 +67,8 @@ static void tick_broadcast_start_periodi
*/
int tick_check_broadcast_device(struct clock_event_device *dev)
{
+ struct clock_event_device *cur = tick_broadcast_device.evtdev;
+
if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
(tick_broadcast_device.evtdev &&
tick_broadcast_device.evtdev->rating >= dev->rating) ||
@@ -74,6 +76,8 @@ int tick_check_broadcast_device(struct c
return 0;
clockevents_exchange_device(tick_broadcast_device.evtdev, dev);
+ if (cur)
+ cur->event_handler = clockevents_handle_noop;
tick_broadcast_device.evtdev = dev;
if (!cpumask_empty(tick_get_broadcast_mask()))
tick_broadcast_start_periodic(dev);
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -323,6 +323,7 @@ static void tick_shutdown(unsigned int *
*/
dev->mode = CLOCK_EVT_MODE_UNUSED;
clockevents_exchange_device(dev, NULL);
+ dev->event_handler = clockevents_handle_noop;
td->evtdev = NULL;
}
raw_spin_unlock_irqrestore(&tick_device_lock, flags);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 082/115] sata_highbank: Rename proc_name to the module name
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2013-05-06 20:45 ` [ 081/115] clockevents: Set dummy handler on CPU_DEAD shutdown Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 083/115] inotify: invalid mask should return a error number but not set it Greg Kroah-Hartman
` (33 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robert Richter, Rob Herring,
Alexander Graf, Jeff Garzik
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Richter <robert.richter@calxeda.com>
commit 2cc1144a31f76d4a9fb48bec5d6ba1359f980813 upstream.
mkinitrd looks at /sys/class/scsi_host/host$hostnum/proc_name to find
the module name of a disk driver. Current name is "highbank-ahci" but
the module is "sata_highbank". Rename it to match the module name.
Signed-off-by: Robert Richter <robert.richter@calxeda.com>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/sata_highbank.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -251,7 +251,7 @@ static const struct ata_port_info ahci_h
};
static struct scsi_host_template ahci_highbank_platform_sht = {
- AHCI_SHT("highbank-ahci"),
+ AHCI_SHT("sata_highbank"),
};
static const struct of_device_id ahci_of_match[] = {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 083/115] inotify: invalid mask should return a error number but not set it
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2013-05-06 20:45 ` [ 082/115] sata_highbank: Rename proc_name to the module name Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 084/115] fs/dcache.c: add cond_resched() to shrink_dcache_parent() Greg Kroah-Hartman
` (32 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhao Hongjiang, Jim Somerville,
Paul Gortmaker, Jerome Marchand, Eric Paris, Andrew Morton,
Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Hongjiang <zhaohongjiang@huawei.com>
commit 04df32fa10ab9a6f0643db2949d42efc966bc844 upstream.
When we run the crackerjack testsuite, the inotify_add_watch test is
stalled.
This is caused by the invalid mask 0 - the task is waiting for the event
but it never comes. inotify_add_watch() should return -EINVAL as it did
before commit 676a0675cf92 ("inotify: remove broken mask checks causing
unmount to be EINVAL"). That commit removes the invalid mask check, but
that check is needed.
Check the mask's ALL_INOTIFY_BITS before the inotify_arg_to_mask() call.
If none are set, just return -EINVAL.
Because IN_UNMOUNT is in ALL_INOTIFY_BITS, this change will not trigger
the problem that above commit fixed.
[akpm@linux-foundation.org: fix build]
Signed-off-by: Zhao Hongjiang <zhaohongjiang@huawei.com>
Acked-by: Jim Somerville <Jim.Somerville@windriver.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Eric Paris <eparis@parisplace.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/inotify/inotify_user.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -572,7 +572,6 @@ static int inotify_update_existing_watch
int add = (arg & IN_MASK_ADD);
int ret;
- /* don't allow invalid bits: we don't want flags set */
mask = inotify_arg_to_mask(arg);
fsn_mark = fsnotify_find_inode_mark(group, inode);
@@ -623,7 +622,6 @@ static int inotify_new_watch(struct fsno
struct idr *idr = &group->inotify_data.idr;
spinlock_t *idr_lock = &group->inotify_data.idr_lock;
- /* don't allow invalid bits: we don't want flags set */
mask = inotify_arg_to_mask(arg);
tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
@@ -751,6 +749,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int,
int ret;
unsigned flags = 0;
+ /* don't allow invalid bits: we don't want flags set */
+ if (unlikely(!(mask & ALL_INOTIFY_BITS)))
+ return -EINVAL;
+
f = fdget(fd);
if (unlikely(!f.file))
return -EBADF;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 084/115] fs/dcache.c: add cond_resched() to shrink_dcache_parent()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2013-05-06 20:45 ` [ 083/115] inotify: invalid mask should return a error number but not set it Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 085/115] exec: do not abuse ->cred_guard_mutex in threadgroup_lock() Greg Kroah-Hartman
` (31 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Greg Thelen, Dave Chinner,
Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <gthelen@google.com>
commit 421348f1ca0bf17769dee0aed4d991845ae0536d upstream.
Call cond_resched() in shrink_dcache_parent() to maintain interactivity.
Before this patch:
void shrink_dcache_parent(struct dentry * parent)
{
while ((found = select_parent(parent, &dispose)) != 0)
shrink_dentry_list(&dispose);
}
select_parent() populates the dispose list with dentries which
shrink_dentry_list() then deletes. select_parent() carefully uses
need_resched() to avoid doing too much work at once. But neither
shrink_dcache_parent() nor its called functions call cond_resched(). So
once need_resched() is set select_parent() will return single dentry
dispose list which is then deleted by shrink_dentry_list(). This is
inefficient when there are a lot of dentry to process. This can cause
softlockup and hurts interactivity on non preemptable kernels.
This change adds cond_resched() in shrink_dcache_parent(). The benefit
of this is that need_resched() is quickly cleared so that future calls
to select_parent() are able to efficiently return a big batch of dentry.
These additional cond_resched() do not seem to impact performance, at
least for the workload below.
Here is a program which can cause soft lockup if other system activity
sets need_resched().
int main()
{
struct rlimit rlim;
int i;
int f[100000];
char buf[20];
struct timeval t1, t2;
double diff;
/* cleanup past run */
system("rm -rf x");
/* boost nfile rlimit */
rlim.rlim_cur = 200000;
rlim.rlim_max = 200000;
if (setrlimit(RLIMIT_NOFILE, &rlim))
err(1, "setrlimit");
/* make directory for files */
if (mkdir("x", 0700))
err(1, "mkdir");
if (gettimeofday(&t1, NULL))
err(1, "gettimeofday");
/* populate directory with open files */
for (i = 0; i < 100000; i++) {
snprintf(buf, sizeof(buf), "x/%d", i);
f[i] = open(buf, O_CREAT);
if (f[i] == -1)
err(1, "open");
}
/* close some of the files */
for (i = 0; i < 85000; i++)
close(f[i]);
/* unlink all files, even open ones */
system("rm -rf x");
if (gettimeofday(&t2, NULL))
err(1, "gettimeofday");
diff = (((double)t2.tv_sec * 1000000 + t2.tv_usec) -
((double)t1.tv_sec * 1000000 + t1.tv_usec));
printf("done: %g elapsed\n", diff/1e6);
return 0;
}
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1230,8 +1230,10 @@ void shrink_dcache_parent(struct dentry
LIST_HEAD(dispose);
int found;
- while ((found = select_parent(parent, &dispose)) != 0)
+ while ((found = select_parent(parent, &dispose)) != 0) {
shrink_dentry_list(&dispose);
+ cond_resched();
+ }
}
EXPORT_SYMBOL(shrink_dcache_parent);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 085/115] exec: do not abuse ->cred_guard_mutex in threadgroup_lock()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2013-05-06 20:45 ` [ 084/115] fs/dcache.c: add cond_resched() to shrink_dcache_parent() Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 086/115] LOCKD: Ensure that nlmclnt_block resets block->b_status after a server reboot Greg Kroah-Hartman
` (30 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jones, Tejun Heo, Li Zefan,
Oleg Nesterov, Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit e56fb2874015370e3b7f8d85051f6dce26051df9 upstream.
threadgroup_lock() takes signal->cred_guard_mutex to ensure that
thread_group_leader() is stable. This doesn't look nice, the scope of
this lock in do_execve() is huge.
And as Dave pointed out this can lead to deadlock, we have the
following dependencies:
do_execve: cred_guard_mutex -> i_mutex
cgroup_mount: i_mutex -> cgroup_mutex
attach_task_by_pid: cgroup_mutex -> cred_guard_mutex
Change de_thread() to take threadgroup_change_begin() around the
switch-the-leader code and change threadgroup_lock() to avoid
->cred_guard_mutex.
Note that de_thread() can't sleep with ->group_rwsem held, this can
obviously deadlock with the exiting leader if the writer is active, so it
does threadgroup_change_end() before schedule().
Reported-by: Dave Jones <davej@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exec.c | 3 +++
include/linux/sched.h | 18 ++++--------------
2 files changed, 7 insertions(+), 14 deletions(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -898,11 +898,13 @@ static int de_thread(struct task_struct
sig->notify_count = -1; /* for exit_notify() */
for (;;) {
+ threadgroup_change_begin(tsk);
write_lock_irq(&tasklist_lock);
if (likely(leader->exit_state))
break;
__set_current_state(TASK_KILLABLE);
write_unlock_irq(&tasklist_lock);
+ threadgroup_change_end(tsk);
schedule();
if (unlikely(__fatal_signal_pending(tsk)))
goto killed;
@@ -960,6 +962,7 @@ static int de_thread(struct task_struct
if (unlikely(leader->ptrace))
__wake_up_parent(leader, leader->parent);
write_unlock_irq(&tasklist_lock);
+ threadgroup_change_end(tsk);
release_task(leader);
}
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2413,27 +2413,18 @@ static inline void threadgroup_change_en
*
* Lock the threadgroup @tsk belongs to. No new task is allowed to enter
* and member tasks aren't allowed to exit (as indicated by PF_EXITING) or
- * perform exec. This is useful for cases where the threadgroup needs to
- * stay stable across blockable operations.
+ * change ->group_leader/pid. This is useful for cases where the threadgroup
+ * needs to stay stable across blockable operations.
*
* fork and exit paths explicitly call threadgroup_change_{begin|end}() for
* synchronization. While held, no new task will be added to threadgroup
* and no existing live task will have its PF_EXITING set.
*
- * During exec, a task goes and puts its thread group through unusual
- * changes. After de-threading, exclusive access is assumed to resources
- * which are usually shared by tasks in the same group - e.g. sighand may
- * be replaced with a new one. Also, the exec'ing task takes over group
- * leader role including its pid. Exclude these changes while locked by
- * grabbing cred_guard_mutex which is used to synchronize exec path.
+ * de_thread() does threadgroup_change_{begin|end}() when a non-leader
+ * sub-thread becomes a new leader.
*/
static inline void threadgroup_lock(struct task_struct *tsk)
{
- /*
- * exec uses exit for de-threading nesting group_rwsem inside
- * cred_guard_mutex. Grab cred_guard_mutex first.
- */
- mutex_lock(&tsk->signal->cred_guard_mutex);
down_write(&tsk->signal->group_rwsem);
}
@@ -2446,7 +2437,6 @@ static inline void threadgroup_lock(stru
static inline void threadgroup_unlock(struct task_struct *tsk)
{
up_write(&tsk->signal->group_rwsem);
- mutex_unlock(&tsk->signal->cred_guard_mutex);
}
#else
static inline void threadgroup_change_begin(struct task_struct *tsk) {}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 086/115] LOCKD: Ensure that nlmclnt_block resets block->b_status after a server reboot
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2013-05-06 20:45 ` [ 085/115] exec: do not abuse ->cred_guard_mutex in threadgroup_lock() Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 087/115] md: bad block list should default to disabled Greg Kroah-Hartman
` (29 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Eshel, Trond Myklebust
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit 1dfd89af8697a299e7982ae740d4695ecd917eef upstream.
After a server reboot, the reclaimer thread will recover all the existing
locks. For locks that are blocked, however, it will change the value
of block->b_status to nlm_lck_denied_grace_period in order to signal that
they need to wake up and resend the original blocking lock request.
Due to a bug, however, the block->b_status never gets reset after the
blocked locks have been woken up, and so the process goes into an
infinite loop of resends until the blocked lock is satisfied.
Reported-by: Marc Eshel <eshel@us.ibm.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/clntlock.c | 3 +++
fs/lockd/clntproc.c | 3 ---
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -144,6 +144,9 @@ int nlmclnt_block(struct nlm_wait *block
timeout);
if (ret < 0)
return -ERESTARTSYS;
+ /* Reset the lock status after a server reboot so we resend */
+ if (block->b_status == nlm_lck_denied_grace_period)
+ block->b_status = nlm_lck_blocked;
req->a_res.status = block->b_status;
return 0;
}
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -550,9 +550,6 @@ again:
status = nlmclnt_block(block, req, NLMCLNT_POLL_TIMEOUT);
if (status < 0)
break;
- /* Resend the blocking lock request after a server reboot */
- if (resp->status == nlm_lck_denied_grace_period)
- continue;
if (resp->status != nlm_lck_blocked)
break;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 087/115] md: bad block list should default to disabled.
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2013-05-06 20:45 ` [ 086/115] LOCKD: Ensure that nlmclnt_block resets block->b_status after a server reboot Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 088/115] MD: ignore discard request for hard disks of hybid raid1/raid10 array Greg Kroah-Hartman
` (28 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jonathan Brassow, NeilBrown
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 486adf72ccc0c235754923d47a2270c5dcb0c98b upstream.
Maintenance of a bad-block-list currently defaults to 'enabled'
and is then disabled when it cannot be supported.
This is backwards and causes problem for dm-raid which didn't know
to disable it.
So fix the defaults, and only enabled for v1.x metadata which
explicitly has bad blocks enabled.
The problem with dm-raid has been present since badblock support was
added in v3.1, so this patch is suitable for any -stable from 3.1
onwards.
Reported-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1564,8 +1564,8 @@ static int super_1_load(struct md_rdev *
sector, count, 1) == 0)
return -EINVAL;
}
- } else if (sb->bblog_offset == 0)
- rdev->badblocks.shift = -1;
+ } else if (sb->bblog_offset != 0)
+ rdev->badblocks.shift = 0;
if (!refdev) {
ret = 1;
@@ -3221,7 +3221,7 @@ int md_rdev_init(struct md_rdev *rdev)
* be used - I wonder if that matters
*/
rdev->badblocks.count = 0;
- rdev->badblocks.shift = 0;
+ rdev->badblocks.shift = -1; /* disabled until explicitly enabled */
rdev->badblocks.page = kmalloc(PAGE_SIZE, GFP_KERNEL);
seqlock_init(&rdev->badblocks.lock);
if (rdev->badblocks.page == NULL)
@@ -3293,9 +3293,6 @@ static struct md_rdev *md_import_device(
goto abort_free;
}
}
- if (super_format == -1)
- /* hot-add for 0.90, or non-persistent: so no badblocks */
- rdev->badblocks.shift = -1;
return rdev;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 088/115] MD: ignore discard request for hard disks of hybid raid1/raid10 array
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2013-05-06 20:45 ` [ 087/115] md: bad block list should default to disabled Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 089/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_lock_delegation_recall Greg Kroah-Hartman
` (27 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shaohua Li, NeilBrown
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <shli@kernel.org>
commit 32f9f570d04461a41bdcd5c1d93b41ebc5ce182a upstream.
In SSD/hard disk hybid storage, discard request should be ignored for hard
disk. We used to be doing this way, but the unplug path forgets it.
This is suitable for stable tree since v3.6.
Reported-and-tested-by: Markus <M4rkusXXL@web.de>
Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1.c | 7 ++++++-
drivers/md/raid10.c | 7 ++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -981,7 +981,12 @@ static void raid1_unplug(struct blk_plug
while (bio) { /* submit pending writes */
struct bio *next = bio->bi_next;
bio->bi_next = NULL;
- generic_make_request(bio);
+ if (unlikely((bio->bi_rw & REQ_DISCARD) &&
+ !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
+ /* Just ignore it */
+ bio_endio(bio, 0);
+ else
+ generic_make_request(bio);
bio = next;
}
kfree(plug);
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1133,7 +1133,12 @@ static void raid10_unplug(struct blk_plu
while (bio) { /* submit pending writes */
struct bio *next = bio->bi_next;
bio->bi_next = NULL;
- generic_make_request(bio);
+ if (unlikely((bio->bi_rw & REQ_DISCARD) &&
+ !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
+ /* Just ignore it */
+ bio_endio(bio, 0);
+ else
+ generic_make_request(bio);
bio = next;
}
kfree(plug);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 089/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_lock_delegation_recall
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2013-05-06 20:45 ` [ 088/115] MD: ignore discard request for hard disks of hybid raid1/raid10 array Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 090/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall Greg Kroah-Hartman
` (26 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit dbb21c25a35a71baf413f5176f028ee11b88cfbc upstream.
A server shouldn't normally return NFS4ERR_GRACE if the client holds a
delegation, since no conflicting lock reclaims can be granted, however
the spec does not require the server to grant the lock in this
instance.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5025,6 +5025,12 @@ int nfs4_lock_delegation_recall(struct n
nfs4_schedule_stateid_recovery(server, state);
err = 0;
goto out;
+ case -NFS4ERR_DELAY:
+ case -NFS4ERR_GRACE:
+ set_bit(NFS_DELEGATED_STATE, &state->flags);
+ ssleep(1);
+ err = -EAGAIN;
+ goto out;
case -ENOMEM:
case -NFS4ERR_DENIED:
/* kill_proc(fl->fl_pid, SIGLOST, 1); */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 090/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2013-05-06 20:45 ` [ 089/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_lock_delegation_recall Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 091/115] nfsd4: dont close read-write opens too soon Greg Kroah-Hartman
` (25 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit 8b6cc4d6f841d31f72fe7478453759166d366274 upstream.
A server shouldn't normally return NFS4ERR_GRACE if the client holds a
delegation, since no conflicting lock reclaims can be granted, however
the spec does not require the server to grant the open in this
instance
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1380,6 +1380,12 @@ int nfs4_open_delegation_recall(struct n
case -ENOMEM:
err = 0;
goto out;
+ case -NFS4ERR_DELAY:
+ case -NFS4ERR_GRACE:
+ set_bit(NFS_DELEGATED_STATE, &state->flags);
+ ssleep(1);
+ err = -EAGAIN;
+ goto out;
}
set_bit(NFS_DELEGATED_STATE, &state->flags);
err = nfs4_handle_exception(server, err, &exception);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 091/115] nfsd4: dont close read-write opens too soon
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2013-05-06 20:45 ` [ 090/115] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 092/115] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error Greg Kroah-Hartman
` (24 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Toralf Förster, J. Bruce Fields
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 0c7c3e67ab91ec6caa44bdf1fc89a48012ceb0c5 upstream.
Don't actually close any opens until we don't need them at all.
This means being left with write access when it's not really necessary,
but that's better than putting a file that might still have posix locks
held on it, as we have been.
Reported-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -210,13 +210,7 @@ static void __nfs4_file_put_access(struc
{
if (atomic_dec_and_test(&fp->fi_access[oflag])) {
nfs4_file_put_fd(fp, oflag);
- /*
- * It's also safe to get rid of the RDWR open *if*
- * we no longer have need of the other kind of access
- * or if we already have the other kind of open:
- */
- if (fp->fi_fds[1-oflag]
- || atomic_read(&fp->fi_access[1 - oflag]) == 0)
+ if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
nfs4_file_put_fd(fp, O_RDWR);
}
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 092/115] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2013-05-06 20:45 ` [ 091/115] nfsd4: dont close read-write opens too soon Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 093/115] nfsd: use kmem_cache_free() instead of kfree() Greg Kroah-Hartman
` (23 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, fanchaoting, J. Bruce Fields
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: fanchaoting <fanchaoting@cn.fujitsu.com>
commit b022032e195ffca83d7002d6b84297d796ed443b upstream.
we should return error status directly when nfs4_preprocess_stateid_op
return error.
Signed-off-by: fanchaoting <fanchaoting@cn.fujitsu.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -931,14 +931,14 @@ nfsd4_write(struct svc_rqst *rqstp, stru
nfs4_lock_state();
status = nfs4_preprocess_stateid_op(SVC_NET(rqstp),
cstate, stateid, WR_STATE, &filp);
- if (filp)
- get_file(filp);
- nfs4_unlock_state();
-
if (status) {
+ nfs4_unlock_state();
dprintk("NFSD: nfsd4_write: couldn't process stateid!\n");
return status;
}
+ if (filp)
+ get_file(filp);
+ nfs4_unlock_state();
cnt = write->wr_buflen;
write->wr_how_written = write->wr_stable_how;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 093/115] nfsd: use kmem_cache_free() instead of kfree()
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2013-05-06 20:45 ` [ 092/115] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 094/115] nfsd: Decode and send 64bit time values Greg Kroah-Hartman
` (22 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wei Yongjun, J. Bruce Fields
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
commit 2c44a23471d048118e49b616d08df0729cdbd9f1 upstream.
memory allocated by kmem_cache_alloc() should be freed using
kmem_cache_free(), not kfree().
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -261,7 +261,7 @@ kmem_cache *slab)
min_stateid = 0;
return stid;
out_free:
- kfree(stid);
+ kmem_cache_free(slab, stid);
return NULL;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 094/115] nfsd: Decode and send 64bit time values
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2013-05-06 20:45 ` [ 093/115] nfsd: use kmem_cache_free() instead of kfree() Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 095/115] wireless: regulatory: fix channel disabling race condition Greg Kroah-Hartman
` (21 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bryan Schumaker, J. Bruce Fields
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan Schumaker <bjschuma@netapp.com>
commit bf8d909705e9d9bac31d9b8eac6734d2b51332a7 upstream.
The seconds field of an nfstime4 structure is 64bit, but we are assuming
that the first 32bits are zero-filled. So if the client tries to set
atime to a value before the epoch (touch -t 196001010101), then the
server will save the wrong value on disk.
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 19 +++++--------------
1 file changed, 5 insertions(+), 14 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -344,10 +344,7 @@ nfsd4_decode_fattr(struct nfsd4_compound
all 32 bits of 'nseconds'. */
READ_BUF(12);
len += 12;
- READ32(dummy32);
- if (dummy32)
- return nfserr_inval;
- READ32(iattr->ia_atime.tv_sec);
+ READ64(iattr->ia_atime.tv_sec);
READ32(iattr->ia_atime.tv_nsec);
if (iattr->ia_atime.tv_nsec >= (u32)1000000000)
return nfserr_inval;
@@ -370,10 +367,7 @@ nfsd4_decode_fattr(struct nfsd4_compound
all 32 bits of 'nseconds'. */
READ_BUF(12);
len += 12;
- READ32(dummy32);
- if (dummy32)
- return nfserr_inval;
- READ32(iattr->ia_mtime.tv_sec);
+ READ64(iattr->ia_mtime.tv_sec);
READ32(iattr->ia_mtime.tv_nsec);
if (iattr->ia_mtime.tv_nsec >= (u32)1000000000)
return nfserr_inval;
@@ -2401,8 +2395,7 @@ out_acl:
if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
if ((buflen -= 12) < 0)
goto out_resource;
- WRITE32(0);
- WRITE32(stat.atime.tv_sec);
+ WRITE64((s64)stat.atime.tv_sec);
WRITE32(stat.atime.tv_nsec);
}
if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
@@ -2415,15 +2408,13 @@ out_acl:
if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
if ((buflen -= 12) < 0)
goto out_resource;
- WRITE32(0);
- WRITE32(stat.ctime.tv_sec);
+ WRITE64((s64)stat.ctime.tv_sec);
WRITE32(stat.ctime.tv_nsec);
}
if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
if ((buflen -= 12) < 0)
goto out_resource;
- WRITE32(0);
- WRITE32(stat.mtime.tv_sec);
+ WRITE64((s64)stat.mtime.tv_sec);
WRITE32(stat.mtime.tv_nsec);
}
if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 095/115] wireless: regulatory: fix channel disabling race condition
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2013-05-06 20:45 ` [ 094/115] nfsd: Decode and send 64bit time values Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 096/115] ipc: sysv shared memory limited to 8TiB Greg Kroah-Hartman
` (20 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 990de49f74e772b6db5208457b7aa712a5f4db86 upstream.
When a full scan 2.4 and 5 GHz scan is scheduled, but then the 2.4 GHz
part of the scan disables a 5.2 GHz channel due to, e.g. receiving
country or frequency information, that 5.2 GHz channel might already
be in the list of channels to scan next. Then, when the driver checks
if it should do a passive scan, that will return false and attempt an
active scan. This is not only wrong but can also lead to the iwlwifi
device firmware crashing since it checks regulatory as well.
Fix this by not setting the channel flags to just disabled but rather
OR'ing in the disabled flag. That way, even if the race happens, the
channel will be scanned passively which is still (mostly) correct.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/reg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -855,7 +855,7 @@ static void handle_channel(struct wiphy
return;
REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
- chan->flags = IEEE80211_CHAN_DISABLED;
+ chan->flags |= IEEE80211_CHAN_DISABLED;
return;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 096/115] ipc: sysv shared memory limited to 8TiB
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2013-05-06 20:45 ` [ 095/115] wireless: regulatory: fix channel disabling race condition Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 097/115] ixgbe: fix EICR write in ixgbe_msix_other Greg Kroah-Hartman
` (19 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin Holt, Alex Thorlton,
Andrew Morton, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Holt <holt@sgi.com>
commit d69f3bad4675ac519d41ca2b11e1c00ca115cecd upstream.
Trying to run an application which was trying to put data into half of
memory using shmget(), we found that having a shmall value below 8EiB-8TiB
would prevent us from using anything more than 8TiB. By setting
kernel.shmall greater than 8EiB-8TiB would make the job work.
In the newseg() function, ns->shm_tot which, at 8TiB is INT_MAX.
ipc/shm.c:
458 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
459 {
...
465 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
...
474 if (ns->shm_tot + numpages > ns->shm_ctlall)
475 return -ENOSPC;
[akpm@linux-foundation.org: make ipc/shm.c:newseg()'s numpages size_t, not int]
Signed-off-by: Robin Holt <holt@sgi.com>
Reported-by: Alex Thorlton <athorlton@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ipc_namespace.h | 2 +-
ipc/shm.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -43,8 +43,8 @@ struct ipc_namespace {
size_t shm_ctlmax;
size_t shm_ctlall;
+ unsigned long shm_tot;
int shm_ctlmni;
- int shm_tot;
/*
* Defines whether IPC_RMID is forced for _all_ shm segments regardless
* of shmctl()
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -462,7 +462,7 @@ static int newseg(struct ipc_namespace *
size_t size = params->u.size;
int error;
struct shmid_kernel *shp;
- int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
+ size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
struct file * file;
char name[13];
int id;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 097/115] ixgbe: fix EICR write in ixgbe_msix_other
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2013-05-06 20:45 ` [ 096/115] ipc: sysv shared memory limited to 8TiB Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 098/115] e1000e: fix numeric overflow in phc settime method Greg Kroah-Hartman
` (18 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jacob Keller, Phil Schmitt,
Jeff Kirsher
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <jacob.e.keller@intel.com>
commit d87d830720a1446403ed38bfc2da268be0d356d1 upstream.
Previously, the ixgbe_msix_other was writing the full 32bits of the set
interrupts, instead of only the ones which the ixgbe_msix_other is
handling. This resulted in a loss of performance when the X540's PPS feature is
enabled due to sometimes clearing queue interrupts which resulted in the driver
not getting the interrupt for cleaning the q_vector rings often enough. The fix
is to simply mask the lower 16bits off so that this handler does not write them
in the EICR, which causes them to remain high and be properly handled by the
clean_rings interrupt routine as normal.
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2405,6 +2405,16 @@ static irqreturn_t ixgbe_msix_other(int
* with the write to EICR.
*/
eicr = IXGBE_READ_REG(hw, IXGBE_EICS);
+
+ /* The lower 16bits of the EICR register are for the queue interrupts
+ * which should be masked here in order to not accidently clear them if
+ * the bits are high when ixgbe_msix_other is called. There is a race
+ * condition otherwise which results in possible performance loss
+ * especially if the ixgbe_msix_other interrupt is triggering
+ * consistently (as it would when PPS is turned on for the X540 device)
+ */
+ eicr &= 0xFFFF0000;
+
IXGBE_WRITE_REG(hw, IXGBE_EICR, eicr);
if (eicr & IXGBE_EICR_LSC)
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 098/115] e1000e: fix numeric overflow in phc settime method
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2013-05-06 20:45 ` [ 097/115] ixgbe: fix EICR write in ixgbe_msix_other Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 099/115] x86-64, init: Do not set NX bits on non-NX capable hardware Greg Kroah-Hartman
` (17 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Cochran, Aaron Brown,
Jeff Kirsher
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <richardcochran@gmail.com>
commit 73e3dd6b45c4c870fc2641eb04c24e3f12dab1e0 upstream.
The PTP Hardware Clock settime function in the e1000e driver
computes nanoseconds from a struct timespec. The code converts the
seconds field .tv_sec by multiplying it with NSEC_PER_SEC. However,
both operands are of type long, resulting in an unintended overflow.
The patch fixes the issue by using the helper function from time.h.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/ptp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/ptp.c
+++ b/drivers/net/ethernet/intel/e1000e/ptp.c
@@ -145,8 +145,7 @@ static int e1000e_phc_settime(struct ptp
unsigned long flags;
u64 ns;
- ns = ts->tv_sec * NSEC_PER_SEC;
- ns += ts->tv_nsec;
+ ns = timespec_to_ns(ts);
/* reset the timecounter */
spin_lock_irqsave(&adapter->systim_lock, flags);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 099/115] x86-64, init: Do not set NX bits on non-NX capable hardware
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2013-05-06 20:45 ` [ 098/115] e1000e: fix numeric overflow in phc settime method Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 100/115] ext4/jbd2: dont wait (forever) for stale tid caused by wraparound Greg Kroah-Hartman
` (16 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fernando Luis Vázquez Cao,
H. Peter Anvin
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit 78d77df71510a96e042de7ba6dbd7998103642cb upstream.
During early init, we would incorrectly set the NX bit even if the NX
feature was not supported. Instead, only set this bit if NX is
actually available and enabled. We already do very early detection of
the NX bit to enable it in EFER, this simply extends this detection to
the early page table mask.
Reported-by: Fernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1367476850.5660.2.camel@nexus
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/head64.c | 3 ++-
arch/x86/kernel/head_64.S | 1 +
2 files changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -34,6 +34,7 @@
extern pgd_t early_level4_pgt[PTRS_PER_PGD];
extern pmd_t early_dynamic_pgts[EARLY_DYNAMIC_PAGE_TABLES][PTRS_PER_PMD];
static unsigned int __initdata next_early_pgt = 2;
+pmdval_t __initdata early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
/* Wipe all early page tables except for the kernel symbol map */
static void __init reset_early_page_tables(void)
@@ -99,7 +100,7 @@ again:
pmd_p[i] = 0;
*pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
}
- pmd = (physaddr & PMD_MASK) + (__PAGE_KERNEL_LARGE & ~_PAGE_GLOBAL);
+ pmd = (physaddr & PMD_MASK) + early_pmd_flags;
pmd_p[pmd_index(address)] = pmd;
return 0;
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -200,6 +200,7 @@ ENTRY(secondary_startup_64)
btl $20,%edi /* No Execute supported? */
jnc 1f
btsl $_EFER_NX, %eax
+ btsq $_PAGE_BIT_NX,early_pmd_flags(%rip)
1: wrmsr /* Make changes effective */
/* Setup cr0 */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 100/115] ext4/jbd2: dont wait (forever) for stale tid caused by wraparound
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2013-05-06 20:45 ` [ 099/115] x86-64, init: Do not set NX bits on non-NX capable hardware Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 101/115] jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback Greg Kroah-Hartman
` (15 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Theodore Tso, Ben Hutchings,
George Barnett
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit d76a3a77113db020d9bb1e894822869410450bd9 upstream.
In the case where an inode has a very stale transaction id (tid) in
i_datasync_tid or i_sync_tid, it's possible that after a very large
(2**31) number of transactions, that the tid number space might wrap,
causing tid_geq()'s calculations to fail.
Commit deeeaf13 "jbd2: fix fsync() tid wraparound bug", later modified
by commit e7b04ac0 "jbd2: don't wake kjournald unnecessarily",
attempted to fix this problem, but it only avoided kjournald spinning
forever by fixing the logic in jbd2_log_start_commit().
Unfortunately, in the codepaths in fs/ext4/fsync.c and fs/ext4/inode.c
that might call jbd2_log_start_commit() with a stale tid, those
functions will subsequently call jbd2_log_wait_commit() with the same
stale tid, and then wait for a very long time. To fix this, we
replace the calls to jbd2_log_start_commit() and
jbd2_log_wait_commit() with a call to a new function,
jbd2_complete_transaction(), which will correctly handle stale tid's.
As a bonus, jbd2_complete_transaction() will avoid locking
j_state_lock for writing unless a commit needs to be started. This
should have a small (but probably not measurable) improvement for
ext4's scalability.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Reported-by: George Barnett <gbarnett@atlassian.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/fsync.c | 3 +--
fs/ext4/inode.c | 3 +--
fs/jbd2/journal.c | 31 +++++++++++++++++++++++++++++++
include/linux/jbd2.h | 1 +
4 files changed, 34 insertions(+), 4 deletions(-)
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -166,8 +166,7 @@ int ext4_sync_file(struct file *file, lo
if (journal->j_flags & JBD2_BARRIER &&
!jbd2_trans_will_send_data_barrier(journal, commit_tid))
needs_barrier = true;
- jbd2_log_start_commit(journal, commit_tid);
- ret = jbd2_log_wait_commit(journal, commit_tid);
+ ret = jbd2_complete_transaction(journal, commit_tid);
if (needs_barrier) {
err = blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL);
if (!ret)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -210,8 +210,7 @@ void ext4_evict_inode(struct inode *inod
journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
- jbd2_log_start_commit(journal, commit_tid);
- jbd2_log_wait_commit(journal, commit_tid);
+ jbd2_complete_transaction(journal, commit_tid);
filemap_write_and_wait(&inode->i_data);
}
truncate_inode_pages(&inode->i_data, 0);
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -710,6 +710,37 @@ int jbd2_log_wait_commit(journal_t *jour
}
/*
+ * When this function returns the transaction corresponding to tid
+ * will be completed. If the transaction has currently running, start
+ * committing that transaction before waiting for it to complete. If
+ * the transaction id is stale, it is by definition already completed,
+ * so just return SUCCESS.
+ */
+int jbd2_complete_transaction(journal_t *journal, tid_t tid)
+{
+ int need_to_wait = 1;
+
+ read_lock(&journal->j_state_lock);
+ if (journal->j_running_transaction &&
+ journal->j_running_transaction->t_tid == tid) {
+ if (journal->j_commit_request != tid) {
+ /* transaction not yet started, so request it */
+ read_unlock(&journal->j_state_lock);
+ jbd2_log_start_commit(journal, tid);
+ goto wait_commit;
+ }
+ } else if (!(journal->j_committing_transaction &&
+ journal->j_committing_transaction->t_tid == tid))
+ need_to_wait = 0;
+ read_unlock(&journal->j_state_lock);
+ if (!need_to_wait)
+ return 0;
+wait_commit:
+ return jbd2_log_wait_commit(journal, tid);
+}
+EXPORT_SYMBOL(jbd2_complete_transaction);
+
+/*
* Log buffer allocation routines:
*/
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1200,6 +1200,7 @@ int __jbd2_log_start_commit(journal_t *j
int jbd2_journal_start_commit(journal_t *journal, tid_t *tid);
int jbd2_journal_force_commit_nested(journal_t *journal);
int jbd2_log_wait_commit(journal_t *journal, tid_t tid);
+int jbd2_complete_transaction(journal_t *journal, tid_t tid);
int jbd2_log_do_checkpoint(journal_t *journal);
int jbd2_trans_will_send_data_barrier(journal_t *journal, tid_t tid);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 101/115] jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2013-05-06 20:45 ` [ 100/115] ext4/jbd2: dont wait (forever) for stale tid caused by wraparound Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 102/115] ext4: fix journal callback list traversal Greg Kroah-Hartman
` (14 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Monakhov, Theodore Tso
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit 794446c6946513c684d448205fbd76fa35f38b72 upstream.
The following race is possible:
[kjournald2] other_task
jbd2_journal_commit_transaction()
j_state = T_FINISHED;
spin_unlock(&journal->j_list_lock);
->jbd2_journal_remove_checkpoint()
->jbd2_journal_free_transaction();
->kmem_cache_free(transaction)
->j_commit_callback(journal, transaction);
-> USE_AFTER_FREE
WARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250()
Hardware name:
list_del corruption. prev->next should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod
Pid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107
Call Trace:
[<ffffffff8106fb0d>] warn_slowpath_common+0xad/0xf0
[<ffffffff8106fc06>] warn_slowpath_fmt+0x46/0x50
[<ffffffff813637e9>] ? ext4_journal_commit_callback+0x99/0xc0
[<ffffffff8148cae0>] __list_del_entry+0x1c0/0x250
[<ffffffff813637bf>] ext4_journal_commit_callback+0x6f/0xc0
[<ffffffff813ca336>] jbd2_journal_commit_transaction+0x23a6/0x2570
[<ffffffff8108aa42>] ? try_to_del_timer_sync+0x82/0xa0
[<ffffffff8108b491>] ? del_timer_sync+0x91/0x1e0
[<ffffffff813d3ecf>] kjournald2+0x19f/0x6a0
[<ffffffff810ad630>] ? wake_up_bit+0x40/0x40
[<ffffffff813d3d30>] ? bit_spin_lock+0x80/0x80
[<ffffffff810ac6be>] kthread+0x10e/0x120
[<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70
[<ffffffff818ff6ac>] ret_from_fork+0x7c/0xb0
[<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70
In order to demonstrace this issue one should mount ext4 with mount -o
discard option on SSD disk. This makes callback longer and race
window becomes wider.
In order to fix this we should mark transaction as finished only after
callbacks have completed
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/commit.c | 50 ++++++++++++++++++++++++++++----------------------
include/linux/jbd2.h | 1 +
2 files changed, 29 insertions(+), 22 deletions(-)
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -382,7 +382,7 @@ void jbd2_journal_commit_transaction(jou
int space_left = 0;
int first_tag = 0;
int tag_flag;
- int i, to_free = 0;
+ int i;
int tag_bytes = journal_tag_bytes(journal);
struct buffer_head *cbh = NULL; /* For transactional checksums */
__u32 crc32_sum = ~0;
@@ -1134,7 +1134,7 @@ restart_loop:
journal->j_stats.run.rs_blocks_logged += stats.run.rs_blocks_logged;
spin_unlock(&journal->j_history_lock);
- commit_transaction->t_state = T_FINISHED;
+ commit_transaction->t_state = T_COMMIT_CALLBACK;
J_ASSERT(commit_transaction == journal->j_committing_transaction);
journal->j_commit_sequence = commit_transaction->t_tid;
journal->j_committing_transaction = NULL;
@@ -1149,38 +1149,44 @@ restart_loop:
journal->j_average_commit_time*3) / 4;
else
journal->j_average_commit_time = commit_time;
+
write_unlock(&journal->j_state_lock);
- if (commit_transaction->t_checkpoint_list == NULL &&
- commit_transaction->t_checkpoint_io_list == NULL) {
- __jbd2_journal_drop_transaction(journal, commit_transaction);
- to_free = 1;
+ if (journal->j_checkpoint_transactions == NULL) {
+ journal->j_checkpoint_transactions = commit_transaction;
+ commit_transaction->t_cpnext = commit_transaction;
+ commit_transaction->t_cpprev = commit_transaction;
} else {
- if (journal->j_checkpoint_transactions == NULL) {
- journal->j_checkpoint_transactions = commit_transaction;
- commit_transaction->t_cpnext = commit_transaction;
- commit_transaction->t_cpprev = commit_transaction;
- } else {
- commit_transaction->t_cpnext =
- journal->j_checkpoint_transactions;
- commit_transaction->t_cpprev =
- commit_transaction->t_cpnext->t_cpprev;
- commit_transaction->t_cpnext->t_cpprev =
- commit_transaction;
- commit_transaction->t_cpprev->t_cpnext =
+ commit_transaction->t_cpnext =
+ journal->j_checkpoint_transactions;
+ commit_transaction->t_cpprev =
+ commit_transaction->t_cpnext->t_cpprev;
+ commit_transaction->t_cpnext->t_cpprev =
+ commit_transaction;
+ commit_transaction->t_cpprev->t_cpnext =
commit_transaction;
- }
}
spin_unlock(&journal->j_list_lock);
-
+ /* Drop all spin_locks because commit_callback may be block.
+ * __journal_remove_checkpoint() can not destroy transaction
+ * under us because it is not marked as T_FINISHED yet */
if (journal->j_commit_callback)
journal->j_commit_callback(journal, commit_transaction);
trace_jbd2_end_commit(journal, commit_transaction);
jbd_debug(1, "JBD2: commit %d complete, head %d\n",
journal->j_commit_sequence, journal->j_tail_sequence);
- if (to_free)
- jbd2_journal_free_transaction(commit_transaction);
+ write_lock(&journal->j_state_lock);
+ spin_lock(&journal->j_list_lock);
+ commit_transaction->t_state = T_FINISHED;
+ /* Recheck checkpoint lists after j_list_lock was dropped */
+ if (commit_transaction->t_checkpoint_list == NULL &&
+ commit_transaction->t_checkpoint_io_list == NULL) {
+ __jbd2_journal_drop_transaction(journal, commit_transaction);
+ jbd2_journal_free_transaction(commit_transaction);
+ }
+ spin_unlock(&journal->j_list_lock);
+ write_unlock(&journal->j_state_lock);
wake_up(&journal->j_wait_done_commit);
}
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -480,6 +480,7 @@ struct transaction_s
T_COMMIT,
T_COMMIT_DFLUSH,
T_COMMIT_JFLUSH,
+ T_COMMIT_CALLBACK,
T_FINISHED
} t_state;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 102/115] ext4: fix journal callback list traversal
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2013-05-06 20:45 ` [ 101/115] jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 103/115] ext4: unregister es_shrinker if mount failed Greg Kroah-Hartman
` (13 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Monakhov, Theodore Tso,
Jan Kara
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit 5d3ee20855e28169d711b394857ee608a5023094 upstream.
It is incorrect to use list_for_each_entry_safe() for journal callback
traversial because ->next may be removed by other task:
->ext4_mb_free_metadata()
->ext4_mb_free_metadata()
->ext4_journal_callback_del()
This results in the following issue:
WARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250()
Hardware name:
list_del corruption. prev->next should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod
Pid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107
Call Trace:
[<ffffffff8106fb0d>] warn_slowpath_common+0xad/0xf0
[<ffffffff8106fc06>] warn_slowpath_fmt+0x46/0x50
[<ffffffff813637e9>] ? ext4_journal_commit_callback+0x99/0xc0
[<ffffffff8148cae0>] __list_del_entry+0x1c0/0x250
[<ffffffff813637bf>] ext4_journal_commit_callback+0x6f/0xc0
[<ffffffff813ca336>] jbd2_journal_commit_transaction+0x23a6/0x2570
[<ffffffff8108aa42>] ? try_to_del_timer_sync+0x82/0xa0
[<ffffffff8108b491>] ? del_timer_sync+0x91/0x1e0
[<ffffffff813d3ecf>] kjournald2+0x19f/0x6a0
[<ffffffff810ad630>] ? wake_up_bit+0x40/0x40
[<ffffffff813d3d30>] ? bit_spin_lock+0x80/0x80
[<ffffffff810ac6be>] kthread+0x10e/0x120
[<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70
[<ffffffff818ff6ac>] ret_from_fork+0x7c/0xb0
[<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70
This patch fix the issue as follows:
- ext4_journal_commit_callback() make list truly traversial safe
simply by always starting from list_head
- fix race between two ext4_journal_callback_del() and
ext4_journal_callback_try_del()
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4_jbd2.h | 6 +++++-
fs/ext4/mballoc.c | 8 ++++----
fs/ext4/super.c | 7 +++++--
3 files changed, 14 insertions(+), 7 deletions(-)
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -194,16 +194,20 @@ static inline void ext4_journal_callback
* ext4_journal_callback_del: delete a registered callback
* @handle: active journal transaction handle on which callback was registered
* @jce: registered journal callback entry to unregister
+ * Return true if object was sucessfully removed
*/
-static inline void ext4_journal_callback_del(handle_t *handle,
+static inline bool ext4_journal_callback_try_del(handle_t *handle,
struct ext4_journal_cb_entry *jce)
{
+ bool deleted;
struct ext4_sb_info *sbi =
EXT4_SB(handle->h_transaction->t_journal->j_private);
spin_lock(&sbi->s_md_lock);
+ deleted = !list_empty(&jce->jce_list);
list_del_init(&jce->jce_list);
spin_unlock(&sbi->s_md_lock);
+ return deleted;
}
int
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4420,11 +4420,11 @@ ext4_mb_free_metadata(handle_t *handle,
node = rb_prev(new_node);
if (node) {
entry = rb_entry(node, struct ext4_free_data, efd_node);
- if (can_merge(entry, new_entry)) {
+ if (can_merge(entry, new_entry) &&
+ ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
new_entry->efd_start_cluster = entry->efd_start_cluster;
new_entry->efd_count += entry->efd_count;
rb_erase(node, &(db->bb_free_root));
- ext4_journal_callback_del(handle, &entry->efd_jce);
kmem_cache_free(ext4_free_data_cachep, entry);
}
}
@@ -4432,10 +4432,10 @@ ext4_mb_free_metadata(handle_t *handle,
node = rb_next(new_node);
if (node) {
entry = rb_entry(node, struct ext4_free_data, efd_node);
- if (can_merge(new_entry, entry)) {
+ if (can_merge(new_entry, entry) &&
+ ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
new_entry->efd_count += entry->efd_count;
rb_erase(node, &(db->bb_free_root));
- ext4_journal_callback_del(handle, &entry->efd_jce);
kmem_cache_free(ext4_free_data_cachep, entry);
}
}
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -353,10 +353,13 @@ static void ext4_journal_commit_callback
struct super_block *sb = journal->j_private;
struct ext4_sb_info *sbi = EXT4_SB(sb);
int error = is_journal_aborted(journal);
- struct ext4_journal_cb_entry *jce, *tmp;
+ struct ext4_journal_cb_entry *jce;
+ BUG_ON(txn->t_state == T_FINISHED);
spin_lock(&sbi->s_md_lock);
- list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) {
+ while (!list_empty(&txn->t_private_list)) {
+ jce = list_entry(txn->t_private_list.next,
+ struct ext4_journal_cb_entry, jce_list);
list_del_init(&jce->jce_list);
spin_unlock(&sbi->s_md_lock);
jce->jce_func(sb, jce, error);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 103/115] ext4: unregister es_shrinker if mount failed
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2013-05-06 20:45 ` [ 102/115] ext4: fix journal callback list traversal Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 104/115] ext4: fix big-endian bug in metadata checksum calculations Greg Kroah-Hartman
` (12 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Monakhov, Theodore Tso
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit a75ae78f087f933ab3432e98bb4dbbf2196cf6d5 upstream.
Otherwise destroyed ext_sb_info will be part of global shinker list
and result in the following OOPS:
JBD2: corrupted journal superblock
JBD2: recovery failed
EXT4-fs (dm-2): error loading journal
general protection fault: 0000 [#1] SMP
Modules linked in: fuse acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel microcode sg button sd_mod crc_t10dif ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_\
mod
CPU 1
Pid: 2758, comm: mount Not tainted 3.8.0-rc3+ #136 /DH55TC
RIP: 0010:[<ffffffff811bfb2d>] [<ffffffff811bfb2d>] unregister_shrinker+0xad/0xe0
RSP: 0000:ffff88011d5cbcd8 EFLAGS: 00010207
RAX: 6b6b6b6b6b6b6b6b RBX: 6b6b6b6b6b6b6b53 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000246
RBP: ffff88011d5cbce8 R08: 0000000000000002 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88011cd3f848
R13: ffff88011cd3f830 R14: ffff88011cd3f000 R15: 0000000000000000
FS: 00007f7b721dd7e0(0000) GS:ffff880121a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fffa6f75038 CR3: 000000011bc1c000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process mount (pid: 2758, threadinfo ffff88011d5ca000, task ffff880116aacb80)
Stack:
ffff88011cd3f000 ffffffff8209b6c0 ffff88011d5cbd18 ffffffff812482f1
00000000000003f3 00000000ffffffea ffff880115f4c200 0000000000000000
ffff88011d5cbda8 ffffffff81249381 ffff8801219d8bf8 ffffffff00000000
Call Trace:
[<ffffffff812482f1>] deactivate_locked_super+0x91/0xb0
[<ffffffff81249381>] mount_bdev+0x331/0x340
[<ffffffff81376730>] ? ext4_alloc_flex_bg_array+0x180/0x180
[<ffffffff81362035>] ext4_mount+0x15/0x20
[<ffffffff8124869a>] mount_fs+0x9a/0x2e0
[<ffffffff81277e25>] vfs_kern_mount+0xc5/0x170
[<ffffffff81279c02>] do_new_mount+0x172/0x2e0
[<ffffffff8127aa56>] do_mount+0x376/0x380
[<ffffffff8127ab98>] sys_mount+0x138/0x150
[<ffffffff818ffed9>] system_call_fastpath+0x16/0x1b
Code: 8b 05 88 04 eb 00 48 3d 90 ff 06 82 48 8d 58 e8 75 19 4c 89 e7 e8 e4 d7 2c 00 48 c7 c7 00 ff 06 82 e8 58 5f ef ff 5b 41 5c c9 c3 <48> 8b 4b 18 48 8b 73 20 48 89 da 31 c0 48 c7 c7 c5 a0 e4 81 e\
8
RIP [<ffffffff811bfb2d>] unregister_shrinker+0xad/0xe0
RSP <ffff88011d5cbcd8>
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3701,6 +3701,9 @@ static int ext4_fill_super(struct super_
sbi->s_err_report.function = print_daily_error_info;
sbi->s_err_report.data = (unsigned long) sb;
+ /* Register extent status tree shrinker */
+ ext4_es_register_shrinker(sb);
+
err = percpu_counter_init(&sbi->s_freeclusters_counter,
ext4_count_free_clusters(sb));
if (!err) {
@@ -3726,9 +3729,6 @@ static int ext4_fill_super(struct super_
sbi->s_max_writeback_mb_bump = 128;
sbi->s_extent_max_zeroout_kb = 32;
- /* Register extent status tree shrinker */
- ext4_es_register_shrinker(sb);
-
/*
* set up enough so that it can read an inode
*/
@@ -4013,6 +4013,7 @@ failed_mount_wq:
sbi->s_journal = NULL;
}
failed_mount3:
+ ext4_es_unregister_shrinker(sb);
del_timer(&sbi->s_err_report);
if (sbi->s_flex_groups)
ext4_kvfree(sbi->s_flex_groups);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 104/115] ext4: fix big-endian bug in metadata checksum calculations
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2013-05-06 20:45 ` [ 103/115] ext4: unregister es_shrinker if mount failed Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 105/115] ext4: fix online resizing for ext3-compat file systems Greg Kroah-Hartman
` (11 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Monakhov, Theodore Tso
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit 171a7f21a76a0958c225b97c00a97a10390d40ee upstream.
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 8 ++++----
fs/ext4/mmp.c | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -55,21 +55,21 @@ static __u32 ext4_inode_csum(struct inod
__u16 csum_hi = 0;
__u32 csum;
- csum_lo = raw->i_checksum_lo;
+ csum_lo = le16_to_cpu(raw->i_checksum_lo);
raw->i_checksum_lo = 0;
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
- csum_hi = raw->i_checksum_hi;
+ csum_hi = le16_to_cpu(raw->i_checksum_hi);
raw->i_checksum_hi = 0;
}
csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
EXT4_INODE_SIZE(inode->i_sb));
- raw->i_checksum_lo = csum_lo;
+ raw->i_checksum_lo = cpu_to_le16(csum_lo);
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
- raw->i_checksum_hi = csum_hi;
+ raw->i_checksum_hi = cpu_to_le16(csum_hi);
return csum;
}
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -7,7 +7,7 @@
#include "ext4.h"
/* Checksumming functions */
-static __u32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
+static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
int offset = offsetof(struct mmp_struct, mmp_checksum);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 105/115] ext4: fix online resizing for ext3-compat file systems
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2013-05-06 20:45 ` [ 104/115] ext4: fix big-endian bug in metadata checksum calculations Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 106/115] ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG Greg Kroah-Hartman
` (10 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Sandeen, Theodore Tso
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit c5c72d814cf0f650010337c73638b25e6d14d2d4 upstream.
Commit fb0a387dcdc restricts block allocations for indirect-mapped
files to block groups less than s_blockfile_groups. However, the
online resizing code wasn't setting s_blockfile_groups, so the newly
added block groups were not available for non-extent mapped files.
Reported-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/resize.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1341,6 +1341,8 @@ static void ext4_update_super(struct sup
/* Update the global fs size fields */
sbi->s_groups_count += flex_gd->count;
+ sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
+ (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
/* Update the reserved block counts only once the new group is
* active. */
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 106/115] ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2013-05-06 20:45 ` [ 105/115] ext4: fix online resizing for ext3-compat file systems Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 107/115] do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks") Greg Kroah-Hartman
` (9 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 7f3e3c7cfcec148ccca9c0dd2dbfd7b00b7ac10f upstream.
Fox the Kconfig documentation for CONFIG_EXT4_DEBUG to match the
change made by commit a0b30c1229: ext4: use module parameters instead
of debugfs for mballoc_debug
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -71,4 +71,5 @@ config EXT4_DEBUG
Enables run-time debugging support for the ext4 filesystem.
If you select Y here, then you will be able to turn on debugging
- with a command such as "echo 1 > /sys/kernel/debug/ext4/mballoc-debug"
+ with a command such as:
+ echo 1 > /sys/module/ext4/parameters/mballoc_debug
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 107/115] do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks")
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2013-05-06 20:45 ` [ 106/115] ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 108/115] mmc: at91/avr32/atmel-mci: fix DMA-channel leak on module unload Greg Kroah-Hartman
` (8 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 0d5cadb87e0fa764db7fa0b78d8a6f173cb475a1 upstream.
Bisected-by: Michael Leun <lkml20130126@newton.leun.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2238,12 +2238,11 @@ long do_mount(const char *dev_name, cons
retval = security_sb_mount(dev_name, &path,
type_page, flags, data_page);
+ if (!retval && !may_mount())
+ retval = -EPERM;
if (retval)
goto dput_out;
- if (!may_mount())
- return -EPERM;
-
/* Default to relatime unless overriden */
if (!(flags & MS_NOATIME))
mnt_flags |= MNT_RELATIME;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 108/115] mmc: at91/avr32/atmel-mci: fix DMA-channel leak on module unload
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2013-05-06 20:45 ` [ 107/115] do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks") Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 109/115] Give the OID registry file module info to avoid kernel tainting Greg Kroah-Hartman
` (7 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Ludovic Desroches,
Chris Ball
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 91cf54feecf815bec0b6a8d6d9dbd0e219f2f2cc upstream.
Fix regression introduced by commit 796211b7953 ("mmc: atmel-mci: add
pdc support and runtime capabilities detection") which removed the need
for CONFIG_MMC_ATMELMCI_DMA but kept the Kconfig-entry as well as the
compile guards around dma_release_channel() in remove(). Consequently,
DMA is always enabled (if supported), but the DMA-channel is not
released on module unload unless the DMA-config option is selected.
Remove the no longer used CONFIG_MMC_ATMELMCI_DMA option completely.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/at91sam9g45_defconfig | 1 -
arch/avr32/configs/favr-32_defconfig | 1 -
arch/avr32/configs/merisc_defconfig | 1 -
drivers/mmc/host/Kconfig | 10 ----------
drivers/mmc/host/atmel-mci.c | 2 --
5 files changed, 15 deletions(-)
--- a/arch/arm/configs/at91sam9g45_defconfig
+++ b/arch/arm/configs/at91sam9g45_defconfig
@@ -173,7 +173,6 @@ CONFIG_MMC=y
# CONFIG_MMC_BLOCK_BOUNCE is not set
CONFIG_SDIO_UART=m
CONFIG_MMC_ATMELMCI=y
-CONFIG_MMC_ATMELMCI_DMA=y
CONFIG_LEDS_ATMEL_PWM=y
CONFIG_LEDS_GPIO=y
CONFIG_LEDS_TRIGGER_TIMER=y
--- a/arch/avr32/configs/favr-32_defconfig
+++ b/arch/avr32/configs/favr-32_defconfig
@@ -122,7 +122,6 @@ CONFIG_USB_G_SERIAL=m
CONFIG_USB_CDC_COMPOSITE=m
CONFIG_MMC=y
CONFIG_MMC_ATMELMCI=y
-CONFIG_MMC_ATMELMCI_DMA=y
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
CONFIG_LEDS_ATMEL_PWM=m
--- a/arch/avr32/configs/merisc_defconfig
+++ b/arch/avr32/configs/merisc_defconfig
@@ -102,7 +102,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
CONFIG_LOGO=y
CONFIG_MMC=y
CONFIG_MMC_ATMELMCI=y
-CONFIG_MMC_ATMELMCI_DMA=y
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
CONFIG_LEDS_ATMEL_PWM=y
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -300,16 +300,6 @@ config MMC_ATMELMCI
If unsure, say N.
-config MMC_ATMELMCI_DMA
- bool "Atmel MCI DMA support"
- depends on MMC_ATMELMCI && (AVR32 || ARCH_AT91SAM9G45) && DMA_ENGINE
- help
- Say Y here to have the Atmel MCI driver use a DMA engine to
- do data transfers and thus increase the throughput and
- reduce the CPU utilization.
-
- If unsure, say N.
-
config MMC_MSM
tristate "Qualcomm SDCC Controller Support"
depends on MMC && ARCH_MSM
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -2487,10 +2487,8 @@ static int __exit atmci_remove(struct pl
atmci_readl(host, ATMCI_SR);
clk_disable(host->mck);
-#ifdef CONFIG_MMC_ATMELMCI_DMA
if (host->dma.chan)
dma_release_channel(host->dma.chan);
-#endif
free_irq(platform_get_irq(pdev, 0), host);
iounmap(host->regs);
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 109/115] Give the OID registry file module info to avoid kernel tainting
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2013-05-06 20:45 ` [ 108/115] mmc: at91/avr32/atmel-mci: fix DMA-channel leak on module unload Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 110/115] KVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions Greg Kroah-Hartman
` (6 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dros Adamson, David Howells,
Trond Myklebust, Linus Torvalds
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 9e6879460c8edb0cd3c24c09b83d06541b5af0dc upstream.
Give the OID registry file module information so that it doesn't taint the
kernel when compiled as a module and loaded.
Reported-by: Dros Adamson <Weston.Adamson@netapp.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/oid_registry.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/lib/oid_registry.c
+++ b/lib/oid_registry.c
@@ -9,6 +9,7 @@
* 2 of the Licence, or (at your option) any later version.
*/
+#include <linux/module.h>
#include <linux/export.h>
#include <linux/oid_registry.h>
#include <linux/kernel.h>
@@ -16,6 +17,10 @@
#include <linux/bug.h>
#include "oid_registry_data.c"
+MODULE_DESCRIPTION("OID Registry");
+MODULE_AUTHOR("Red Hat, Inc.");
+MODULE_LICENSE("GPL");
+
/**
* look_up_OID - Find an OID registration for the specified data
* @data: Binary representation of the OID
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 110/115] KVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2013-05-06 20:45 ` [ 109/115] Give the OID registry file module info to avoid kernel tainting Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 111/115] x86: Eliminate irq_mis_count counted in arch_irq_stat Greg Kroah-Hartman
` (5 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gleb Natapov
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Natapov <gleb@redhat.com>
commit 660696d1d16a71e15549ce1bf74953be1592bcd3 upstream.
Source operand for one byte mov[zs]x is decoded incorrectly if it is in
high byte register. Fix that.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/emulate.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4162,6 +4162,10 @@ static int decode_operand(struct x86_emu
break;
case OpMem8:
ctxt->memop.bytes = 1;
+ if (ctxt->memop.type == OP_REG) {
+ ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
+ fetch_register_operand(&ctxt->memop);
+ }
goto mem_common;
case OpMem16:
ctxt->memop.bytes = 2;
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 111/115] x86: Eliminate irq_mis_count counted in arch_irq_stat
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2013-05-06 20:45 ` [ 110/115] KVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 112/115] mmc: core: Fix bit width test failing on old eMMC cards Greg Kroah-Hartman
` (4 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liu Chuansheng, Li Fei, Ingo Molnar,
tomoki.sekiyama.qu, joe
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Fei <fei.li@intel.com>
commit f7b0e1055574ce06ab53391263b4e205bf38daf3 upstream.
With the current implementation, kstat_cpu(cpu).irqs_sum is also
increased in case of irq_mis_count increment.
So there is no need to count irq_mis_count in arch_irq_stat,
otherwise irq_mis_count will be counted twice in the sum of
/proc/stat.
Reported-by: Liu Chuansheng <chuansheng.liu@intel.com>
Signed-off-by: Li Fei <fei.li@intel.com>
Acked-by: Liu Chuansheng <chuansheng.liu@intel.com>
Cc: tomoki.sekiyama.qu@hitachi.com
Cc: joe@perches.com
Link: http://lkml.kernel.org/r/1366980611.32469.7.camel@fli24-HP-Compaq-8100-Elite-CMT-PC
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/irq.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -165,10 +165,6 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
u64 arch_irq_stat(void)
{
u64 sum = atomic_read(&irq_err_count);
-
-#ifdef CONFIG_X86_IO_APIC
- sum += atomic_read(&irq_mis_count);
-#endif
return sum;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 112/115] mmc: core: Fix bit width test failing on old eMMC cards
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2013-05-06 20:45 ` [ 111/115] x86: Eliminate irq_mis_count counted in arch_irq_stat Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 113/115] mmc: atmel-mci: pio hang on block errors Greg Kroah-Hartman
` (3 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Elad Yi, Philip Rakity, Chris Ball
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Rakity <prakity@yahoo.com>
commit 836dc2fe89c968c10cada87e0dfae6626f8f9da3 upstream.
PARTITION_SUPPORT needs to be set before doing the compare on version
number so the bit width test does not get invalid data. Before this
patch, a Sandisk iNAND eMMC card would detect 1-bit width although
the hardware supports 4-bit.
Only affects old emmc devices - pre 4.4 devices.
Reported-by: Elad Yi <elad.yi@gmail.com>
Signed-off-by: Philip Rakity <prakity@yahoo.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/mmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -368,13 +368,13 @@ static int mmc_read_ext_csd(struct mmc_c
ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT];
card->ext_csd.raw_trim_mult =
ext_csd[EXT_CSD_TRIM_MULT];
+ card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
if (card->ext_csd.rev >= 4) {
/*
* Enhanced area feature support -- check whether the eMMC
* card has the Enhanced area enabled. If so, export enhanced
* area offset and size to user by adding sysfs interface.
*/
- card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) &&
(ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
hc_erase_grp_sz =
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 113/115] mmc: atmel-mci: pio hang on block errors
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2013-05-06 20:45 ` [ 112/115] mmc: core: Fix bit width test failing on old eMMC cards Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 114/115] rcutrace: single_open() leaks Greg Kroah-Hartman
` (2 subsequent siblings)
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Terry Barnaby, Ludovic Desroches,
Chris Ball
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Barnaby <terry@beam.ltd.uk>
commit bdbc5d0c60f3e9de3eeccf1c1a18bdc11dca62cc upstream.
The driver is doing, by default, multi-block reads. When a block error
occurs, card/block.c instigates a single block read: "mmcblk0: retrying
using single block read". It leaves the sg chain intact and just changes
the length attribute for the first sg entry and the overall sg_len
parameter. When atmci_read_data_pio is called to read the single block
of data it ignores the sg_len and expects to read more than 512 bytes as
it sees there are multiple items in the sg list. No more data comes as
the controller has only been commanded to get one block.
Signed-off-by: Terry Barnaby <terry@beam.ltd.uk>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/atmel-mci.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -178,6 +178,7 @@ struct atmel_mci {
void __iomem *regs;
struct scatterlist *sg;
+ unsigned int sg_len;
unsigned int pio_offset;
unsigned int *buffer;
unsigned int buf_size;
@@ -892,6 +893,7 @@ static u32 atmci_prepare_data(struct atm
data->error = -EINPROGRESS;
host->sg = data->sg;
+ host->sg_len = data->sg_len;
host->data = data;
host->data_chan = NULL;
@@ -1826,7 +1828,8 @@ static void atmci_read_data_pio(struct a
if (offset == sg->length) {
flush_dcache_page(sg_page(sg));
host->sg = sg = sg_next(sg);
- if (!sg)
+ host->sg_len--;
+ if (!sg || !host->sg_len)
goto done;
offset = 0;
@@ -1839,7 +1842,8 @@ static void atmci_read_data_pio(struct a
flush_dcache_page(sg_page(sg));
host->sg = sg = sg_next(sg);
- if (!sg)
+ host->sg_len--;
+ if (!sg || !host->sg_len)
goto done;
offset = 4 - remaining;
@@ -1890,7 +1894,8 @@ static void atmci_write_data_pio(struct
nbytes += 4;
if (offset == sg->length) {
host->sg = sg = sg_next(sg);
- if (!sg)
+ host->sg_len--;
+ if (!sg || !host->sg_len)
goto done;
offset = 0;
@@ -1904,7 +1909,8 @@ static void atmci_write_data_pio(struct
nbytes += remaining;
host->sg = sg = sg_next(sg);
- if (!sg) {
+ host->sg_len--;
+ if (!sg || !host->sg_len) {
atmci_writel(host, ATMCI_TDR, value);
goto done;
}
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 114/115] rcutrace: single_open() leaks
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2013-05-06 20:45 ` [ 113/115] mmc: atmel-mci: pio hang on block errors Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
2013-05-06 20:45 ` [ 115/115] mfd: adp5520: Restore mode bits on resume Greg Kroah-Hartman
[not found] ` <CAKocOOOcpAeLo=K5usRnk2w5S4tXx2Y4rXe9bff=2ba=ZWdDJA@mail.gmail.com>
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 7ee2b9e56495c56dcaffa2bab19b39451d9fdc8a upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/rcutree_trace.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -97,7 +97,7 @@ static const struct file_operations rcub
.open = rcubarrier_open,
.read = seq_read,
.llseek = no_llseek,
- .release = seq_release,
+ .release = single_release,
};
#ifdef CONFIG_RCU_BOOST
@@ -208,7 +208,7 @@ static const struct file_operations rcue
.open = rcuexp_open,
.read = seq_read,
.llseek = no_llseek,
- .release = seq_release,
+ .release = single_release,
};
#ifdef CONFIG_RCU_BOOST
@@ -308,7 +308,7 @@ static const struct file_operations rcuh
.open = rcuhier_open,
.read = seq_read,
.llseek = no_llseek,
- .release = seq_release,
+ .release = single_release,
};
static void show_one_rcugp(struct seq_file *m, struct rcu_state *rsp)
@@ -350,7 +350,7 @@ static const struct file_operations rcug
.open = rcugp_open,
.read = seq_read,
.llseek = no_llseek,
- .release = seq_release,
+ .release = single_release,
};
static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
^ permalink raw reply [flat|nested] 119+ messages in thread* [ 115/115] mfd: adp5520: Restore mode bits on resume
2013-05-06 20:43 [ 000/115] 3.9.1-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2013-05-06 20:45 ` [ 114/115] rcutrace: single_open() leaks Greg Kroah-Hartman
@ 2013-05-06 20:45 ` Greg Kroah-Hartman
[not found] ` <CAKocOOOcpAeLo=K5usRnk2w5S4tXx2Y4rXe9bff=2ba=ZWdDJA@mail.gmail.com>
115 siblings, 0 replies; 119+ messages in thread
From: Greg Kroah-Hartman @ 2013-05-06 20:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Michael Hennerich,
Samuel Ortiz
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit c6cc25fda58da8685ecef3f179adc7b99c8253b2 upstream.
The adp5520 unfortunately also clears the BL_EN bit when the nSTNDBY bit is
cleared. So we need to make sure to restore it during resume if it was set
before suspend.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/adp5520.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/mfd/adp5520.c
+++ b/drivers/mfd/adp5520.c
@@ -36,6 +36,7 @@ struct adp5520_chip {
struct blocking_notifier_head notifier_list;
int irq;
unsigned long id;
+ uint8_t mode;
};
static int __adp5520_read(struct i2c_client *client,
@@ -326,7 +327,10 @@ static int adp5520_suspend(struct device
struct i2c_client *client = to_i2c_client(dev);
struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
- adp5520_clr_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
+ adp5520_read(chip->dev, ADP5520_MODE_STATUS, &chip->mode);
+ /* All other bits are W1C */
+ chip->mode &= ADP5520_BL_EN | ADP5520_DIM_EN | ADP5520_nSTNBY;
+ adp5520_write(chip->dev, ADP5520_MODE_STATUS, 0);
return 0;
}
@@ -335,7 +339,7 @@ static int adp5520_resume(struct device
struct i2c_client *client = to_i2c_client(dev);
struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
- adp5520_set_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
+ adp5520_write(chip->dev, ADP5520_MODE_STATUS, chip->mode);
return 0;
}
#endif
^ permalink raw reply [flat|nested] 119+ messages in thread[parent not found: <CAKocOOOcpAeLo=K5usRnk2w5S4tXx2Y4rXe9bff=2ba=ZWdDJA@mail.gmail.com>]
* Re: Fwd: [ 000/115] 3.9.1-stable review
[not found] ` <CAKocOOOcpAeLo=K5usRnk2w5S4tXx2Y4rXe9bff=2ba=ZWdDJA@mail.gmail.com>
@ 2013-05-07 19:11 ` Shuah Khan
0 siblings, 0 replies; 119+ messages in thread
From: Shuah Khan @ 2013-05-07 19:11 UTC (permalink / raw)
To: gregkh@linuxfoundation.org
Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, stable@vger.kernel.org
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Date: Mon, May 6, 2013 at 2:43 PM
> Subject: [ 000/115] 3.9.1-stable review
> To: linux-kernel@vger.kernel.org
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
> torvalds@linux-foundation.org, akpm@linux-foundation.org,
> stable@vger.kernel.org
>
>
> NOTE: I have NOT applied all of the submitted -stable patches to this
> release, specifically I've skipped all of the drm patches for now. This
> release was big enough that I didn't want to double the size of it. I
> should be all caught up after a release or two, so if you have sent me
> stable patches that are not in here, please be patient.
>
> This is the start of the stable review cycle for the 3.9.1 release.
> There are 115 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed May 8 20:28:24 UTC 2013.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.9.1-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Patches applied cleanly to 3.0.76, 3.4.43, 3.8.11, and 3.9.0
Compiled and booted on the following systems:
Samsung Series 9 Intel Corei5:
(3.4.44-rc1, 3.8.12-rc1, and 3.9.1-rc1)
HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics:
(3.0.77-rc1, 3.4.44-rc1, 3.8.12-rc1, and 3.9.1-rc)
HP Compaq dc7700 SFF desktop: x86-64 Intel Core-i2:
(cross-compile testing: 3.0.77-rc1, 3.4.44-rc1, 3.8.12-rc1, and 3.9.1-rc1)
dmesgs for all releases look good. No regressions compared to the previous
dmesgs for each of these releases.
Cross-compile tests results:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.8.y
c6x: not applicable to 3.0.y, defconfig passed on 3.4.y, and 3.8.y.
mips: defconfig passed on all
mipsel: defconfig passed on all
powerpc: wii_defconfig passed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile: tilegx_defconfig passed on all
-- thanks
Shuah
--
Shuah Khan Linux Kernel Developer - Open Source Group
Samsung Research America (Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 119+ messages in thread