* [PATCH 3.12 001/142] openrisc: Rework signal handling
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 002/142] usb: host: ohci-spear: fix ohci_dump parameters Jiri Slaby
` (142 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jonas Bonn, Jiri Slaby
From: Jonas Bonn <jonas@southpole.se>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 10f67dbf6add97751050f294d4c8e0cc1e5c2c23 upstream.
The mainline signal handling code for OpenRISC has been buggy since day
one with respect to syscall restart. This patch significantly reworks
the signal handling code:
i) Move the "work pending" loop to C code (borrowed from ARM arch)
ii) Allow a tracer to muck about with the IP and skip syscall restart
in that case (again, borrowed from ARM)
iii) Make signal handling WRT syscall restart actually work
v) Make the signal handling code look more like that of other
architectures so that it's easier for others to follow
Reported-by: Anders Nystrom <anders@southpole.se>
Signed-off-by: Jonas Bonn <jonas@southpole.se>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/openrisc/kernel/entry.S | 59 +++++++------
arch/openrisc/kernel/signal.c | 198 ++++++++++++++++++++++--------------------
2 files changed, 139 insertions(+), 118 deletions(-)
diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
index d8a455ede5a7..fec8bf97d806 100644
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -853,37 +853,44 @@ UNHANDLED_EXCEPTION(_vector_0x1f00,0x1f00)
/* ========================================================[ return ] === */
+_resume_userspace:
+ DISABLE_INTERRUPTS(r3,r4)
+ l.lwz r4,TI_FLAGS(r10)
+ l.andi r13,r4,_TIF_WORK_MASK
+ l.sfeqi r13,0
+ l.bf _restore_all
+ l.nop
+
_work_pending:
- /*
- * if (current_thread_info->flags & _TIF_NEED_RESCHED)
- * schedule();
- */
- l.lwz r5,TI_FLAGS(r10)
- l.andi r3,r5,_TIF_NEED_RESCHED
- l.sfnei r3,0
- l.bnf _work_notifysig
+ l.lwz r5,PT_ORIG_GPR11(r1)
+ l.sfltsi r5,0
+ l.bnf 1f
l.nop
- l.jal schedule
+ l.andi r5,r5,0
+1:
+ l.jal do_work_pending
+ l.ori r3,r1,0 /* pt_regs */
+
+ l.sfeqi r11,0
+ l.bf _restore_all
l.nop
- l.j _resume_userspace
+ l.sfltsi r11,0
+ l.bnf 1f
l.nop
-
-/* Handle pending signals and notify-resume requests.
- * do_notify_resume must be passed the latest pushed pt_regs, not
- * necessarily the "userspace" ones. Also, pt_regs->syscallno
- * must be set so that the syscall restart functionality works.
- */
-_work_notifysig:
- l.jal do_notify_resume
- l.ori r3,r1,0 /* pt_regs */
-
-_resume_userspace:
- DISABLE_INTERRUPTS(r3,r4)
- l.lwz r3,TI_FLAGS(r10)
- l.andi r3,r3,_TIF_WORK_MASK
- l.sfnei r3,0
- l.bf _work_pending
+ l.and r11,r11,r0
+ l.ori r11,r11,__NR_restart_syscall
+ l.j _syscall_check_trace_enter
l.nop
+1:
+ l.lwz r11,PT_ORIG_GPR11(r1)
+ /* Restore arg registers */
+ l.lwz r3,PT_GPR3(r1)
+ l.lwz r4,PT_GPR4(r1)
+ l.lwz r5,PT_GPR5(r1)
+ l.lwz r6,PT_GPR6(r1)
+ l.lwz r7,PT_GPR7(r1)
+ l.j _syscall_check_trace_enter
+ l.lwz r8,PT_GPR8(r1)
_restore_all:
RESTORE_ALL
diff --git a/arch/openrisc/kernel/signal.c b/arch/openrisc/kernel/signal.c
index ae167f7e081a..c277ec82783d 100644
--- a/arch/openrisc/kernel/signal.c
+++ b/arch/openrisc/kernel/signal.c
@@ -28,24 +28,24 @@
#include <linux/tracehook.h>
#include <asm/processor.h>
+#include <asm/syscall.h>
#include <asm/ucontext.h>
#include <asm/uaccess.h>
#define DEBUG_SIG 0
struct rt_sigframe {
- struct siginfo *pinfo;
- void *puc;
struct siginfo info;
struct ucontext uc;
unsigned char retcode[16]; /* trampoline code */
};
-static int restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
+static int restore_sigcontext(struct pt_regs *regs,
+ struct sigcontext __user *sc)
{
- unsigned int err = 0;
+ int err = 0;
- /* Alwys make any pending restarted system call return -EINTR */
+ /* Always make any pending restarted system calls return -EINTR */
current_thread_info()->restart_block.fn = do_no_restart_syscall;
/*
@@ -53,25 +53,21 @@ static int restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
* (sc is already checked for VERIFY_READ since the sigframe was
* checked in sys_sigreturn previously)
*/
- if (__copy_from_user(regs, sc->regs.gpr, 32 * sizeof(unsigned long)))
- goto badframe;
- if (__copy_from_user(®s->pc, &sc->regs.pc, sizeof(unsigned long)))
- goto badframe;
- if (__copy_from_user(®s->sr, &sc->regs.sr, sizeof(unsigned long)))
- goto badframe;
+ err |= __copy_from_user(regs, sc->regs.gpr, 32 * sizeof(unsigned long));
+ err |= __copy_from_user(®s->pc, &sc->regs.pc, sizeof(unsigned long));
+ err |= __copy_from_user(®s->sr, &sc->regs.sr, sizeof(unsigned long));
/* make sure the SM-bit is cleared so user-mode cannot fool us */
regs->sr &= ~SPR_SR_SM;
+ regs->orig_gpr11 = -1; /* Avoid syscall restart checks */
+
/* TODO: the other ports use regs->orig_XX to disable syscall checks
* after this completes, but we don't use that mechanism. maybe we can
* use it now ?
*/
return err;
-
-badframe:
- return 1;
}
asmlinkage long _sys_rt_sigreturn(struct pt_regs *regs)
@@ -111,21 +107,18 @@ badframe:
* Set up a signal frame.
*/
-static int setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
- unsigned long mask)
+static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
{
int err = 0;
/* copy the regs */
-
+ /* There should be no need to save callee-saved registers here...
+ * ...but we save them anyway. Revisit this
+ */
err |= __copy_to_user(sc->regs.gpr, regs, 32 * sizeof(unsigned long));
err |= __copy_to_user(&sc->regs.pc, ®s->pc, sizeof(unsigned long));
err |= __copy_to_user(&sc->regs.sr, ®s->sr, sizeof(unsigned long));
- /* then some other stuff */
-
- err |= __put_user(mask, &sc->oldmask);
-
return err;
}
@@ -181,24 +174,18 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
int err = 0;
frame = get_sigframe(ka, regs, sizeof(*frame));
-
if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
goto give_sigsegv;
- err |= __put_user(&frame->info, &frame->pinfo);
- err |= __put_user(&frame->uc, &frame->puc);
-
+ /* Create siginfo. */
if (ka->sa.sa_flags & SA_SIGINFO)
err |= copy_siginfo_to_user(&frame->info, info);
- if (err)
- goto give_sigsegv;
- /* Clear all the bits of the ucontext we don't use. */
- err |= __clear_user(&frame->uc, offsetof(struct ucontext, uc_mcontext));
+ /* Create the ucontext. */
err |= __put_user(0, &frame->uc.uc_flags);
err |= __put_user(NULL, &frame->uc.uc_link);
err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
- err |= setup_sigcontext(&frame->uc.uc_mcontext, regs, set->sig[0]);
+ err |= setup_sigcontext(regs, &frame->uc.uc_mcontext);
err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
@@ -207,9 +194,12 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
/* trampoline - the desired return ip is the retcode itself */
return_ip = (unsigned long)&frame->retcode;
- /* This is l.ori r11,r0,__NR_sigreturn, l.sys 1 */
- err |= __put_user(0xa960, (short *)(frame->retcode + 0));
- err |= __put_user(__NR_rt_sigreturn, (short *)(frame->retcode + 2));
+ /* This is:
+ l.ori r11,r0,__NR_sigreturn
+ l.sys 1
+ */
+ err |= __put_user(0xa960, (short *)(frame->retcode + 0));
+ err |= __put_user(__NR_rt_sigreturn, (short *)(frame->retcode + 2));
err |= __put_user(0x20000001, (unsigned long *)(frame->retcode + 4));
err |= __put_user(0x15000000, (unsigned long *)(frame->retcode + 8));
@@ -262,82 +252,106 @@ handle_signal(unsigned long sig,
* mode below.
*/
-void do_signal(struct pt_regs *regs)
+int do_signal(struct pt_regs *regs, int syscall)
{
siginfo_t info;
int signr;
struct k_sigaction ka;
-
- /*
- * We want the common case to go fast, which
- * is why we may in certain cases get here from
- * kernel mode. Just return without doing anything
- * if so.
- */
- if (!user_mode(regs))
- return;
-
- signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-
- /* If we are coming out of a syscall then we need
- * to check if the syscall was interrupted and wants to be
- * restarted after handling the signal. If so, the original
- * syscall number is put back into r11 and the PC rewound to
- * point at the l.sys instruction that resulted in the
- * original syscall. Syscall results other than the four
- * below mean that the syscall executed to completion and no
- * restart is necessary.
- */
- if (regs->orig_gpr11) {
- int restart = 0;
-
- switch (regs->gpr[11]) {
+ unsigned long continue_addr = 0;
+ unsigned long restart_addr = 0;
+ unsigned long retval = 0;
+ int restart = 0;
+
+ if (syscall) {
+ continue_addr = regs->pc;
+ restart_addr = continue_addr - 4;
+ retval = regs->gpr[11];
+
+ /*
+ * Setup syscall restart here so that a debugger will
+ * see the already changed PC.
+ */
+ switch (retval) {
case -ERESTART_RESTARTBLOCK:
+ restart = -2;
+ /* Fall through */
case -ERESTARTNOHAND:
- /* Restart if there is no signal handler */
- restart = (signr <= 0);
- break;
case -ERESTARTSYS:
- /* Restart if there no signal handler or
- * SA_RESTART flag is set */
- restart = (signr <= 0 || (ka.sa.sa_flags & SA_RESTART));
- break;
case -ERESTARTNOINTR:
- /* Always restart */
- restart = 1;
+ restart++;
+ regs->gpr[11] = regs->orig_gpr11;
+ regs->pc = restart_addr;
break;
}
+ }
- if (restart) {
- if (regs->gpr[11] == -ERESTART_RESTARTBLOCK)
- regs->gpr[11] = __NR_restart_syscall;
- else
- regs->gpr[11] = regs->orig_gpr11;
- regs->pc -= 4;
- } else {
- regs->gpr[11] = -EINTR;
+ /*
+ * Get the signal to deliver. When running under ptrace, at this
+ * point the debugger may change all our registers ...
+ */
+ signr = get_signal_to_deliver(&info, &ka, regs, NULL);
+ /*
+ * Depending on the signal settings we may need to revert the
+ * decision to restart the system call. But skip this if a
+ * debugger has chosen to restart at a different PC.
+ */
+ if (signr > 0) {
+ if (unlikely(restart) && regs->pc == restart_addr) {
+ if (retval == -ERESTARTNOHAND ||
+ retval == -ERESTART_RESTARTBLOCK
+ || (retval == -ERESTARTSYS
+ && !(ka.sa.sa_flags & SA_RESTART))) {
+ /* No automatic restart */
+ regs->gpr[11] = -EINTR;
+ regs->pc = continue_addr;
+ }
}
- }
- if (signr <= 0) {
- /* no signal to deliver so we just put the saved sigmask
- * back */
- restore_saved_sigmask();
- } else { /* signr > 0 */
- /* Whee! Actually deliver the signal. */
handle_signal(signr, &info, &ka, regs);
+ } else {
+ /* no handler */
+ restore_saved_sigmask();
+ /*
+ * Restore pt_regs PC as syscall restart will be handled by
+ * kernel without return to userspace
+ */
+ if (unlikely(restart) && regs->pc == restart_addr) {
+ regs->pc = continue_addr;
+ return restart;
+ }
}
- return;
+ return 0;
}
-asmlinkage void do_notify_resume(struct pt_regs *regs)
+asmlinkage int
+do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
{
- if (current_thread_info()->flags & _TIF_SIGPENDING)
- do_signal(regs);
-
- if (current_thread_info()->flags & _TIF_NOTIFY_RESUME) {
- clear_thread_flag(TIF_NOTIFY_RESUME);
- tracehook_notify_resume(regs);
- }
+ do {
+ if (likely(thread_flags & _TIF_NEED_RESCHED)) {
+ schedule();
+ } else {
+ if (unlikely(!user_mode(regs)))
+ return 0;
+ local_irq_enable();
+ if (thread_flags & _TIF_SIGPENDING) {
+ int restart = do_signal(regs, syscall);
+ if (unlikely(restart)) {
+ /*
+ * Restart without handlers.
+ * Deal with it without leaving
+ * the kernel space.
+ */
+ return restart;
+ }
+ syscall = 0;
+ } else {
+ clear_thread_flag(TIF_NOTIFY_RESUME);
+ tracehook_notify_resume(regs);
+ }
+ }
+ local_irq_disable();
+ thread_flags = current_thread_info()->flags;
+ } while (thread_flags & _TIF_WORK_MASK);
+ return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 002/142] usb: host: ohci-spear: fix ohci_dump parameters
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 001/142] openrisc: Rework signal handling Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 003/142] x86: Add check for number of available vectors before CPU down Jiri Slaby
` (141 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Vincent Stehlé, Greg Kroah-Hartman, Jiri Slaby
From: Vincent Stehlé <vincent.stehle@laposte.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Commit 6a04d05acfb51355 ("USB: OHCI: fix bugs in debug routines") has removed
the unused `verbose' argument of the debug function ohci_dump(); adapt
ohci-spear accordingly.
This fixes the following compilation error:
drivers/usb/host/ohci-spear.c: In function ‘ohci_spear_start’:
drivers/usb/host/ohci-spear.c:56:2: error: too many arguments to function ‘ohci_dump’
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/ohci-spear.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/ohci-spear.c b/drivers/usb/host/ohci-spear.c
index cc9dd9e4f05e..45f87735b449 100644
--- a/drivers/usb/host/ohci-spear.c
+++ b/drivers/usb/host/ohci-spear.c
@@ -53,7 +53,7 @@ static int ohci_spear_start(struct usb_hcd *hcd)
create_debug_files(ohci);
#ifdef DEBUG
- ohci_dump(ohci, 1);
+ ohci_dump(ohci);
#endif
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 003/142] x86: Add check for number of available vectors before CPU down
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 001/142] openrisc: Rework signal handling Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 002/142] usb: host: ohci-spear: fix ohci_dump parameters Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 004/142] x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable() Jiri Slaby
` (140 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Prarit Bhargava, Andi Kleen, Michel Lespinasse,
Seiji Aguchi, Yang Zhang, Paul Gortmaker, Janet Morgan, Tony Luck,
Ruiv Wang, Gong Chen, H. Peter Anvin, Jiri Slaby
From: Prarit Bhargava <prarit@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit da6139e49c7cb0f4251265cb5243b8d220adb48d upstream.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64791
When a cpu is downed on a system, the irqs on the cpu are assigned to
other cpus. It is possible, however, that when a cpu is downed there
aren't enough free vectors on the remaining cpus to account for the
vectors from the cpu that is being downed.
This results in an interesting "overflow" condition where irqs are
"assigned" to a CPU but are not handled.
For example, when downing cpus on a 1-64 logical processor system:
<snip>
[ 232.021745] smpboot: CPU 61 is now offline
[ 238.480275] smpboot: CPU 62 is now offline
[ 245.991080] ------------[ cut here ]------------
[ 245.996270] WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:264 dev_watchdog+0x246/0x250()
[ 246.005688] NETDEV WATCHDOG: p786p1 (ixgbe): transmit queue 0 timed out
[ 246.013070] Modules linked in: lockd sunrpc iTCO_wdt iTCO_vendor_support sb_edac ixgbe microcode e1000e pcspkr joydev edac_core lpc_ich ioatdma ptp mdio mfd_core i2c_i801 dca pps_core i2c_core wmi acpi_cpufreq isci libsas scsi_transport_sas
[ 246.037633] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0+ #14
[ 246.044451] Hardware name: Intel Corporation S4600LH ........../SVRBD-ROW_T, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013
[ 246.057371] 0000000000000009 ffff88081fa03d40 ffffffff8164fbf6 ffff88081fa0ee48
[ 246.065728] ffff88081fa03d90 ffff88081fa03d80 ffffffff81054ecc ffff88081fa13040
[ 246.074073] 0000000000000000 ffff88200cce0000 0000000000000040 0000000000000000
[ 246.082430] Call Trace:
[ 246.085174] <IRQ> [<ffffffff8164fbf6>] dump_stack+0x46/0x58
[ 246.091633] [<ffffffff81054ecc>] warn_slowpath_common+0x8c/0xc0
[ 246.098352] [<ffffffff81054fb6>] warn_slowpath_fmt+0x46/0x50
[ 246.104786] [<ffffffff815710d6>] dev_watchdog+0x246/0x250
[ 246.110923] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
[ 246.119097] [<ffffffff8106092a>] call_timer_fn+0x3a/0x110
[ 246.125224] [<ffffffff8106280f>] ? update_process_times+0x6f/0x80
[ 246.132137] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
[ 246.140308] [<ffffffff81061db0>] run_timer_softirq+0x1f0/0x2a0
[ 246.146933] [<ffffffff81059a80>] __do_softirq+0xe0/0x220
[ 246.152976] [<ffffffff8165fedc>] call_softirq+0x1c/0x30
[ 246.158920] [<ffffffff810045f5>] do_softirq+0x55/0x90
[ 246.164670] [<ffffffff81059d35>] irq_exit+0xa5/0xb0
[ 246.170227] [<ffffffff8166062a>] smp_apic_timer_interrupt+0x4a/0x60
[ 246.177324] [<ffffffff8165f40a>] apic_timer_interrupt+0x6a/0x70
[ 246.184041] <EOI> [<ffffffff81505a1b>] ? cpuidle_enter_state+0x5b/0xe0
[ 246.191559] [<ffffffff81505a17>] ? cpuidle_enter_state+0x57/0xe0
[ 246.198374] [<ffffffff81505b5d>] cpuidle_idle_call+0xbd/0x200
[ 246.204900] [<ffffffff8100b7ae>] arch_cpu_idle+0xe/0x30
[ 246.210846] [<ffffffff810a47b0>] cpu_startup_entry+0xd0/0x250
[ 246.217371] [<ffffffff81646b47>] rest_init+0x77/0x80
[ 246.223028] [<ffffffff81d09e8e>] start_kernel+0x3ee/0x3fb
[ 246.229165] [<ffffffff81d0989f>] ? repair_env_string+0x5e/0x5e
[ 246.235787] [<ffffffff81d095a5>] x86_64_start_reservations+0x2a/0x2c
[ 246.242990] [<ffffffff81d0969f>] x86_64_start_kernel+0xf8/0xfc
[ 246.249610] ---[ end trace fb74fdef54d79039 ]---
[ 246.254807] ixgbe 0000:c2:00.0 p786p1: initiating reset due to tx timeout
[ 246.262489] ixgbe 0000:c2:00.0 p786p1: Reset adapter
Last login: Mon Nov 11 08:35:14 from 10.18.17.119
[root@(none) ~]# [ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
[ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
(last lines keep repeating. ixgbe driver is dead until module reload.)
If the downed cpu has more vectors than are free on the remaining cpus on the
system, it is possible that some vectors are "orphaned" even though they are
assigned to a cpu. In this case, since the ixgbe driver had a watchdog, the
watchdog fired and notified that something was wrong.
This patch adds a function, check_vectors(), to compare the number of vectors
on the CPU going down and compares it to the number of vectors available on
the system. If there aren't enough vectors for the CPU to go down, an
error is returned and propogated back to userspace.
v2: Do not need to look at percpu irqs
v3: Need to check affinity to prevent counting of MSIs in IOAPIC Lowest
Priority Mode
v4: Additional changes suggested by Gong Chen.
v5/v6/v7/v8: Updated comment text
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Link: http://lkml.kernel.org/r/1389613861-3853-1-git-send-email-prarit@redhat.com
Reviewed-by: Gong Chen <gong.chen@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Yang Zhang <yang.z.zhang@Intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Janet Morgan <janet.morgan@intel.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Ruiv Wang <ruiv.wang@gmail.com>
Cc: Gong Chen <gong.chen@linux.intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/include/asm/irq.h | 1 +
arch/x86/kernel/irq.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
arch/x86/kernel/smpboot.c | 6 ++++
3 files changed, 77 insertions(+)
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index 0ea10f27d613..cb6cfcd034cf 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu);
#ifdef CONFIG_HOTPLUG_CPU
#include <linux/cpumask.h>
+extern int check_irq_vectors_for_cpu_disable(void);
extern void fixup_irqs(void);
extern void irq_force_complete_move(int);
#endif
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 22d0687e7fda..4207e8d1a094 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -262,6 +262,76 @@ __visible void smp_trace_x86_platform_ipi(struct pt_regs *regs)
EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
#ifdef CONFIG_HOTPLUG_CPU
+/*
+ * This cpu is going to be removed and its vectors migrated to the remaining
+ * online cpus. Check to see if there are enough vectors in the remaining cpus.
+ * This function is protected by stop_machine().
+ */
+int check_irq_vectors_for_cpu_disable(void)
+{
+ int irq, cpu;
+ unsigned int this_cpu, vector, this_count, count;
+ struct irq_desc *desc;
+ struct irq_data *data;
+ struct cpumask affinity_new, online_new;
+
+ this_cpu = smp_processor_id();
+ cpumask_copy(&online_new, cpu_online_mask);
+ cpu_clear(this_cpu, online_new);
+
+ this_count = 0;
+ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
+ irq = __this_cpu_read(vector_irq[vector]);
+ if (irq >= 0) {
+ desc = irq_to_desc(irq);
+ data = irq_desc_get_irq_data(desc);
+ cpumask_copy(&affinity_new, data->affinity);
+ cpu_clear(this_cpu, affinity_new);
+
+ /* Do not count inactive or per-cpu irqs. */
+ if (!irq_has_action(irq) || irqd_is_per_cpu(data))
+ continue;
+
+ /*
+ * A single irq may be mapped to multiple
+ * cpu's vector_irq[] (for example IOAPIC cluster
+ * mode). In this case we have two
+ * possibilities:
+ *
+ * 1) the resulting affinity mask is empty; that is
+ * this the down'd cpu is the last cpu in the irq's
+ * affinity mask, or
+ *
+ * 2) the resulting affinity mask is no longer
+ * a subset of the online cpus but the affinity
+ * mask is not zero; that is the down'd cpu is the
+ * last online cpu in a user set affinity mask.
+ */
+ if (cpumask_empty(&affinity_new) ||
+ !cpumask_subset(&affinity_new, &online_new))
+ this_count++;
+ }
+ }
+
+ count = 0;
+ for_each_online_cpu(cpu) {
+ if (cpu == this_cpu)
+ continue;
+ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
+ vector++) {
+ if (per_cpu(vector_irq, cpu)[vector] < 0)
+ count++;
+ }
+ }
+
+ if (count < this_count) {
+ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n",
+ this_cpu, this_count, count);
+ return -ERANGE;
+ }
+ return 0;
+}
+
/* A cpu has been removed from cpu_online_mask. Reset irq affinities. */
void fixup_irqs(void)
{
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 42c26a485533..b17dfe212233 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1317,6 +1317,12 @@ void cpu_disable_common(void)
int native_cpu_disable(void)
{
+ int ret;
+
+ ret = check_irq_vectors_for_cpu_disable();
+ if (ret)
+ return ret;
+
clear_local_APIC();
cpu_disable_common();
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 004/142] x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (2 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 003/142] x86: Add check for number of available vectors before CPU down Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 005/142] ext4: fix BUG_ON in mb_free_blocks() Jiri Slaby
` (139 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Prarit Bhargava, Andi Kleen, Michel Lespinasse,
Seiji Aguchi, Yang Zhang, Paul Gortmaker, Janet Morgan, Tony Luck,
Ruiv Wang, Gong Chen, Yinghai Lu, H. Peter Anvin, Jiri Slaby
From: Prarit Bhargava <prarit@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 39424e89d64661faa0a2e00c5ad1e6dbeebfa972 upstream.
Further discussion here: http://marc.info/?l=linux-kernel&m=139073901101034&w=2
kbuild, 0day kernel build service, outputs the warning:
arch/x86/kernel/irq.c:333:1: warning: the frame size of 2056 bytes
is larger than 2048 bytes [-Wframe-larger-than=]
because check_irq_vectors_for_cpu_disable() allocates two cpumasks on the
stack. Fix this by moving the two cpumasks to a global file context.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Tested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Link: http://lkml.kernel.org/r/1390915331-27375-1-git-send-email-prarit@redhat.com
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Yang Zhang <yang.z.zhang@Intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Janet Morgan <janet.morgan@intel.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Ruiv Wang <ruiv.wang@gmail.com>
Cc: Gong Chen <gong.chen@linux.intel.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/kernel/irq.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 4207e8d1a094..39100783cf26 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -262,6 +262,14 @@ __visible void smp_trace_x86_platform_ipi(struct pt_regs *regs)
EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
#ifdef CONFIG_HOTPLUG_CPU
+
+/* These two declarations are only used in check_irq_vectors_for_cpu_disable()
+ * below, which is protected by stop_machine(). Putting them on the stack
+ * results in a stack frame overflow. Dynamically allocating could result in a
+ * failure so declare these two cpumasks as global.
+ */
+static struct cpumask affinity_new, online_new;
+
/*
* This cpu is going to be removed and its vectors migrated to the remaining
* online cpus. Check to see if there are enough vectors in the remaining cpus.
@@ -273,7 +281,6 @@ int check_irq_vectors_for_cpu_disable(void)
unsigned int this_cpu, vector, this_count, count;
struct irq_desc *desc;
struct irq_data *data;
- struct cpumask affinity_new, online_new;
this_cpu = smp_processor_id();
cpumask_copy(&online_new, cpu_online_mask);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 005/142] ext4: fix BUG_ON in mb_free_blocks()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (3 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 004/142] x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable() Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 006/142] futex: Unlock hb->lock in futex_wait_requeue_pi() error path Jiri Slaby
` (138 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Theodore Ts'o, Jiri Slaby
From: Theodore Ts'o <tytso@mit.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c99d1e6e83b06744c75d9f5e491ed495a7086b7b upstream.
If we suffer a block allocation failure (for example due to a memory
allocation failure), it's possible that we will call
ext4_discard_allocated_blocks() before we've actually allocated any
blocks. In that case, fe_len and fe_start in ac->ac_f_ex will still
be zero, and this will result in mb_free_blocks(inode, e4b, 0, 0)
triggering the BUG_ON on mb_free_blocks():
BUG_ON(last >= (sb->s_blocksize << 3));
Fix this by bailing out of ext4_discard_allocated_blocks() if fs_len
is zero.
Also fix a missing ext4_mb_unload_buddy() call in
ext4_discard_allocated_blocks().
Google-Bug-Id: 16844242
Fixes: 86f0afd463215fc3e58020493482faa4ac3a4d69
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/mballoc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 795d5afc1479..242226a87be7 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1398,6 +1398,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
int last = first + count - 1;
struct super_block *sb = e4b->bd_sb;
+ if (WARN_ON(count == 0))
+ return;
BUG_ON(last >= (sb->s_blocksize << 3));
assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
/* Don't bother if the block group is corrupt. */
@@ -3200,6 +3202,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
int err;
if (pa == NULL) {
+ if (ac->ac_f_ex.fe_len == 0)
+ return;
err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
if (err) {
/*
@@ -3214,6 +3218,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
ac->ac_f_ex.fe_len);
ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
+ ext4_mb_unload_buddy(&e4b);
return;
}
if (pa->pa_type == MB_INODE_PA)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 006/142] futex: Unlock hb->lock in futex_wait_requeue_pi() error path
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (4 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 005/142] ext4: fix BUG_ON in mb_free_blocks() Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 007/142] dcache.c: get rid of pointless macros Jiri Slaby
` (137 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Thomas Gleixner, Peter Zijlstra, Jiri Slaby
From: Thomas Gleixner <tglx@linutronix.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 13c42c2f43b19aab3195f2d357db00d1e885eaa8 upstream.
futex_wait_requeue_pi() calls futex_wait_setup(). If
futex_wait_setup() succeeds it returns with hb->lock held and
preemption disabled. Now the sanity check after this does:
if (match_futex(&q.key, &key2)) {
ret = -EINVAL;
goto out_put_keys;
}
which releases the keys but does not release hb->lock.
So we happily return to user space with hb->lock held and therefor
preemption disabled.
Unlock hb->lock before taking the exit route.
Reported-by: Dave "Trinity" Jones <davej@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1409112318500.4178@nanos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
kernel/futex.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/futex.c b/kernel/futex.c
index f94695c9d38b..e4b9b60e25b1 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2465,6 +2465,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
* shared futexes. We need to compare the keys:
*/
if (match_futex(&q.key, &key2)) {
+ queue_unlock(&q, hb);
ret = -EINVAL;
goto out_put_keys;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 007/142] dcache.c: get rid of pointless macros
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (5 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 006/142] futex: Unlock hb->lock in futex_wait_requeue_pi() error path Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 008/142] vfs: fix bad hashing of dentries Jiri Slaby
` (136 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Al Viro, Jiri Slaby
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 482db9066199813d6b999b65a3171afdbec040b6 upstream.
D_HASH{MASK,BITS} are used once each, both in the same function (d_hash()).
At this point they are actively misguiding - they imply that values are
compiler constants, which is no longer true.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/dcache.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 8ef74f3d8fe5..5859bc5c981d 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -125,8 +125,6 @@ static inline void done_seqretry(seqlock_t *lock, int seq)
* This hash-function tries to avoid losing too many bits of hash
* information, yet avoid using a prime hash-size or similar.
*/
-#define D_HASHBITS d_hash_shift
-#define D_HASHMASK d_hash_mask
static unsigned int d_hash_mask __read_mostly;
static unsigned int d_hash_shift __read_mostly;
@@ -137,8 +135,8 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
unsigned int hash)
{
hash += (unsigned long) parent / L1_CACHE_BYTES;
- hash = hash + (hash >> D_HASHBITS);
- return dentry_hashtable + (hash & D_HASHMASK);
+ hash = hash + (hash >> d_hash_shift);
+ return dentry_hashtable + (hash & d_hash_mask);
}
/* Statistics gathering. */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 008/142] vfs: fix bad hashing of dentries
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (6 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 007/142] dcache.c: get rid of pointless macros Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 009/142] Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch Jiri Slaby
` (135 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Linus Torvalds, Al Viro, Christoph Hellwig,
Chris Mason, linux-fsdevel, Jiri Slaby
From: Linus Torvalds <torvalds@linux-foundation.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 upstream.
Josef Bacik found a performance regression between 3.2 and 3.10 and
narrowed it down to commit bfcfaa77bdf0 ("vfs: use 'unsigned long'
accesses for dcache name comparison and hashing"). He reports:
"The test case is essentially
for (i = 0; i < 1000000; i++)
mkdir("a$i");
On xfs on a fio card this goes at about 20k dir/sec with 3.2, and 12k
dir/sec with 3.10. This is because we spend waaaaay more time in
__d_lookup on 3.10 than in 3.2.
The new hashing function for strings is suboptimal for <
sizeof(unsigned long) string names (and hell even > sizeof(unsigned
long) string names that I've tested). I broke out the old hashing
function and the new one into a userspace helper to get real numbers
and this is what I'm getting:
Old hash table had 1000000 entries, 0 dupes, 0 max dupes
New hash table had 12628 entries, 987372 dupes, 900 max dupes
We had 11400 buckets with a p50 of 30 dupes, p90 of 240 dupes, p99 of 567 dupes for the new hash
My test does the hash, and then does the d_hash into a integer pointer
array the same size as the dentry hash table on my system, and then
just increments the value at the address we got to see how many
entries we overlap with.
As you can see the old hash function ended up with all 1 million
entries in their own bucket, whereas the new one they are only
distributed among ~12.5k buckets, which is why we're using so much
more CPU in __d_lookup".
The reason for this hash regression is two-fold:
- On 64-bit architectures the down-mixing of the original 64-bit
word-at-a-time hash into the final 32-bit hash value is very
simplistic and suboptimal, and just adds the two 32-bit parts
together.
In particular, because there is no bit shuffling and the mixing
boundary is also a byte boundary, similar character patterns in the
low and high word easily end up just canceling each other out.
- the old byte-at-a-time hash mixed each byte into the final hash as it
hashed the path component name, resulting in the low bits of the hash
generally being a good source of hash data. That is not true for the
word-at-a-time case, and the hash data is distributed among all the
bits.
The fix is the same in both cases: do a better job of mixing the bits up
and using as much of the hash data as possible. We already have the
"hash_32|64()" functions to do that.
Reported-by: Josef Bacik <jbacik@fb.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Chris Mason <clm@fb.com>
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/dcache.c | 3 +--
fs/namei.c | 4 ++--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 5859bc5c981d..87b70fe7eccc 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -135,8 +135,7 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
unsigned int hash)
{
hash += (unsigned long) parent / L1_CACHE_BYTES;
- hash = hash + (hash >> d_hash_shift);
- return dentry_hashtable + (hash & d_hash_mask);
+ return dentry_hashtable + hash_32(hash, d_hash_shift);
}
/* Statistics gathering. */
diff --git a/fs/namei.c b/fs/namei.c
index e3249d565c95..227c78ae70b4 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -34,6 +34,7 @@
#include <linux/device_cgroup.h>
#include <linux/fs_struct.h>
#include <linux/posix_acl.h>
+#include <linux/hash.h>
#include <asm/uaccess.h>
#include "internal.h"
@@ -1661,8 +1662,7 @@ static inline int can_lookup(struct inode *inode)
static inline unsigned int fold_hash(unsigned long hash)
{
- hash += hash >> (8*sizeof(int));
- return hash;
+ return hash_64(hash, 32);
}
#else /* 32-bit case */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 009/142] Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (7 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 008/142] vfs: fix bad hashing of dentries Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 010/142] Btrfs: fix csum tree corruption, duplicate and outdated checksums Jiri Slaby
` (134 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Takashi Iwai, Chris Mason, Jiri Slaby
From: Takashi Iwai <tiwai@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4eb1f66dce6c4dc28dd90a7ffbe6b2b1cb08aa4e upstream.
We've got bug reports that btrfs crashes when quota is enabled on
32bit kernel, typically with the Oops like below:
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f9234590>] find_parent_nodes+0x360/0x1380 [btrfs]
*pde = 00000000
Oops: 0000 [#1] SMP
CPU: 0 PID: 151 Comm: kworker/u8:2 Tainted: G S W 3.15.2-1.gd43d97e-default #1
Workqueue: btrfs-qgroup-rescan normal_work_helper [btrfs]
task: f1478130 ti: f147c000 task.ti: f147c000
EIP: 0060:[<f9234590>] EFLAGS: 00010213 CPU: 0
EIP is at find_parent_nodes+0x360/0x1380 [btrfs]
EAX: f147dda8 EBX: f147ddb0 ECX: 00000011 EDX: 00000000
ESI: 00000000 EDI: f147dda4 EBP: f147ddf8 ESP: f147dd38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000004 CR3: 00bf3000 CR4: 00000690
Stack:
00000000 00000000 f147dda4 00000050 00000001 00000000 00000001 00000050
00000001 00000000 d3059000 00000001 00000022 000000a8 00000000 00000000
00000000 000000a1 00000000 00000000 00000001 00000000 00000000 11800000
Call Trace:
[<f923564d>] __btrfs_find_all_roots+0x9d/0xf0 [btrfs]
[<f9237bb1>] btrfs_qgroup_rescan_worker+0x401/0x760 [btrfs]
[<f9206148>] normal_work_helper+0xc8/0x270 [btrfs]
[<c025e38b>] process_one_work+0x11b/0x390
[<c025eea1>] worker_thread+0x101/0x340
[<c026432b>] kthread+0x9b/0xb0
[<c0712a71>] ret_from_kernel_thread+0x21/0x30
[<c0264290>] kthread_create_on_node+0x110/0x110
This indicates a NULL corruption in prefs_delayed list. The further
investigation and bisection pointed that the call of ulist_add_merge()
results in the corruption.
ulist_add_merge() takes u64 as aux and writes a 64bit value into
old_aux. The callers of this function in backref.c, however, pass a
pointer of a pointer to old_aux. That is, the function overwrites
64bit value on 32bit pointer. This caused a NULL in the adjacent
variable, in this case, prefs_delayed.
Here is a quick attempt to band-aid over this: a new function,
ulist_add_merge_ptr() is introduced to pass/store properly a pointer
value instead of u64. There are still ugly void ** cast remaining
in the callers because void ** cannot be taken implicitly. But, it's
safer than explicit cast to u64, anyway.
Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=887046
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/btrfs/backref.c | 11 +++++------
fs/btrfs/ulist.h | 15 +++++++++++++++
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 1f4ce7ac144d..715cfa42e182 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -263,9 +263,8 @@ static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
}
if (ret > 0)
goto next;
- ret = ulist_add_merge(parents, eb->start,
- (uintptr_t)eie,
- (u64 *)&old, GFP_NOFS);
+ ret = ulist_add_merge_ptr(parents, eb->start,
+ eie, (void **)&old, GFP_NOFS);
if (ret < 0)
break;
if (!ret && extent_item_pos) {
@@ -962,9 +961,9 @@ again:
goto out;
ref->inode_list = eie;
}
- ret = ulist_add_merge(refs, ref->parent,
- (uintptr_t)ref->inode_list,
- (u64 *)&eie, GFP_NOFS);
+ ret = ulist_add_merge_ptr(refs, ref->parent,
+ ref->inode_list,
+ (void **)&eie, GFP_NOFS);
if (ret < 0)
goto out;
if (!ret && extent_item_pos) {
diff --git a/fs/btrfs/ulist.h b/fs/btrfs/ulist.h
index fb36731074b5..3e62b57be6b5 100644
--- a/fs/btrfs/ulist.h
+++ b/fs/btrfs/ulist.h
@@ -74,6 +74,21 @@ void ulist_free(struct ulist *ulist);
int ulist_add(struct ulist *ulist, u64 val, u64 aux, gfp_t gfp_mask);
int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
u64 *old_aux, gfp_t gfp_mask);
+
+/* just like ulist_add_merge() but take a pointer for the aux data */
+static inline int ulist_add_merge_ptr(struct ulist *ulist, u64 val, void *aux,
+ void **old_aux, gfp_t gfp_mask)
+{
+#if BITS_PER_LONG == 32
+ u64 old64 = (uintptr_t)*old_aux;
+ int ret = ulist_add_merge(ulist, val, (uintptr_t)aux, &old64, gfp_mask);
+ *old_aux = (void *)((uintptr_t)old64);
+ return ret;
+#else
+ return ulist_add_merge(ulist, val, (u64)aux, (u64 *)old_aux, gfp_mask);
+#endif
+}
+
struct ulist_node *ulist_next(struct ulist *ulist,
struct ulist_iterator *uiter);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 010/142] Btrfs: fix csum tree corruption, duplicate and outdated checksums
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (8 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 009/142] Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 011/142] Btrfs: read lock extent buffer while walking backrefs Jiri Slaby
` (133 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Filipe Manana, Chris Mason, Jiri Slaby
From: Filipe Manana <fdmanana@suse.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 27b9a8122ff71a8cadfbffb9c4f0694300464f3b upstream.
Under rare circumstances we can end up leaving 2 versions of a checksum
for the same file extent range.
The reason for this is that after calling btrfs_next_leaf we process
slot 0 of the leaf it returns, instead of processing the slot set in
path->slots[0]. Most of the time (by far) path->slots[0] is 0, but after
btrfs_next_leaf() releases the path and before it searches for the next
leaf, another task might cause a split of the next leaf, which migrates
some of its keys to the leaf we were processing before calling
btrfs_next_leaf(). In this case btrfs_next_leaf() returns again the
same leaf but with path->slots[0] having a slot number corresponding
to the first new key it got, that is, a slot number that didn't exist
before calling btrfs_next_leaf(), as the leaf now has more keys than
it had before. So we must really process the returned leaf starting at
path->slots[0] always, as it isn't always 0, and the key at slot 0 can
have an offset much lower than our search offset/bytenr.
For example, consider the following scenario, where we have:
sums->bytenr: 40157184, sums->len: 16384, sums end: 40173568
four 4kb file data blocks with offsets 40157184, 40161280, 40165376, 40169472
Leaf N:
slot = 0 slot = btrfs_header_nritems() - 1
|-------------------------------------------------------------------|
| [(CSUM CSUM 39239680), size 8] ... [(CSUM CSUM 40116224), size 4] |
|-------------------------------------------------------------------|
Leaf N + 1:
slot = 0 slot = btrfs_header_nritems() - 1
|--------------------------------------------------------------------|
| [(CSUM CSUM 40161280), size 32] ... [((CSUM CSUM 40615936), size 8 |
|--------------------------------------------------------------------|
Because we are at the last slot of leaf N, we call btrfs_next_leaf() to
find the next highest key, which releases the current path and then searches
for that next key. However after releasing the path and before finding that
next key, the item at slot 0 of leaf N + 1 gets moved to leaf N, due to a call
to ctree.c:push_leaf_left() (via ctree.c:split_leaf()), and therefore
btrfs_next_leaf() will returns us a path again with leaf N but with the slot
pointing to its new last key (CSUM CSUM 40161280). This new version of leaf N
is then:
slot = 0 slot = btrfs_header_nritems() - 2 slot = btrfs_header_nritems() - 1
|----------------------------------------------------------------------------------------------------|
| [(CSUM CSUM 39239680), size 8] ... [(CSUM CSUM 40116224), size 4] [(CSUM CSUM 40161280), size 32] |
|----------------------------------------------------------------------------------------------------|
And incorrecly using slot 0, makes us set next_offset to 39239680 and we jump
into the "insert:" label, which will set tmp to:
tmp = min((sums->len - total_bytes) >> blocksize_bits,
(next_offset - file_key.offset) >> blocksize_bits) =
min((16384 - 0) >> 12, (39239680 - 40157184) >> 12) =
min(4, (u64)-917504 = 18446744073708634112 >> 12) = 4
and
ins_size = csum_size * tmp = 4 * 4 = 16 bytes.
In other words, we insert a new csum item in the tree with key
(CSUM_OBJECTID CSUM_KEY 40157184 = sums->bytenr) that contains the checksums
for all the data (4 blocks of 4096 bytes each = sums->len). Which is wrong,
because the item with key (CSUM CSUM 40161280) (the one that was moved from
leaf N + 1 to the end of leaf N) contains the old checksums of the last 12288
bytes of our data and won't get those old checksums removed.
So this leaves us 2 different checksums for 3 4kb blocks of data in the tree,
and breaks the logical rule:
Key_N+1.offset >= Key_N.offset + length_of_data_its_checksums_cover
An obvious bad effect of this is that a subsequent csum tree lookup to get
the checksum of any of the blocks with logical offset of 40161280, 40165376
or 40169472 (the last 3 4kb blocks of file data), will get the old checksums.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/btrfs/file-item.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 4f53159bdb9d..d4731e9808ea 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -752,7 +752,7 @@ again:
found_next = 1;
if (ret != 0)
goto insert;
- slot = 0;
+ slot = path->slots[0];
}
btrfs_item_key_to_cpu(path->nodes[0], &found_key, slot);
if (found_key.objectid != BTRFS_EXTENT_CSUM_OBJECTID ||
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 011/142] Btrfs: read lock extent buffer while walking backrefs
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (9 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 010/142] Btrfs: fix csum tree corruption, duplicate and outdated checksums Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 012/142] Btrfs: fix compressed write corruption on enospc Jiri Slaby
` (132 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Filipe Manana, Chris Mason, Jiri Slaby
From: Filipe Manana <fdmanana@suse.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6f7ff6d7832c6be13e8c95598884dbc40ad69fb7 upstream.
Before processing the extent buffer, acquire a read lock on it, so
that we're safe against concurrent updates on the extent buffer.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/btrfs/backref.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 715cfa42e182..53039de1495d 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -954,8 +954,11 @@ again:
ret = -EIO;
goto out;
}
+ btrfs_tree_read_lock(eb);
+ btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
ret = find_extent_in_eb(eb, bytenr,
*extent_item_pos, &eie);
+ btrfs_tree_read_unlock_blocking(eb);
free_extent_buffer(eb);
if (ret < 0)
goto out;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 012/142] Btrfs: fix compressed write corruption on enospc
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (10 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 011/142] Btrfs: read lock extent buffer while walking backrefs Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 013/142] Btrfs: fix crash on endio of reading corrupted block Jiri Slaby
` (131 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Liu Bo, Chris Mason, Jiri Slaby
From: Liu Bo <bo.li.liu@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ce62003f690dff38d3164a632ec69efa15c32cbf upstream.
When failing to allocate space for the whole compressed extent, we'll
fallback to uncompressed IO, but we've forgotten to redirty the pages
which belong to this compressed extent, and these 'clean' pages will
simply skip 'submit' part and go to endio directly, at last we got data
corruption as we write nothing.
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Tested-By: Martin Steigerwald <martin@lichtvoll.de>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/btrfs/inode.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index fa8010c1b628..7e6758d075ad 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -683,6 +683,18 @@ retry:
unlock_extent(io_tree, async_extent->start,
async_extent->start +
async_extent->ram_size - 1);
+
+ /*
+ * we need to redirty the pages if we decide to
+ * fallback to uncompressed IO, otherwise we
+ * will not submit these pages down to lower
+ * layers.
+ */
+ extent_range_redirty_for_io(inode,
+ async_extent->start,
+ async_extent->start +
+ async_extent->ram_size - 1);
+
goto retry;
}
goto out_free;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 013/142] Btrfs: fix crash on endio of reading corrupted block
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (11 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 012/142] Btrfs: fix compressed write corruption on enospc Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 014/142] mei: nfc: fix memory leak in error path Jiri Slaby
` (130 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Liu Bo, Chris Mason, Jiri Slaby
From: Liu Bo <bo.li.liu@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 38c1c2e44bacb37efd68b90b3f70386a8ee370ee upstream.
The crash is
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:2124!
[...]
Workqueue: btrfs-endio normal_work_helper [btrfs]
RIP: 0010:[<ffffffffa02d6055>] [<ffffffffa02d6055>] end_bio_extent_readpage+0xb45/0xcd0 [btrfs]
This is in fact a regression.
It is because we forgot to increase @offset properly in reading corrupted block,
so that the @offset remains, and this leads to checksum errors while reading
left blocks queued up in the same bio, and then ends up with hiting the above
BUG_ON.
Reported-by: Chris Murphy <lists@colorremedies.com>
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/btrfs/extent_io.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index b395791dd923..594bbfd4996e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2485,6 +2485,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
test_bit(BIO_UPTODATE, &bio->bi_flags);
if (err)
uptodate = 0;
+ offset += len;
continue;
}
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 014/142] mei: nfc: fix memory leak in error path
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (12 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 013/142] Btrfs: fix crash on endio of reading corrupted block Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 015/142] ext4: update i_disksize coherently with block allocation on " Jiri Slaby
` (129 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alexander Usyskin, Tomas Winkler, Jiri Slaby
From: Alexander Usyskin <alexander.usyskin@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8e8248b1369c97c7bb6f8bcaee1f05deeabab8ef upstream.
NFC will leak buffer if send failed.
Use single exit point that does the freeing
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/misc/mei/nfc.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
index 994ca4aff1a3..4b7ea3fb143c 100644
--- a/drivers/misc/mei/nfc.c
+++ b/drivers/misc/mei/nfc.c
@@ -342,9 +342,10 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
ndev = (struct mei_nfc_dev *) cldev->priv_data;
dev = ndev->cl->dev;
+ err = -ENOMEM;
mei_buf = kzalloc(length + MEI_NFC_HEADER_SIZE, GFP_KERNEL);
if (!mei_buf)
- return -ENOMEM;
+ goto out;
hdr = (struct mei_nfc_hci_hdr *) mei_buf;
hdr->cmd = MEI_NFC_CMD_HCI_SEND;
@@ -354,12 +355,9 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
hdr->data_size = length;
memcpy(mei_buf + MEI_NFC_HEADER_SIZE, buf, length);
-
err = __mei_cl_send(ndev->cl, mei_buf, length + MEI_NFC_HEADER_SIZE);
if (err < 0)
- return err;
-
- kfree(mei_buf);
+ goto out;
if (!wait_event_interruptible_timeout(ndev->send_wq,
ndev->recv_req_id == ndev->req_id, HZ)) {
@@ -368,7 +366,8 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
} else {
ndev->req_id++;
}
-
+out:
+ kfree(mei_buf);
return err;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 015/142] ext4: update i_disksize coherently with block allocation on error path
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (13 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 014/142] mei: nfc: fix memory leak in error path Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 016/142] jbd2: fix infinite loop when recovering corrupt journal blocks Jiri Slaby
` (128 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dmitry Monakhov, Theodore Ts'o, Jiri Slaby
From: Dmitry Monakhov <dmonakhov@openvz.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6603120e96eae9a5d6228681ae55c7fdc998d1bb upstream.
In case of delalloc block i_disksize may be less than i_size. So we
have to update i_disksize each time we allocated and submitted some
blocks beyond i_disksize. We weren't doing this on the error paths,
so fix this.
testcase: xfstest generic/019
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/inode.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e5d9908c0bc3..d65a6260ad61 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2192,6 +2192,7 @@ static int mpage_map_and_submit_extent(handle_t *handle,
struct ext4_map_blocks *map = &mpd->map;
int err;
loff_t disksize;
+ int progress = 0;
mpd->io_submit.io_end->offset =
((loff_t)map->m_lblk) << inode->i_blkbits;
@@ -2208,8 +2209,11 @@ static int mpage_map_and_submit_extent(handle_t *handle,
* is non-zero, a commit should free up blocks.
*/
if ((err == -ENOMEM) ||
- (err == -ENOSPC && ext4_count_free_clusters(sb)))
+ (err == -ENOSPC && ext4_count_free_clusters(sb))) {
+ if (progress)
+ goto update_disksize;
return err;
+ }
ext4_msg(sb, KERN_CRIT,
"Delayed block allocation failed for "
"inode %lu at logical offset %llu with"
@@ -2226,15 +2230,17 @@ static int mpage_map_and_submit_extent(handle_t *handle,
*give_up_on_write = true;
return err;
}
+ progress = 1;
/*
* Update buffer state, submit mapped pages, and get us new
* extent to map
*/
err = mpage_map_and_submit_buffers(mpd);
if (err < 0)
- return err;
+ goto update_disksize;
} while (map->m_len);
+update_disksize:
/*
* Update on-disk size after IO is submitted. Races with
* truncate are avoided by checking i_size under i_data_sem.
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 016/142] jbd2: fix infinite loop when recovering corrupt journal blocks
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (14 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 015/142] ext4: update i_disksize coherently with block allocation on " Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 017/142] jbd2: fix descriptor block size handling errors with journal_csum Jiri Slaby
` (127 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Darrick J. Wong, Theodore Ts'o, Jiri Slaby
From: "Darrick J. Wong" <darrick.wong@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 022eaa7517017efe4f6538750c2b59a804dc7df7 upstream.
When recovering the journal, don't fall into an infinite loop if we
encounter a corrupt journal block. Instead, just skip the block and
return an error, which fails the mount and thus forces the user to run
a full filesystem fsck.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/jbd2/recovery.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3929c50428b1..9070e485e9e6 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -426,6 +426,7 @@ static int do_one_pass(journal_t *journal,
int tag_bytes = journal_tag_bytes(journal);
__u32 crc32_sum = ~0; /* Transactional Checksums */
int descr_csum_size = 0;
+ int block_error = 0;
/*
* First thing is to establish what we expect to find in the log
@@ -598,7 +599,8 @@ static int do_one_pass(journal_t *journal,
"checksum recovering "
"block %llu in log\n",
blocknr);
- continue;
+ block_error = 1;
+ goto skip_write;
}
/* Find a buffer for the new
@@ -797,7 +799,8 @@ static int do_one_pass(journal_t *journal,
success = -EIO;
}
}
-
+ if (block_error && success == 0)
+ success = -EIO;
return success;
failed:
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 017/142] jbd2: fix descriptor block size handling errors with journal_csum
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (15 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 016/142] jbd2: fix infinite loop when recovering corrupt journal blocks Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 018/142] staging/rtl8188eu: add 0df6:0076 Sitecom Europe B.V Jiri Slaby
` (126 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Darrick J. Wong, Theodore Ts'o, Jiri Slaby
From: "Darrick J. Wong" <darrick.wong@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit db9ee220361de03ee86388f9ea5e529eaad5323c upstream.
It turns out that there are some serious problems with the on-disk
format of journal checksum v2. The foremost is that the function to
calculate descriptor tag size returns sizes that are too big. This
causes alignment issues on some architectures and is compounded by the
fact that some parts of jbd2 use the structure size (incorrectly) to
determine the presence of a 64bit journal instead of checking the
feature flags.
Therefore, introduce journal checksum v3, which enlarges the
descriptor block tag format to allow for full 32-bit checksums of
journal blocks, fix the journal tag function to return the correct
sizes, and fix the jbd2 recovery code to use feature flags to
determine 64bitness.
Add a few function helpers so we don't have to open-code quite so
many pieces.
Switching to a 16-byte block size was found to increase journal size
overhead by a maximum of 0.1%, to convert a 32-bit journal with no
checksumming to a 32-bit journal with checksum v3 enabled.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reported-by: TR Reardon <thomas_reardon@hotmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/super.c | 5 +++--
fs/jbd2/commit.c | 21 +++++++++++---------
fs/jbd2/journal.c | 56 ++++++++++++++++++++++++++++++++++------------------
fs/jbd2/recovery.c | 26 +++++++++++++-----------
fs/jbd2/revoke.c | 6 +++---
include/linux/jbd2.h | 30 +++++++++++++++++++++++-----
6 files changed, 95 insertions(+), 49 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 9afc4ba21611..b52a34bc7600 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3141,9 +3141,9 @@ static int set_journal_csum_feature_set(struct super_block *sb)
if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) {
- /* journal checksum v2 */
+ /* journal checksum v3 */
compat = 0;
- incompat = JBD2_FEATURE_INCOMPAT_CSUM_V2;
+ incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3;
} else {
/* journal checksum v1 */
compat = JBD2_FEATURE_COMPAT_CHECKSUM;
@@ -3165,6 +3165,7 @@ static int set_journal_csum_feature_set(struct super_block *sb)
jbd2_journal_clear_features(sbi->s_journal,
JBD2_FEATURE_COMPAT_CHECKSUM, 0,
JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT |
+ JBD2_FEATURE_INCOMPAT_CSUM_V3 |
JBD2_FEATURE_INCOMPAT_CSUM_V2);
}
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index cf2fc0594063..9181c2b22b3c 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -97,7 +97,7 @@ static void jbd2_commit_block_csum_set(journal_t *j, struct buffer_head *bh)
struct commit_header *h;
__u32 csum;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return;
h = (struct commit_header *)(bh->b_data);
@@ -313,11 +313,11 @@ static __u32 jbd2_checksum_data(__u32 crc32_sum, struct buffer_head *bh)
return checksum;
}
-static void write_tag_block(int tag_bytes, journal_block_tag_t *tag,
+static void write_tag_block(journal_t *j, journal_block_tag_t *tag,
unsigned long long block)
{
tag->t_blocknr = cpu_to_be32(block & (u32)~0);
- if (tag_bytes > JBD2_TAG_SIZE32)
+ if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_64BIT))
tag->t_blocknr_high = cpu_to_be32((block >> 31) >> 1);
}
@@ -327,7 +327,7 @@ static void jbd2_descr_block_csum_set(journal_t *j,
struct jbd2_journal_block_tail *tail;
__u32 csum;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return;
tail = (struct jbd2_journal_block_tail *)(bh->b_data + j->j_blocksize -
@@ -340,12 +340,13 @@ static void jbd2_descr_block_csum_set(journal_t *j,
static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
struct buffer_head *bh, __u32 sequence)
{
+ journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
struct page *page = bh->b_page;
__u8 *addr;
__u32 csum32;
__be32 seq;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return;
seq = cpu_to_be32(sequence);
@@ -355,8 +356,10 @@ static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
bh->b_size);
kunmap_atomic(addr);
- /* We only have space to store the lower 16 bits of the crc32c. */
- tag->t_checksum = cpu_to_be16(csum32);
+ if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+ tag3->t_checksum = cpu_to_be32(csum32);
+ else
+ tag->t_checksum = cpu_to_be16(csum32);
}
/*
* jbd2_journal_commit_transaction
@@ -396,7 +399,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
LIST_HEAD(io_bufs);
LIST_HEAD(log_bufs);
- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
csum_size = sizeof(struct jbd2_journal_block_tail);
/*
@@ -692,7 +695,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
tag_flag |= JBD2_FLAG_SAME_UUID;
tag = (journal_block_tag_t *) tagp;
- write_tag_block(tag_bytes, tag, jh2bh(jh)->b_blocknr);
+ write_tag_block(journal, tag, jh2bh(jh)->b_blocknr);
tag->t_flags = cpu_to_be16(tag_flag);
jbd2_block_tag_csum_set(journal, tag, wbuf[bufs],
commit_transaction->t_tid);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 52032647dd4a..e72faacaf578 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -124,7 +124,7 @@ EXPORT_SYMBOL(__jbd2_debug);
/* Checksumming functions */
int jbd2_verify_csum_type(journal_t *j, journal_superblock_t *sb)
{
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
return sb->s_checksum_type == JBD2_CRC32C_CHKSUM;
@@ -145,7 +145,7 @@ static __be32 jbd2_superblock_csum(journal_t *j, journal_superblock_t *sb)
int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
{
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
return sb->s_checksum == jbd2_superblock_csum(j, sb);
@@ -153,7 +153,7 @@ int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
void jbd2_superblock_csum_set(journal_t *j, journal_superblock_t *sb)
{
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return;
sb->s_checksum = jbd2_superblock_csum(j, sb);
@@ -1524,21 +1524,29 @@ static int journal_get_superblock(journal_t *journal)
goto out;
}
- if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
- JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+ if (jbd2_journal_has_csum_v2or3(journal) &&
+ JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM)) {
/* Can't have checksum v1 and v2 on at the same time! */
printk(KERN_ERR "JBD: Can't enable checksumming v1 and v2 "
"at the same time!\n");
goto out;
}
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) &&
+ JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
+ /* Can't have checksum v2 and v3 at the same time! */
+ printk(KERN_ERR "JBD: Can't enable checksumming v2 and v3 "
+ "at the same time!\n");
+ goto out;
+ }
+
if (!jbd2_verify_csum_type(journal, sb)) {
printk(KERN_ERR "JBD: Unknown checksum type\n");
goto out;
}
/* Load the checksum driver */
- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+ if (jbd2_journal_has_csum_v2or3(journal)) {
journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
if (IS_ERR(journal->j_chksum_driver)) {
printk(KERN_ERR "JBD: Cannot load crc32c driver.\n");
@@ -1555,7 +1563,7 @@ static int journal_get_superblock(journal_t *journal)
}
/* Precompute checksum seed for all metadata */
- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
sizeof(sb->s_uuid));
@@ -1815,8 +1823,14 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
if (!jbd2_journal_check_available_features(journal, compat, ro, incompat))
return 0;
- /* Asking for checksumming v2 and v1? Only give them v2. */
- if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2 &&
+ /* If enabling v2 checksums, turn on v3 instead */
+ if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2) {
+ incompat &= ~JBD2_FEATURE_INCOMPAT_CSUM_V2;
+ incompat |= JBD2_FEATURE_INCOMPAT_CSUM_V3;
+ }
+
+ /* Asking for checksumming v3 and v1? Only give them v3. */
+ if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V3 &&
compat & JBD2_FEATURE_COMPAT_CHECKSUM)
compat &= ~JBD2_FEATURE_COMPAT_CHECKSUM;
@@ -1825,8 +1839,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
sb = journal->j_superblock;
- /* If enabling v2 checksums, update superblock */
- if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+ /* If enabling v3 checksums, update superblock */
+ if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
sb->s_feature_compat &=
~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
@@ -1844,8 +1858,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
}
/* Precompute checksum seed for all metadata */
- if (JBD2_HAS_INCOMPAT_FEATURE(journal,
- JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
journal->j_csum_seed = jbd2_chksum(journal, ~0,
sb->s_uuid,
sizeof(sb->s_uuid));
@@ -1854,7 +1867,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
/* If enabling v1 checksums, downgrade superblock */
if (COMPAT_FEATURE_ON(JBD2_FEATURE_COMPAT_CHECKSUM))
sb->s_feature_incompat &=
- ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2);
+ ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2 |
+ JBD2_FEATURE_INCOMPAT_CSUM_V3);
sb->s_feature_compat |= cpu_to_be32(compat);
sb->s_feature_ro_compat |= cpu_to_be32(ro);
@@ -2167,16 +2181,20 @@ int jbd2_journal_blocks_per_page(struct inode *inode)
*/
size_t journal_tag_bytes(journal_t *journal)
{
- journal_block_tag_t tag;
- size_t x = 0;
+ size_t sz;
+
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+ return sizeof(journal_block_tag3_t);
+
+ sz = sizeof(journal_block_tag_t);
if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
- x += sizeof(tag.t_checksum);
+ sz += sizeof(__u16);
if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
- return x + JBD2_TAG_SIZE64;
+ return sz;
else
- return x + JBD2_TAG_SIZE32;
+ return sz - sizeof(__u32);
}
/*
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 9070e485e9e6..20dbfabbf874 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -181,7 +181,7 @@ static int jbd2_descr_block_csum_verify(journal_t *j,
__be32 provided;
__u32 calculated;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
tail = (struct jbd2_journal_block_tail *)(buf + j->j_blocksize -
@@ -205,7 +205,7 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
int nr = 0, size = journal->j_blocksize;
int tag_bytes = journal_tag_bytes(journal);
- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
size -= sizeof(struct jbd2_journal_block_tail);
tagp = &bh->b_data[sizeof(journal_header_t)];
@@ -338,10 +338,11 @@ int jbd2_journal_skip_recovery(journal_t *journal)
return err;
}
-static inline unsigned long long read_tag_block(int tag_bytes, journal_block_tag_t *tag)
+static inline unsigned long long read_tag_block(journal_t *journal,
+ journal_block_tag_t *tag)
{
unsigned long long block = be32_to_cpu(tag->t_blocknr);
- if (tag_bytes > JBD2_TAG_SIZE32)
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
return block;
}
@@ -384,7 +385,7 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
__be32 provided;
__u32 calculated;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
h = buf;
@@ -399,17 +400,21 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
void *buf, __u32 sequence)
{
+ journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
__u32 csum32;
__be32 seq;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
seq = cpu_to_be32(sequence);
csum32 = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&seq, sizeof(seq));
csum32 = jbd2_chksum(j, csum32, buf, j->j_blocksize);
- return tag->t_checksum == cpu_to_be16(csum32);
+ if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+ return tag3->t_checksum == cpu_to_be32(csum32);
+ else
+ return tag->t_checksum == cpu_to_be16(csum32);
}
static int do_one_pass(journal_t *journal,
@@ -513,8 +518,7 @@ static int do_one_pass(journal_t *journal,
switch(blocktype) {
case JBD2_DESCRIPTOR_BLOCK:
/* Verify checksum first */
- if (JBD2_HAS_INCOMPAT_FEATURE(journal,
- JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
descr_csum_size =
sizeof(struct jbd2_journal_block_tail);
if (descr_csum_size > 0 &&
@@ -575,7 +579,7 @@ static int do_one_pass(journal_t *journal,
unsigned long long blocknr;
J_ASSERT(obh != NULL);
- blocknr = read_tag_block(tag_bytes,
+ blocknr = read_tag_block(journal,
tag);
/* If the block has been
@@ -814,7 +818,7 @@ static int jbd2_revoke_block_csum_verify(journal_t *j,
__be32 provided;
__u32 calculated;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return 1;
tail = (struct jbd2_journal_revoke_tail *)(buf + j->j_blocksize -
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 198c9c10276d..d5e95a175c92 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -91,8 +91,8 @@
#include <linux/list.h>
#include <linux/init.h>
#include <linux/bio.h>
-#endif
#include <linux/log2.h>
+#endif
static struct kmem_cache *jbd2_revoke_record_cache;
static struct kmem_cache *jbd2_revoke_table_cache;
@@ -597,7 +597,7 @@ static void write_one_revoke_record(journal_t *journal,
offset = *offsetp;
/* Do we need to leave space at the end for a checksum? */
- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (jbd2_journal_has_csum_v2or3(journal))
csum_size = sizeof(struct jbd2_journal_revoke_tail);
/* Make sure we have a descriptor with space left for the record */
@@ -644,7 +644,7 @@ static void jbd2_revoke_csum_set(journal_t *j, struct buffer_head *bh)
struct jbd2_journal_revoke_tail *tail;
__u32 csum;
- if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+ if (!jbd2_journal_has_csum_v2or3(j))
return;
tail = (struct jbd2_journal_revoke_tail *)(bh->b_data + j->j_blocksize -
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index d5b50a19463c..0dae71e9971c 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -159,7 +159,11 @@ typedef struct journal_header_s
* journal_block_tag (in the descriptor). The other h_chksum* fields are
* not used.
*
- * Checksum v1 and v2 are mutually exclusive features.
+ * If FEATURE_INCOMPAT_CSUM_V3 is set, the descriptor block uses
+ * journal_block_tag3_t to store a full 32-bit checksum. Everything else
+ * is the same as v2.
+ *
+ * Checksum v1, v2, and v3 are mutually exclusive features.
*/
struct commit_header {
__be32 h_magic;
@@ -179,6 +183,14 @@ struct commit_header {
* raw struct shouldn't be used for pointer math or sizeof() - use
* journal_tag_bytes(journal) instead to compute this.
*/
+typedef struct journal_block_tag3_s
+{
+ __be32 t_blocknr; /* The on-disk block number */
+ __be32 t_flags; /* See below */
+ __be32 t_blocknr_high; /* most-significant high 32bits. */
+ __be32 t_checksum; /* crc32c(uuid+seq+block) */
+} journal_block_tag3_t;
+
typedef struct journal_block_tag_s
{
__be32 t_blocknr; /* The on-disk block number */
@@ -187,9 +199,6 @@ typedef struct journal_block_tag_s
__be32 t_blocknr_high; /* most-significant high 32bits. */
} journal_block_tag_t;
-#define JBD2_TAG_SIZE32 (offsetof(journal_block_tag_t, t_blocknr_high))
-#define JBD2_TAG_SIZE64 (sizeof(journal_block_tag_t))
-
/* Tail of descriptor block, for checksumming */
struct jbd2_journal_block_tail {
__be32 t_checksum; /* crc32c(uuid+descr_block) */
@@ -284,6 +293,7 @@ typedef struct journal_superblock_s
#define JBD2_FEATURE_INCOMPAT_64BIT 0x00000002
#define JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT 0x00000004
#define JBD2_FEATURE_INCOMPAT_CSUM_V2 0x00000008
+#define JBD2_FEATURE_INCOMPAT_CSUM_V3 0x00000010
/* Features known to this kernel version: */
#define JBD2_KNOWN_COMPAT_FEATURES JBD2_FEATURE_COMPAT_CHECKSUM
@@ -291,7 +301,8 @@ typedef struct journal_superblock_s
#define JBD2_KNOWN_INCOMPAT_FEATURES (JBD2_FEATURE_INCOMPAT_REVOKE | \
JBD2_FEATURE_INCOMPAT_64BIT | \
JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT | \
- JBD2_FEATURE_INCOMPAT_CSUM_V2)
+ JBD2_FEATURE_INCOMPAT_CSUM_V2 | \
+ JBD2_FEATURE_INCOMPAT_CSUM_V3)
#ifdef __KERNEL__
@@ -1296,6 +1307,15 @@ static inline int tid_geq(tid_t x, tid_t y)
extern int jbd2_journal_blocks_per_page(struct inode *inode);
extern size_t journal_tag_bytes(journal_t *journal);
+static inline int jbd2_journal_has_csum_v2or3(journal_t *journal)
+{
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) ||
+ JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+ return 1;
+
+ return 0;
+}
+
/*
* We reserve t_outstanding_credits >> JBD2_CONTROL_BLOCKS_SHIFT for
* transaction control blocks.
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 018/142] staging/rtl8188eu: add 0df6:0076 Sitecom Europe B.V.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (16 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 017/142] jbd2: fix descriptor block size handling errors with journal_csum Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 019/142] staging: r8188eu: Add new USB ID Jiri Slaby
` (125 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Holger Paradies, Larry Finger, Jiri Slaby
From: Holger Paradies <retabell@gmx.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8626d524ef08f10fccc0c41e5f75aef8235edf47 upstream.
The stick is not recognized.
This dongle uses r8188eu but usb-id is missing.
3.16.0
Signed-off-by: Holger Paradies <retabell@gmx.de>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 85f692ddd992..899c91bd1ad1 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -56,6 +56,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
{USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
{} /* Terminating entry */
};
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 019/142] staging: r8188eu: Add new USB ID
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (17 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 018/142] staging/rtl8188eu: add 0df6:0076 Sitecom Europe B.V Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 020/142] xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL Jiri Slaby
` (124 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a2fa6721c7237b5a666f16f732628c0c09c0b954 upstream.
The Elecom WDC-150SU2M uses this chip.
Reported-by: Hiroki Kondo <kompiro@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 899c91bd1ad1..d1eea2d426bd 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -53,6 +53,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
/*=== Customer ID ===*/
/****** 8188EUS ********/
+ {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
{USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 020/142] xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (18 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 019/142] staging: r8188eu: Add new USB ID Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 021/142] usb: xhci: amd chipset also needs short TX quirk Jiri Slaby
` (123 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hans de Goede, Mathias Nyman, Jiri Slaby
From: Hans de Goede <hdegoede@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9a54886342e227433aebc9d374f8ae268a836475 upstream.
When using a Renesas uPD720231 chipset usb-3 uas to sata bridge with a 120G
Crucial M500 ssd, model string: Crucial_ CT120M500SSD1, together with a
the integrated Intel xhci controller on a Haswell laptop:
00:14.0 USB controller [0c03]: Intel Corporation 8 Series USB xHCI HC [8086:9c31] (rev 04)
The following error gets logged to dmesg:
xhci error: Transfer event TRB DMA ptr not part of current TD
Treating COMP_STOP the same as COMP_STOP_INVAL when no event_seg gets found
fixes this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-ring.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6118e292d5df..46ad9f3f589d 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2579,7 +2579,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
* last TRB of the previous TD. The command completion handle
* will take care the rest.
*/
- if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
+ if (!event_seg && (trb_comp_code == COMP_STOP ||
+ trb_comp_code == COMP_STOP_INVAL)) {
ret = 0;
goto cleanup;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 021/142] usb: xhci: amd chipset also needs short TX quirk
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (19 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 020/142] xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 022/142] USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID Jiri Slaby
` (122 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Huang Rui, Mathias Nyman, Jiri Slaby
From: Huang Rui <ray.huang@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2597fe99bb0259387111d0431691f5daac84f5a5 upstream.
AMD xHC also needs short tx quirk after tested on most of chipset
generations. That's because there is the same incorrect behavior like
Fresco Logic host. Please see below message with on USB webcam
attached on xHC host:
[ 139.262944] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.266934] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.270913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.274937] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.278914] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.282936] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.286915] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.290938] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.294913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[ 139.298917] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
Reported-by: Arindam Nath <arindam.nath@amd.com>
Tested-by: Shriraj-Rai P <shriraj-rai.p@amd.com>
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-pci.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index f34b42e4c391..1cfe0c743092 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -101,6 +101,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
/* AMD PLL quirk */
if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
xhci->quirks |= XHCI_AMD_PLL_FIX;
+
+ if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
xhci->quirks |= XHCI_LPM_SUPPORT;
xhci->quirks |= XHCI_INTEL_HOST;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 022/142] USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (20 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 021/142] usb: xhci: amd chipset also needs short TX quirk Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 023/142] USB: ftdi_sio: Added PID for new ekey device Jiri Slaby
` (121 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Johan Hovold, Jiri Slaby
From: Johan Hovold <johan@kernel.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 upstream.
Add device id for Basic Micro ATOM Nano USB2Serial adapters.
Reported-by: Nicolas Alt <n.alt@mytum.de>
Tested-by: Nicolas Alt <n.alt@mytum.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 2 ++
2 files changed, 3 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index bac979402ce3..b370cc8f0b96 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -152,6 +152,7 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1e58d90a0b6c..3168a0191973 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -42,6 +42,8 @@
/* www.candapter.com Ewert Energy Systems CANdapter device */
#define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+#define FTDI_BM_ATOM_NANO_PID 0xa559 /* Basic Micro ATOM Nano USB2Serial */
+
/*
* Texas Instruments XDS100v2 JTAG / BeagleBone A3
* http://processors.wiki.ti.com/index.php/XDS100
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 023/142] USB: ftdi_sio: Added PID for new ekey device
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (21 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 022/142] USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 024/142] USB: whiteheat: Added bounds checking for bulk command response Jiri Slaby
` (120 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jaša Bartelj, Johan Hovold, Jiri Slaby
From: Jaša Bartelj <jasa.bartelj@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 646907f5bfb0782c731ae9ff6fb63471a3566132 upstream.
Added support to the ftdi_sio driver for ekey Converter USB which
uses an FT232BM chip.
Signed-off-by: Jaša Bartelj <jasa.bartelj@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
2 files changed, 7 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b370cc8f0b96..bb68ed5cd3bc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -949,6 +949,8 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ /* ekey Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
/* Infineon Devices */
{ USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
{ } /* Terminating entry */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 3168a0191973..70b0b1d88ae9 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1380,3 +1380,8 @@
#define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
#define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
#define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+
+/*
+ * ekey biometric systems GmbH (http://ekey.net/)
+ */
+#define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 024/142] USB: whiteheat: Added bounds checking for bulk command response
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (22 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 023/142] USB: ftdi_sio: Added PID for new ekey device Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 025/142] usb: ehci: using wIndex + 1 for hub port Jiri Slaby
` (119 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, James Forshaw, Jiri Slaby
From: James Forshaw <forshaw@google.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6817ae225cd650fb1c3295d769298c38b1eba818 upstream.
This patch fixes a potential security issue in the whiteheat USB driver
which might allow a local attacker to cause kernel memory corrpution. This
is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
EHCI and XHCI busses it's possible to craft responses greater than 64
bytes leading a buffer overflow.
Signed-off-by: James Forshaw <forshaw@google.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/whiteheat.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 36a7740e827c..cc5a430dc357 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -521,6 +521,10 @@ static void command_port_read_callback(struct urb *urb)
dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
return;
}
+ if (!urb->actual_length) {
+ dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
+ return;
+ }
if (status) {
dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
if (status != -ENOENT)
@@ -541,7 +545,8 @@ static void command_port_read_callback(struct urb *urb)
/* These are unsolicited reports from the firmware, hence no
waiting command to wakeup */
dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
- } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
+ } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
+ (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
memcpy(command_info->result_buffer, &data[1],
urb->actual_length - 1);
command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 025/142] usb: ehci: using wIndex + 1 for hub port
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (23 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 024/142] USB: whiteheat: Added bounds checking for bulk command response Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 026/142] usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1 Jiri Slaby
` (118 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Peter Chen, Jiri Slaby
From: Peter Chen <peter.chen@freescale.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5cbcc35e5bf0eae3c7494ce3efefffc9977827ae upstream.
The roothub's index per controller is from 0, but the hub port index per hub
is from 1, this patch fixes "can't find device at roohub" problem for connecting
test fixture at roohub when do USB-IF Embedded Host High-Speed Electrical Test.
This patch is for v3.12+.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/ehci-hub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 1bb85bee2625..7ba861543d03 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1241,7 +1241,7 @@ static int ehci_hub_control (
if (selector == EHSET_TEST_SINGLE_STEP_SET_FEATURE) {
spin_unlock_irqrestore(&ehci->lock, flags);
retval = ehset_single_step_set_feature(hcd,
- wIndex);
+ wIndex + 1);
spin_lock_irqsave(&ehci->lock, flags);
break;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 026/142] usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (24 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 025/142] usb: ehci: using wIndex + 1 for hub port Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 027/142] NFSD: Decrease nfsd_users in nfsd_startup_generic fail Jiri Slaby
` (117 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Roger Quadros, Jiri Slaby
From: Roger Quadros <rogerq@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bdd405d2a5287bdb9b04670ea255e1f122138e66 upstream.
If user specifies that USB autosuspend must be disabled by module
parameter "usbcore.autosuspend=-1" then we must prevent
autosuspend of USB hub devices as well.
commit 596d789a211d introduced in v3.8 changed the original behaivour
and stopped respecting the usbcore.autosuspend parameter for hubs.
Fixes: 596d789a211d "USB: set hub's default autosuspend delay as 0"
Signed-off-by: Roger Quadros <rogerq@ti.com>
Tested-by: Michael Welling <mwelling@emacinc.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/core/hub.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 557e8a9fe58a..156fe93fb3d9 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1704,8 +1704,12 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
* - Change autosuspend delay of hub can avoid unnecessary auto
* suspend timer for hub, also may decrease power consumption
* of USB bus.
+ *
+ * - If user has indicated to prevent autosuspend by passing
+ * usbcore.autosuspend = -1 then keep autosuspend disabled.
*/
- pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+ if (hdev->dev.power.autosuspend_delay >= 0)
+ pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
/*
* Hubs have proper suspend/resume support, except for root hubs
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 027/142] NFSD: Decrease nfsd_users in nfsd_startup_generic fail
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (25 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 026/142] usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1 Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:43 ` [PATCH 3.12 028/142] svcrdma: Select NFSv4.1 backchannel transport based on forward channel Jiri Slaby
` (116 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kinglong Mee, J. Bruce Fields, Jiri Slaby
From: Kinglong Mee <kinglongmee@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d9499a95716db0d4bc9b67e88fd162133e7d6b08 upstream.
A memory allocation failure could cause nfsd_startup_generic to fail, in
which case nfsd_users wouldn't be incorrectly left elevated.
After nfsd restarts nfsd_startup_generic will then succeed without doing
anything--the first consequence is likely nfs4_start_net finding a bad
laundry_wq and crashing.
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Fixes: 4539f14981ce "nfsd: replace boolean nfsd_up flag by users counter"
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfssvc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 760c85a6f534..4942f4370f60 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -221,7 +221,8 @@ static int nfsd_startup_generic(int nrservs)
*/
ret = nfsd_racache_init(2*nrservs);
if (ret)
- return ret;
+ goto dec_users;
+
ret = nfs4_state_start();
if (ret)
goto out_racache;
@@ -229,6 +230,8 @@ static int nfsd_startup_generic(int nrservs)
out_racache:
nfsd_racache_shutdown();
+dec_users:
+ nfsd_users--;
return ret;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 028/142] svcrdma: Select NFSv4.1 backchannel transport based on forward channel
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (26 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 027/142] NFSD: Decrease nfsd_users in nfsd_startup_generic fail Jiri Slaby
@ 2014-09-26 9:43 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 029/142] NFSv4: Fix problems with close in the presence of a delegation Jiri Slaby
` (115 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:43 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Chuck Lever, J. Bruce Fields, Jiri Slaby
From: Chuck Lever <chuck.lever@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3c45ddf823d679a820adddd53b52c6699c9a05ac upstream.
The current code always selects XPRT_TRANSPORT_BC_TCP for the back
channel, even when the forward channel was not TCP (eg, RDMA). When
a 4.1 mount is attempted with RDMA, the server panics in the TCP BC
code when trying to send CB_NULL.
Instead, construct the transport protocol number from the forward
channel transport or'd with XPRT_TRANSPORT_BC. Transports that do
not support bi-directional RPC will not have registered a "BC"
transport, causing create_backchannel_client() to fail immediately.
Fixes: https://bugzilla.linux-nfs.org/show_bug.cgi?id=265
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4callback.c | 3 ++-
include/linux/sunrpc/svc_xprt.h | 1 +
net/sunrpc/svcsock.c | 2 ++
net/sunrpc/xprt.c | 2 +-
net/sunrpc/xprtrdma/svc_rdma_transport.c | 1 +
5 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 3eaa6e30a2dc..cc8c5b32043c 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -672,7 +672,8 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
clp->cl_cb_session = ses;
args.bc_xprt = conn->cb_xprt;
args.prognumber = clp->cl_cb_session->se_cb_prog;
- args.protocol = XPRT_TRANSPORT_BC_TCP;
+ args.protocol = conn->cb_xprt->xpt_class->xcl_ident |
+ XPRT_TRANSPORT_BC;
args.authflavor = ses->se_cb_sec.flavor;
}
/* Create RPC client */
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index b05963f09ebf..f5bfb1a80abe 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -32,6 +32,7 @@ struct svc_xprt_class {
struct svc_xprt_ops *xcl_ops;
struct list_head xcl_list;
u32 xcl_max_payload;
+ int xcl_ident;
};
/*
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 6ac0f1c3fc28..8c6e9c75c525 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -683,6 +683,7 @@ static struct svc_xprt_class svc_udp_class = {
.xcl_owner = THIS_MODULE,
.xcl_ops = &svc_udp_ops,
.xcl_max_payload = RPCSVC_MAXPAYLOAD_UDP,
+ .xcl_ident = XPRT_TRANSPORT_UDP,
};
static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
@@ -1277,6 +1278,7 @@ static struct svc_xprt_class svc_tcp_class = {
.xcl_owner = THIS_MODULE,
.xcl_ops = &svc_tcp_ops,
.xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
+ .xcl_ident = XPRT_TRANSPORT_TCP,
};
void svc_init_xprt_sock(void)
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 095363eee764..42ce6bfc729d 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1290,7 +1290,7 @@ struct rpc_xprt *xprt_create_transport(struct xprt_create *args)
}
}
spin_unlock(&xprt_list_lock);
- printk(KERN_ERR "RPC: transport (%d) not supported\n", args->ident);
+ dprintk("RPC: transport (%d) not supported\n", args->ident);
return ERR_PTR(-EIO);
found:
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 62e4f9bcc387..ed36cb52cd86 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -89,6 +89,7 @@ struct svc_xprt_class svc_rdma_class = {
.xcl_owner = THIS_MODULE,
.xcl_ops = &svc_rdma_ops,
.xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
+ .xcl_ident = XPRT_TRANSPORT_RDMA,
};
struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 029/142] NFSv4: Fix problems with close in the presence of a delegation
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (27 preceding siblings ...)
2014-09-26 9:43 ` [PATCH 3.12 028/142] svcrdma: Select NFSv4.1 backchannel transport based on forward channel Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 030/142] vm_is_stack: use for_each_thread() rather then buggy while_each_thread() Jiri Slaby
` (114 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Trond Myklebust, Jiri Slaby
From: Trond Myklebust <trond.myklebust@primarydata.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aee7af356e151494d5014f57b33460b162f181b5 upstream.
In the presence of delegations, we can no longer assume that the
state->n_rdwr, state->n_rdonly, state->n_wronly reflect the open
stateid share mode, and so we need to calculate the initial value
for calldata->arg.fmode using the state->flags.
Reported-by: James Drews <drews@engr.wisc.edu>
Fixes: 88069f77e1ac5 (NFSv41: Fix a potential state leakage when...)
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfs/nfs4proc.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 40062e42c955..067d8c90eb1a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2532,6 +2532,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
struct nfs4_closedata *calldata = data;
struct nfs4_state *state = calldata->state;
struct inode *inode = calldata->inode;
+ bool is_rdonly, is_wronly, is_rdwr;
int call_close = 0;
dprintk("%s: begin!\n", __func__);
@@ -2539,18 +2540,24 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
goto out_wait;
task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
- calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
spin_lock(&state->owner->so_lock);
+ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+ /* Calculate the current open share mode */
+ calldata->arg.fmode = 0;
+ if (is_rdonly || is_rdwr)
+ calldata->arg.fmode |= FMODE_READ;
+ if (is_wronly || is_rdwr)
+ calldata->arg.fmode |= FMODE_WRITE;
/* Calculate the change in open mode */
if (state->n_rdwr == 0) {
if (state->n_rdonly == 0) {
- call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+ call_close |= is_rdonly || is_rdwr;
calldata->arg.fmode &= ~FMODE_READ;
}
if (state->n_wronly == 0) {
- call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+ call_close |= is_wronly || is_rdwr;
calldata->arg.fmode &= ~FMODE_WRITE;
}
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 030/142] vm_is_stack: use for_each_thread() rather then buggy while_each_thread()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (28 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 029/142] NFSv4: Fix problems with close in the presence of a delegation Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 031/142] USB: fix build error with CONFIG_PM_RUNTIME disabled Jiri Slaby
` (113 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Oleg Nesterov, Andrew Morton, Linus Torvalds,
Jiri Slaby
From: Oleg Nesterov <oleg@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4449a51a7c281602d3a385044ab928322a122a02 upstream.
Aleksei hit the soft lockup during reading /proc/PID/smaps. David
investigated the problem and suggested the right fix.
while_each_thread() is racy and should die, this patch updates
vm_is_stack().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Aleksei Besogonov <alex.besogonov@gmail.com>
Tested-by: Aleksei Besogonov <alex.besogonov@gmail.com>
Suggested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
mm/util.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/mm/util.c b/mm/util.c
index 96da2d7c076c..de943ec0a4c8 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -272,17 +272,14 @@ pid_t vm_is_stack(struct task_struct *task,
if (in_group) {
struct task_struct *t;
- rcu_read_lock();
- if (!pid_alive(task))
- goto done;
- t = task;
- do {
+ rcu_read_lock();
+ for_each_thread(task, t) {
if (vm_is_stack_for_task(t, vma)) {
ret = t->pid;
goto done;
}
- } while_each_thread(task, t);
+ }
done:
rcu_read_unlock();
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 031/142] USB: fix build error with CONFIG_PM_RUNTIME disabled
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (29 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 030/142] vm_is_stack: use for_each_thread() rather then buggy while_each_thread() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 032/142] media: xc5000: Fix get_frequency() Jiri Slaby
` (112 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Greg Kroah-Hartman, Roger Quadros, Michael Welling,
Alan Stern, Jiri Slaby
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a9ef803d740bfadf5e505fbc57efa57692e27025 upstream.
commit bdd405d2a528 ("usb: hub: Prevent hub autosuspend if
usbcore.autosuspend is -1") causes a build error if CONFIG_PM_RUNTIME is
disabled. Fix that by doing a simple #ifdef guard around it.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Cc: Roger Quadros <rogerq@ti.com>
Cc: Michael Welling <mwelling@emacinc.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/core/hub.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 156fe93fb3d9..721de375c543 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1708,8 +1708,10 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
* - If user has indicated to prevent autosuspend by passing
* usbcore.autosuspend = -1 then keep autosuspend disabled.
*/
+#ifdef CONFIG_PM_RUNTIME
if (hdev->dev.power.autosuspend_delay >= 0)
pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+#endif
/*
* Hubs have proper suspend/resume support, except for root hubs
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 032/142] media: xc5000: Fix get_frequency()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (30 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 031/142] USB: fix build error with CONFIG_PM_RUNTIME disabled Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 033/142] media: xc4000: " Jiri Slaby
` (111 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mauro Carvalho Chehab, Jiri Slaby
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a3eec916cbc17dc1aaa3ddf120836cd5200eb4ef upstream.
The programmed frequency on xc5000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/tuners/xc5000.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index 5cd09a681b6a..b2d9e9cb97f7 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -55,7 +55,7 @@ struct xc5000_priv {
u32 if_khz;
u16 xtal_khz;
- u32 freq_hz;
+ u32 freq_hz, freq_offset;
u32 bandwidth;
u8 video_standard;
u8 rf_mode;
@@ -755,13 +755,13 @@ static int xc5000_set_params(struct dvb_frontend *fe)
case SYS_ATSC:
dprintk(1, "%s() VSB modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_AIR;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = DTV6;
break;
case SYS_DVBC_ANNEX_B:
dprintk(1, "%s() QAM modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_CABLE;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = DTV6;
break;
case SYS_ISDBT:
@@ -776,15 +776,15 @@ static int xc5000_set_params(struct dvb_frontend *fe)
switch (bw) {
case 6000000:
priv->video_standard = DTV6;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
break;
case 7000000:
priv->video_standard = DTV7;
- priv->freq_hz = freq - 2250000;
+ priv->freq_offset = 2250000;
break;
case 8000000:
priv->video_standard = DTV8;
- priv->freq_hz = freq - 2750000;
+ priv->freq_offset = 2750000;
break;
default:
printk(KERN_ERR "xc5000 bandwidth not set!\n");
@@ -798,15 +798,15 @@ static int xc5000_set_params(struct dvb_frontend *fe)
priv->rf_mode = XC_RF_MODE_CABLE;
if (bw <= 6000000) {
priv->video_standard = DTV6;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
b = 6;
} else if (bw <= 7000000) {
priv->video_standard = DTV7;
- priv->freq_hz = freq - 2250000;
+ priv->freq_offset = 2250000;
b = 7;
} else {
priv->video_standard = DTV7_8;
- priv->freq_hz = freq - 2750000;
+ priv->freq_offset = 2750000;
b = 8;
}
dprintk(1, "%s() Bandwidth %dMHz (%d)\n", __func__,
@@ -817,6 +817,8 @@ static int xc5000_set_params(struct dvb_frontend *fe)
return -EINVAL;
}
+ priv->freq_hz = freq - priv->freq_offset;
+
dprintk(1, "%s() frequency=%d (compensated to %d)\n",
__func__, freq, priv->freq_hz);
@@ -1067,7 +1069,7 @@ static int xc5000_get_frequency(struct dvb_frontend *fe, u32 *freq)
{
struct xc5000_priv *priv = fe->tuner_priv;
dprintk(1, "%s()\n", __func__);
- *freq = priv->freq_hz;
+ *freq = priv->freq_hz + priv->freq_offset;
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 033/142] media: xc4000: Fix get_frequency()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (31 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 032/142] media: xc5000: Fix get_frequency() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 034/142] media: au0828: Only alt setting logic when needed Jiri Slaby
` (110 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mauro Carvalho Chehab, Jiri Slaby
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4c07e32884ab69574cfd9eb4de3334233c938071 upstream.
The programmed frequency on xc4000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
This works fine on set_frontend, as the device calculates
the needed offset. However, at get_frequency(), the returned
value is the initial frequency. That's generally not a big
problem on most drivers, however, starting with changeset
6fe1099c7aec, the frequency drift is taken into account at
dib7000p driver.
This broke support for PCTV 340e, with uses dib7000p demod and
xc4000 tuner.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/tuners/xc4000.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
index 2018befabb5a..e71decbfd0af 100644
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -93,7 +93,7 @@ struct xc4000_priv {
struct firmware_description *firm;
int firm_size;
u32 if_khz;
- u32 freq_hz;
+ u32 freq_hz, freq_offset;
u32 bandwidth;
u8 video_standard;
u8 rf_mode;
@@ -1157,14 +1157,14 @@ static int xc4000_set_params(struct dvb_frontend *fe)
case SYS_ATSC:
dprintk(1, "%s() VSB modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_AIR;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = XC4000_DTV6;
type = DTV6;
break;
case SYS_DVBC_ANNEX_B:
dprintk(1, "%s() QAM modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_CABLE;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = XC4000_DTV6;
type = DTV6;
break;
@@ -1173,23 +1173,23 @@ static int xc4000_set_params(struct dvb_frontend *fe)
dprintk(1, "%s() OFDM\n", __func__);
if (bw == 0) {
if (c->frequency < 400000000) {
- priv->freq_hz = c->frequency - 2250000;
+ priv->freq_offset = 2250000;
} else {
- priv->freq_hz = c->frequency - 2750000;
+ priv->freq_offset = 2750000;
}
priv->video_standard = XC4000_DTV7_8;
type = DTV78;
} else if (bw <= 6000000) {
priv->video_standard = XC4000_DTV6;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
type = DTV6;
} else if (bw <= 7000000) {
priv->video_standard = XC4000_DTV7;
- priv->freq_hz = c->frequency - 2250000;
+ priv->freq_offset = 2250000;
type = DTV7;
} else {
priv->video_standard = XC4000_DTV8;
- priv->freq_hz = c->frequency - 2750000;
+ priv->freq_offset = 2750000;
type = DTV8;
}
priv->rf_mode = XC_RF_MODE_AIR;
@@ -1200,6 +1200,8 @@ static int xc4000_set_params(struct dvb_frontend *fe)
goto fail;
}
+ priv->freq_hz = c->frequency - priv->freq_offset;
+
dprintk(1, "%s() frequency=%d (compensated)\n",
__func__, priv->freq_hz);
@@ -1520,7 +1522,7 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq)
{
struct xc4000_priv *priv = fe->tuner_priv;
- *freq = priv->freq_hz;
+ *freq = priv->freq_hz + priv->freq_offset;
if (debug) {
mutex_lock(&priv->lock);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 034/142] media: au0828: Only alt setting logic when needed
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (32 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 033/142] media: xc4000: " Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 035/142] media: media-device: Remove duplicated memset() in media_enum_entities() Jiri Slaby
` (109 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mauro Carvalho Chehab, Jiri Slaby
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 64ea37bbd8a5815522706f0099ad3f11c7537e15 upstream.
It seems that there's a bug at au0828 hardware/firmware
related to alternate setting: when the device is already at
alt 5, a further call causes the URBs to receive -ESHUTDOWN.
I found two different encarnations of this issue:
1) at qv4l2, it fails the second time we try to open the
video screen;
2) at xawtv, when audio underrun occurs, with is very
frequent, at least on my test machine.
The fix is simple: just check if alt=5 before calling
set_usb_interface().
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/usb/au0828/au0828-video.c | 34 ++++++++++++++++-----------------
1 file changed, 17 insertions(+), 17 deletions(-)
diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
index f6154546b5c0..7ed75efa1c36 100644
--- a/drivers/media/usb/au0828/au0828-video.c
+++ b/drivers/media/usb/au0828/au0828-video.c
@@ -787,11 +787,27 @@ static int au0828_i2s_init(struct au0828_dev *dev)
/*
* Auvitek au0828 analog stream enable
- * Please set interface0 to AS5 before enable the stream
*/
static int au0828_analog_stream_enable(struct au0828_dev *d)
{
+ struct usb_interface *iface;
+ int ret;
+
dprintk(1, "au0828_analog_stream_enable called\n");
+
+ iface = usb_ifnum_to_if(d->usbdev, 0);
+ if (iface && iface->cur_altsetting->desc.bAlternateSetting != 5) {
+ dprintk(1, "Changing intf#0 to alt 5\n");
+ /* set au0828 interface0 to AS5 here again */
+ ret = usb_set_interface(d->usbdev, 0, 5);
+ if (ret < 0) {
+ printk(KERN_INFO "Au0828 can't set alt setting to 5!\n");
+ return -EBUSY;
+ }
+ }
+
+ /* FIXME: size should be calculated using d->width, d->height */
+
au0828_writereg(d, AU0828_SENSORCTRL_VBI_103, 0x00);
au0828_writereg(d, 0x106, 0x00);
/* set x position */
@@ -1002,15 +1018,6 @@ static int au0828_v4l2_open(struct file *filp)
return -ERESTARTSYS;
}
if (dev->users == 0) {
- /* set au0828 interface0 to AS5 here again */
- ret = usb_set_interface(dev->usbdev, 0, 5);
- if (ret < 0) {
- mutex_unlock(&dev->lock);
- printk(KERN_INFO "Au0828 can't set alternate to 5!\n");
- kfree(fh);
- return -EBUSY;
- }
-
au0828_analog_stream_enable(dev);
au0828_analog_stream_reset(dev);
@@ -1252,13 +1259,6 @@ static int au0828_set_format(struct au0828_dev *dev, unsigned int cmd,
}
}
- /* set au0828 interface0 to AS5 here again */
- ret = usb_set_interface(dev->usbdev, 0, 5);
- if (ret < 0) {
- printk(KERN_INFO "Au0828 can't set alt setting to 5!\n");
- return -EBUSY;
- }
-
au0828_analog_stream_enable(dev);
return 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 035/142] media: media-device: Remove duplicated memset() in media_enum_entities()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (33 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 034/142] media: au0828: Only alt setting logic when needed Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 036/142] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field Jiri Slaby
` (108 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Salva Peiró, Laurent Pinchart,
Mauro Carvalho Chehab, Jiri Slaby
From: Salva Peiró <speiro@ai2.upv.es>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f8ca6ac00d2ba24c5557f08f81439cd3432f0802 upstream.
After the zeroing the whole struct struct media_entity_desc u_ent,
it is no longer necessary to memset(0) its u_ent.name field.
Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/media-device.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 703560fa5e73..88c1606fd555 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -106,8 +106,6 @@ static long media_device_enum_entities(struct media_device *mdev,
if (ent->name) {
strncpy(u_ent.name, ent->name, sizeof(u_ent.name));
u_ent.name[sizeof(u_ent.name) - 1] = '\0';
- } else {
- memset(u_ent.name, 0, sizeof(u_ent.name));
}
u_ent.type = ent->type;
u_ent.revision = ent->revision;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 036/142] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (34 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 035/142] media: media-device: Remove duplicated memset() in media_enum_entities() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 037/142] media: sms: Remove CONFIG_ prefix from Kconfig symbols Jiri Slaby
` (107 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Laurent Pinchart, Mauro Carvalho Chehab, Jiri Slaby
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e51daefc228aa164adcc17fe8fce0f856ad0a1cc upstream.
The field is assigned but never read, remove it.
This fixes a bug caused by the struct vb2_buffer field not being be the
very first field of the vsp1_video_buffer buffer structure as required
by videobuf2.
Reported-by: Takanari Hayama <taki@igel.co.jp>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/platform/vsp1/vsp1_video.c | 2 --
drivers/media/platform/vsp1/vsp1_video.h | 1 -
2 files changed, 3 deletions(-)
diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c
index 714c53ef6c11..2960ff1637d1 100644
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -622,8 +622,6 @@ static int vsp1_video_buffer_prepare(struct vb2_buffer *vb)
if (vb->num_planes < format->num_planes)
return -EINVAL;
- buf->video = video;
-
for (i = 0; i < vb->num_planes; ++i) {
buf->addr[i] = vb2_dma_contig_plane_dma_addr(vb, i);
buf->length[i] = vb2_plane_size(vb, i);
diff --git a/drivers/media/platform/vsp1/vsp1_video.h b/drivers/media/platform/vsp1/vsp1_video.h
index d8612a378345..47b7a8ab5e2f 100644
--- a/drivers/media/platform/vsp1/vsp1_video.h
+++ b/drivers/media/platform/vsp1/vsp1_video.h
@@ -89,7 +89,6 @@ static inline struct vsp1_pipeline *to_vsp1_pipeline(struct media_entity *e)
}
struct vsp1_video_buffer {
- struct vsp1_video *video;
struct vb2_buffer buf;
struct list_head queue;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 037/142] media: sms: Remove CONFIG_ prefix from Kconfig symbols
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (35 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 036/142] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 038/142] iommu/amd: Fix cleanup_domain for mass device removal Jiri Slaby
` (106 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Paul Bolle, Mauro Carvalho Chehab, Jiri Slaby
From: Paul Bolle <pebolle@tiscali.nl>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3c4b422adb7694418848cefc2a4669d63192c649 upstream.
X-Patchwork-Delegate: mchehab@redhat.com
Remove the CONFIG_ prefix from two Kconfig symbols in a dependency for
SMS_SIANO_DEBUGFS. This prefix is invalid inside Kconfig files.
Note that the current (common sense) dependency on SMS_USB_DRV and
SMS_SDIO_DRV being equal ensures that SMS_SIANO_DEBUGFS will not
violate its constraints. These constraint are that:
- it should only be built if SMS_USB_DRV is set;
- it can't be builtin if USB support is modular.
So drop the dependency on SMS_USB_DRV, as it is unneeded.
Fixes: 6c84b214284e ("[media] sms: fix randconfig building error")
Reported-by: Martin Walch <walch.martin@web.de>
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/common/siano/Kconfig | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/common/siano/Kconfig b/drivers/media/common/siano/Kconfig
index f953d33ee151..4bfbd5f463d1 100644
--- a/drivers/media/common/siano/Kconfig
+++ b/drivers/media/common/siano/Kconfig
@@ -22,8 +22,7 @@ config SMS_SIANO_DEBUGFS
bool "Enable debugfs for smsdvb"
depends on SMS_SIANO_MDTV
depends on DEBUG_FS
- depends on SMS_USB_DRV
- depends on CONFIG_SMS_USB_DRV = CONFIG_SMS_SDIO_DRV
+ depends on SMS_USB_DRV = SMS_SDIO_DRV
---help---
Choose Y to enable visualizing a dump of the frontend
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 038/142] iommu/amd: Fix cleanup_domain for mass device removal
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (36 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 037/142] media: sms: Remove CONFIG_ prefix from Kconfig symbols Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 039/142] spi: orion: fix incorrect handling of cell-index DT property Jiri Slaby
` (105 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Joerg Roedel, Jiri Slaby
From: Joerg Roedel <jroedel@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9b29d3c6510407d91786c1cf9183ff4debb3473a upstream.
When multiple devices are detached in __detach_device, they
are also removed from the domains dev_list. This makes it
unsafe to use list_for_each_entry_safe, as the next pointer
might also not be in the list anymore after __detach_device
returns. So just repeatedly remove the first element of the
list until it is empty.
Tested-by: Marti Raudsepp <marti@juffo.org>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/iommu/amd_iommu.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 22f656e125dd..67644e960592 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3227,14 +3227,16 @@ free_domains:
static void cleanup_domain(struct protection_domain *domain)
{
- struct iommu_dev_data *dev_data, *next;
+ struct iommu_dev_data *entry;
unsigned long flags;
write_lock_irqsave(&amd_iommu_devtable_lock, flags);
- list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) {
- __detach_device(dev_data);
- atomic_set(&dev_data->bind, 0);
+ while (!list_empty(&domain->dev_list)) {
+ entry = list_first_entry(&domain->dev_list,
+ struct iommu_dev_data, list);
+ __detach_device(entry);
+ atomic_set(&entry->bind, 0);
}
write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 039/142] spi: orion: fix incorrect handling of cell-index DT property
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (37 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 038/142] iommu/amd: Fix cleanup_domain for mass device removal Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning Jiri Slaby
` (104 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Thomas Petazzoni, Mark Brown, Jiri Slaby
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e06871cd2c92e5c65d7ca1d32866b4ca5dd4ac30 upstream.
In commit f814f9ac5a81 ("spi/orion: add device tree binding"), Device
Tree support was added to the spi-orion driver. However, this commit
reads the "cell-index" property, without taking into account the fact
that DT properties are big-endian encoded.
Since most of the platforms using spi-orion with DT have apparently
not used anything but cell-index = <0>, the problem was not
visible. But as soon as one starts using cell-index = <1>, the problem
becomes clearly visible, as the master->bus_num gets a wrong value
(actually it gets the value 0, which conflicts with the first bus that
has cell-index = <0>).
This commit fixes that by using of_property_read_u32() to read the
property value, which does the appropriate endianness conversion when
needed.
Fixes: f814f9ac5a81 ("spi/orion: add device tree binding")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/spi/spi-orion.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index 1d1d321d90c4..72006e63d513 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -404,8 +404,6 @@ static int orion_spi_probe(struct platform_device *pdev)
struct resource *r;
unsigned long tclk_hz;
int status = 0;
- const u32 *iprop;
- int size;
master = spi_alloc_master(&pdev->dev, sizeof *spi);
if (master == NULL) {
@@ -416,10 +414,10 @@ static int orion_spi_probe(struct platform_device *pdev)
if (pdev->id != -1)
master->bus_num = pdev->id;
if (pdev->dev.of_node) {
- iprop = of_get_property(pdev->dev.of_node, "cell-index",
- &size);
- if (iprop && size == sizeof(*iprop))
- master->bus_num = *iprop;
+ u32 cell_index;
+ if (!of_property_read_u32(pdev->dev.of_node, "cell-index",
+ &cell_index))
+ master->bus_num = cell_index;
}
/* we support only mode 0, and no options */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (38 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 039/142] spi: orion: fix incorrect handling of cell-index DT property Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 10:06 ` Christian Borntraeger
2014-09-26 9:44 ` [PATCH 3.12 041/142] firmware: Do not use WARN_ON(!spin_is_locked()) Jiri Slaby
` (103 subsequent siblings)
143 siblings, 1 reply; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Christian Borntraeger, Ingo Molnar, Peter Zijlstra,
Heiko Carstens, Martin Schwidefsky, Jiri Slaby
From: Christian Borntraeger <borntraeger@de.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 36e7fdaa1a04fcf65b864232e1af56a51c7814d6 upstream.
commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc (locking/mutex: Disable
optimistic spinning on some architectures) fenced spinning for
architectures without proper cmpxchg.
There is no need to disable mutex spinning on s390, though:
The instructions CS,CSG and friends provide the proper guarantees.
(We dont implement cmpxchg with locks).
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/s390/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 6671e8db1861..faa97bd4948e 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -93,6 +93,7 @@ config S390
select ARCH_INLINE_WRITE_UNLOCK_IRQ
select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
select ARCH_SAVE_PAGE_KEYS if HIBERNATION
+ select ARCH_SUPPORTS_ATOMIC_RMW
select ARCH_USE_CMPXCHG_LOCKREF
select ARCH_WANT_IPC_PARSE_VERSION
select BUILDTIME_EXTABLE_SORT
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* Re: [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning
2014-09-26 9:44 ` [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning Jiri Slaby
@ 2014-09-26 10:06 ` Christian Borntraeger
2014-09-26 10:20 ` Jiri Slaby
0 siblings, 1 reply; 150+ messages in thread
From: Christian Borntraeger @ 2014-09-26 10:06 UTC (permalink / raw)
To: Jiri Slaby, stable
Cc: linux-kernel, Ingo Molnar, Peter Zijlstra, Heiko Carstens,
Martin Schwidefsky
On 09/26/2014 11:44 AM, Jiri Slaby wrote:
> From: Christian Borntraeger <borntraeger@de.ibm.com>
>
> 3.12-stable review patch. If anyone has any objections, please let me know.
I just checked.
It seems that the referenced commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc
(locking/mutex: Disable optimistic spinning on some architectures)
is not part of 3.12-stable. So this fix is not (yet) necessary.
This is probably also true for other stable backports. It seems that Kconfig just ignores non-existent entries for SELECT, so it does not hurt either.
If you are going to backport that commit later on then it might make sense to keep this patch in, otherwise not.
Christian
>
>
> ===============
>
> commit 36e7fdaa1a04fcf65b864232e1af56a51c7814d6 upstream.
>
> commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc (locking/mutex: Disable
> optimistic spinning on some architectures) fenced spinning for
> architectures without proper cmpxchg.
> There is no need to disable mutex spinning on s390, though:
> The instructions CS,CSG and friends provide the proper guarantees.
> (We dont implement cmpxchg with locks).
>
> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> ---
> arch/s390/Kconfig | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
> index 6671e8db1861..faa97bd4948e 100644
> --- a/arch/s390/Kconfig
> +++ b/arch/s390/Kconfig
> @@ -93,6 +93,7 @@ config S390
> select ARCH_INLINE_WRITE_UNLOCK_IRQ
> select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
> select ARCH_SAVE_PAGE_KEYS if HIBERNATION
> + select ARCH_SUPPORTS_ATOMIC_RMW
> select ARCH_USE_CMPXCHG_LOCKREF
> select ARCH_WANT_IPC_PARSE_VERSION
> select BUILDTIME_EXTABLE_SORT
>
^ permalink raw reply [flat|nested] 150+ messages in thread
* Re: [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning
2014-09-26 10:06 ` Christian Borntraeger
@ 2014-09-26 10:20 ` Jiri Slaby
2014-09-26 10:30 ` Christian Borntraeger
0 siblings, 1 reply; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 10:20 UTC (permalink / raw)
To: Christian Borntraeger, stable
Cc: linux-kernel, Ingo Molnar, Peter Zijlstra, Heiko Carstens,
Martin Schwidefsky
On 09/26/2014, 12:06 PM, Christian Borntraeger wrote:
> On 09/26/2014 11:44 AM, Jiri Slaby wrote:
>> From: Christian Borntraeger <borntraeger@de.ibm.com>
>>
>> 3.12-stable review patch. If anyone has any objections, please let me know.
>
> I just checked.
>
> It seems that the referenced commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc
> (locking/mutex: Disable optimistic spinning on some architectures)
> is not part of 3.12-stable. So this fix is not (yet) necessary.
Hi, thanks for checking. However as far as I can see, 4badad352a6 is in
3.12.26 already, right?
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 150+ messages in thread
* Re: [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning
2014-09-26 10:20 ` Jiri Slaby
@ 2014-09-26 10:30 ` Christian Borntraeger
0 siblings, 0 replies; 150+ messages in thread
From: Christian Borntraeger @ 2014-09-26 10:30 UTC (permalink / raw)
To: Jiri Slaby, stable
Cc: linux-kernel, Ingo Molnar, Peter Zijlstra, Heiko Carstens,
Martin Schwidefsky
On 09/26/2014 12:20 PM, Jiri Slaby wrote:
> On 09/26/2014, 12:06 PM, Christian Borntraeger wrote:
>> On 09/26/2014 11:44 AM, Jiri Slaby wrote:
>>> From: Christian Borntraeger <borntraeger@de.ibm.com>
>>>
>>> 3.12-stable review patch. If anyone has any objections, please let me know.
>>
>> I just checked.
>>
>> It seems that the referenced commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc
>> (locking/mutex: Disable optimistic spinning on some architectures)
>> is not part of 3.12-stable. So this fix is not (yet) necessary.
>
> Hi, thanks for checking. However as far as I can see, 4badad352a6 is in
> 3.12.26 already, right?
>
> thanks,
>
Right. I was looking at kernel/git/jirislaby/linux-stable.git, but I checked the master branch and not the 3.12 stable branch.. Sorry for the noise.
Christian
^ permalink raw reply [flat|nested] 150+ messages in thread
* [PATCH 3.12 041/142] firmware: Do not use WARN_ON(!spin_is_locked())
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (39 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 040/142] s390/locking: Reenable optimistic spinning Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 042/142] tpm: missing tpm_chip_put in tpm_get_random() Jiri Slaby
` (102 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guenter Roeck, Matt Fleming, Jiri Slaby
From: Guenter Roeck <linux@roeck-us.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aee530cfecf4f3ec83b78406bac618cec35853f8 upstream.
spin_is_locked() always returns false for uniprocessor configurations
in several architectures, so do not use WARN_ON with it.
Use lockdep_assert_held() instead to also reduce overhead in
non-debug kernels.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/firmware/efi/vars.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index b22659cccca4..e6125522860a 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -481,7 +481,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_remove);
*/
static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
{
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
list_del(&entry->list);
spin_unlock_irq(&__efivars->lock);
@@ -507,7 +507,7 @@ int __efivar_entry_delete(struct efivar_entry *entry)
const struct efivar_operations *ops = __efivars->ops;
efi_status_t status;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
status = ops->set_variable(entry->var.VariableName,
&entry->var.VendorGuid,
@@ -667,7 +667,7 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
int strsize1, strsize2;
bool found = false;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
list_for_each_entry_safe(entry, n, head, list) {
strsize1 = ucs2_strsize(name, 1024);
@@ -739,7 +739,7 @@ int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
const struct efivar_operations *ops = __efivars->ops;
efi_status_t status;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
status = ops->get_variable(entry->var.VariableName,
&entry->var.VendorGuid,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 042/142] tpm: missing tpm_chip_put in tpm_get_random()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (40 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 041/142] firmware: Do not use WARN_ON(!spin_is_locked()) Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 043/142] tpm: Provide a generic means to override the chip returned timeouts Jiri Slaby
` (101 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jarkko Sakkinen, Peter Huewe, Jiri Slaby
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3e14d83ef94a5806a865b85b513b4e891923c19b upstream.
Regression in 41ab999c. Call to tpm_chip_put is missing. This
will cause TPM device driver not to unload if tmp_get_random()
is called.
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/char/tpm/tpm.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index e3c974a6c522..334b9ef1bb1d 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1423,13 +1423,13 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
int err, total = 0, retries = 5;
u8 *dest = out;
+ if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
+ return -EINVAL;
+
chip = tpm_chip_find_get(chip_num);
if (chip == NULL)
return -ENODEV;
- if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
- return -EINVAL;
-
do {
tpm_cmd.header.in = tpm_getrandom_header;
tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
@@ -1448,6 +1448,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
num_bytes -= recd;
} while (retries-- && total < max);
+ tpm_chip_put(chip);
return total ? total : -EIO;
}
EXPORT_SYMBOL_GPL(tpm_get_random);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 043/142] tpm: Provide a generic means to override the chip returned timeouts
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (41 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 042/142] tpm: missing tpm_chip_put in tpm_get_random() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 044/142] CAPABILITIES: remove undefined caps from all processes Jiri Slaby
` (100 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Jason Gunthorpe, Berg, Christopher, Peter Huewe,
Ben Hutchings, Jiri Slaby
From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8e54caf407b98efa05409e1fee0e5381abd2b088 upstream.
Some Atmel TPMs provide completely wrong timeouts from their
TPM_CAP_PROP_TIS_TIMEOUT query. This patch detects that and returns
new correct values via a DID/VID table in the TIS driver.
Tested on ARM using an AT97SC3204T FW version 37.16
[PHuewe: without this fix these 'broken' Atmel TPMs won't function on
older kernels]
Signed-off-by: "Berg, Christopher" <Christopher.Berg@atmel.com>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
[bwh: Backported to 3.10:
- Adjust filename, context
- s/chip->ops->/chip->vendor./]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/char/tpm/tpm.c | 62 ++++++++++++++++++++++++++++++----------------
drivers/char/tpm/tpm.h | 3 +++
drivers/char/tpm/tpm_tis.c | 31 +++++++++++++++++++++++
3 files changed, 75 insertions(+), 21 deletions(-)
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 334b9ef1bb1d..48138b311460 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -533,11 +533,10 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
int tpm_get_timeouts(struct tpm_chip *chip)
{
struct tpm_cmd_t tpm_cmd;
- struct timeout_t *timeout_cap;
+ unsigned long new_timeout[4];
+ unsigned long old_timeout[4];
struct duration_t *duration_cap;
ssize_t rc;
- u32 timeout;
- unsigned int scale = 1;
tpm_cmd.header.in = tpm_getcap_header;
tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
@@ -571,25 +570,46 @@ int tpm_get_timeouts(struct tpm_chip *chip)
!= sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))
return -EINVAL;
- timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout;
- /* Don't overwrite default if value is 0 */
- timeout = be32_to_cpu(timeout_cap->a);
- if (timeout && timeout < 1000) {
- /* timeouts in msec rather usec */
- scale = 1000;
- chip->vendor.timeout_adjusted = true;
+ old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);
+ old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);
+ old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);
+ old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);
+ memcpy(new_timeout, old_timeout, sizeof(new_timeout));
+
+ /*
+ * Provide ability for vendor overrides of timeout values in case
+ * of misreporting.
+ */
+ if (chip->vendor.update_timeouts != NULL)
+ chip->vendor.timeout_adjusted =
+ chip->vendor.update_timeouts(chip, new_timeout);
+
+ if (!chip->vendor.timeout_adjusted) {
+ /* Don't overwrite default if value is 0 */
+ if (new_timeout[0] != 0 && new_timeout[0] < 1000) {
+ int i;
+
+ /* timeouts in msec rather usec */
+ for (i = 0; i != ARRAY_SIZE(new_timeout); i++)
+ new_timeout[i] *= 1000;
+ chip->vendor.timeout_adjusted = true;
+ }
}
- if (timeout)
- chip->vendor.timeout_a = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->b);
- if (timeout)
- chip->vendor.timeout_b = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->c);
- if (timeout)
- chip->vendor.timeout_c = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->d);
- if (timeout)
- chip->vendor.timeout_d = usecs_to_jiffies(timeout * scale);
+
+ /* Report adjusted timeouts */
+ if (chip->vendor.timeout_adjusted) {
+ dev_info(chip->dev,
+ HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n",
+ old_timeout[0], new_timeout[0],
+ old_timeout[1], new_timeout[1],
+ old_timeout[2], new_timeout[2],
+ old_timeout[3], new_timeout[3]);
+ }
+
+ chip->vendor.timeout_a = usecs_to_jiffies(new_timeout[0]);
+ chip->vendor.timeout_b = usecs_to_jiffies(new_timeout[1]);
+ chip->vendor.timeout_c = usecs_to_jiffies(new_timeout[2]);
+ chip->vendor.timeout_d = usecs_to_jiffies(new_timeout[3]);
duration:
tpm_cmd.header.in = tpm_getcap_header;
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index a7bfc176ed43..b911d79fbd58 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -95,6 +95,9 @@ struct tpm_vendor_specific {
int (*send) (struct tpm_chip *, u8 *, size_t);
void (*cancel) (struct tpm_chip *);
u8 (*status) (struct tpm_chip *);
+ bool (*update_timeouts)(struct tpm_chip *chip,
+ unsigned long *timeout_cap);
+
void (*release) (struct device *);
struct miscdevice miscdev;
struct attribute_group *attr_group;
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 5796d0157ce0..e7b1a0ae4300 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -373,6 +373,36 @@ out_err:
return rc;
}
+struct tis_vendor_timeout_override {
+ u32 did_vid;
+ unsigned long timeout_us[4];
+};
+
+static const struct tis_vendor_timeout_override vendor_timeout_overrides[] = {
+ /* Atmel 3204 */
+ { 0x32041114, { (TIS_SHORT_TIMEOUT*1000), (TIS_LONG_TIMEOUT*1000),
+ (TIS_SHORT_TIMEOUT*1000), (TIS_SHORT_TIMEOUT*1000) } },
+};
+
+static bool tpm_tis_update_timeouts(struct tpm_chip *chip,
+ unsigned long *timeout_cap)
+{
+ int i;
+ u32 did_vid;
+
+ did_vid = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+ for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
+ if (vendor_timeout_overrides[i].did_vid != did_vid)
+ continue;
+ memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us,
+ sizeof(vendor_timeout_overrides[i].timeout_us));
+ return true;
+ }
+
+ return false;
+}
+
/*
* Early probing for iTPM with STS_DATA_EXPECT flaw.
* Try sending command without itpm flag set and if that
@@ -475,6 +505,7 @@ static struct tpm_vendor_specific tpm_tis = {
.recv = tpm_tis_recv,
.send = tpm_tis_send,
.cancel = tpm_tis_ready,
+ .update_timeouts = tpm_tis_update_timeouts,
.req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
.req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
.req_canceled = tpm_tis_req_canceled,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 044/142] CAPABILITIES: remove undefined caps from all processes
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (42 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 043/142] tpm: Provide a generic means to override the chip returned timeouts Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 045/142] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path Jiri Slaby
` (99 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Eric Paris, Andrew Vagin, Andrew G. Morgan,
Serge E. Hallyn, Kees Cook, Steve Grubb, Dan Walsh, James Morris,
Jiri Slaby
From: Eric Paris <eparis@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7d8b6c63751cfbbe5eef81a48c22978b3407a3ad upstream.
This is effectively a revert of 7b9a7ec565505699f503b4fcf61500dceb36e744
plus fixing it a different way...
We found, when trying to run an application from an application which
had dropped privs that the kernel does security checks on undefined
capability bits. This was ESPECIALLY difficult to debug as those
undefined bits are hidden from /proc/$PID/status.
Consider a root application which drops all capabilities from ALL 4
capability sets. We assume, since the application is going to set
eff/perm/inh from an array that it will clear not only the defined caps
less than CAP_LAST_CAP, but also the higher 28ish bits which are
undefined future capabilities.
The BSET gets cleared differently. Instead it is cleared one bit at a
time. The problem here is that in security/commoncap.c::cap_task_prctl()
we actually check the validity of a capability being read. So any task
which attempts to 'read all things set in bset' followed by 'unset all
things set in bset' will not even attempt to unset the undefined bits
higher than CAP_LAST_CAP.
So the 'parent' will look something like:
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: ffffffc000000000
All of this 'should' be fine. Given that these are undefined bits that
aren't supposed to have anything to do with permissions. But they do...
So lets now consider a task which cleared the eff/perm/inh completely
and cleared all of the valid caps in the bset (but not the invalid caps
it couldn't read out of the kernel). We know that this is exactly what
the libcap-ng library does and what the go capabilities library does.
They both leave you in that above situation if you try to clear all of
you capapabilities from all 4 sets. If that root task calls execve()
the child task will pick up all caps not blocked by the bset. The bset
however does not block bits higher than CAP_LAST_CAP. So now the child
task has bits in eff which are not in the parent. These are
'meaningless' undefined bits, but still bits which the parent doesn't
have.
The problem is now in cred_cap_issubset() (or any operation which does a
subset test) as the child, while a subset for valid cap bits, is not a
subset for invalid cap bits! So now we set durring commit creds that
the child is not dumpable. Given it is 'more priv' than its parent. It
also means the parent cannot ptrace the child and other stupidity.
The solution here:
1) stop hiding capability bits in status
This makes debugging easier!
2) stop giving any task undefined capability bits. it's simple, it you
don't put those invalid bits in CAP_FULL_SET you won't get them in init
and you won't get them in any other task either.
This fixes the cap_issubset() tests and resulting fallout (which
made the init task in a docker container untraceable among other
things)
3) mask out undefined bits when sys_capset() is called as it might use
~0, ~0 to denote 'all capabilities' for backward/forward compatibility.
This lets 'capsh --caps="all=eip" -- -c /bin/bash' run.
4) mask out undefined bit when we read a file capability off of disk as
again likely all bits are set in the xattr for forward/backward
compatibility.
This lets 'setcap all+pe /bin/bash; /bin/bash' run
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Vagin <avagin@openvz.org>
Cc: Andrew G. Morgan <morgan@kernel.org>
Cc: Serge E. Hallyn <serge.hallyn@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Steve Grubb <sgrubb@redhat.com>
Cc: Dan Walsh <dwalsh@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/proc/array.c | 11 +----------
include/linux/capability.h | 5 ++++-
kernel/audit.c | 2 +-
kernel/capability.c | 4 ++++
security/commoncap.c | 3 +++
5 files changed, 13 insertions(+), 12 deletions(-)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index cbd0f1b324b9..09f0d9c374a3 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -304,15 +304,11 @@ static void render_cap_t(struct seq_file *m, const char *header,
seq_puts(m, header);
CAP_FOR_EACH_U32(__capi) {
seq_printf(m, "%08x",
- a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
+ a->cap[CAP_LAST_U32 - __capi]);
}
seq_putc(m, '\n');
}
-/* Remove non-existent capabilities */
-#define NORM_CAPS(v) (v.cap[CAP_TO_INDEX(CAP_LAST_CAP)] &= \
- CAP_TO_MASK(CAP_LAST_CAP + 1) - 1)
-
static inline void task_cap(struct seq_file *m, struct task_struct *p)
{
const struct cred *cred;
@@ -326,11 +322,6 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
cap_bset = cred->cap_bset;
rcu_read_unlock();
- NORM_CAPS(cap_inheritable);
- NORM_CAPS(cap_permitted);
- NORM_CAPS(cap_effective);
- NORM_CAPS(cap_bset);
-
render_cap_t(m, "CapInh:\t", &cap_inheritable);
render_cap_t(m, "CapPrm:\t", &cap_permitted);
render_cap_t(m, "CapEff:\t", &cap_effective);
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 84b13ad67c1c..aa93e5ef594c 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -78,8 +78,11 @@ extern const kernel_cap_t __cap_init_eff_set;
# error Fix up hand-coded capability macro initializers
#else /* HAND-CODED capability initializers */
+#define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1)
+#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1)
+
# define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
-# define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }})
+# define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
# define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
| CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
CAP_FS_MASK_B1 } })
diff --git a/kernel/audit.c b/kernel/audit.c
index 197a496587a6..4059e949beb2 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1412,7 +1412,7 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
audit_log_format(ab, " %s=", prefix);
CAP_FOR_EACH_U32(i) {
audit_log_format(ab, "%08x",
- cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
+ cap->cap[CAP_LAST_U32 - i]);
}
}
diff --git a/kernel/capability.c b/kernel/capability.c
index 788653b97430..50fb74b136db 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -268,6 +268,10 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
i++;
}
+ effective.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
new = prepare_creds();
if (!new)
return -ENOMEM;
diff --git a/security/commoncap.c b/security/commoncap.c
index b9d613e0ef14..963dc5981661 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -421,6 +421,9 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
}
+ cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 045/142] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (43 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 044/142] CAPABILITIES: remove undefined caps from all processes Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 046/142] mfd: omap-usb-host: Fix improper mask use Jiri Slaby
` (98 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Sasha Levin, Christoph Lameter, Gilad Ben-Yossef,
David Rientjes, Joonsoo Kim, Tejun Heo, Andrew Morton,
Linus Torvalds, Jiri Slaby
From: Sasha Levin <sasha.levin@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 618fde872163e782183ce574c77f1123e2be8887 upstream.
The rarely-executed memry-allocation-failed callback path generates a
WARN_ON_ONCE() when smp_call_function_single() succeeds. Presumably
it's supposed to warn on failures.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Gilad Ben-Yossef <gilad@benyossef.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
kernel/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index 0564571dcdf7..7d1187c0c2b6 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -650,7 +650,7 @@ void on_each_cpu_cond(bool (*cond_func)(int cpu, void *info),
if (cond_func(cpu, info)) {
ret = smp_call_function_single(cpu, func,
info, wait);
- WARN_ON_ONCE(!ret);
+ WARN_ON_ONCE(ret);
}
preempt_enable();
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 046/142] mfd: omap-usb-host: Fix improper mask use.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (44 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 045/142] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 047/142] regulator: arizona-ldo1: remove bypass functionality Jiri Slaby
` (97 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Michael Welling, Lee Jones, Jiri Slaby
From: Michael Welling <mwelling@emacinc.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 46de8ff8e80a6546aa3d2fdf58c6776666301a0c upstream.
single-ulpi-bypass is a flag used for older OMAP3 silicon.
The flag when set, can excite code that improperly uses the
OMAP_UHH_HOSTCONFIG_UPLI_BYPASS define to clear the corresponding bit.
Instead it clears all of the other bits disabling all of the ports in
the process.
Signed-off-by: Michael Welling <mwelling@emacinc.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/omap-usb-host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 29ee54d68512..5dd653f9b094 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -445,7 +445,7 @@ static unsigned omap_usbhs_rev1_hostconfig(struct usbhs_hcd_omap *omap,
for (i = 0; i < omap->nports; i++) {
if (is_ehci_phy_mode(pdata->port_mode[i])) {
- reg &= OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
+ reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
break;
}
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 047/142] regulator: arizona-ldo1: remove bypass functionality
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (45 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 046/142] mfd: omap-usb-host: Fix improper mask use Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 048/142] powerpc/mm/numa: Fix break placement Jiri Slaby
` (96 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Nikesh Oswal, Mark Brown, Jiri Slaby
From: Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5b919f3ebb533cbe400664837e24f66a0836b907 upstream.
WM5110/8280 devices do not support bypass mode for LDO1 so remove
the bypass callbacks registered with regulator core.
Signed-off-by: Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/regulator/arizona-ldo1.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c
index 7917bb2fa834..406e50ef5152 100644
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -141,8 +141,6 @@ static struct regulator_ops arizona_ldo1_ops = {
.map_voltage = regulator_map_voltage_linear,
.get_voltage_sel = regulator_get_voltage_sel_regmap,
.set_voltage_sel = regulator_set_voltage_sel_regmap,
- .get_bypass = regulator_get_bypass_regmap,
- .set_bypass = regulator_set_bypass_regmap,
};
static const struct regulator_desc arizona_ldo1 = {
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 048/142] powerpc/mm/numa: Fix break placement
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (46 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 047/142] regulator: arizona-ldo1: remove bypass functionality Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 049/142] powerpc/mm: Use read barrier when creating real_pte Jiri Slaby
` (95 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Andrey Utkin, Benjamin Herrenschmidt, Jiri Slaby
From: Andrey Utkin <andrey.krieger.utkin@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b00fc6ec1f24f9d7af9b8988b6a198186eb3408c upstream.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81631
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/mm/numa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 14c05547bd74..e91079b796d2 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -589,8 +589,8 @@ static int cpu_numa_callback(struct notifier_block *nfb, unsigned long action,
case CPU_UP_CANCELED:
case CPU_UP_CANCELED_FROZEN:
unmap_cpu_from_node(lcpu);
- break;
ret = NOTIFY_OK;
+ break;
#endif
}
return ret;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 049/142] powerpc/mm: Use read barrier when creating real_pte
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (47 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 048/142] powerpc/mm/numa: Fix break placement Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 050/142] powerpc/pseries: Failure on removing device node Jiri Slaby
` (94 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 85c1fafd7262e68ad821ee1808686b1392b1167d upstream.
On ppc64 we support 4K hash pte with 64K page size. That requires
us to track the hash pte slot information on a per 4k basis. We do that
by storing the slot details in the second half of pte page. The pte bit
_PAGE_COMBO is used to indicate whether the second half need to be
looked while building real_pte. We need to use read memory barrier while
doing that so that load of hidx is not reordered w.r.t _PAGE_COMBO
check. On the store side we already do a lwsync in __hash_page_4K
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/include/asm/pte-hash64-64k.h | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/include/asm/pte-hash64-64k.h b/arch/powerpc/include/asm/pte-hash64-64k.h
index d836d945068d..9ecede1e124c 100644
--- a/arch/powerpc/include/asm/pte-hash64-64k.h
+++ b/arch/powerpc/include/asm/pte-hash64-64k.h
@@ -46,11 +46,31 @@
* in order to deal with 64K made of 4K HW pages. Thus we override the
* generic accessors and iterators here
*/
-#define __real_pte(e,p) ((real_pte_t) { \
- (e), (pte_val(e) & _PAGE_COMBO) ? \
- (pte_val(*((p) + PTRS_PER_PTE))) : 0 })
-#define __rpte_to_hidx(r,index) ((pte_val((r).pte) & _PAGE_COMBO) ? \
- (((r).hidx >> ((index)<<2)) & 0xf) : ((pte_val((r).pte) >> 12) & 0xf))
+#define __real_pte __real_pte
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
+{
+ real_pte_t rpte;
+
+ rpte.pte = pte;
+ rpte.hidx = 0;
+ if (pte_val(pte) & _PAGE_COMBO) {
+ /*
+ * Make sure we order the hidx load against the _PAGE_COMBO
+ * check. The store side ordering is done in __hash_page_4K
+ */
+ smp_rmb();
+ rpte.hidx = pte_val(*((ptep) + PTRS_PER_PTE));
+ }
+ return rpte;
+}
+
+static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
+{
+ if ((pte_val(rpte.pte) & _PAGE_COMBO))
+ return (rpte.hidx >> (index<<2)) & 0xf;
+ return (pte_val(rpte.pte) >> 12) & 0xf;
+}
+
#define __rpte_to_pte(r) ((r).pte)
#define __rpte_sub_valid(rpte, index) \
(pte_val(rpte.pte) & (_PAGE_HPTE_SUB0 >> (index)))
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 050/142] powerpc/pseries: Failure on removing device node
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (48 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 049/142] powerpc/mm: Use read barrier when creating real_pte Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 051/142] powerpc/pseries: Avoid deadlock on removing ddw Jiri Slaby
` (93 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Gavin Shan, Benjamin Herrenschmidt, Jiri Slaby
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f1b3929c232784580e5d8ee324b6bc634e709575 upstream.
While running command "drmgr -c phb -r -s 'PHB 528'", following
backtrace jumped out because the target device node isn't marked
with OF_DETACHED by of_detach_node(), which caused by error
returned from memory hotplug related reconfig notifier when
disabling CONFIG_MEMORY_HOTREMOVE. The patch fixes it.
ERROR: Bad of_node_put() on /pci@800000020000210/ethernet@0
CPU: 14 PID: 2252 Comm: drmgr Tainted: G W 3.16.0+ #427
Call Trace:
[c000000012a776a0] [c000000000013d9c] .show_stack+0x88/0x148 (unreliable)
[c000000012a77750] [c00000000083cd34] .dump_stack+0x7c/0x9c
[c000000012a777d0] [c0000000006807c4] .of_node_release+0x58/0xe0
[c000000012a77860] [c00000000038a7d0] .kobject_release+0x174/0x1b8
[c000000012a77900] [c00000000038a884] .kobject_put+0x70/0x78
[c000000012a77980] [c000000000681680] .of_node_put+0x28/0x34
[c000000012a77a00] [c000000000681ea8] .__of_get_next_child+0x64/0x70
[c000000012a77a90] [c000000000682138] .of_find_node_by_path+0x1b8/0x20c
[c000000012a77b40] [c000000000051840] .ofdt_write+0x308/0x688
[c000000012a77c20] [c000000000238430] .proc_reg_write+0xb8/0xd4
[c000000012a77cd0] [c0000000001cbeac] .vfs_write+0xec/0x1f8
[c000000012a77d70] [c0000000001cc3b0] .SyS_write+0x58/0xa0
[c000000012a77e30] [c00000000000a064] syscall_exit+0x0/0x98
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 9a432de363b8..bebe64ed5dc3 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -158,7 +158,7 @@ static int pseries_remove_memory(struct device_node *np)
static inline int pseries_remove_memblock(unsigned long base,
unsigned int memblock_size)
{
- return -EOPNOTSUPP;
+ return 0;
}
static inline int pseries_remove_memory(struct device_node *np)
{
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 051/142] powerpc/pseries: Avoid deadlock on removing ddw
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (49 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 050/142] powerpc/pseries: Failure on removing device node Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 052/142] powerpc/thp: Add write barrier after updating the valid bit Jiri Slaby
` (92 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Gavin Shan, Benjamin Herrenschmidt, Jiri Slaby
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5efbabe09d986f25c02d19954660238fcd7f008a upstream.
Function remove_ddw() could be called in of_reconfig_notifier and
we potentially remove the dynamic DMA window property, which invokes
of_reconfig_notifier again. Eventually, it leads to the deadlock as
following backtrace shows.
The patch fixes the above issue by deferring releasing the dynamic
DMA window property while releasing the device node.
=============================================
[ INFO: possible recursive locking detected ]
3.16.0+ #428 Tainted: G W
---------------------------------------------
drmgr/2273 is trying to acquire lock:
((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
but task is already holding lock:
((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((of_reconfig_chain).rwsem);
lock((of_reconfig_chain).rwsem);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by drmgr/2273:
#0: (sb_writers#4){.+.+.+}, at: [<c0000000001cbe70>] \
.vfs_write+0xb0/0x1f8
#1: ((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
stack backtrace:
CPU: 17 PID: 2273 Comm: drmgr Tainted: G W 3.16.0+ #428
Call Trace:
[c0000000137e7000] [c000000000013d9c] .show_stack+0x88/0x148 (unreliable)
[c0000000137e70b0] [c00000000083cd34] .dump_stack+0x7c/0x9c
[c0000000137e7130] [c0000000000b8afc] .__lock_acquire+0x128c/0x1c68
[c0000000137e7280] [c0000000000b9a4c] .lock_acquire+0xe8/0x104
[c0000000137e7350] [c00000000083588c] .down_read+0x4c/0x90
[c0000000137e73e0] [c000000000091890] .__blocking_notifier_call_chain+0x40/0x78
[c0000000137e7490] [c000000000091900] .blocking_notifier_call_chain+0x38/0x48
[c0000000137e7520] [c000000000682a28] .of_reconfig_notify+0x34/0x5c
[c0000000137e75b0] [c000000000682a9c] .of_property_notify+0x4c/0x54
[c0000000137e7650] [c000000000682bf0] .of_remove_property+0x30/0xd4
[c0000000137e76f0] [c000000000052a44] .remove_ddw+0x144/0x168
[c0000000137e7790] [c000000000053204] .iommu_reconfig_notifier+0x30/0xe0
[c0000000137e7820] [c00000000009137c] .notifier_call_chain+0x6c/0xb4
[c0000000137e78c0] [c0000000000918ac] .__blocking_notifier_call_chain+0x5c/0x78
[c0000000137e7970] [c000000000091900] .blocking_notifier_call_chain+0x38/0x48
[c0000000137e7a00] [c000000000682a28] .of_reconfig_notify+0x34/0x5c
[c0000000137e7a90] [c000000000682e14] .of_detach_node+0x44/0x1fc
[c0000000137e7b40] [c0000000000518e4] .ofdt_write+0x3ac/0x688
[c0000000137e7c20] [c000000000238430] .proc_reg_write+0xb8/0xd4
[c0000000137e7cd0] [c0000000001cbeac] .vfs_write+0xec/0x1f8
[c0000000137e7d70] [c0000000001cc3b0] .SyS_write+0x58/0xa0
[c0000000137e7e30] [c00000000000a064] syscall_exit+0x0/0x98
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/platforms/pseries/iommu.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 0307901e4132..261c5095d5d3 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -731,13 +731,13 @@ static inline void __remove_ddw(struct device_node *np, const u32 *ddw_avail, u6
np->full_name, ret, ddw_avail[2], liobn);
}
-static void remove_ddw(struct device_node *np)
+static void remove_ddw(struct device_node *np, bool remove_prop)
{
struct dynamic_dma_window_prop *dwp;
struct property *win64;
const u32 *ddw_avail;
u64 liobn;
- int len, ret;
+ int len, ret = 0;
ddw_avail = of_get_property(np, "ibm,ddw-applicable", &len);
win64 = of_find_property(np, DIRECT64_PROPNAME, NULL);
@@ -763,7 +763,8 @@ static void remove_ddw(struct device_node *np)
__remove_ddw(np, ddw_avail, liobn);
delprop:
- ret = of_remove_property(np, win64);
+ if (remove_prop)
+ ret = of_remove_property(np, win64);
if (ret)
pr_warning("%s: failed to remove direct window property: %d\n",
np->full_name, ret);
@@ -835,7 +836,7 @@ static int find_existing_ddw_windows(void)
* can clear the table or find the holes. To that end,
* first, remove any existing DDW configuration.
*/
- remove_ddw(pdn);
+ remove_ddw(pdn, true);
/*
* Second, if we are running on a new enough level of
@@ -1125,7 +1126,7 @@ out_free_window:
kfree(window);
out_clear_window:
- remove_ddw(pdn);
+ remove_ddw(pdn, true);
out_free_prop:
kfree(win64->name);
@@ -1337,7 +1338,14 @@ static int iommu_reconfig_notifier(struct notifier_block *nb, unsigned long acti
switch (action) {
case OF_RECONFIG_DETACH_NODE:
- remove_ddw(np);
+ /*
+ * Removing the property will invoke the reconfig
+ * notifier again, which causes dead-lock on the
+ * read-write semaphore of the notifier chain. So
+ * we have to remove the property when releasing
+ * the device node.
+ */
+ remove_ddw(np, false);
if (pci && pci->iommu_table)
iommu_free_table(pci->iommu_table, np->full_name);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 052/142] powerpc/thp: Add write barrier after updating the valid bit
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (50 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 051/142] powerpc/pseries: Avoid deadlock on removing ddw Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 053/142] powerpc/thp: Don't recompute vsid and ssize in loop on invalidate Jiri Slaby
` (91 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b0aa44a3dfae3d8f45bd1264349aa87f87b7774f upstream.
With hugepages, we store the hpte valid information in the pte page
whose address is stored in the second half of the PMD. Use a
write barrier to make sure clearing pmd busy bit and updating
hpte valid info are ordered properly.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/mm/hugepage-hash64.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
index 34de9e0cdc34..f50c4dfd1819 100644
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -168,8 +168,11 @@ repeat:
mark_hpte_slot_valid(hpte_slot_array, index, slot);
}
/*
- * No need to use ldarx/stdcx here
+ * The hpte valid is stored in the pgtable whose address is in the
+ * second half of the PMD. Order this against clearing of the busy bit in
+ * huge pmd.
*/
+ smp_wmb();
*pmdp = __pmd(new_pmd & ~_PAGE_BUSY);
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 053/142] powerpc/thp: Don't recompute vsid and ssize in loop on invalidate
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (51 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 052/142] powerpc/thp: Add write barrier after updating the valid bit Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 054/142] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte Jiri Slaby
` (90 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fa1f8ae80f8bb996594167ff4750a0b0a5a5bb5d upstream.
The segment identifier and segment size will remain the same in
the loop, So we can compute it outside. We also change the
hugepage_invalidate interface so that we can use it the later patch
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/include/asm/machdep.h | 6 +++---
arch/powerpc/mm/hash_native_64.c | 19 +++++--------------
arch/powerpc/mm/pgtable_64.c | 24 ++++++++++++------------
arch/powerpc/platforms/pseries/lpar.c | 20 ++++++--------------
4 files changed, 26 insertions(+), 43 deletions(-)
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 8b480901165a..3a52b9b01133 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -57,10 +57,10 @@ struct machdep_calls {
void (*hpte_removebolted)(unsigned long ea,
int psize, int ssize);
void (*flush_hash_range)(unsigned long number, int local);
- void (*hugepage_invalidate)(struct mm_struct *mm,
+ void (*hugepage_invalidate)(unsigned long vsid,
+ unsigned long addr,
unsigned char *hpte_slot_array,
- unsigned long addr, int psize);
-
+ int psize, int ssize);
/* special for kexec, to be called in real mode, linear mapping is
* destroyed as well */
void (*hpte_clear_all)(void);
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index c33d939120c9..9197691fd5d5 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -413,18 +413,18 @@ static void native_hpte_invalidate(unsigned long slot, unsigned long vpn,
local_irq_restore(flags);
}
-static void native_hugepage_invalidate(struct mm_struct *mm,
+static void native_hugepage_invalidate(unsigned long vsid,
+ unsigned long addr,
unsigned char *hpte_slot_array,
- unsigned long addr, int psize)
+ int psize, int ssize)
{
- int ssize = 0, i;
- int lock_tlbie;
+ int i, lock_tlbie;
struct hash_pte *hptep;
int actual_psize = MMU_PAGE_16M;
unsigned int max_hpte_count, valid;
unsigned long flags, s_addr = addr;
unsigned long hpte_v, want_v, shift;
- unsigned long hidx, vpn = 0, vsid, hash, slot;
+ unsigned long hidx, vpn = 0, hash, slot;
shift = mmu_psize_defs[psize].shift;
max_hpte_count = 1U << (PMD_SHIFT - shift);
@@ -438,15 +438,6 @@ static void native_hugepage_invalidate(struct mm_struct *mm,
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 536eec72c0f7..48bda6700404 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -726,12 +726,21 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
if (!hpte_slot_array)
return;
- /* get the base page size */
+ /* get the base page size,vsid and segment size */
psize = get_slice_psize(mm, s_addr);
+ if (!is_kernel_addr(s_addr)) {
+ ssize = user_segment_size(s_addr);
+ vsid = get_vsid(mm->context.id, s_addr, ssize);
+ WARN_ON(vsid == 0);
+ } else {
+ vsid = get_kernel_vsid(s_addr, mmu_kernel_ssize);
+ ssize = mmu_kernel_ssize;
+ }
if (ppc_md.hugepage_invalidate)
- return ppc_md.hugepage_invalidate(mm, hpte_slot_array,
- s_addr, psize);
+ return ppc_md.hugepage_invalidate(vsid, s_addr,
+ hpte_slot_array,
+ psize, ssize);
/*
* No bluk hpte removal support, invalidate each entry
*/
@@ -749,15 +758,6 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 356bc75ca74f..691a479f7d97 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -412,16 +412,17 @@ static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot,
spin_unlock_irqrestore(&pSeries_lpar_tlbie_lock, flags);
}
-static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm,
- unsigned char *hpte_slot_array,
- unsigned long addr, int psize)
+static void pSeries_lpar_hugepage_invalidate(unsigned long vsid,
+ unsigned long addr,
+ unsigned char *hpte_slot_array,
+ int psize, int ssize)
{
- int ssize = 0, i, index = 0;
+ int i, index = 0;
unsigned long s_addr = addr;
unsigned int max_hpte_count, valid;
unsigned long vpn_array[PPC64_HUGE_HPTE_BATCH];
unsigned long slot_array[PPC64_HUGE_HPTE_BATCH];
- unsigned long shift, hidx, vpn = 0, vsid, hash, slot;
+ unsigned long shift, hidx, vpn = 0, hash, slot;
shift = mmu_psize_defs[psize].shift;
max_hpte_count = 1U << (PMD_SHIFT - shift);
@@ -434,15 +435,6 @@ static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm,
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 054/142] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (52 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 053/142] powerpc/thp: Don't recompute vsid and ssize in loop on invalidate Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 055/142] powerpc/thp: Handle combo pages in invalidate Jiri Slaby
` (89 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 629149fae478f0ac6bf705a535708b192e9c6b59 upstream.
If we changed base page size of the segment, either via sub_page_protect
or via remap_4k_pfn, we do a demote_segment which doesn't flush the hash
table entries. We do a lazy hash page table flush for all mapped pages
in the demoted segment. This happens when we handle hash page fault
for these pages.
We use _PAGE_COMBO bit along with _PAGE_HASHPTE to indicate whether a
pte is backed by 4K hash pte. If we find _PAGE_COMBO not set on the pte,
that implies that we could possibly have older 64K hash pte entries in
the hash page table and we need to invalidate those entries.
Handle this correctly for 16M pages
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/mm/hugepage-hash64.c | 79 ++++++++++++++++++++++++++++++++++-----
1 file changed, 70 insertions(+), 9 deletions(-)
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
index f50c4dfd1819..e0da84719b46 100644
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -18,6 +18,57 @@
#include <linux/mm.h>
#include <asm/machdep.h>
+static void invalidate_old_hpte(unsigned long vsid, unsigned long addr,
+ pmd_t *pmdp, unsigned int psize, int ssize)
+{
+ int i, max_hpte_count, valid;
+ unsigned long s_addr;
+ unsigned char *hpte_slot_array;
+ unsigned long hidx, shift, vpn, hash, slot;
+
+ s_addr = addr & HPAGE_PMD_MASK;
+ hpte_slot_array = get_hpte_slot_array(pmdp);
+ /*
+ * IF we try to do a HUGE PTE update after a withdraw is done.
+ * we will find the below NULL. This happens when we do
+ * split_huge_page_pmd
+ */
+ if (!hpte_slot_array)
+ return;
+
+ if (ppc_md.hugepage_invalidate)
+ return ppc_md.hugepage_invalidate(vsid, s_addr, hpte_slot_array,
+ psize, ssize);
+ /*
+ * No bluk hpte removal support, invalidate each entry
+ */
+ shift = mmu_psize_defs[psize].shift;
+ max_hpte_count = HPAGE_PMD_SIZE >> shift;
+ for (i = 0; i < max_hpte_count; i++) {
+ /*
+ * 8 bits per each hpte entries
+ * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
+ */
+ valid = hpte_valid(hpte_slot_array, i);
+ if (!valid)
+ continue;
+ hidx = hpte_hash_index(hpte_slot_array, i);
+
+ /* get the vpn */
+ addr = s_addr + (i * (1ul << shift));
+ vpn = hpt_vpn(addr, vsid, ssize);
+ hash = hpt_hash(vpn, shift, ssize);
+ if (hidx & _PTEIDX_SECONDARY)
+ hash = ~hash;
+
+ slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+ slot += hidx & _PTEIDX_GROUP_IX;
+ ppc_md.hpte_invalidate(slot, vpn, psize,
+ MMU_PAGE_16M, ssize, 0);
+ }
+}
+
+
int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
pmd_t *pmdp, unsigned long trap, int local, int ssize,
unsigned int psize)
@@ -85,6 +136,15 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
vpn = hpt_vpn(ea, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
hpte_slot_array = get_hpte_slot_array(pmdp);
+ if (psize == MMU_PAGE_4K) {
+ /*
+ * invalidate the old hpte entry if we have that mapped via 64K
+ * base page size. This is because demote_segment won't flush
+ * hash page table entries.
+ */
+ if ((old_pmd & _PAGE_HASHPTE) && !(old_pmd & _PAGE_COMBO))
+ invalidate_old_hpte(vsid, ea, pmdp, MMU_PAGE_64K, ssize);
+ }
valid = hpte_valid(hpte_slot_array, index);
if (valid) {
@@ -107,11 +167,8 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
* safely update this here.
*/
valid = 0;
- new_pmd &= ~_PAGE_HPTEFLAGS;
hpte_slot_array[index] = 0;
- } else
- /* clear the busy bits and set the hash pte bits */
- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+ }
}
if (!valid) {
@@ -119,15 +176,13 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
/* insert new entry */
pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
-repeat:
- hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
-
- /* clear the busy bits and set the hash pte bits */
- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+ new_pmd |= _PAGE_HASHPTE;
/* Add in WIMG bits */
rflags |= (new_pmd & (_PAGE_WRITETHRU | _PAGE_NO_CACHE |
_PAGE_COHERENT | _PAGE_GUARDED));
+repeat:
+ hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
/* Insert into the hash table, primary slot */
slot = ppc_md.hpte_insert(hpte_group, vpn, pa, rflags, 0,
@@ -168,6 +223,12 @@ repeat:
mark_hpte_slot_valid(hpte_slot_array, index, slot);
}
/*
+ * Mark the pte with _PAGE_COMBO, if we are trying to hash it with
+ * base page size 4k.
+ */
+ if (psize == MMU_PAGE_4K)
+ new_pmd |= _PAGE_COMBO;
+ /*
* The hpte valid is stored in the pgtable whose address is in the
* second half of the PMD. Order this against clearing of the busy bit in
* huge pmd.
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 055/142] powerpc/thp: Handle combo pages in invalidate
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (53 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 054/142] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 056/142] powerpc/thp: Invalidate with vpn in loop Jiri Slaby
` (88 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fc0479557572375100ef16c71170b29a98e0d69a upstream.
If we changed base page size of the segment, either via sub_page_protect
or via remap_4k_pfn, we do a demote_segment which doesn't flush the hash
table entries. We do a lazy hash page table flush for all mapped pages
in the demoted segment. This happens when we handle hash page fault for
these pages.
We use _PAGE_COMBO bit along with _PAGE_HASHPTE to indicate whether a
pte is backed by 4K hash pte. If we find _PAGE_COMBO not set on the pte,
that implies that we could possibly have older 64K hash pte entries in
the hash page table and we need to invalidate those entries.
Use _PAGE_COMBO to determine the page size with which we should
invalidate the hash table entries on unmap.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/include/asm/pgtable-ppc64.h | 2 +-
arch/powerpc/mm/pgtable_64.c | 14 +++++++++++---
arch/powerpc/mm/tlb_hash64.c | 2 +-
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
index 46db09414a10..832a39d042d4 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -409,7 +409,7 @@ static inline char *get_hpte_slot_array(pmd_t *pmdp)
}
extern void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
- pmd_t *pmdp);
+ pmd_t *pmdp, unsigned long old_pmd);
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
extern pmd_t pfn_pmd(unsigned long pfn, pgprot_t pgprot);
extern pmd_t mk_pmd(struct page *page, pgprot_t pgprot);
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 48bda6700404..c9379a2d6006 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -524,7 +524,7 @@ unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
*pmdp = __pmd(old & ~clr);
#endif
if (old & _PAGE_HASHPTE)
- hpte_do_hugepage_flush(mm, addr, pmdp);
+ hpte_do_hugepage_flush(mm, addr, pmdp, old);
return old;
}
@@ -631,7 +631,7 @@ void pmdp_splitting_flush(struct vm_area_struct *vma,
if (!(old & _PAGE_SPLITTING)) {
/* We need to flush the hpte */
if (old & _PAGE_HASHPTE)
- hpte_do_hugepage_flush(vma->vm_mm, address, pmdp);
+ hpte_do_hugepage_flush(vma->vm_mm, address, pmdp, old);
}
}
@@ -704,7 +704,7 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
* neesd to be flushed.
*/
void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
- pmd_t *pmdp)
+ pmd_t *pmdp, unsigned long old_pmd)
{
int ssize, i;
unsigned long s_addr;
@@ -727,7 +727,15 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
return;
/* get the base page size,vsid and segment size */
+#ifdef CONFIG_DEBUG_VM
psize = get_slice_psize(mm, s_addr);
+ BUG_ON(psize == MMU_PAGE_16M);
+#endif
+ if (old_pmd & _PAGE_COMBO)
+ psize = MMU_PAGE_4K;
+ else
+ psize = MMU_PAGE_64K;
+
if (!is_kernel_addr(s_addr)) {
ssize = user_segment_size(s_addr);
vsid = get_vsid(mm->context.id, s_addr, ssize);
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 36e44b4260eb..c66e445d9890 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -217,7 +217,7 @@ void __flush_hash_table_range(struct mm_struct *mm, unsigned long start,
if (!(pte & _PAGE_HASHPTE))
continue;
if (unlikely(hugepage_shift && pmd_trans_huge(*(pmd_t *)pte)))
- hpte_do_hugepage_flush(mm, start, (pmd_t *)pte);
+ hpte_do_hugepage_flush(mm, start, (pmd_t *)ptep, pte);
else
hpte_need_flush(mm, start, ptep, pte, 0);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 056/142] powerpc/thp: Invalidate with vpn in loop
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (54 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 055/142] powerpc/thp: Handle combo pages in invalidate Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 057/142] powerpc/thp: Use ACCESS_ONCE when loading pmdp Jiri Slaby
` (87 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 969b7b208f7408712a3526856e4ae60ad13f6928 upstream.
As per ISA, for 4k base page size we compare 14..65 bits of VA specified
with the entry_VA in tlb. That implies we need to make sure we do a
tlbie with all the possible 4k va we used to access the 16MB hugepage.
With 64k base page size we compare 14..57 bits of VA. Hence we cannot
ignore the lower 24 bits of va while tlbie .We also cannot tlb
invalidate a 16MB entry with just one tlbie instruction because
we don't track which va was used to instantiate the tlb entry.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/mm/hash_native_64.c | 23 +++++++----------------
1 file changed, 7 insertions(+), 16 deletions(-)
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index 9197691fd5d5..9ca9c160dee4 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -418,7 +418,7 @@ static void native_hugepage_invalidate(unsigned long vsid,
unsigned char *hpte_slot_array,
int psize, int ssize)
{
- int i, lock_tlbie;
+ int i;
struct hash_pte *hptep;
int actual_psize = MMU_PAGE_16M;
unsigned int max_hpte_count, valid;
@@ -457,22 +457,13 @@ static void native_hugepage_invalidate(unsigned long vsid,
else
/* Invalidate the hpte. NOTE: this also unlocks it */
hptep->v = 0;
+ /*
+ * We need to do tlb invalidate for all the address, tlbie
+ * instruction compares entry_VA in tlb with the VA specified
+ * here
+ */
+ tlbie(vpn, psize, actual_psize, ssize, 0);
}
- /*
- * Since this is a hugepage, we just need a single tlbie.
- * use the last vpn.
- */
- lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
- if (lock_tlbie)
- raw_spin_lock(&native_tlbie_lock);
-
- asm volatile("ptesync":::"memory");
- __tlbie(vpn, psize, actual_psize, ssize);
- asm volatile("eieio; tlbsync; ptesync":::"memory");
-
- if (lock_tlbie)
- raw_spin_unlock(&native_tlbie_lock);
-
local_irq_restore(flags);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 057/142] powerpc/thp: Use ACCESS_ONCE when loading pmdp
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (55 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 056/142] powerpc/thp: Invalidate with vpn in loop Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 058/142] Drivers: scsi: storvsc: Implement a eh_timed_out handler Jiri Slaby
` (86 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aneesh Kumar K.V, Benjamin Herrenschmidt,
Jiri Slaby
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7e467245bf5226db34c4b12d3cbacfa2f7a15a8b upstream.
We would get wrong results in compiler recomputed old_pmd. Avoid
that by using ACCESS_ONCE
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/mm/hugepage-hash64.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
index e0da84719b46..7d86c868040d 100644
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -84,7 +84,9 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
* atomically mark the linux large page PMD busy and dirty
*/
do {
- old_pmd = pmd_val(*pmdp);
+ pmd_t pmd = ACCESS_ONCE(*pmdp);
+
+ old_pmd = pmd_val(pmd);
/* If PMD busy, retry the access */
if (unlikely(old_pmd & _PAGE_BUSY))
return 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 058/142] Drivers: scsi: storvsc: Implement a eh_timed_out handler
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (56 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 057/142] powerpc/thp: Use ACCESS_ONCE when loading pmdp Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 059/142] Drivers: scsi: storvsc: Filter commands based on the storage protocol version Jiri Slaby
` (85 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 56b26e69c8283121febedd12b3cc193384af46b9 upstream.
On Azure, we have seen instances of unbounded I/O latencies. To deal with
this issue, implement handler that can reset the timeout. Note that the
host gaurantees that it will respond to each command that has been issued.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
[hch: added a better comment explaining the issue]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 9969fa1ef7c4..a14a1f7cd577 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -33,6 +33,7 @@
#include <linux/device.h>
#include <linux/hyperv.h>
#include <linux/mempool.h>
+#include <linux/blkdev.h>
#include <scsi/scsi.h>
#include <scsi/scsi_cmnd.h>
#include <scsi/scsi_host.h>
@@ -1518,6 +1519,16 @@ static int storvsc_host_reset_handler(struct scsi_cmnd *scmnd)
return SUCCESS;
}
+/*
+ * The host guarantees to respond to each command, although I/O latencies might
+ * be unbounded on Azure. Reset the timer unconditionally to give the host a
+ * chance to perform EH.
+ */
+static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
+{
+ return BLK_EH_RESET_TIMER;
+}
+
static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd)
{
bool allowed = true;
@@ -1687,6 +1698,7 @@ static struct scsi_host_template scsi_driver = {
.bios_param = storvsc_get_chs,
.queuecommand = storvsc_queuecommand,
.eh_host_reset_handler = storvsc_host_reset_handler,
+ .eh_timed_out = storvsc_eh_timed_out,
.slave_alloc = storvsc_device_alloc,
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 059/142] Drivers: scsi: storvsc: Filter commands based on the storage protocol version
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (57 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 058/142] Drivers: scsi: storvsc: Implement a eh_timed_out handler Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 060/142] Drivers: scsi: storvsc: Change the limits to reflect the values on the host Jiri Slaby
` (84 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8caf92d80526f3d7cc96831ec18b384ebcaccdf0 upstream.
Going forward it is possible that some of the commands that are not currently
implemented will be implemented on future Windows hosts. Even if they are not
implemented, we are told the host will corrrectly handle unsupported
commands (by returning appropriate return code and sense information).
Make command filtering depend on the host version.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index a14a1f7cd577..4bae90722ad2 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1564,9 +1564,19 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
struct vmscsi_request *vm_srb;
struct stor_mem_pools *memp = scmnd->device->hostdata;
- if (!storvsc_scsi_cmd_ok(scmnd)) {
- scmnd->scsi_done(scmnd);
- return 0;
+ if (vmstor_current_major <= VMSTOR_WIN8_MAJOR) {
+ /*
+ * On legacy hosts filter unimplemented commands.
+ * Future hosts are expected to correctly handle
+ * unsupported commands. Furthermore, it is
+ * possible that some of the currently
+ * unsupported commands maybe supported in
+ * future versions of the host.
+ */
+ if (!storvsc_scsi_cmd_ok(scmnd)) {
+ scmnd->scsi_done(scmnd);
+ return 0;
+ }
}
request_size = sizeof(struct storvsc_cmd_request);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 060/142] Drivers: scsi: storvsc: Change the limits to reflect the values on the host
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (58 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 059/142] Drivers: scsi: storvsc: Filter commands based on the storage protocol version Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 061/142] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host Jiri Slaby
` (83 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4cd83ecdac20d30725b4f96e5d7814a1e290bc7e upstream.
Hyper-V hosts can support multiple targets and multiple channels and larger number of
LUNs per target. Update the code to reflect this. With this patch we can correctly
enumerate all the paths in a multi-path storage environment.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 47 ++++++++++++++++++++++++++++++----------------
1 file changed, 31 insertions(+), 16 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 4bae90722ad2..8292628c109c 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -331,17 +331,17 @@ static int storvsc_timeout = 180;
static void storvsc_on_channel_callback(void *context);
-/*
- * In Hyper-V, each port/path/target maps to 1 scsi host adapter. In
- * reality, the path/target is not used (ie always set to 0) so our
- * scsi host adapter essentially has 1 bus with 1 target that contains
- * up to 256 luns.
- */
-#define STORVSC_MAX_LUNS_PER_TARGET 64
-#define STORVSC_MAX_TARGETS 1
-#define STORVSC_MAX_CHANNELS 1
+#define STORVSC_MAX_LUNS_PER_TARGET 255
+#define STORVSC_MAX_TARGETS 2
+#define STORVSC_MAX_CHANNELS 8
+#define STORVSC_FC_MAX_LUNS_PER_TARGET 255
+#define STORVSC_FC_MAX_TARGETS 128
+#define STORVSC_FC_MAX_CHANNELS 8
+#define STORVSC_IDE_MAX_LUNS_PER_TARGET 64
+#define STORVSC_IDE_MAX_TARGETS 1
+#define STORVSC_IDE_MAX_CHANNELS 1
struct storvsc_cmd_request {
struct list_head entry;
@@ -1713,7 +1713,6 @@ static struct scsi_host_template scsi_driver = {
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
.cmd_per_lun = 1,
- /* 64 max_queue * 1 target */
.can_queue = STORVSC_MAX_IO_REQUESTS*STORVSC_MAX_TARGETS,
.this_id = -1,
/* no use setting to 0 since ll_blk_rw reset it to 1 */
@@ -1778,6 +1777,9 @@ static int storvsc_probe(struct hv_device *device,
}
+ if (dev_id->driver_data == SFC_GUID)
+ scsi_driver.can_queue = (STORVSC_MAX_IO_REQUESTS *
+ STORVSC_FC_MAX_TARGETS);
host = scsi_host_alloc(&scsi_driver,
sizeof(struct hv_host_device));
if (!host)
@@ -1811,12 +1813,25 @@ static int storvsc_probe(struct hv_device *device,
host_dev->path = stor_device->path_id;
host_dev->target = stor_device->target_id;
- /* max # of devices per target */
- host->max_lun = STORVSC_MAX_LUNS_PER_TARGET;
- /* max # of targets per channel */
- host->max_id = STORVSC_MAX_TARGETS;
- /* max # of channels */
- host->max_channel = STORVSC_MAX_CHANNELS - 1;
+ switch (dev_id->driver_data) {
+ case SFC_GUID:
+ host->max_lun = STORVSC_FC_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_FC_MAX_TARGETS;
+ host->max_channel = STORVSC_FC_MAX_CHANNELS - 1;
+ break;
+
+ case SCSI_GUID:
+ host->max_lun = STORVSC_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_MAX_TARGETS;
+ host->max_channel = STORVSC_MAX_CHANNELS - 1;
+ break;
+
+ default:
+ host->max_lun = STORVSC_IDE_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_IDE_MAX_TARGETS;
+ host->max_channel = STORVSC_IDE_MAX_CHANNELS - 1;
+ break;
+ }
/* max cmd length */
host->max_cmd_len = STORVSC_MAX_CMD_LEN;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 061/142] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (59 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 060/142] Drivers: scsi: storvsc: Change the limits to reflect the values on the host Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 062/142] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version Jiri Slaby
` (82 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 52f9614dd8294e95d2c0929c2d4f64b077ae486f upstream.
Set cmd_per_lun to reflect value supported by the Host.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 8292628c109c..1d77edce03c2 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1712,7 +1712,7 @@ static struct scsi_host_template scsi_driver = {
.slave_alloc = storvsc_device_alloc,
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
- .cmd_per_lun = 1,
+ .cmd_per_lun = 255,
.can_queue = STORVSC_MAX_IO_REQUESTS*STORVSC_MAX_TARGETS,
.this_id = -1,
/* no use setting to 0 since ll_blk_rw reset it to 1 */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 062/142] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (60 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 061/142] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 063/142] drivers: scsi: storvsc: Set srb_flags in all cases Jiri Slaby
` (81 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit adb6f9e1a8c6af1037232b59edb11277471537ea upstream.
Based on the negotiated VMBUS protocol version, we adjust the size of the storage
protocol messages. The two sizes we currently handle are pre-win8 and post-win8.
In WS2012 R2, we are negotiating higher VMBUS protocol version than the win8
version. Make adjustments to correctly handle this.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1d77edce03c2..2b8595b7ad45 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1764,19 +1764,22 @@ static int storvsc_probe(struct hv_device *device,
* set state to properly communicate with the host.
*/
- if (vmbus_proto_version == VERSION_WIN8) {
- sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE;
- vmscsi_size_delta = 0;
- vmstor_current_major = VMSTOR_WIN8_MAJOR;
- vmstor_current_minor = VMSTOR_WIN8_MINOR;
- } else {
+ switch (vmbus_proto_version) {
+ case VERSION_WS2008:
+ case VERSION_WIN7:
sense_buffer_size = PRE_WIN8_STORVSC_SENSE_BUFFER_SIZE;
vmscsi_size_delta = sizeof(struct vmscsi_win8_extension);
vmstor_current_major = VMSTOR_WIN7_MAJOR;
vmstor_current_minor = VMSTOR_WIN7_MINOR;
+ break;
+ default:
+ sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE;
+ vmscsi_size_delta = 0;
+ vmstor_current_major = VMSTOR_WIN8_MAJOR;
+ vmstor_current_minor = VMSTOR_WIN8_MINOR;
+ break;
}
-
if (dev_id->driver_data == SFC_GUID)
scsi_driver.can_queue = (STORVSC_MAX_IO_REQUESTS *
STORVSC_FC_MAX_TARGETS);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 063/142] drivers: scsi: storvsc: Set srb_flags in all cases
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (61 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 062/142] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 064/142] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure Jiri Slaby
` (80 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f885fb73f64154690c2158e813de56363389ffec upstream.
Correctly set SRB flags for all valid I/O directions. Some IHV drivers on the
Windows host require this. The host validates the command and SRB flags
prior to passing the command down to native driver stack.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 2b8595b7ad45..b529ae8e8fff 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1601,26 +1601,24 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
vm_srb = &cmd_request->vstor_packet.vm_srb;
vm_srb->win8_extension.time_out_value = 60;
+ vm_srb->win8_extension.srb_flags |=
+ (SRB_FLAGS_QUEUE_ACTION_ENABLE |
+ SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
/* Build the SRB */
switch (scmnd->sc_data_direction) {
case DMA_TO_DEVICE:
vm_srb->data_in = WRITE_TYPE;
vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_OUT;
- vm_srb->win8_extension.srb_flags |=
- (SRB_FLAGS_QUEUE_ACTION_ENABLE |
- SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
break;
case DMA_FROM_DEVICE:
vm_srb->data_in = READ_TYPE;
vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_IN;
- vm_srb->win8_extension.srb_flags |=
- (SRB_FLAGS_QUEUE_ACTION_ENABLE |
- SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
break;
default:
vm_srb->data_in = UNKNOWN_TYPE;
- vm_srb->win8_extension.srb_flags = 0;
+ vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
+ SRB_FLAGS_DATA_OUT);
break;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 064/142] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (62 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 063/142] drivers: scsi: storvsc: Set srb_flags in all cases Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 065/142] scsi_scan: Restrict sequential scan to 256 LUNs Jiri Slaby
` (79 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Christoph Hellwig, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3533f8603d28b77c62d75ec899449a99bc6b77a1 upstream.
On some Windows hosts on FC SANs, TEST_UNIT_READY can return SRB_STATUS_ERROR.
Correctly handle this. Note that there is sufficient sense information to
support scsi error handling even in this case.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/storvsc_drv.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index b529ae8e8fff..ed0f899e8aa5 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1018,6 +1018,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
case ATA_12:
set_host_byte(scmnd, DID_PASSTHROUGH);
break;
+ /*
+ * On Some Windows hosts TEST_UNIT_READY command can return
+ * SRB_STATUS_ERROR, let the upper level code deal with it
+ * based on the sense information.
+ */
+ case TEST_UNIT_READY:
+ break;
default:
set_host_byte(scmnd, DID_TARGET_FAILURE);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 065/142] scsi_scan: Restrict sequential scan to 256 LUNs
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (63 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 064/142] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 066/142] scsi: add a blacklist flag which enables VPD page inquiries Jiri Slaby
` (78 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hannes Reinecke, Christoph Hellwig, Jiri Slaby
From: Hannes Reinecke <hare@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 22ffeb48b7584d6cd50f2a595ed6065d86a87459 upstream.
Sequential scan for more than 256 LUNs is very fragile as
LUNs might not be numbered sequentially after that point.
SAM revisions later than SCSI-3 impose a structure on
LUNs larger than 256, making LUN numbers between 256
and 16384 illegal.
SCSI-3, however allows for plain 64-bit numbers with
no internal structure.
So restrict sequential LUN scan to 256 LUNs and add a
new blacklist flag 'BLIST_SCSI3LUN' to scan up to
max_lun devices.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/scsi_scan.c | 6 ++++++
include/scsi/scsi_devinfo.h | 2 ++
2 files changed, 8 insertions(+)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 4109530e92a0..bfad3586d914 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1236,6 +1236,12 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget,
max_dev_lun = min(8U, max_dev_lun);
/*
+ * Stop scanning at 255 unless BLIST_SCSI3LUN
+ */
+ if (!(bflags & BLIST_SCSI3LUN))
+ max_dev_lun = min(256U, max_dev_lun);
+
+ /*
* We have already scanned LUN 0, so start at LUN 1. Keep scanning
* until we reach the max, or no LUN is found and we are not
* sparse_lun.
diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
index 447d2d7466fc..8670c04e199e 100644
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -32,4 +32,6 @@
#define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */
#define BLIST_NO_DIF 0x2000000 /* Disable T10 PI (DIF) */
#define BLIST_SKIP_VPD_PAGES 0x4000000 /* Ignore SBC-3 VPD pages */
+#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
+ for sequential scan */
#endif
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 066/142] scsi: add a blacklist flag which enables VPD page inquiries
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (64 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 065/142] scsi_scan: Restrict sequential scan to 256 LUNs Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 067/142] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f Jiri Slaby
` (77 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Martin K. Petersen, Christoph Hellwig, Jiri Slaby
From: "Martin K. Petersen" <martin.petersen@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c1d40a527e885a40bb9ea6c46a1b1145d42b66a0 upstream.
Despite supporting modern SCSI features some storage devices continue to
claim conformance to an older version of the SPC spec. This is done for
compatibility with legacy operating systems.
Linux by default will not attempt to read VPD pages on devices that
claim SPC-2 or older. Introduce a blacklist flag that can be used to
trigger VPD page inquiries on devices that are known to support them.
Reported-by: KY Srinivasan <kys@microsoft.com>
Tested-by: KY Srinivasan <kys@microsoft.com>
Reviewed-by: KY Srinivasan <kys@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/scsi_scan.c | 4 +++-
drivers/scsi/sd.c | 5 +++++
include/scsi/scsi_device.h | 1 +
include/scsi/scsi_devinfo.h | 1 +
4 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index bfad3586d914..17b08db224e8 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -950,7 +950,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
- if (*bflags & BLIST_SKIP_VPD_PAGES)
+ if (*bflags & BLIST_TRY_VPD_PAGES)
+ sdev->try_vpd_pages = 1;
+ else if (*bflags & BLIST_SKIP_VPD_PAGES)
sdev->skip_vpd_pages = 1;
transport_configure_device(&sdev->sdev_gendev);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index dbc024bd4adf..69d2a7060fde 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2667,6 +2667,11 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
static int sd_try_extended_inquiry(struct scsi_device *sdp)
{
+ /* Attempt VPD inquiry if the device blacklist explicitly calls
+ * for it.
+ */
+ if (sdp->try_vpd_pages)
+ return 1;
/*
* Although VPD inquiries can go to SCSI-2 type devices,
* some USB ones crash on receiving them, and the pages
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index b4f1effc9216..409fafb63f63 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -149,6 +149,7 @@ struct scsi_device {
unsigned skip_ms_page_8:1; /* do not use MODE SENSE page 0x08 */
unsigned skip_ms_page_3f:1; /* do not use MODE SENSE page 0x3f */
unsigned skip_vpd_pages:1; /* do not read VPD pages */
+ unsigned try_vpd_pages:1; /* attempt to read VPD pages */
unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */
unsigned no_start_on_add:1; /* do not issue start on add */
unsigned allow_restart:1; /* issue START_UNIT in error handler */
diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
index 8670c04e199e..1fdd6fc5492b 100644
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -34,4 +34,5 @@
#define BLIST_SKIP_VPD_PAGES 0x4000000 /* Ignore SBC-3 VPD pages */
#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
for sequential scan */
+#define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */
#endif
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 067/142] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (65 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 066/142] scsi: add a blacklist flag which enables VPD page inquiries Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 068/142] MIPS: GIC: Prevent array overrun Jiri Slaby
` (76 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Janusz Dziemidowicz, Christoph Hellwig, Jiri Slaby
From: Janusz Dziemidowicz <rraptorr@nails.eu.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0213436a2cc5e4a5ca2fabfaa4d3877097f3b13f upstream.
Some devices don't like REPORT SUPPORTED OPERATION CODES and will
simply timeout causing sd_mod init to take a very very long time.
Introduce BLIST_NO_RSOC scsi scan flag, that stops RSOC from being
issued. Add it to Promise Vtrak E610f entry in scsi scan
blacklist. Fixes bug #79901 reported at
https://bugzilla.kernel.org/show_bug.cgi?id=79901
Fixes: 98dcc2946adb ("SCSI: sd: Update WRITE SAME heuristics")
Signed-off-by: Janusz Dziemidowicz <rraptorr@nails.eu.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/scsi_devinfo.c | 1 +
drivers/scsi/scsi_scan.c | 6 ++++++
include/scsi/scsi_devinfo.h | 2 ++
3 files changed, 9 insertions(+)
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index f969aca0b54e..49014a143c6a 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -222,6 +222,7 @@ static struct {
{"PIONEER", "CD-ROM DRM-602X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
{"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
{"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
{"Promise", "", NULL, BLIST_SPARSELUN},
{"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
{"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 17b08db224e8..054ec2c412a4 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -922,6 +922,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
if (*bflags & BLIST_USE_10_BYTE_MS)
sdev->use_10_for_ms = 1;
+ /* some devices don't like REPORT SUPPORTED OPERATION CODES
+ * and will simply timeout causing sd_mod init to take a very
+ * very long time */
+ if (*bflags & BLIST_NO_RSOC)
+ sdev->no_report_opcodes = 1;
+
/* set the device running here so that slave configure
* may do I/O */
ret = scsi_device_set_state(sdev, SDEV_RUNNING);
diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
index 1fdd6fc5492b..183eaab7c380 100644
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -35,4 +35,6 @@
#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
for sequential scan */
#define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */
+#define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */
+
#endif
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 068/142] MIPS: GIC: Prevent array overrun
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (66 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 067/142] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 069/142] MIPS: Prevent user from setting FCSR cause bits Jiri Slaby
` (75 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Jeffrey Deans, Markos Chandras, linux-mips,
Ralf Baechle, Jiri Slaby
From: Jeffrey Deans <jeffrey.deans@imgtec.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ffc8415afab20bd97754efae6aad1f67b531132b upstream.
A GIC interrupt which is declared as having a GIC_MAP_TO_NMI_MSK
mapping causes the cpu parameter to gic_setup_intr() to be increased
to 32, causing memory corruption when pcpu_masks[] is written to again
later in the function.
Signed-off-by: Jeffrey Deans <jeffrey.deans@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7375/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/kernel/irq-gic.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index 5b5ddb231f26..78f18436cdf2 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -255,11 +255,13 @@ static void __init gic_setup_intr(unsigned int intr, unsigned int cpu,
/* Setup Intr to Pin mapping */
if (pin & GIC_MAP_TO_NMI_MSK) {
+ int i;
+
GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin);
/* FIXME: hack to route NMI to all cpu's */
- for (cpu = 0; cpu < NR_CPUS; cpu += 32) {
+ for (i = 0; i < NR_CPUS; i += 32) {
GICWRITE(GIC_REG_ADDR(SHARED,
- GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)),
+ GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)),
0xffffffff);
}
} else {
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 069/142] MIPS: Prevent user from setting FCSR cause bits
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (67 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 068/142] MIPS: GIC: Prevent array overrun Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 070/142] MIPS: tlbex: Fix a missing statement for HUGETLB Jiri Slaby
` (74 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Paul Burton, linux-mips, Ralf Baechle, Jiri Slaby
From: Paul Burton <paul.burton@imgtec.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b1442d39fac2fcfbe6a4814979020e993ca59c9e upstream.
If one or more matching FCSR cause & enable bits are set in saved thread
context then when that context is restored the kernel will take an FP
exception. This is of course undesirable and considered an oops, leading
to the kernel writing a backtrace to the console and potentially
rebooting depending upon the configuration. Thus the kernel avoids this
situation by clearing the cause bits of the FCSR register when handling
FP exceptions and after emulating FP instructions.
However the kernel does not prevent userland from setting arbitrary FCSR
cause & enable bits via ptrace, using either the PTRACE_POKEUSR or
PTRACE_SETFPREGS requests. This means userland can trivially cause the
kernel to oops on any system with an FPU. Prevent this from happening
by clearing the cause bits when writing to the saved FCSR context via
ptrace.
This problem appears to exist at least back to the beginning of the git
era in the PTRACE_POKEUSR case.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/7438/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/kernel/ptrace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 8ae1ebef8b71..5404cab551f3 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -162,6 +162,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data)
__get_user(fregs[i], i + (__u64 __user *) data);
__get_user(child->thread.fpu.fcr31, data + 64);
+ child->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
/* FIR may not be written. */
@@ -452,7 +453,7 @@ long arch_ptrace(struct task_struct *child, long request,
break;
#endif
case FPC_CSR:
- child->thread.fpu.fcr31 = data;
+ child->thread.fpu.fcr31 = data & ~FPU_CSR_ALL_X;
break;
case DSP_BASE ... DSP_BASE + 5: {
dspreg_t *dregs;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 070/142] MIPS: tlbex: Fix a missing statement for HUGETLB
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (68 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 069/142] MIPS: Prevent user from setting FCSR cause bits Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 071/142] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade() Jiri Slaby
` (73 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Huacai Chen, Binbin Zhou, John Crispin,
Steven J. Hill, linux-mips, Fuxin Zhang, Zhangjin Wu,
Ralf Baechle, Jiri Slaby
From: Huacai Chen <chenhc@lemote.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8393c524a25609a30129e4a8975cf3b91f6c16a5 upstream.
In commit 2c8c53e28f1 (MIPS: Optimize TLB handlers for Octeon CPUs)
build_r4000_tlb_refill_handler() is modified. But it doesn't compatible
with the original code in HUGETLB case. Because there is a copy & paste
error and one line of code is missing. It is very easy to produce a bug
with LTP's hugemmap05 test.
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Binbin Zhou <zhoubb@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/7496/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/mm/tlbex.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 9bb3a9363b06..db7a050f5c2c 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -1333,6 +1333,7 @@ static void build_r4000_tlb_refill_handler(void)
}
#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
uasm_l_tlb_huge_update(&l, p);
+ UASM_i_LW(&p, K0, 0, K1);
build_huge_update_entries(&p, htlb_info.huge_pte, K1);
build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random,
htlb_info.restore_scratch);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 071/142] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (69 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 070/142] MIPS: tlbex: Fix a missing statement for HUGETLB Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 072/142] MIPS: OCTEON: make get_system_type() thread-safe Jiri Slaby
` (72 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Huacai Chen, Jie Chen, Rui Wang, John Crispin,
Steven J. Hill, linux-mips, Fuxin Zhang, Zhangjin Wu,
Ralf Baechle, Jiri Slaby
From: Huacai Chen <chenhc@lemote.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2e5767a27337812f6850b3fa362419e2f085e5c3 upstream.
In do_ade(), is_fpu_owner() isn't preempt-safe. For example, when an
unaligned ldc1 is executed, do_cpu() is called and then FPU will be
enabled (and TIF_USEDFPU will be set for the current process). Then,
do_ade() is called because the access is unaligned. If the current
process is preempted at this time, TIF_USEDFPU will be cleard. So when
the process is scheduled again, BUG_ON(!is_fpu_owner()) is triggered.
This small program can trigger this BUG in a preemptible kernel:
int main (int argc, char *argv[])
{
double u64[2];
while (1) {
asm volatile (
".set push \n\t"
".set noreorder \n\t"
"ldc1 $f3, 4(%0) \n\t"
".set pop \n\t"
::"r"(u64):
);
}
return 0;
}
V2: Remove the BUG_ON() unconditionally due to Paul's suggestion.
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Jie Chen <chenj@lemote.com>
Signed-off-by: Rui Wang <wangr@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/kernel/unaligned.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c
index c369a5d35527..b897dde93e7a 100644
--- a/arch/mips/kernel/unaligned.c
+++ b/arch/mips/kernel/unaligned.c
@@ -605,7 +605,6 @@ static void emulate_load_store_insn(struct pt_regs *regs,
case sdc1_op:
die_if_kernel("Unaligned FP access in kernel code", regs);
BUG_ON(!used_math());
- BUG_ON(!is_fpu_owner());
lose_fpu(1); /* Save FPU state for the emulator. */
res = fpu_emulator_cop1Handler(regs, ¤t->thread.fpu, 1,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 072/142] MIPS: OCTEON: make get_system_type() thread-safe
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (70 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 071/142] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 073/142] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811 Jiri Slaby
` (71 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aaro Koskinen, James Hogan, Jiri Slaby
From: Aaro Koskinen <aaro.koskinen@nsn.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 608308682addfdc7b8e2aee88f0e028331d88e4d upstream.
get_system_type() is not thread-safe on OCTEON. It uses static data,
also more dangerous issue is that it's calling cvmx_fuse_read_byte()
every time without any synchronization. Currently it's possible to get
processes stuck looping forever in kernel simply by launching multiple
readers of /proc/cpuinfo:
(while true; do cat /proc/cpuinfo > /dev/null; done) &
(while true; do cat /proc/cpuinfo > /dev/null; done) &
...
Fix by initializing the system type string only once during the early
boot.
Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
Reviewed-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7437/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/cavium-octeon/setup.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index b212ae12e5ac..8a0079981cc8 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -458,6 +458,18 @@ static void octeon_halt(void)
octeon_kill_core(NULL);
}
+static char __read_mostly octeon_system_type[80];
+
+static int __init init_octeon_system_type(void)
+{
+ snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
+ cvmx_board_type_to_string(octeon_bootinfo->board_type),
+ octeon_model_get_string(read_c0_prid()));
+
+ return 0;
+}
+early_initcall(init_octeon_system_type);
+
/**
* Return a string representing the system type
*
@@ -465,11 +477,7 @@ static void octeon_halt(void)
*/
const char *octeon_board_type_string(void)
{
- static char name[80];
- sprintf(name, "%s (%s)",
- cvmx_board_type_to_string(octeon_bootinfo->board_type),
- octeon_model_get_string(read_c0_prid()));
- return name;
+ return octeon_system_type;
}
const char *get_system_type(void)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 073/142] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (71 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 072/142] MIPS: OCTEON: make get_system_type() thread-safe Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 074/142] ASoC: pcm: fix dpcm_path_put in dpcm runtime update Jiri Slaby
` (70 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Charles Keepax, Mark Brown, Jiri Slaby
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b38314179c9ccb789e6fe967cff171fa817e8978 upstream.
wm1811_micd_stop takes the accdet_lock mutex, and is called from two
places, one of which is already holding the accdet_lock. This obviously
causes a lock up.
This patch fixes this issue by removing the lock from wm1811_micd_stop
and ensuring that it is always locked externally.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/wm8994.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 86426a117b07..c9ce9772e49b 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3492,6 +3492,7 @@ static irqreturn_t wm8994_mic_irq(int irq, void *data)
return IRQ_HANDLED;
}
+/* Should be called with accdet_lock held */
static void wm1811_micd_stop(struct snd_soc_codec *codec)
{
struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
@@ -3499,14 +3500,10 @@ static void wm1811_micd_stop(struct snd_soc_codec *codec)
if (!wm8994->jackdet)
return;
- mutex_lock(&wm8994->accdet_lock);
-
snd_soc_update_bits(codec, WM8958_MIC_DETECT_1, WM8958_MICD_ENA, 0);
wm1811_jackdet_set_mode(codec, WM1811_JACKDET_MODE_JACK);
- mutex_unlock(&wm8994->accdet_lock);
-
if (wm8994->wm8994->pdata.jd_ext_cap)
snd_soc_dapm_disable_pin(&codec->dapm,
"MICBIAS2");
@@ -3547,10 +3544,10 @@ static void wm8958_open_circuit_work(struct work_struct *work)
open_circuit_work.work);
struct device *dev = wm8994->wm8994->dev;
- wm1811_micd_stop(wm8994->hubs.codec);
-
mutex_lock(&wm8994->accdet_lock);
+ wm1811_micd_stop(wm8994->hubs.codec);
+
dev_dbg(dev, "Reporting open circuit\n");
wm8994->jack_mic = false;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 074/142] ASoC: pcm: fix dpcm_path_put in dpcm runtime update
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (72 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 073/142] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811 Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 075/142] ASoC: wm_adsp: Add missing MODULE_LICENSE Jiri Slaby
` (69 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Qiao Zhou, Mark Brown, Jiri Slaby
From: Qiao Zhou <zhouqiao@marvell.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7ed9de76ff342cbd717a9cf897044b99272cb8f8 upstream.
we need to release dapm widget list after dpcm_path_get in
soc_dpcm_runtime_update. otherwise, there will be potential memory
leak. add dpcm_path_put to fix it.
Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/soc-pcm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 330c9a6b5cb5..875cae86d708 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1882,6 +1882,7 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card)
dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK);
}
+ dpcm_path_put(&list);
capture:
/* skip if FE doesn't have capture capability */
if (!fe->cpu_dai->driver->capture.channels_min)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 075/142] ASoC: wm_adsp: Add missing MODULE_LICENSE
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (73 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 074/142] ASoC: pcm: fix dpcm_path_put in dpcm runtime update Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 076/142] ASoC: blackfin: use samples to set silence Jiri Slaby
` (68 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Praveen Diwakar, Vinod Koul, Mark Brown, Jiri Slaby
From: Praveen Diwakar <praveen.diwakar@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0a37c6efec4a2fdc2563c5a8faa472b814deee80 upstream.
Since MODULE_LICENSE is missing the module load fails,
so add this for module.
Signed-off-by: Praveen Diwakar <praveen.diwakar@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/wm_adsp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 0d5de6003849..61e871bf63dd 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1694,3 +1694,5 @@ int wm_adsp2_init(struct wm_adsp *adsp, bool dvfs)
return 0;
}
EXPORT_SYMBOL_GPL(wm_adsp2_init);
+
+MODULE_LICENSE("GPL v2");
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 076/142] ASoC: blackfin: use samples to set silence
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (74 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 075/142] ASoC: wm_adsp: Add missing MODULE_LICENSE Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 077/142] ASoC: samsung: Correct I2S DAI suspend/resume ops Jiri Slaby
` (67 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Scott Jiang, Mark Brown, Jiri Slaby
From: Scott Jiang <scott.jiang.linux@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 30443408fd7201fd1911b09daccf92fae3cc700d upstream.
The third parameter for snd_pcm_format_set_silence needs the number
of samples instead of sample bytes.
Signed-off-by: Scott Jiang <scott.jiang.linux@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/blackfin/bf5xx-i2s-pcm.c b/sound/soc/blackfin/bf5xx-i2s-pcm.c
index 9cb4a80df98e..bc9983d38ff3 100644
--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c
+++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c
@@ -293,19 +293,19 @@ static int bf5xx_pcm_silence(struct snd_pcm_substream *substream,
unsigned int sample_size = runtime->sample_bits / 8;
void *buf = runtime->dma_area;
struct bf5xx_i2s_pcm_data *dma_data;
- unsigned int offset, size;
+ unsigned int offset, samples;
dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
if (dma_data->tdm_mode) {
offset = pos * 8 * sample_size;
- size = count * 8 * sample_size;
+ samples = count * 8;
} else {
offset = frames_to_bytes(runtime, pos);
- size = frames_to_bytes(runtime, count);
+ samples = count * runtime->channels;
}
- snd_pcm_format_set_silence(runtime->format, buf + offset, size);
+ snd_pcm_format_set_silence(runtime->format, buf + offset, samples);
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 077/142] ASoC: samsung: Correct I2S DAI suspend/resume ops
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (75 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 076/142] ASoC: blackfin: use samples to set silence Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 078/142] ASoC: adau1701: fix adau1701_reg_read() Jiri Slaby
` (66 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Sylwester Nawrocki, Mark Brown, Jiri Slaby
From: Sylwester Nawrocki <s.nawrocki@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d3d4e5247b013008a39e4d5f69ce4c60ed57f997 upstream.
We should save/restore relevant I2S registers regardless of
the dai->active flag, otherwise some settings are being lost
after system suspend/resume cycle. E.g. I2S slave mode set only
during dai initialization is not preserved and the device ends
up in master mode after system resume.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/samsung/i2s.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index b302f3b7a587..2ac8d88fe7eb 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -922,11 +922,9 @@ static int i2s_suspend(struct snd_soc_dai *dai)
{
struct i2s_dai *i2s = to_info(dai);
- if (dai->active) {
- i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
- i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
- i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
- }
+ i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
+ i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
+ i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
return 0;
}
@@ -935,11 +933,9 @@ static int i2s_resume(struct snd_soc_dai *dai)
{
struct i2s_dai *i2s = to_info(dai);
- if (dai->active) {
- writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
- writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
- writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
- }
+ writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
+ writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
+ writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 078/142] ASoC: adau1701: fix adau1701_reg_read()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (76 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 077/142] ASoC: samsung: Correct I2S DAI suspend/resume ops Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 079/142] ASoC: max98090: Fix missing free_irq Jiri Slaby
` (65 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Daniel Mack, Mark Brown, Jiri Slaby
From: Daniel Mack <zonque@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3ad80b828b2533f37c221e2df155774efd6ed814 upstream.
Fix a long standing bug in the read register routing of adau1701.
The bytes arrive in the buffer in big-endian, so the result has to be
shifted before and-ing the bytes in the loop.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/adau1701.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c
index adee866f463f..56bfc679f437 100644
--- a/sound/soc/codecs/adau1701.c
+++ b/sound/soc/codecs/adau1701.c
@@ -230,8 +230,10 @@ static int adau1701_reg_read(void *context, unsigned int reg,
*value = 0;
- for (i = 0; i < size; i++)
- *value |= recv_buf[i] << (i * 8);
+ for (i = 0; i < size; i++) {
+ *value <<= 8;
+ *value |= recv_buf[i];
+ }
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 079/142] ASoC: max98090: Fix missing free_irq
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (77 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 078/142] ASoC: adau1701: fix adau1701_reg_read() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 080/142] ASoC: pxa: pxa-ssp: small leak in probe() Jiri Slaby
` (64 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jarkko Nikula, Mark Brown, Jiri Slaby
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 upstream.
max98090.c doesn't free the threaded interrupt it requests. This causes
an oops when doing "cat /proc/interrupts" after snd-soc-max98090.ko is
unloaded.
Fix this by requesting the interrupt by using devm_request_threaded_irq().
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/max98090.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index 9ad8f019adcd..764d0ea42e7c 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -2250,7 +2250,7 @@ static int max98090_probe(struct snd_soc_codec *codec)
/* Register for interrupts */
dev_dbg(codec->dev, "irq = %d\n", max98090->irq);
- ret = request_threaded_irq(max98090->irq, NULL,
+ ret = devm_request_threaded_irq(codec->dev, max98090->irq, NULL,
max98090_interrupt, IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
"max98090_interrupt", codec);
if (ret < 0) {
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 080/142] ASoC: pxa: pxa-ssp: small leak in probe()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (78 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 079/142] ASoC: max98090: Fix missing free_irq Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 081/142] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE Jiri Slaby
` (63 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dan Carpenter, Mark Brown, Jiri Slaby
From: Dan Carpenter <dan.carpenter@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4548728981de259d7d37d0ae968a777b09794168 upstream.
There is a small memory leak if probe() fails.
Fixes: 2023c90c3a2c ('ASoC: pxa: pxa-ssp: add DT bindings')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/pxa/pxa-ssp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index a3119a00d8fa..e4558e31a9ee 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -725,7 +725,8 @@ static int pxa_ssp_probe(struct snd_soc_dai *dai)
ssp_handle = of_parse_phandle(dev->of_node, "port", 0);
if (!ssp_handle) {
dev_err(dev, "unable to get 'port' phandle\n");
- return -ENODEV;
+ ret = -ENODEV;
+ goto err_priv;
}
priv->ssp = pxa_ssp_request_of(ssp_handle, "SoC audio");
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 081/142] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (79 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 080/142] ASoC: pxa: pxa-ssp: small leak in probe() Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 082/142] ASoC: rt5640: Do not allow regmap to use bulk read-write operations Jiri Slaby
` (62 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Daniel Mack, Mark Brown, Jiri Slaby
From: Daniel Mack <zonque@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9301503af016eb537ccce76adec0c1bb5c84871e upstream.
This mode is unsupported, as the DMA controller can't do zero-padding
of samples.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Reported-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/pxa/pxa-ssp.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index e4558e31a9ee..6c6b35e471c8 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -767,9 +767,7 @@ static int pxa_ssp_remove(struct snd_soc_dai *dai)
SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
- SNDRV_PCM_FMTBIT_S24_LE | \
- SNDRV_PCM_FMTBIT_S32_LE)
+#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
static const struct snd_soc_dai_ops pxa_ssp_dai_ops = {
.startup = pxa_ssp_startup,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 082/142] ASoC: rt5640: Do not allow regmap to use bulk read-write operations
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (80 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 081/142] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 083/142] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address Jiri Slaby
` (61 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jarkko Nikula, Mark Brown, Jiri Slaby
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 upstream.
Debugging showed Realtek RT5642 doesn't support autoincrementing writes so
driver should set the use_single_rw flag for regmap.
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/rt5640.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index c26a8f814b18..aa5253a3548e 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2061,6 +2061,7 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5640 = {
static const struct regmap_config rt5640_regmap = {
.reg_bits = 8,
.val_bits = 16,
+ .use_single_rw = true,
.max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) *
RT5640_PR_SPACING),
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 083/142] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (81 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 082/142] ASoC: rt5640: Do not allow regmap to use bulk read-write operations Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 084/142] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject Jiri Slaby
` (60 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Ben Hutchings, Christoph Hellwig, Jiri Slaby
From: Ben Hutchings <ben@decadent.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.
bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
each way. In two places the argument type is dma_addr_t, which may be
32-bit, in which case the effect of the bit shift is undefined:
drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
addr = bfa_sgaddr_le(sg_dma_address(sg));
^
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
addr = bfa_sgaddr_le(sg_dma_address(sg));
^
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]
Avoid this by adding casts to u64 in bfa_swap_words().
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Anil Gurumurthy <anil.gurumurthy@qlogic.com>
Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/bfa/bfa_ioc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
index 90814fe85ac1..d5b3f66f0ebd 100644
--- a/drivers/scsi/bfa/bfa_ioc.h
+++ b/drivers/scsi/bfa/bfa_ioc.h
@@ -72,7 +72,7 @@ struct bfa_sge_s {
} while (0)
#define bfa_swap_words(_x) ( \
- ((_x) << 32) | ((_x) >> 32))
+ ((u64)(_x) << 32) | ((u64)(_x) >> 32))
#ifdef __BIG_ENDIAN
#define bfa_sge_to_be(_x)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 084/142] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (82 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 083/142] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 085/142] spi/pxa2xx: Add ACPI ID for Intel Braswell Jiri Slaby
` (59 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable
Cc: linux-kernel, David E. Box, Bob Moore, Lv Zheng,
Rafael J. Wysocki, Jiri Slaby
From: "David E. Box" <david.e.box@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce upstream.
Adds return status check on copy routines to delete the allocated destination
object if either copy fails. Reported by Colin Ian King on bugs.acpica.org,
Bug 1087.
The last applicable commit:
Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61
Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro
Link: https://bugs.acpica.org/show_bug.cgi?id=1087
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/acpi/acpica/utcopy.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 1731c27c36a6..2cac1d1f3863 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union acpi_operand_object *source_desc,
status = acpi_ut_copy_simple_object(source_desc, *dest_desc);
}
+ /* Delete the allocated object if copy failed */
+
+ if (ACPI_FAILURE(status)) {
+ acpi_ut_remove_reference(*dest_desc);
+ }
+
return_ACPI_STATUS(status);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 085/142] spi/pxa2xx: Add ACPI ID for Intel Braswell
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (83 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 084/142] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 086/142] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock Jiri Slaby
` (58 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alan Cox, Mika Westerberg, Mark Brown, Jiri Slaby
From: Alan Cox <alan@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aca26364689e00e3b2052072424682231bdae6ae upstream.
The SPI host controller is the same as used in Baytrail, only the ACPI ID
is different so add this new ID to the list.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/spi/spi-pxa2xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 7b69e93d8448..fa28c75c6d04 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1082,6 +1082,7 @@ static struct acpi_device_id pxa2xx_spi_acpi_match[] = {
{ "INT3430", 0 },
{ "INT3431", 0 },
{ "80860F0E", 0 },
+ { "8086228E", 0 },
{ },
};
MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 086/142] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (84 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 085/142] spi/pxa2xx: Add ACPI ID for Intel Braswell Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 087/142] ring-buffer: Always reset iterator to reader page Jiri Slaby
` (57 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jiri Kosina, Rafael J. Wysocki, Jiri Slaby
From: Jiri Kosina <jkosina@suse.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6726655dfdd2dc60c035c690d9f10cb69d7ea075 upstream.
There is a following AB-BA dependency between cpu_hotplug.lock and
cpuidle_lock:
1) cpu_hotplug.lock -> cpuidle_lock
enable_nonboot_cpus()
_cpu_up()
cpu_hotplug_begin()
LOCK(cpu_hotplug.lock)
cpu_notify()
...
acpi_processor_hotplug()
cpuidle_pause_and_lock()
LOCK(cpuidle_lock)
2) cpuidle_lock -> cpu_hotplug.lock
acpi_os_execute_deferred() workqueue
...
acpi_processor_cst_has_changed()
cpuidle_pause_and_lock()
LOCK(cpuidle_lock)
get_online_cpus()
LOCK(cpu_hotplug.lock)
Fix this by reversing the order acpi_processor_cst_has_changed() does
thigs -- let it first execute the protection against CPU hotplug by
calling get_online_cpus() and obtain the cpuidle lock only after that (and
perform the symmentric change when allowing CPUs hotplug again and
dropping cpuidle lock).
Spotted by lockdep.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/acpi/processor_idle.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index c7414a545a4f..2a4ae32c4b97 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1099,9 +1099,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) {
- cpuidle_pause_and_lock();
/* Protect against cpu-hotplug */
get_online_cpus();
+ cpuidle_pause_and_lock();
/* Disable all cpuidle devices */
for_each_online_cpu(cpu) {
@@ -1128,8 +1128,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
cpuidle_enable_device(dev);
}
}
- put_online_cpus();
cpuidle_resume_and_unlock();
+ put_online_cpus();
}
return 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 087/142] ring-buffer: Always reset iterator to reader page
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (85 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 086/142] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:44 ` [PATCH 3.12 088/142] ring-buffer: Up rb_iter_peek() loop count to 3 Jiri Slaby
` (56 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Steven Rostedt (Red Hat), Jiri Slaby
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 651e22f2701b4113989237c3048d17337dd2185c upstream.
When performing a consuming read, the ring buffer swaps out a
page from the ring buffer with a empty page and this page that
was swapped out becomes the new reader page. The reader page
is owned by the reader and since it was swapped out of the ring
buffer, writers do not have access to it (there's an exception
to that rule, but it's out of scope for this commit).
When reading the "trace" file, it is a non consuming read, which
means that the data in the ring buffer will not be modified.
When the trace file is opened, a ring buffer iterator is allocated
and writes to the ring buffer are disabled, such that the iterator
will not have issues iterating over the data.
Although the ring buffer disabled writes, it does not disable other
reads, or even consuming reads. If a consuming read happens, then
the iterator is reset and starts reading from the beginning again.
My tests would sometimes trigger this bug on my i386 box:
WARNING: CPU: 0 PID: 5175 at kernel/trace/trace.c:1527 __trace_find_cmdline+0x66/0xaa()
Modules linked in:
CPU: 0 PID: 5175 Comm: grep Not tainted 3.16.0-rc3-test+ #8
Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
00000000 00000000 f09c9e1c c18796b3 c1b5d74c f09c9e4c c103a0e3 c1b5154b
f09c9e78 00001437 c1b5d74c 000005f7 c10bd85a c10bd85a c1cac57c f09c9eb0
ed0e0000 f09c9e64 c103a185 00000009 f09c9e5c c1b5154b f09c9e78 f09c9e80^M
Call Trace:
[<c18796b3>] dump_stack+0x4b/0x75
[<c103a0e3>] warn_slowpath_common+0x7e/0x95
[<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
[<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
[<c103a185>] warn_slowpath_fmt+0x33/0x35
[<c10bd85a>] __trace_find_cmdline+0x66/0xaa^M
[<c10bed04>] trace_find_cmdline+0x40/0x64
[<c10c3c16>] trace_print_context+0x27/0xec
[<c10c4360>] ? trace_seq_printf+0x37/0x5b
[<c10c0b15>] print_trace_line+0x319/0x39b
[<c10ba3fb>] ? ring_buffer_read+0x47/0x50
[<c10c13b1>] s_show+0x192/0x1ab
[<c10bfd9a>] ? s_next+0x5a/0x7c
[<c112e76e>] seq_read+0x267/0x34c
[<c1115a25>] vfs_read+0x8c/0xef
[<c112e507>] ? seq_lseek+0x154/0x154
[<c1115ba2>] SyS_read+0x54/0x7f
[<c188488e>] syscall_call+0x7/0xb
---[ end trace 3f507febd6b4cc83 ]---
>>>> ##### CPU 1 buffer started ####
Which was the __trace_find_cmdline() function complaining about the pid
in the event record being negative.
After adding more test cases, this would trigger more often. Strangely
enough, it would never trigger on a single test, but instead would trigger
only when running all the tests. I believe that was the case because it
required one of the tests to be shutting down via delayed instances while
a new test started up.
After spending several days debugging this, I found that it was caused by
the iterator becoming corrupted. Debugging further, I found out why
the iterator became corrupted. It happened with the rb_iter_reset().
As consuming reads may not read the full reader page, and only part
of it, there's a "read" field to know where the last read took place.
The iterator, must also start at the read position. In the rb_iter_reset()
code, if the reader page was disconnected from the ring buffer, the iterator
would start at the head page within the ring buffer (where writes still
happen). But the mistake there was that it still used the "read" field
to start the iterator on the head page, where it should always start
at zero because readers never read from within the ring buffer where
writes occur.
I originally wrote a patch to have it set the iter->head to 0 instead
of iter->head_page->read, but then I questioned why it wasn't always
setting the iter to point to the reader page, as the reader page is
still valid. The list_empty(reader_page->list) just means that it was
successful in swapping out. But the reader_page may still have data.
There was a bug report a long time ago that was not reproducible that
had something about trace_pipe (consuming read) not matching trace
(iterator read). This may explain why that happened.
Anyway, the correct answer to this bug is to always use the reader page
an not reset the iterator to inside the writable ring buffer.
Fixes: d769041f8653 "ring_buffer: implement new locking"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
kernel/trace/ring_buffer.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index a758ec217bc0..c9b4f81959fc 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3354,21 +3354,16 @@ static void rb_iter_reset(struct ring_buffer_iter *iter)
struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
/* Iterator usage is expected to have record disabled */
- if (list_empty(&cpu_buffer->reader_page->list)) {
- iter->head_page = rb_set_head_page(cpu_buffer);
- if (unlikely(!iter->head_page))
- return;
- iter->head = iter->head_page->read;
- } else {
- iter->head_page = cpu_buffer->reader_page;
- iter->head = cpu_buffer->reader_page->read;
- }
+ iter->head_page = cpu_buffer->reader_page;
+ iter->head = cpu_buffer->reader_page->read;
+
+ iter->cache_reader_page = iter->head_page;
+ iter->cache_read = iter->head;
+
if (iter->head)
iter->read_stamp = cpu_buffer->read_stamp;
else
iter->read_stamp = iter->head_page->page->time_stamp;
- iter->cache_reader_page = cpu_buffer->reader_page;
- iter->cache_read = cpu_buffer->read;
}
/**
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 088/142] ring-buffer: Up rb_iter_peek() loop count to 3
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (86 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 087/142] ring-buffer: Always reset iterator to reader page Jiri Slaby
@ 2014-09-26 9:44 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 089/142] mnt: Change the default remount atime from relatime to the existing value Jiri Slaby
` (55 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:44 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Steven Rostedt (Red Hat), Jiri Slaby
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 021de3d904b88b1771a3a2cfc5b75023c391e646 upstream.
After writting a test to try to trigger the bug that caused the
ring buffer iterator to become corrupted, I hit another bug:
WARNING: CPU: 1 PID: 5281 at kernel/trace/ring_buffer.c:3766 rb_iter_peek+0x113/0x238()
Modules linked in: ipt_MASQUERADE sunrpc [...]
CPU: 1 PID: 5281 Comm: grep Tainted: G W 3.16.0-rc3-test+ #143
Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
0000000000000000 ffffffff81809a80 ffffffff81503fb0 0000000000000000
ffffffff81040ca1 ffff8800796d6010 ffffffff810c138d ffff8800796d6010
ffff880077438c80 ffff8800796d6010 ffff88007abbe600 0000000000000003
Call Trace:
[<ffffffff81503fb0>] ? dump_stack+0x4a/0x75
[<ffffffff81040ca1>] ? warn_slowpath_common+0x7e/0x97
[<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
[<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
[<ffffffff810c14df>] ? ring_buffer_iter_peek+0x2d/0x5c
[<ffffffff810c6f73>] ? tracing_iter_reset+0x6e/0x96
[<ffffffff810c74a3>] ? s_start+0xd7/0x17b
[<ffffffff8112b13e>] ? kmem_cache_alloc_trace+0xda/0xea
[<ffffffff8114cf94>] ? seq_read+0x148/0x361
[<ffffffff81132d98>] ? vfs_read+0x93/0xf1
[<ffffffff81132f1b>] ? SyS_read+0x60/0x8e
[<ffffffff8150bf9f>] ? tracesys+0xdd/0xe2
Debugging this bug, which triggers when the rb_iter_peek() loops too
many times (more than 2 times), I discovered there's a case that can
cause that function to legitimately loop 3 times!
rb_iter_peek() is different than rb_buffer_peek() as the rb_buffer_peek()
only deals with the reader page (it's for consuming reads). The
rb_iter_peek() is for traversing the buffer without consuming it, and as
such, it can loop for one more reason. That is, if we hit the end of
the reader page or any page, it will go to the next page and try again.
That is, we have this:
1. iter->head > iter->head_page->page->commit
(rb_inc_iter() which moves the iter to the next page)
try again
2. event = rb_iter_head_event()
event->type_len == RINGBUF_TYPE_TIME_EXTEND
rb_advance_iter()
try again
3. read the event.
But we never get to 3, because the count is greater than 2 and we
cause the WARNING and return NULL.
Up the counter to 3.
Fixes: 69d1b839f7ee "ring-buffer: Bind time extend and data events together"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
kernel/trace/ring_buffer.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c9b4f81959fc..65da8249bae6 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1981,7 +1981,7 @@ rb_add_time_stamp(struct ring_buffer_event *event, u64 delta)
/**
* rb_update_event - update event type and data
- * @event: the even to update
+ * @event: the event to update
* @type: the type of event
* @length: the size of the event field in the ring buffer
*
@@ -3756,12 +3756,14 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
return NULL;
/*
- * We repeat when a time extend is encountered.
- * Since the time extend is always attached to a data event,
- * we should never loop more than once.
- * (We never hit the following condition more than twice).
+ * We repeat when a time extend is encountered or we hit
+ * the end of the page. Since the time extend is always attached
+ * to a data event, we should never loop more than three times.
+ * Once for going to next page, once on time extend, and
+ * finally once to get the event.
+ * (We never hit the following condition more than thrice).
*/
- if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
+ if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3))
return NULL;
if (rb_per_cpu_empty(cpu_buffer))
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 089/142] mnt: Change the default remount atime from relatime to the existing value
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (87 preceding siblings ...)
2014-09-26 9:44 ` [PATCH 3.12 088/142] ring-buffer: Up rb_iter_peek() loop count to 3 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 090/142] mnt: Add tests for unprivileged remount cases that have found to be faulty Jiri Slaby
` (54 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Eric W. Biederman, Jiri Slaby
From: "Eric W. Biederman" <ebiederm@xmission.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e upstream.
Since March 2009 the kernel has treated the state that if no
MS_..ATIME flags are passed then the kernel defaults to relatime.
Defaulting to relatime instead of the existing atime state during a
remount is silly, and causes problems in practice for people who don't
specify any MS_...ATIME flags and to get the default filesystem atime
setting. Those users may encounter a permission error because the
default atime setting does not work.
A default that does not work and causes permission problems is
ridiculous, so preserve the existing value to have a default
atime setting that is always guaranteed to work.
Using the default atime setting in this way is particularly
interesting for applications built to run in restricted userspace
environments without /proc mounted, as the existing atime mount
options of a filesystem can not be read from /proc/mounts.
In practice this fixes user space that uses the default atime
setting on remount that are broken by the permission checks
keeping less privileged users from changing more privileged users
atime settings.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/namespace.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/namespace.c b/fs/namespace.c
index 7c67de88f3f1..4ea2b7378d8c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2391,6 +2391,14 @@ long do_mount(const char *dev_name, const char *dir_name,
if (flags & MS_RDONLY)
mnt_flags |= MNT_READONLY;
+ /* The default atime for remount is preservation */
+ if ((flags & MS_REMOUNT) &&
+ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
+ MS_STRICTATIME)) == 0)) {
+ mnt_flags &= ~MNT_ATIME_MASK;
+ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
+ }
+
flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
MS_STRICTATIME);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 090/142] mnt: Add tests for unprivileged remount cases that have found to be faulty
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (88 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 089/142] mnt: Change the default remount atime from relatime to the existing value Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 091/142] Bluetooth: never linger on process exit Jiri Slaby
` (53 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Eric W. Biederman, Jiri Slaby
From: "Eric W. Biederman" <ebiederm@xmission.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit db181ce011e3c033328608299cd6fac06ea50130 upstream.
Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
read-only bind mount read-only in a user namespace the
MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
to the remount a read-only mount read-write.
Upon review of the code in remount it was discovered that the code allowed
nosuid, noexec, and nodev to be cleared. It was also discovered that
the code was allowing the per mount atime flags to be changed.
The first naive patch to fix these issues contained the flaw that using
default atime settings when remounting a filesystem could be disallowed.
To avoid this problems in the future add tests to ensure unprivileged
remounts are succeeding and failing at the appropriate times.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/mount/Makefile | 17 ++
.../selftests/mount/unprivileged-remount-test.c | 242 +++++++++++++++++++++
3 files changed, 260 insertions(+)
create mode 100644 tools/testing/selftests/mount/Makefile
create mode 100644 tools/testing/selftests/mount/unprivileged-remount-test.c
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 9f3eae290900..2d9ab9417289 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -4,6 +4,7 @@ TARGETS += efivarfs
TARGETS += kcmp
TARGETS += memory-hotplug
TARGETS += mqueue
+TARGETS += mount
TARGETS += net
TARGETS += ptrace
TARGETS += timers
diff --git a/tools/testing/selftests/mount/Makefile b/tools/testing/selftests/mount/Makefile
new file mode 100644
index 000000000000..337d853c2b72
--- /dev/null
+++ b/tools/testing/selftests/mount/Makefile
@@ -0,0 +1,17 @@
+# Makefile for mount selftests.
+
+all: unprivileged-remount-test
+
+unprivileged-remount-test: unprivileged-remount-test.c
+ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
+
+# Allow specific tests to be selected.
+test_unprivileged_remount: unprivileged-remount-test
+ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
+
+run_tests: all test_unprivileged_remount
+
+clean:
+ rm -f unprivileged-remount-test
+
+.PHONY: all test_unprivileged_remount
diff --git a/tools/testing/selftests/mount/unprivileged-remount-test.c b/tools/testing/selftests/mount/unprivileged-remount-test.c
new file mode 100644
index 000000000000..1b3ff2fda4d0
--- /dev/null
+++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
@@ -0,0 +1,242 @@
+#define _GNU_SOURCE
+#include <sched.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <stdbool.h>
+#include <stdarg.h>
+
+#ifndef CLONE_NEWNS
+# define CLONE_NEWNS 0x00020000
+#endif
+#ifndef CLONE_NEWUTS
+# define CLONE_NEWUTS 0x04000000
+#endif
+#ifndef CLONE_NEWIPC
+# define CLONE_NEWIPC 0x08000000
+#endif
+#ifndef CLONE_NEWNET
+# define CLONE_NEWNET 0x40000000
+#endif
+#ifndef CLONE_NEWUSER
+# define CLONE_NEWUSER 0x10000000
+#endif
+#ifndef CLONE_NEWPID
+# define CLONE_NEWPID 0x20000000
+#endif
+
+#ifndef MS_RELATIME
+#define MS_RELATIME (1 << 21)
+#endif
+#ifndef MS_STRICTATIME
+#define MS_STRICTATIME (1 << 24)
+#endif
+
+static void die(char *fmt, ...)
+{
+ va_list ap;
+ va_start(ap, fmt);
+ vfprintf(stderr, fmt, ap);
+ va_end(ap);
+ exit(EXIT_FAILURE);
+}
+
+static void write_file(char *filename, char *fmt, ...)
+{
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+ va_list ap;
+
+ va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+ va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+ }
+ if (buf_len >= sizeof(buf)) {
+ die("vsnprintf output truncated\n");
+ }
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+ written = write(fd, buf, buf_len);
+ if (written != buf_len) {
+ if (written >= 0) {
+ die("short write to %s\n", filename);
+ } else {
+ die("write to %s failed: %s\n",
+ filename, strerror(errno));
+ }
+ }
+ if (close(fd) != 0) {
+ die("close of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+}
+
+static void create_and_enter_userns(void)
+{
+ uid_t uid;
+ gid_t gid;
+
+ uid = getuid();
+ gid = getgid();
+
+ if (unshare(CLONE_NEWUSER) !=0) {
+ die("unshare(CLONE_NEWUSER) failed: %s\n",
+ strerror(errno));
+ }
+
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+ if (setgroups(0, NULL) != 0) {
+ die("setgroups failed: %s\n",
+ strerror(errno));
+ }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
+ }
+ if (setuid(0) != 0) {
+ die("setuid(0) failed %s\n",
+ strerror(errno));
+ }
+}
+
+static
+bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+{
+ pid_t child;
+
+ child = fork();
+ if (child == -1) {
+ die("fork failed: %s\n",
+ strerror(errno));
+ }
+ if (child != 0) { /* parent */
+ pid_t pid;
+ int status;
+ pid = waitpid(child, &status, 0);
+ if (pid == -1) {
+ die("waitpid failed: %s\n",
+ strerror(errno));
+ }
+ if (pid != child) {
+ die("waited for %d got %d\n",
+ child, pid);
+ }
+ if (!WIFEXITED(status)) {
+ die("child did not terminate cleanly\n");
+ }
+ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
+ }
+
+ create_and_enter_userns();
+ if (unshare(CLONE_NEWNS) != 0) {
+ die("unshare(CLONE_NEWNS) failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
+ die("mount of /tmp failed: %s\n",
+ strerror(errno));
+ }
+
+ create_and_enter_userns();
+
+ if (unshare(CLONE_NEWNS) != 0) {
+ die("unshare(CLONE_NEWNS) failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("/tmp", "/tmp", "none",
+ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
+ /* system("cat /proc/self/mounts"); */
+ die("remount of /tmp failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("/tmp", "/tmp", "none",
+ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
+ /* system("cat /proc/self/mounts"); */
+ die("remount of /tmp with invalid flags "
+ "succeeded unexpectedly\n");
+ }
+ exit(EXIT_SUCCESS);
+}
+
+static bool test_unpriv_remount_simple(int mount_flags)
+{
+ return test_unpriv_remount(mount_flags, mount_flags, 0);
+}
+
+static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
+{
+ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
+}
+
+int main(int argc, char **argv)
+{
+ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
+ die("MS_RDONLY malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NODEV)) {
+ die("MS_NODEV malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
+ die("MS_NOSUID malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
+ die("MS_NOEXEC malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_STRICTATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
+ MS_STRICTATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
+ MS_STRICTATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("Default atime malfunctions\n");
+ }
+ return EXIT_SUCCESS;
+}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 091/142] Bluetooth: never linger on process exit
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (89 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 090/142] mnt: Add tests for unprivileged remount cases that have found to be faulty Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 092/142] Bluetooth: Avoid use of session socket after the session gets freed Jiri Slaby
` (52 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Vladimir Davydov, Marcel Holtmann, Jiri Slaby
From: Vladimir Davydov <vdavydov@parallels.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 093facf3634da1b0c2cc7ed106f1983da901bbab upstream.
If the current process is exiting, lingering on socket close will make
it unkillable, so we should avoid it.
Reproducer:
#include <sys/types.h>
#include <sys/socket.h>
#define BTPROTO_L2CAP 0
#define BTPROTO_SCO 2
#define BTPROTO_RFCOMM 3
int main()
{
int fd;
struct linger ling;
fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
//or: fd = socket(PF_BLUETOOTH, SOCK_DGRAM, BTPROTO_L2CAP);
//or: fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
ling.l_onoff = 1;
ling.l_linger = 1000000000;
setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling));
return 0;
}
Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/bluetooth/l2cap_sock.c | 3 ++-
net/bluetooth/rfcomm/sock.c | 3 ++-
net/bluetooth/sco.c | 6 ++++--
3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index a3a81d96314b..2710e850b74c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -882,7 +882,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
l2cap_chan_close(chan, 0);
lock_sock(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED,
sk->sk_lingertime);
}
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c1c6028e389a..7ca014daa5ab 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -887,7 +887,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how)
sk->sk_shutdown = SHUTDOWN_MASK;
__rfcomm_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
}
release_sock(sk);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d021e441b6e6..4f5f01b779b5 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -913,7 +913,8 @@ static int sco_sock_shutdown(struct socket *sock, int how)
sco_sock_clear_timer(sk);
__sco_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED,
sk->sk_lingertime);
}
@@ -933,7 +934,8 @@ static int sco_sock_release(struct socket *sock)
sco_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING)) {
lock_sock(sk);
err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
release_sock(sk);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 092/142] Bluetooth: Avoid use of session socket after the session gets freed
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (90 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 091/142] Bluetooth: never linger on process exit Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 093/142] md/raid1,raid10: always abort recover on write error Jiri Slaby
` (51 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Vignesh Raman, Vitaly Kuzmichev, Marcel Holtmann,
Jiri Slaby
From: Vignesh Raman <Vignesh_Raman@mentor.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 32333edb82fb2009980eefc5518100068147ab82 upstream.
The commits 08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
RFCOMM session refcnt" and 8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
"Bluetooth: Return RFCOMM session ptrs to avoid freed session"
allow rfcomm_recv_ua and rfcomm_session_close to delete the session
(and free the corresponding socket) and propagate NULL session pointer
to the upper callers.
Additional fix is required to terminate the loop in rfcomm_process_rx
function to avoid use of freed 'sk' memory.
The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
enabled making freed memory being changed and filled up with fixed char
value used to unmask use-after-free issues.
Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com>
Signed-off-by: Vitaly Kuzmichev <Vitaly_Kuzmichev@mentor.com>
Acked-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/bluetooth/rfcomm/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ca957d34b0c8..19ba192e9dbf 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1857,10 +1857,13 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
/* Get data directly from socket receive queue without copying it. */
while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
skb_orphan(skb);
- if (!skb_linearize(skb))
+ if (!skb_linearize(skb)) {
s = rfcomm_recv_frame(s, skb);
- else
+ if (!s)
+ break;
+ } else {
kfree_skb(skb);
+ }
}
if (s && (sk->sk_state == BT_CLOSED))
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 093/142] md/raid1,raid10: always abort recover on write error.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (91 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 092/142] Bluetooth: Avoid use of session socket after the session gets freed Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 094/142] md/raid6: avoid data corruption during recovery of double-degraded RAID6 Jiri Slaby
` (50 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, NeilBrown, Jiri Slaby
From: NeilBrown <neilb@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2446dba03f9dabe0b477a126cbeb377854785b47 upstream.
Currently we don't abort recovery on a write error if the write error
to the recovering device was triggerd by normal IO (as opposed to
recovery IO).
This means that for one bitmap region, the recovery might write to the
recovering device for a few sectors, then not bother for subsequent
sectors (as it never writes to failed devices). In this case
the bitmap bit will be cleared, but it really shouldn't.
The result is that if the recovering device fails and is then re-added
(after fixing whatever hardware problem triggerred the failure),
the second recovery won't redo the region it was in the middle of,
so some of the device will not be recovered properly.
If we abort the recovery, the region being processes will be cancelled
(bit not cleared) and the whole region will be retried.
As the bug can result in data corruption the patch is suitable for
-stable. For kernels prior to 3.11 there is a conflict in raid10.c
which will require care.
Original-from: jiao hui <jiaohui@bwstor.com.cn>
Reported-and-tested-by: jiao hui <jiaohui@bwstor.com.cn>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/raid1.c | 8 ++++----
drivers/md/raid10.c | 11 +++++------
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 66c4aee20c72..9b582c9444f2 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1406,12 +1406,12 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
mddev->degraded++;
set_bit(Faulty, &rdev->flags);
spin_unlock_irqrestore(&conf->device_lock, flags);
- /*
- * if recovery is running, make sure it aborts.
- */
- set_bit(MD_RECOVERY_INTR, &mddev->recovery);
} else
set_bit(Faulty, &rdev->flags);
+ /*
+ * if recovery is running, make sure it aborts.
+ */
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
set_bit(MD_CHANGE_DEVS, &mddev->flags);
printk(KERN_ALERT
"md/raid1:%s: Disk failure on %s, disabling device.\n"
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 308575d23550..867a8b67d5b9 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1698,13 +1698,12 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
spin_unlock_irqrestore(&conf->device_lock, flags);
return;
}
- if (test_and_clear_bit(In_sync, &rdev->flags)) {
+ if (test_and_clear_bit(In_sync, &rdev->flags))
mddev->degraded++;
- /*
- * if recovery is running, make sure it aborts.
- */
- set_bit(MD_RECOVERY_INTR, &mddev->recovery);
- }
+ /*
+ * If recovery is running, make sure it aborts.
+ */
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
set_bit(Blocked, &rdev->flags);
set_bit(Faulty, &rdev->flags);
set_bit(MD_CHANGE_DEVS, &mddev->flags);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 094/142] md/raid6: avoid data corruption during recovery of double-degraded RAID6
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (92 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 093/142] md/raid1,raid10: always abort recover on write error Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 095/142] md/raid10: fix memory leak when reshaping a RAID10 Jiri Slaby
` (49 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, NeilBrown, Yuri Tikhonov, Dan Williams, Jiri Slaby
From: NeilBrown <neilb@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9c4bdf697c39805078392d5ddbbba5ae5680e0dd upstream.
During recovery of a double-degraded RAID6 it is possible for
some blocks not to be recovered properly, leading to corruption.
If a write happens to one block in a stripe that would be written to a
missing device, and at the same time that stripe is recovering data
to the other missing device, then that recovered data may not be written.
This patch skips, in the double-degraded case, an optimisation that is
only safe for single-degraded arrays.
Bug was introduced in 2.6.32 and fix is suitable for any kernel since
then. In an older kernel with separate handle_stripe5() and
handle_stripe6() functions the patch must change handle_stripe6().
Fixes: 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8
Cc: Yuri Tikhonov <yur@emcraft.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Reported-by: "Manibalan P" <pmanibalan@amiindia.co.in>
Tested-by: "Manibalan P" <pmanibalan@amiindia.co.in>
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1090423
Signed-off-by: NeilBrown <neilb@suse.de>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/raid5.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3ecfb063ec0b..42510e40c23c 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3672,6 +3672,8 @@ static void handle_stripe(struct stripe_head *sh)
set_bit(R5_Wantwrite, &dev->flags);
if (prexor)
continue;
+ if (s.failed > 1)
+ continue;
if (!test_bit(R5_Insync, &dev->flags) ||
((i == sh->pd_idx || i == sh->qd_idx) &&
s.failed == 0))
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 095/142] md/raid10: fix memory leak when reshaping a RAID10.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (93 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 094/142] md/raid6: avoid data corruption during recovery of double-degraded RAID6 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 096/142] md/raid10: Fix memory leak when raid10 reshape completes Jiri Slaby
` (48 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, NeilBrown, Jiri Slaby
From: NeilBrown <neilb@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ce0b0a46955d1bb389684a2605dbcaa990ba0154 upstream.
raid10 reshape clears unwanted bits from a bio->bi_flags using
a method which, while clumsy, worked until 3.10 when BIO_OWNS_VEC
was added.
Since then it clears that bit but shouldn't. This results in a
memory leak.
So change to used the approved method of clearing unwanted bits.
As this causes a memory leak which can consume all of memory
the fix is suitable for -stable.
Fixes: a38352e0ac02dbbd4fa464dc22d1352b5fbd06fd
Reported-by: mdraid.pkoch@dfgh.net (Peter Koch)
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/raid10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 867a8b67d5b9..d1cf7734e55e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4419,7 +4419,7 @@ read_more:
read_bio->bi_private = r10_bio;
read_bio->bi_end_io = end_sync_read;
read_bio->bi_rw = READ;
- read_bio->bi_flags &= ~(BIO_POOL_MASK - 1);
+ read_bio->bi_flags &= (~0UL << BIO_RESET_BITS);
read_bio->bi_flags |= 1 << BIO_UPTODATE;
read_bio->bi_vcnt = 0;
read_bio->bi_size = 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 096/142] md/raid10: Fix memory leak when raid10 reshape completes.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (94 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 095/142] md/raid10: fix memory leak when reshaping a RAID10 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 097/142] RDMA/iwcm: Use a default listen backlog if needed Jiri Slaby
` (47 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, NeilBrown, Jiri Slaby
From: NeilBrown <neilb@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b39685526f46976bcd13aa08c82480092befa46c upstream.
When a raid10 commences a resync/recovery/reshape it allocates
some buffer space.
When a resync/recovery completes the buffer space is freed. But not
when the reshape completes.
This can result in a small memory leak.
There is a subtle side-effect of this bug. When a RAID10 is reshaped
to a larger array (more devices), the reshape is immediately followed
by a "resync" of the new space. This "resync" will use the buffer
space which was allocated for "reshape". This can cause problems
including a "BUG" in the SCSI layer. So this is suitable for -stable.
Fixes: 3ea7daa5d7fde47cd41f4d56c2deb949114da9d6
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/raid10.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index d1cf7734e55e..9ccb107c982e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2969,6 +2969,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
*/
if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery)) {
end_reshape(conf);
+ close_sync(conf);
return 0;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 097/142] RDMA/iwcm: Use a default listen backlog if needed
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (95 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 096/142] md/raid10: Fix memory leak when raid10 reshape completes Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 098/142] RDMA/uapi: Include socket.h in rdma_user_cm.h Jiri Slaby
` (46 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Steve Wise, Roland Dreier, Jiri Slaby
From: Steve Wise <swise@opengridcomputing.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2f0304d21867476394cd51a54e97f7273d112261 upstream.
If the user creates a listening cm_id with backlog of 0 the IWCM ends
up not allowing any connection requests at all. The correct behavior
is for the IWCM to pick a default value if the user backlog parameter
is zero.
Lustre from version 1.8.8 onward uses a backlog of 0, which breaks
iwarp support without this fix.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/core/iwcm.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c47c2034ca71..4293e89bbbdd 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -46,6 +46,7 @@
#include <linux/completion.h>
#include <linux/slab.h>
#include <linux/module.h>
+#include <linux/sysctl.h>
#include <rdma/iw_cm.h>
#include <rdma/ib_addr.h>
@@ -65,6 +66,20 @@ struct iwcm_work {
struct list_head free_list;
};
+static unsigned int default_backlog = 256;
+
+static struct ctl_table_header *iwcm_ctl_table_hdr;
+static struct ctl_table iwcm_ctl_table[] = {
+ {
+ .procname = "default_backlog",
+ .data = &default_backlog,
+ .maxlen = sizeof(default_backlog),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ { }
+};
+
/*
* The following services provide a mechanism for pre-allocating iwcm_work
* elements. The design pre-allocates them based on the cm_id type:
@@ -419,6 +434,9 @@ int iw_cm_listen(struct iw_cm_id *cm_id, int backlog)
cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
+ if (!backlog)
+ backlog = default_backlog;
+
ret = alloc_work_entries(cm_id_priv, backlog);
if (ret)
return ret;
@@ -1024,11 +1042,20 @@ static int __init iw_cm_init(void)
if (!iwcm_wq)
return -ENOMEM;
+ iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm",
+ iwcm_ctl_table);
+ if (!iwcm_ctl_table_hdr) {
+ pr_err("iw_cm: couldn't register sysctl paths\n");
+ destroy_workqueue(iwcm_wq);
+ return -ENOMEM;
+ }
+
return 0;
}
static void __exit iw_cm_cleanup(void)
{
+ unregister_net_sysctl_table(iwcm_ctl_table_hdr);
destroy_workqueue(iwcm_wq);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 098/142] RDMA/uapi: Include socket.h in rdma_user_cm.h
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (96 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 097/142] RDMA/iwcm: Use a default listen backlog if needed Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 099/142] xfs: ensure verifiers are attached to recovered buffers Jiri Slaby
` (45 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Doug Ledford, Roland Dreier, Jiri Slaby
From: Doug Ledford <dledford@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit db1044d458a287c18c4d413adc4ad12e92e253b5 upstream.
added struct sockaddr_storage to rdma_user_cm.h without also adding an
include for linux/socket.h to make sure it is defined. Systemtap
needs the header files to build standalone and cannot rely on other
files to pre-include other headers, so add linux/socket.h to the list
of includes in this file.
Fixes: ee7aed4528f ("RDMA/ucma: Support querying for AF_IB addresses")
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
include/uapi/rdma/rdma_user_cm.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h
index 99b80abf360a..3066718eb120 100644
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -34,6 +34,7 @@
#define RDMA_USER_CM_H
#include <linux/types.h>
+#include <linux/socket.h>
#include <linux/in6.h>
#include <rdma/ib_user_verbs.h>
#include <rdma/ib_user_sa.h>
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 099/142] xfs: ensure verifiers are attached to recovered buffers
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (97 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 098/142] RDMA/uapi: Include socket.h in rdma_user_cm.h Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 100/142] xfs: quotacheck leaves dquot buffers without verifiers Jiri Slaby
` (44 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dave Chinner, Dave Chinner, Jiri Slaby
From: Dave Chinner <dchinner@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 67dc288c21064b31a98a53dc64f6b9714b819fd6 upstream.
Crash testing of CRC enabled filesystems has resulted in a number of
reports of bad CRCs being detected after the filesystem was mounted.
Errors such as the following were being seen:
XFS (sdb3): Mounting V5 Filesystem
XFS (sdb3): Starting recovery (logdev: internal)
XFS (sdb3): Metadata CRC error detected at xfs_agf_read_verify+0x5a/0x100 [xfs], block 0x1
XFS (sdb3): Unmount and run xfs_repair
XFS (sdb3): First 64 bytes of corrupted metadata buffer:
ffff880136ffd600: 58 41 47 46 00 00 00 01 00 00 00 00 00 0f aa 40 XAGF...........@
ffff880136ffd610: 00 02 6d 53 00 02 77 f8 00 00 00 00 00 00 00 01 ..mS..w.........
ffff880136ffd620: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 03 ................
ffff880136ffd630: 00 00 00 04 00 08 81 d0 00 08 81 a7 00 00 00 00 ................
XFS (sdb3): metadata I/O error: block 0x1 ("xfs_trans_read_buf_map") error 74 numblks 1
The errors were typically being seen in AGF, AGI and their related
btree block buffers some time after log recovery had run. Often it
wasn't until later subsequent mounts that the problem was
discovered. The common symptom was a buffer with the correct
contents, but a CRC and an LSN that matched an older version of the
contents.
Some debug added to _xfs_buf_ioapply() indicated that buffers were
being written without verifiers attached to them from log recovery,
and Jan Kara isolated the cause to log recovery readahead an dit's
interactions with buffers that had a more recent LSN on disk than
the transaction being recovered. In this case, the buffer did not
get a verifier attached, and os when the second phase of log
recovery ran and recovered EFIs and unlinked inodes, the buffers
were modified and written without the verifier running. Hence they
had up to date contents, but stale LSNs and CRCs.
Fix it by attaching verifiers to buffers we skip due to future LSN
values so they don't escape into the buffer cache without the
correct verifier attached.
This patch is based on analysis and a patch from Jan Kara.
Reported-by: Jan Kara <jack@suse.cz>
Reported-by: Fanael Linithien <fanael4@gmail.com>
Reported-by: Grozdan <neutrino8@gmail.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/xfs/xfs_log_recover.c | 51 +++++++++++++++++++++++++++++-------------------
1 file changed, 31 insertions(+), 20 deletions(-)
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 39797490a1f1..5b166a07d55e 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2121,6 +2121,17 @@ xlog_recover_validate_buf_type(
__uint16_t magic16;
__uint16_t magicda;
+ /*
+ * We can only do post recovery validation on items on CRC enabled
+ * fielsystems as we need to know when the buffer was written to be able
+ * to determine if we should have replayed the item. If we replay old
+ * metadata over a newer buffer, then it will enter a temporarily
+ * inconsistent state resulting in verification failures. Hence for now
+ * just avoid the verification stage for non-crc filesystems
+ */
+ if (!xfs_sb_version_hascrc(&mp->m_sb))
+ return;
+
magic32 = be32_to_cpu(*(__be32 *)bp->b_addr);
magic16 = be16_to_cpu(*(__be16*)bp->b_addr);
magicda = be16_to_cpu(info->magic);
@@ -2156,8 +2167,6 @@ xlog_recover_validate_buf_type(
bp->b_ops = &xfs_agf_buf_ops;
break;
case XFS_BLFT_AGFL_BUF:
- if (!xfs_sb_version_hascrc(&mp->m_sb))
- break;
if (magic32 != XFS_AGFL_MAGIC) {
xfs_warn(mp, "Bad AGFL block magic!");
ASSERT(0);
@@ -2190,10 +2199,6 @@ xlog_recover_validate_buf_type(
#endif
break;
case XFS_BLFT_DINO_BUF:
- /*
- * we get here with inode allocation buffers, not buffers that
- * track unlinked list changes.
- */
if (magic16 != XFS_DINODE_MAGIC) {
xfs_warn(mp, "Bad INODE block magic!");
ASSERT(0);
@@ -2273,8 +2278,6 @@ xlog_recover_validate_buf_type(
bp->b_ops = &xfs_attr3_leaf_buf_ops;
break;
case XFS_BLFT_ATTR_RMT_BUF:
- if (!xfs_sb_version_hascrc(&mp->m_sb))
- break;
if (magic32 != XFS_ATTR3_RMT_MAGIC) {
xfs_warn(mp, "Bad attr remote magic!");
ASSERT(0);
@@ -2381,16 +2384,7 @@ xlog_recover_do_reg_buffer(
/* Shouldn't be any more regions */
ASSERT(i == item->ri_total);
- /*
- * We can only do post recovery validation on items on CRC enabled
- * fielsystems as we need to know when the buffer was written to be able
- * to determine if we should have replayed the item. If we replay old
- * metadata over a newer buffer, then it will enter a temporarily
- * inconsistent state resulting in verification failures. Hence for now
- * just avoid the verification stage for non-crc filesystems
- */
- if (xfs_sb_version_hascrc(&mp->m_sb))
- xlog_recover_validate_buf_type(mp, bp, buf_f);
+ xlog_recover_validate_buf_type(mp, bp, buf_f);
}
/*
@@ -2625,12 +2619,29 @@ xlog_recover_buffer_pass2(
}
/*
- * recover the buffer only if we get an LSN from it and it's less than
+ * Recover the buffer only if we get an LSN from it and it's less than
* the lsn of the transaction we are replaying.
+ *
+ * Note that we have to be extremely careful of readahead here.
+ * Readahead does not attach verfiers to the buffers so if we don't
+ * actually do any replay after readahead because of the LSN we found
+ * in the buffer if more recent than that current transaction then we
+ * need to attach the verifier directly. Failure to do so can lead to
+ * future recovery actions (e.g. EFI and unlinked list recovery) can
+ * operate on the buffers and they won't get the verifier attached. This
+ * can lead to blocks on disk having the correct content but a stale
+ * CRC.
+ *
+ * It is safe to assume these clean buffers are currently up to date.
+ * If the buffer is dirtied by a later transaction being replayed, then
+ * the verifier will be reset to match whatever recover turns that
+ * buffer into.
*/
lsn = xlog_recover_get_buf_lsn(mp, bp);
- if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0)
+ if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) {
+ xlog_recover_validate_buf_type(mp, bp, buf_f);
goto out_release;
+ }
if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 100/142] xfs: quotacheck leaves dquot buffers without verifiers
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (98 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 099/142] xfs: ensure verifiers are attached to recovered buffers Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 101/142] xfs: don't dirty buffers beyond EOF Jiri Slaby
` (43 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dave Chinner, Dave Chinner, Jiri Slaby
From: Dave Chinner <dchinner@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5fd364fee81a7888af806e42ed8a91c845894f2d upstream.
When running xfs/305, I noticed that quotacheck was flushing dquot
buffers that did not have the xfs_dquot_buf_ops verifiers attached:
XFS (vdb): _xfs_buf_ioapply: no ops on block 0x1dc8/0x1dc8
ffff880052489000: 44 51 01 04 00 00 65 b8 00 00 00 00 00 00 00 00 DQ....e.........
ffff880052489010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ffff880052489020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ffff880052489030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 1 PID: 2376 Comm: mount Not tainted 3.16.0-rc2-dgc+ #306
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88006fe38000 ffff88004a0ffae8 ffffffff81cf1cca 0000000000000001
ffff88004a0ffb88 ffffffff814d50ca 000010004a0ffc70 0000000000000000
ffff88006be56dc4 0000000000000021 0000000000001dc8 ffff88007c773d80
Call Trace:
[<ffffffff81cf1cca>] dump_stack+0x45/0x56
[<ffffffff814d50ca>] _xfs_buf_ioapply+0x3ca/0x3d0
[<ffffffff810db520>] ? wake_up_state+0x20/0x20
[<ffffffff814d51f5>] ? xfs_bdstrat_cb+0x55/0xb0
[<ffffffff814d513b>] xfs_buf_iorequest+0x6b/0xd0
[<ffffffff814d51f5>] xfs_bdstrat_cb+0x55/0xb0
[<ffffffff814d53ab>] __xfs_buf_delwri_submit+0x15b/0x220
[<ffffffff814d6040>] ? xfs_buf_delwri_submit+0x30/0x90
[<ffffffff814d6040>] xfs_buf_delwri_submit+0x30/0x90
[<ffffffff8150f89d>] xfs_qm_quotacheck+0x17d/0x3c0
[<ffffffff81510591>] xfs_qm_mount_quotas+0x151/0x1e0
[<ffffffff814ed01c>] xfs_mountfs+0x56c/0x7d0
[<ffffffff814f0f12>] xfs_fs_fill_super+0x2c2/0x340
[<ffffffff811c9fe4>] mount_bdev+0x194/0x1d0
[<ffffffff814f0c50>] ? xfs_finish_flags+0x170/0x170
[<ffffffff814ef0f5>] xfs_fs_mount+0x15/0x20
[<ffffffff811ca8c9>] mount_fs+0x39/0x1b0
[<ffffffff811e4d67>] vfs_kern_mount+0x67/0x120
[<ffffffff811e757e>] do_mount+0x23e/0xad0
[<ffffffff8117abde>] ? __get_free_pages+0xe/0x50
[<ffffffff811e71e6>] ? copy_mount_options+0x36/0x150
[<ffffffff811e8103>] SyS_mount+0x83/0xc0
[<ffffffff81cfd40b>] tracesys+0xdd/0xe2
This was caused by dquot buffer readahead not attaching a verifier
structure to the buffer when readahead was issued, resulting in the
followup read of the buffer finding a valid buffer and so not
attaching new verifiers to the buffer as part of the read.
Also, when a verifier failure occurs, we then read the buffer
without verifiers. Attach the verifiers manually after this read so
that if the buffer is then written it will be verified that the
corruption has been repaired.
Further, when flushing a dquot we don't ask for a verifier when
reading in the dquot buffer the dquot belongs to. Most of the time
this isn't an issue because the buffer is still cached, but when it
is not cached it will result in writing the dquot buffer without
having the verfier attached.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/xfs/xfs_dquot.c | 3 ++-
fs/xfs/xfs_qm.c | 8 +++++++-
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 1ee776d477c3..895db7a88412 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1121,7 +1121,8 @@ xfs_qm_dqflush(
* Get the buffer containing the on-disk dquot
*/
error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp, dqp->q_blkno,
- mp->m_quotainfo->qi_dqchunklen, 0, &bp, NULL);
+ mp->m_quotainfo->qi_dqchunklen, 0, &bp,
+ &xfs_dquot_buf_ops);
if (error)
goto out_unlock;
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 4688a622b373..794aa2fb9c69 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -1193,6 +1193,12 @@ xfs_qm_dqiter_bufs(
if (error)
break;
+ /*
+ * A corrupt buffer might not have a verifier attached, so
+ * make sure we have the correct one attached before writeback
+ * occurs.
+ */
+ bp->b_ops = &xfs_dquot_buf_ops;
xfs_qm_reset_dqcounts(mp, bp, firstid, type);
xfs_buf_delwri_queue(bp, buffer_list);
xfs_buf_relse(bp);
@@ -1276,7 +1282,7 @@ xfs_qm_dqiterate(
xfs_buf_readahead(mp->m_ddev_targp,
XFS_FSB_TO_DADDR(mp, rablkno),
mp->m_quotainfo->qi_dqchunklen,
- NULL);
+ &xfs_dquot_buf_ops);
rablkno++;
}
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 101/142] xfs: don't dirty buffers beyond EOF
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (99 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 100/142] xfs: quotacheck leaves dquot buffers without verifiers Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 102/142] xfs: don't zero partial page cache pages during O_DIRECT writes Jiri Slaby
` (42 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dave Chinner, Dave Chinner, Jiri Slaby
From: Dave Chinner <dchinner@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 22e757a49cf010703fcb9c9b4ef793248c39b0c2 upstream.
generic/263 is failing fsx at this point with a page spanning
EOF that cannot be invalidated. The operations are:
1190 mapwrite 0x52c00 thru 0x5e569 (0xb96a bytes)
1191 mapread 0x5c000 thru 0x5d636 (0x1637 bytes)
1192 write 0x5b600 thru 0x771ff (0x1bc00 bytes)
where 1190 extents EOF from 0x54000 to 0x5e569. When the direct IO
write attempts to invalidate the cached page over this range, it
fails with -EBUSY and so any attempt to do page invalidation fails.
The real question is this: Why can't that page be invalidated after
it has been written to disk and cleaned?
Well, there's data on the first two buffers in the page (1k block
size, 4k page), but the third buffer on the page (i.e. beyond EOF)
is failing drop_buffers because it's bh->b_state == 0x3, which is
BH_Uptodate | BH_Dirty. IOWs, there's dirty buffers beyond EOF. Say
what?
OK, set_buffer_dirty() is called on all buffers from
__set_page_buffers_dirty(), regardless of whether the buffer is
beyond EOF or not, which means that when we get to ->writepage,
we have buffers marked dirty beyond EOF that we need to clean.
So, we need to implement our own .set_page_dirty method that
doesn't dirty buffers beyond EOF.
This is messy because the buffer code is not meant to be shared
and it has interesting locking issues on the buffer dirty bits.
So just copy and paste it and then modify it to suit what we need.
Note: the solutions the other filesystems and generic block code use
of marking the buffers clean in ->writepage does not work for XFS.
It still leaves dirty buffers beyond EOF and invalidations still
fail. Hence rather than play whack-a-mole, this patch simply
prevents those buffers from being dirtied in the first place.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/xfs/xfs_aops.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 61 insertions(+)
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index be9a1fa2721b..0415a628b2ab 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1657,11 +1657,72 @@ xfs_vm_readpages(
return mpage_readpages(mapping, pages, nr_pages, xfs_get_blocks);
}
+/*
+ * This is basically a copy of __set_page_dirty_buffers() with one
+ * small tweak: buffers beyond EOF do not get marked dirty. If we mark them
+ * dirty, we'll never be able to clean them because we don't write buffers
+ * beyond EOF, and that means we can't invalidate pages that span EOF
+ * that have been marked dirty. Further, the dirty state can leak into
+ * the file interior if the file is extended, resulting in all sorts of
+ * bad things happening as the state does not match the underlying data.
+ *
+ * XXX: this really indicates that bufferheads in XFS need to die. Warts like
+ * this only exist because of bufferheads and how the generic code manages them.
+ */
+STATIC int
+xfs_vm_set_page_dirty(
+ struct page *page)
+{
+ struct address_space *mapping = page->mapping;
+ struct inode *inode = mapping->host;
+ loff_t end_offset;
+ loff_t offset;
+ int newly_dirty;
+
+ if (unlikely(!mapping))
+ return !TestSetPageDirty(page);
+
+ end_offset = i_size_read(inode);
+ offset = page_offset(page);
+
+ spin_lock(&mapping->private_lock);
+ if (page_has_buffers(page)) {
+ struct buffer_head *head = page_buffers(page);
+ struct buffer_head *bh = head;
+
+ do {
+ if (offset < end_offset)
+ set_buffer_dirty(bh);
+ bh = bh->b_this_page;
+ offset += 1 << inode->i_blkbits;
+ } while (bh != head);
+ }
+ newly_dirty = !TestSetPageDirty(page);
+ spin_unlock(&mapping->private_lock);
+
+ if (newly_dirty) {
+ /* sigh - __set_page_dirty() is static, so copy it here, too */
+ unsigned long flags;
+
+ spin_lock_irqsave(&mapping->tree_lock, flags);
+ if (page->mapping) { /* Race with truncate? */
+ WARN_ON_ONCE(!PageUptodate(page));
+ account_page_dirtied(page, mapping);
+ radix_tree_tag_set(&mapping->page_tree,
+ page_index(page), PAGECACHE_TAG_DIRTY);
+ }
+ spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+ }
+ return newly_dirty;
+}
+
const struct address_space_operations xfs_address_space_operations = {
.readpage = xfs_vm_readpage,
.readpages = xfs_vm_readpages,
.writepage = xfs_vm_writepage,
.writepages = xfs_vm_writepages,
+ .set_page_dirty = xfs_vm_set_page_dirty,
.releasepage = xfs_vm_releasepage,
.invalidatepage = xfs_vm_invalidatepage,
.write_begin = xfs_vm_write_begin,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 102/142] xfs: don't zero partial page cache pages during O_DIRECT writes
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (100 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 101/142] xfs: don't dirty buffers beyond EOF Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 103/142] " Jiri Slaby
` (41 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dave Chinner, Dave Chinner, Jiri Slaby
From: Dave Chinner <dchinner@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 834ffca6f7e345a79f6f2e2d131b0dfba8a4b67a upstream.
Similar to direct IO reads, direct IO writes are using
truncate_pagecache_range to invalidate the page cache. This is
incorrect due to the sub-block zeroing in the page cache that
truncate_pagecache_range() triggers.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/xfs/xfs_file.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 4c749ab543d0..3e0fccf54ed5 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -678,7 +678,15 @@ xfs_file_dio_aio_write(
pos, -1);
if (ret)
goto out;
- truncate_pagecache_range(VFS_I(ip), pos, -1);
+ /*
+ * Invalidate whole pages. This can return an error if
+ * we fail to invalidate a page, but this should never
+ * happen on XFS. Warn if it does fail.
+ */
+ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+ pos >> PAGE_CACHE_SHIFT, -1);
+ WARN_ON_ONCE(ret);
+ ret = 0;
}
/*
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 103/142] xfs: don't zero partial page cache pages during O_DIRECT writes
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (101 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 102/142] xfs: don't zero partial page cache pages during O_DIRECT writes Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 104/142] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly Jiri Slaby
` (40 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Chris Mason, Dave Chinner, Jiri Slaby
From: Chris Mason <clm@fb.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 85e584da3212140ee80fd047f9058bbee0bc00d5 upstream.
xfs is using truncate_pagecache_range to invalidate the page cache
during DIO reads. This is different from the other filesystems who
only invalidate pages during DIO writes.
truncate_pagecache_range is meant to be used when we are freeing the
underlying data structs from disk, so it will zero any partial
ranges in the page. This means a DIO read can zero out part of the
page cache page, and it is possible the page will stay in cache.
buffered reads will find an up to date page with zeros instead of
the data actually on disk.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
[dchinner: catch error and warn if it fails. Comment.]
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/xfs/xfs_file.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 3e0fccf54ed5..d56b136e68fe 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -299,7 +299,16 @@ xfs_file_aio_read(
xfs_rw_iunlock(ip, XFS_IOLOCK_EXCL);
return ret;
}
- truncate_pagecache_range(VFS_I(ip), pos, -1);
+
+ /*
+ * Invalidate whole pages. This can return an error if
+ * we fail to invalidate a page, but this should never
+ * happen on XFS. Warn if it does fail.
+ */
+ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+ pos >> PAGE_CACHE_SHIFT, -1);
+ WARN_ON_ONCE(ret);
+ ret = 0;
}
xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 104/142] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (102 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 103/142] " Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 105/142] libceph: add process_one_ticket() helper Jiri Slaby
` (39 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Ilya Dryomov, Jiri Slaby
From: Ilya Dryomov <ilya.dryomov@inktank.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5f740d7e1531099b888410e6bab13f68da9b1a4d upstream.
Determining ->last_piece based on the value of ->page_offset + length
is incorrect because length here is the length of the entire message.
->last_piece set to false even if page array data item length is <=
PAGE_SIZE, which results in invalid length passed to
ceph_tcp_{send,recv}page() and causes various asserts to fire.
# cat pages-cursor-init.sh
#!/bin/bash
rbd create --size 10 --image-format 2 foo
FOO_DEV=$(rbd map foo)
dd if=/dev/urandom of=$FOO_DEV bs=1M &>/dev/null
rbd snap create foo@snap
rbd snap protect foo@snap
rbd clone foo@snap bar
# rbd_resize calls librbd rbd_resize(), size is in bytes
./rbd_resize bar $(((4 << 20) + 512))
rbd resize --size 10 bar
BAR_DEV=$(rbd map bar)
# trigger a 512-byte copyup -- 512-byte page array data item
dd if=/dev/urandom of=$BAR_DEV bs=1M count=1 seek=5
The problem exists only in ceph_msg_data_pages_cursor_init(),
ceph_msg_data_pages_advance() does the right thing. The size_t cast is
unnecessary.
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/ceph/messenger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index ce83d07eb419..94e21b9b1c87 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -904,7 +904,7 @@ static void ceph_msg_data_pages_cursor_init(struct ceph_msg_data_cursor *cursor,
BUG_ON(page_count > (int)USHRT_MAX);
cursor->page_count = (unsigned short)page_count;
BUG_ON(length > SIZE_MAX - cursor->page_offset);
- cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE;
+ cursor->last_piece = cursor->page_offset + cursor->resid <= PAGE_SIZE;
}
static struct page *
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 105/142] libceph: add process_one_ticket() helper
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (103 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 104/142] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 106/142] libceph: do not hard code max auth ticket len Jiri Slaby
` (38 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Ilya Dryomov, Jiri Slaby
From: Ilya Dryomov <ilya.dryomov@inktank.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 597cda357716a3cf8d994cb11927af917c8d71fa upstream.
Add a helper for processing individual cephx auth tickets. Needed for
the next commit, which deals with allocating ticket buffers. (Most of
the diff here is whitespace - view with git diff -b).
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/ceph/auth_x.c | 228 +++++++++++++++++++++++++++++-------------------------
1 file changed, 124 insertions(+), 104 deletions(-)
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 96238ba95f2b..0eb146dce1aa 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -129,17 +129,131 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
kfree(th);
}
+static int process_one_ticket(struct ceph_auth_client *ac,
+ struct ceph_crypto_key *secret,
+ void **p, void *end,
+ void *dbuf, void *ticket_buf)
+{
+ struct ceph_x_info *xi = ac->private;
+ int type;
+ u8 tkt_struct_v, blob_struct_v;
+ struct ceph_x_ticket_handler *th;
+ void *dp, *dend;
+ int dlen;
+ char is_enc;
+ struct timespec validity;
+ struct ceph_crypto_key old_key;
+ void *tp, *tpend;
+ struct ceph_timespec new_validity;
+ struct ceph_crypto_key new_session_key;
+ struct ceph_buffer *new_ticket_blob;
+ unsigned long new_expires, new_renew_after;
+ u64 new_secret_id;
+ int ret;
+
+ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
+
+ type = ceph_decode_32(p);
+ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+ tkt_struct_v = ceph_decode_8(p);
+ if (tkt_struct_v != 1)
+ goto bad;
+
+ th = get_ticket_handler(ac, type);
+ if (IS_ERR(th)) {
+ ret = PTR_ERR(th);
+ goto out;
+ }
+
+ /* blob for me */
+ dlen = ceph_x_decrypt(secret, p, end, dbuf,
+ TEMP_TICKET_BUF_LEN);
+ if (dlen <= 0) {
+ ret = dlen;
+ goto out;
+ }
+ dout(" decrypted %d bytes\n", dlen);
+ dp = dbuf;
+ dend = dp + dlen;
+
+ tkt_struct_v = ceph_decode_8(&dp);
+ if (tkt_struct_v != 1)
+ goto bad;
+
+ memcpy(&old_key, &th->session_key, sizeof(old_key));
+ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+ if (ret)
+ goto out;
+
+ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+ ceph_decode_timespec(&validity, &new_validity);
+ new_expires = get_seconds() + validity.tv_sec;
+ new_renew_after = new_expires - (validity.tv_sec / 4);
+ dout(" expires=%lu renew_after=%lu\n", new_expires,
+ new_renew_after);
+
+ /* ticket blob for service */
+ ceph_decode_8_safe(p, end, is_enc, bad);
+ tp = ticket_buf;
+ if (is_enc) {
+ /* encrypted */
+ dout(" encrypted ticket\n");
+ dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
+ TEMP_TICKET_BUF_LEN);
+ if (dlen < 0) {
+ ret = dlen;
+ goto out;
+ }
+ dlen = ceph_decode_32(&tp);
+ } else {
+ /* unencrypted */
+ ceph_decode_32_safe(p, end, dlen, bad);
+ ceph_decode_need(p, end, dlen, bad);
+ ceph_decode_copy(p, ticket_buf, dlen);
+ }
+ tpend = tp + dlen;
+ dout(" ticket blob is %d bytes\n", dlen);
+ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+ blob_struct_v = ceph_decode_8(&tp);
+ new_secret_id = ceph_decode_64(&tp);
+ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+ if (ret)
+ goto out;
+
+ /* all is well, update our ticket */
+ ceph_crypto_key_destroy(&th->session_key);
+ if (th->ticket_blob)
+ ceph_buffer_put(th->ticket_blob);
+ th->session_key = new_session_key;
+ th->ticket_blob = new_ticket_blob;
+ th->validity = new_validity;
+ th->secret_id = new_secret_id;
+ th->expires = new_expires;
+ th->renew_after = new_renew_after;
+ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+ type, ceph_entity_type_name(type), th->secret_id,
+ (int)th->ticket_blob->vec.iov_len);
+ xi->have_keys |= th->service;
+
+out:
+ return ret;
+
+bad:
+ ret = -EINVAL;
+ goto out;
+}
+
static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
struct ceph_crypto_key *secret,
void *buf, void *end)
{
- struct ceph_x_info *xi = ac->private;
- int num;
void *p = buf;
- int ret;
char *dbuf;
char *ticket_buf;
u8 reply_struct_v;
+ u32 num;
+ int ret;
dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
if (!dbuf)
@@ -150,112 +264,18 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
if (!ticket_buf)
goto out_dbuf;
- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
- reply_struct_v = ceph_decode_8(&p);
+ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
if (reply_struct_v != 1)
- goto bad;
- num = ceph_decode_32(&p);
- dout("%d tickets\n", num);
- while (num--) {
- int type;
- u8 tkt_struct_v, blob_struct_v;
- struct ceph_x_ticket_handler *th;
- void *dp, *dend;
- int dlen;
- char is_enc;
- struct timespec validity;
- struct ceph_crypto_key old_key;
- void *tp, *tpend;
- struct ceph_timespec new_validity;
- struct ceph_crypto_key new_session_key;
- struct ceph_buffer *new_ticket_blob;
- unsigned long new_expires, new_renew_after;
- u64 new_secret_id;
-
- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
-
- type = ceph_decode_32(&p);
- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
-
- tkt_struct_v = ceph_decode_8(&p);
- if (tkt_struct_v != 1)
- goto bad;
-
- th = get_ticket_handler(ac, type);
- if (IS_ERR(th)) {
- ret = PTR_ERR(th);
- goto out;
- }
-
- /* blob for me */
- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
- TEMP_TICKET_BUF_LEN);
- if (dlen <= 0) {
- ret = dlen;
- goto out;
- }
- dout(" decrypted %d bytes\n", dlen);
- dend = dbuf + dlen;
- dp = dbuf;
-
- tkt_struct_v = ceph_decode_8(&dp);
- if (tkt_struct_v != 1)
- goto bad;
+ return -EINVAL;
- memcpy(&old_key, &th->session_key, sizeof(old_key));
- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
- if (ret)
- goto out;
+ ceph_decode_32_safe(&p, end, num, bad);
+ dout("%d tickets\n", num);
- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
- ceph_decode_timespec(&validity, &new_validity);
- new_expires = get_seconds() + validity.tv_sec;
- new_renew_after = new_expires - (validity.tv_sec / 4);
- dout(" expires=%lu renew_after=%lu\n", new_expires,
- new_renew_after);
-
- /* ticket blob for service */
- ceph_decode_8_safe(&p, end, is_enc, bad);
- tp = ticket_buf;
- if (is_enc) {
- /* encrypted */
- dout(" encrypted ticket\n");
- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
- TEMP_TICKET_BUF_LEN);
- if (dlen < 0) {
- ret = dlen;
- goto out;
- }
- dlen = ceph_decode_32(&tp);
- } else {
- /* unencrypted */
- ceph_decode_32_safe(&p, end, dlen, bad);
- ceph_decode_need(&p, end, dlen, bad);
- ceph_decode_copy(&p, ticket_buf, dlen);
- }
- tpend = tp + dlen;
- dout(" ticket blob is %d bytes\n", dlen);
- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
- blob_struct_v = ceph_decode_8(&tp);
- new_secret_id = ceph_decode_64(&tp);
- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+ while (num--) {
+ ret = process_one_ticket(ac, secret, &p, end,
+ dbuf, ticket_buf);
if (ret)
goto out;
-
- /* all is well, update our ticket */
- ceph_crypto_key_destroy(&th->session_key);
- if (th->ticket_blob)
- ceph_buffer_put(th->ticket_blob);
- th->session_key = new_session_key;
- th->ticket_blob = new_ticket_blob;
- th->validity = new_validity;
- th->secret_id = new_secret_id;
- th->expires = new_expires;
- th->renew_after = new_renew_after;
- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
- type, ceph_entity_type_name(type), th->secret_id,
- (int)th->ticket_blob->vec.iov_len);
- xi->have_keys |= th->service;
}
ret = 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 106/142] libceph: do not hard code max auth ticket len
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (104 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 105/142] libceph: add process_one_ticket() helper Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 107/142] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2 Jiri Slaby
` (37 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Ilya Dryomov, Jiri Slaby
From: Ilya Dryomov <ilya.dryomov@inktank.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c27a3e4d667fdcad3db7b104f75659478e0c68d8 upstream.
We hard code cephx auth ticket buffer size to 256 bytes. This isn't
enough for any moderate setups and, in case tickets themselves are not
encrypted, leads to buffer overflows (ceph_x_decrypt() errors out, but
ceph_decode_copy() doesn't - it's just a memcpy() wrapper). Since the
buffer is allocated dynamically anyway, allocated it a bit later, at
the point where we know how much is going to be needed.
Fixes: http://tracker.ceph.com/issues/8979
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/ceph/auth_x.c | 64 +++++++++++++++++++++++++------------------------------
1 file changed, 29 insertions(+), 35 deletions(-)
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 0eb146dce1aa..de6662b14e1f 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -13,8 +13,6 @@
#include "auth_x.h"
#include "auth_x_protocol.h"
-#define TEMP_TICKET_BUF_LEN 256
-
static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
}
static int ceph_x_decrypt(struct ceph_crypto_key *secret,
- void **p, void *end, void *obuf, size_t olen)
+ void **p, void *end, void **obuf, size_t olen)
{
struct ceph_x_encrypt_header head;
size_t head_len = sizeof(head);
@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
return -EINVAL;
dout("ceph_x_decrypt len %d\n", len);
- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
- *p, len);
+ if (*obuf == NULL) {
+ *obuf = kmalloc(len, GFP_NOFS);
+ if (!*obuf)
+ return -ENOMEM;
+ olen = len;
+ }
+
+ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
if (ret)
return ret;
if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
@@ -131,18 +135,19 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
static int process_one_ticket(struct ceph_auth_client *ac,
struct ceph_crypto_key *secret,
- void **p, void *end,
- void *dbuf, void *ticket_buf)
+ void **p, void *end)
{
struct ceph_x_info *xi = ac->private;
int type;
u8 tkt_struct_v, blob_struct_v;
struct ceph_x_ticket_handler *th;
+ void *dbuf = NULL;
void *dp, *dend;
int dlen;
char is_enc;
struct timespec validity;
struct ceph_crypto_key old_key;
+ void *ticket_buf = NULL;
void *tp, *tpend;
struct ceph_timespec new_validity;
struct ceph_crypto_key new_session_key;
@@ -167,8 +172,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
}
/* blob for me */
- dlen = ceph_x_decrypt(secret, p, end, dbuf,
- TEMP_TICKET_BUF_LEN);
+ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
if (dlen <= 0) {
ret = dlen;
goto out;
@@ -195,20 +199,25 @@ static int process_one_ticket(struct ceph_auth_client *ac,
/* ticket blob for service */
ceph_decode_8_safe(p, end, is_enc, bad);
- tp = ticket_buf;
if (is_enc) {
/* encrypted */
dout(" encrypted ticket\n");
- dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
- TEMP_TICKET_BUF_LEN);
+ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
if (dlen < 0) {
ret = dlen;
goto out;
}
+ tp = ticket_buf;
dlen = ceph_decode_32(&tp);
} else {
/* unencrypted */
ceph_decode_32_safe(p, end, dlen, bad);
+ ticket_buf = kmalloc(dlen, GFP_NOFS);
+ if (!ticket_buf) {
+ ret = -ENOMEM;
+ goto out;
+ }
+ tp = ticket_buf;
ceph_decode_need(p, end, dlen, bad);
ceph_decode_copy(p, ticket_buf, dlen);
}
@@ -237,6 +246,8 @@ static int process_one_ticket(struct ceph_auth_client *ac,
xi->have_keys |= th->service;
out:
+ kfree(ticket_buf);
+ kfree(dbuf);
return ret;
bad:
@@ -249,21 +260,10 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
void *buf, void *end)
{
void *p = buf;
- char *dbuf;
- char *ticket_buf;
u8 reply_struct_v;
u32 num;
int ret;
- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
- if (!dbuf)
- return -ENOMEM;
-
- ret = -ENOMEM;
- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
- if (!ticket_buf)
- goto out_dbuf;
-
ceph_decode_8_safe(&p, end, reply_struct_v, bad);
if (reply_struct_v != 1)
return -EINVAL;
@@ -272,22 +272,15 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
dout("%d tickets\n", num);
while (num--) {
- ret = process_one_ticket(ac, secret, &p, end,
- dbuf, ticket_buf);
+ ret = process_one_ticket(ac, secret, &p, end);
if (ret)
- goto out;
+ return ret;
}
- ret = 0;
-out:
- kfree(ticket_buf);
-out_dbuf:
- kfree(dbuf);
- return ret;
+ return 0;
bad:
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
@@ -603,13 +596,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
struct ceph_x_ticket_handler *th;
int ret = 0;
struct ceph_x_authorize_reply reply;
+ void *preply = &reply;
void *p = au->reply_buf;
void *end = p + sizeof(au->reply_buf);
th = get_ticket_handler(ac, au->service);
if (IS_ERR(th))
return PTR_ERR(th);
- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
+ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
if (ret < 0)
return ret;
if (ret != sizeof(reply))
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 107/142] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (105 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 106/142] libceph: do not hard code max auth ticket len Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 108/142] CIFS: Fix async reading on reconnects Jiri Slaby
` (36 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Pavel Shilovsky, Steve French, Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 21496687a79424572f46a84c690d331055f4866f upstream.
The existing mapping causes unlink() call to return error after delete
operation. Changing the mapping to -EACCES makes the client process
the call like CIFS protocol does - reset dos attributes with ATTR_READONLY
flag masked off and retry the operation.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/smb2maperror.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index 7c2f45c06fc2..824696fb24db 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -605,7 +605,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
{STATUS_MAPPED_FILE_SIZE_ZERO, -EIO, "STATUS_MAPPED_FILE_SIZE_ZERO"},
{STATUS_TOO_MANY_OPENED_FILES, -EMFILE, "STATUS_TOO_MANY_OPENED_FILES"},
{STATUS_CANCELLED, -EIO, "STATUS_CANCELLED"},
- {STATUS_CANNOT_DELETE, -EIO, "STATUS_CANNOT_DELETE"},
+ {STATUS_CANNOT_DELETE, -EACCES, "STATUS_CANNOT_DELETE"},
{STATUS_INVALID_COMPUTER_NAME, -EIO, "STATUS_INVALID_COMPUTER_NAME"},
{STATUS_FILE_DELETED, -EIO, "STATUS_FILE_DELETED"},
{STATUS_SPECIAL_ACCOUNT, -EIO, "STATUS_SPECIAL_ACCOUNT"},
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 108/142] CIFS: Fix async reading on reconnects
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (106 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 107/142] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 109/142] CIFS: Possible null ptr deref in SMB2_tcon Jiri Slaby
` (35 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Pavel Shilovsky, Steve French, Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 038bc961c31b070269ecd07349a7ee2e839d4fec upstream.
If we get into read_into_pages() from cifs_readv_receive() and then
loose a network, we issue cifs_reconnect that moves all mids to
a private list and issue their callbacks. The callback of the async
read request sets a mid to retry, frees it and wakes up a process
that waits on the rdata completion.
After the connection is established we return from read_into_pages()
with a short read, use the mid that was freed before and try to read
the remaining data from the a newly created socket. Both actions are
not what we want to do. In reconnect cases (-EAGAIN) we should not
mask off the error with a short read but should return the error
code instead.
Acked-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 643a18491bed..892a1e947b5a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2847,7 +2847,7 @@ cifs_uncached_read_into_pages(struct TCP_Server_Info *server,
total_read += result;
}
- return total_read > 0 ? total_read : result;
+ return total_read > 0 && result != -EAGAIN ? total_read : result;
}
static ssize_t
@@ -3270,7 +3270,7 @@ cifs_readpages_read_into_pages(struct TCP_Server_Info *server,
total_read += result;
}
- return total_read > 0 ? total_read : result;
+ return total_read > 0 && result != -EAGAIN ? total_read : result;
}
static int cifs_readpages(struct file *file, struct address_space *mapping,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 109/142] CIFS: Possible null ptr deref in SMB2_tcon
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (107 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 108/142] CIFS: Fix async reading on reconnects Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 110/142] CIFS: Fix wrong directory attributes after rename Jiri Slaby
` (34 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Steve French, Jiri Slaby
From: Steve French <smfrench@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 18f39e7be0121317550d03e267e3ebd4dbfbb3ce upstream.
As Raphael Geissert pointed out, tcon_error_exit can dereference tcon
and there is one path in which tcon can be null.
Signed-off-by: Steve French <smfrench@gmail.com>
Reported-by: Raphael Geissert <geissert@debian.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/smb2pdu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 829ad35f98d4..7cf843b976fd 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -912,7 +912,8 @@ tcon_exit:
tcon_error_exit:
if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
- tcon->bad_network_name = true;
+ if (tcon)
+ tcon->bad_network_name = true;
}
goto tcon_exit;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 110/142] CIFS: Fix wrong directory attributes after rename
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (108 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 109/142] CIFS: Possible null ptr deref in SMB2_tcon Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 111/142] CIFS: Fix wrong filename length for SMB2 Jiri Slaby
` (33 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Pavel Shilovsky, Steve French, Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b46799a8f28c43c5264ac8d8ffa28b311b557e03 upstream.
When we requests rename we also need to update attributes
of both source and target parent directories. Not doing it
causes generic/309 xfstest to fail on SMB2 mounts. Fix this
by marking these directories for force revalidating.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5f8bdff3a758..36d2b1d6d492 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1689,6 +1689,12 @@ unlink_target:
target_dentry, to_name);
}
+ /* force revalidate to go get info when needed */
+ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+
+ source_dir->i_ctime = source_dir->i_mtime = target_dir->i_ctime =
+ target_dir->i_mtime = current_fs_time(source_dir->i_sb);
+
cifs_rename_exit:
kfree(info_buf_source);
kfree(from_name);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 111/142] CIFS: Fix wrong filename length for SMB2
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (109 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 110/142] CIFS: Fix wrong directory attributes after rename Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 112/142] CIFS: Fix wrong restart readdir for SMB1 Jiri Slaby
` (32 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Pavel Shilovsky, Steve French, Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1bbe4997b13de903c421c1cc78440e544b5f9064 upstream.
The existing code uses the old MAX_NAME constant. This causes
XFS test generic/013 to fail. Fix it by replacing MAX_NAME with
PATH_MAX that SMB1 uses. Also remove an unused MAX_NAME constant
definition.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/cifsglob.h | 5 -----
fs/cifs/smb2file.c | 2 +-
fs/cifs/smb2inode.c | 2 +-
fs/cifs/smb2ops.c | 2 +-
fs/cifs/smb2pdu.c | 2 +-
5 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 465b65488b27..d13f77ea0034 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -70,11 +70,6 @@
#define SERVER_NAME_LENGTH 40
#define SERVER_NAME_LEN_WITH_NULL (SERVER_NAME_LENGTH + 1)
-/* used to define string lengths for reversing unicode strings */
-/* (256+1)*2 = 514 */
-/* (max path length + 1 for null) * 2 for unicode */
-#define MAX_NAME 514
-
/* SMB echo "timeout" -- FIXME: tunable? */
#define SMB_ECHO_INTERVAL (60 * HZ)
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index 3f17b4550831..45992944e238 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -50,7 +50,7 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
goto out;
}
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL) {
rc = -ENOMEM;
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index 84c012a6aba0..215f8d3e3e53 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -131,7 +131,7 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
*adjust_tz = false;
*symlink = false;
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL)
return -ENOMEM;
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 4ac88f89a5e5..8956cf67299b 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -251,7 +251,7 @@ smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon,
int rc;
struct smb2_file_all_info *smb2_data;
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL)
return -ENOMEM;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 7cf843b976fd..fb0c67372a90 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1489,7 +1489,7 @@ SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
{
return query_info(xid, tcon, persistent_fid, volatile_fid,
FILE_ALL_INFORMATION,
- sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
sizeof(struct smb2_file_all_info), data);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 112/142] CIFS: Fix wrong restart readdir for SMB1
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (110 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 111/142] CIFS: Fix wrong filename length for SMB2 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 113/142] mtd/ftl: fix the double free of the buffers allocated in build_maps() Jiri Slaby
` (31 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Pavel Shilovsky, Dan Carpenter, Steve French,
Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f736906a7669a77cf8cabdcbcf1dc8cb694e12ef upstream.
The existing code calls server->ops->close() that is not
right. This causes XFS test generic/310 to fail. Fix this
by using server->ops->closedir() function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/readdir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 5940ecabbe6a..59edb8fd33aa 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -596,8 +596,8 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
- if (server->ops->close)
- server->ops->close(xid, tcon, &cfile->fid);
+ if (server->ops->close_dir)
+ server->ops->close_dir(xid, tcon, &cfile->fid);
} else
spin_unlock(&cifs_file_list_lock);
if (cfile->srch_inf.ntwrk_buf_start) {
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 113/142] mtd/ftl: fix the double free of the buffers allocated in build_maps()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (111 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 112/142] CIFS: Fix wrong restart readdir for SMB1 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 114/142] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc() Jiri Slaby
` (30 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kevin Hao, Brian Norris, Jiri Slaby
From: Kevin Hao <haokexin@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a152056c912db82860a8b4c23d0bd3a5aa89e363 upstream.
I got the following panic on my fsl p5020ds board.
Unable to handle kernel paging request for data at address 0x7375627379737465
Faulting instruction address: 0xc000000000100778
Oops: Kernel access of bad area, sig: 11 [#1]
SMP NR_CPUS=24 CoreNet Generic
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.15.0-next-20140613 #145
task: c0000000fe080000 ti: c0000000fe088000 task.ti: c0000000fe088000
NIP: c000000000100778 LR: c00000000010073c CTR: 0000000000000000
REGS: c0000000fe08aa00 TRAP: 0300 Not tainted (3.15.0-next-20140613)
MSR: 0000000080029000 <CE,EE,ME> CR: 24ad2e24 XER: 00000000
DEAR: 7375627379737465 ESR: 0000000000000000 SOFTE: 1
GPR00: c0000000000c99b0 c0000000fe08ac80 c0000000009598e0 c0000000fe001d80
GPR04: 00000000000000d0 0000000000000913 c000000007902b20 0000000000000000
GPR08: c0000000feaae888 0000000000000000 0000000007091000 0000000000200200
GPR12: 0000000028ad2e28 c00000000fff4000 c0000000007abe08 0000000000000000
GPR16: c0000000007ab160 c0000000007aaf98 c00000000060ba68 c0000000007abda8
GPR20: c0000000007abde8 c0000000feaea6f8 c0000000feaea708 c0000000007abd10
GPR24: c000000000989370 c0000000008c6228 00000000000041ed c0000000fe00a400
GPR28: c00000000017c1cc 00000000000000d0 7375627379737465 c0000000fe001d80
NIP [c000000000100778] .__kmalloc_track_caller+0x70/0x168
LR [c00000000010073c] .__kmalloc_track_caller+0x34/0x168
Call Trace:
[c0000000fe08ac80] [c00000000087e6b8] uevent_sock_list+0x0/0x10 (unreliable)
[c0000000fe08ad20] [c0000000000c99b0] .kstrdup+0x44/0x90
[c0000000fe08adc0] [c00000000017c1cc] .__kernfs_new_node+0x4c/0x130
[c0000000fe08ae70] [c00000000017d7e4] .kernfs_new_node+0x2c/0x64
[c0000000fe08aef0] [c00000000017db00] .kernfs_create_dir_ns+0x34/0xc8
[c0000000fe08af80] [c00000000018067c] .sysfs_create_dir_ns+0x58/0xcc
[c0000000fe08b010] [c0000000002c711c] .kobject_add_internal+0xc8/0x384
[c0000000fe08b0b0] [c0000000002c7644] .kobject_add+0x64/0xc8
[c0000000fe08b140] [c000000000355ebc] .device_add+0x11c/0x654
[c0000000fe08b200] [c0000000002b5988] .add_disk+0x20c/0x4b4
[c0000000fe08b2c0] [c0000000003a21d4] .add_mtd_blktrans_dev+0x340/0x514
[c0000000fe08b350] [c0000000003a3410] .mtdblock_add_mtd+0x74/0xb4
[c0000000fe08b3e0] [c0000000003a32cc] .blktrans_notify_add+0x64/0x94
[c0000000fe08b470] [c00000000039b5b4] .add_mtd_device+0x1d4/0x368
[c0000000fe08b520] [c00000000039b830] .mtd_device_parse_register+0xe8/0x104
[c0000000fe08b5c0] [c0000000003b8408] .of_flash_probe+0x72c/0x734
[c0000000fe08b750] [c00000000035ba40] .platform_drv_probe+0x38/0x84
[c0000000fe08b7d0] [c0000000003599a4] .really_probe+0xa4/0x29c
[c0000000fe08b870] [c000000000359d3c] .__driver_attach+0x100/0x104
[c0000000fe08b900] [c00000000035746c] .bus_for_each_dev+0x84/0xe4
[c0000000fe08b9a0] [c0000000003593c0] .driver_attach+0x24/0x38
[c0000000fe08ba10] [c000000000358f24] .bus_add_driver+0x1c8/0x2ac
[c0000000fe08bab0] [c00000000035a3a4] .driver_register+0x8c/0x158
[c0000000fe08bb30] [c00000000035b9f4] .__platform_driver_register+0x6c/0x80
[c0000000fe08bba0] [c00000000084e080] .of_flash_driver_init+0x1c/0x30
[c0000000fe08bc10] [c000000000001864] .do_one_initcall+0xbc/0x238
[c0000000fe08bd00] [c00000000082cdc0] .kernel_init_freeable+0x188/0x268
[c0000000fe08bdb0] [c0000000000020a0] .kernel_init+0x1c/0xf7c
[c0000000fe08be30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4
Instruction dump:
41bd0010 480000c8 4bf04eb5 60000000 e94d0028 e93f0000 7cc95214 e8a60008
7fc9502a 2fbe0000 419e00c8 e93f0022 <7f7e482a> 39200000 88ed06b2 992d06b2
---[ end trace b4c9a94804a42d40 ]---
It seems that the corrupted partition header on my mtd device triggers
a bug in the ftl. In function build_maps() it will allocate the buffers
needed by the mtd partition, but if something goes wrong such as kmalloc
failure, mtd read error or invalid partition header parameter, it will
free all allocated buffers and then return non-zero. In my case, it
seems that partition header parameter 'NumTransferUnits' is invalid.
And the ftl_freepart() is a function which free all the partition
buffers allocated by build_maps(). Given the build_maps() is a self
cleaning function, so there is no need to invoke this function even
if build_maps() return with error. Otherwise it will causes the
buffers to be freed twice and then weird things would happen.
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mtd/ftl.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index 19d637266fcd..71e4f6ccae2f 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -1075,7 +1075,6 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
return;
}
- ftl_freepart(partition);
kfree(partition);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 114/142] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (112 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 113/142] mtd/ftl: fix the double free of the buffers allocated in build_maps() Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 115/142] blkcg: don't call into policy draining if root_blkg is already gone Jiri Slaby
` (29 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Roger Quadros, Tony Lindgren, Jiri Slaby
From: Roger Quadros <rogerq@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40ddbf5069bd4e11447c0088fc75318e0aac53f0 upstream.
commit 65b97cf6b8de introduced in v3.7 caused a regression
by using a reversed CS_MASK thus causing omap_calculate_ecc to
always fail. As the NAND base driver never checks for .calculate()'s
return value, the zeroed ECC values are used as is without showing
any error to the user. However, this won't work and the NAND device
won't be guarded by any error code.
Fix the issue by using the correct mask.
Code was tested on omap3beagle using the following procedure
- flash the primary bootloader (MLO) from the kernel to the first
NAND partition using nandwrite.
- boot the board from NAND. This utilizes OMAP ROM loader that
relies on 1-bit Hamming code ECC.
Fixes: 65b97cf6b8de (mtd: nand: omap2: handle nand on gpmc)
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mtd/nand/omap2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 0332d0b2d73a..854662826272 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -948,7 +948,7 @@ static int omap_calculate_ecc(struct mtd_info *mtd, const u_char *dat,
u32 val;
val = readl(info->reg.gpmc_ecc_config);
- if (((val >> ECC_CONFIG_CS_SHIFT) & ~CS_MASK) != info->gpmc_cs)
+ if (((val >> ECC_CONFIG_CS_SHIFT) & CS_MASK) != info->gpmc_cs)
return -EINVAL;
/* read ecc result */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 115/142] blkcg: don't call into policy draining if root_blkg is already gone
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (113 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 114/142] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc() Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 116/142] IB/srp: Fix deadlock between host removal and multipathd Jiri Slaby
` (28 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tejun Heo, Jens Axboe, Jiri Slaby
From: Tejun Heo <tj@kernel.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2a1b4cf2331d92bc009bf94fa02a24604cdaf24c upstream.
While a queue is being destroyed, all the blkgs are destroyed and its
->root_blkg pointer is set to NULL. If someone else starts to drain
while the queue is in this state, the following oops happens.
NULL pointer dereference at 0000000000000028
IP: [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
PGD e4a1067 PUD b773067 PMD 0
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: cfq_iosched(-) [last unloaded: cfq_iosched]
CPU: 1 PID: 537 Comm: bash Not tainted 3.16.0-rc3-work+ #2
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: ffff88000e222250 ti: ffff88000efd4000 task.ti: ffff88000efd4000
RIP: 0010:[<ffffffff8144e944>] [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
RSP: 0018:ffff88000efd7bf0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff880015091450 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88000efd7c10 R08: 0000000000000000 R09: 0000000000000001
R10: ffff88000e222250 R11: 0000000000000000 R12: ffff880015091450
R13: ffff880015092e00 R14: ffff880015091d70 R15: ffff88001508fc28
FS: 00007f1332650740(0000) GS:ffff88001fa80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000028 CR3: 0000000009446000 CR4: 00000000000006e0
Stack:
ffffffff8144e8f6 ffff880015091450 0000000000000000 ffff880015091d80
ffff88000efd7c28 ffffffff8144ae2f ffff880015091450 ffff88000efd7c58
ffffffff81427641 ffff880015091450 ffffffff82401f00 ffff880015091450
Call Trace:
[<ffffffff8144ae2f>] blkcg_drain_queue+0x1f/0x60
[<ffffffff81427641>] __blk_drain_queue+0x71/0x180
[<ffffffff81429b3e>] blk_queue_bypass_start+0x6e/0xb0
[<ffffffff814498b8>] blkcg_deactivate_policy+0x38/0x120
[<ffffffff8144ec44>] blk_throtl_exit+0x34/0x50
[<ffffffff8144aea5>] blkcg_exit_queue+0x35/0x40
[<ffffffff8142d476>] blk_release_queue+0x26/0xd0
[<ffffffff81454968>] kobject_cleanup+0x38/0x70
[<ffffffff81454848>] kobject_put+0x28/0x60
[<ffffffff81427505>] blk_put_queue+0x15/0x20
[<ffffffff817d07bb>] scsi_device_dev_release_usercontext+0x16b/0x1c0
[<ffffffff810bc339>] execute_in_process_context+0x89/0xa0
[<ffffffff817d064c>] scsi_device_dev_release+0x1c/0x20
[<ffffffff817930e2>] device_release+0x32/0xa0
[<ffffffff81454968>] kobject_cleanup+0x38/0x70
[<ffffffff81454848>] kobject_put+0x28/0x60
[<ffffffff817934d7>] put_device+0x17/0x20
[<ffffffff817d11b9>] __scsi_remove_device+0xa9/0xe0
[<ffffffff817d121b>] scsi_remove_device+0x2b/0x40
[<ffffffff817d1257>] sdev_store_delete+0x27/0x30
[<ffffffff81792ca8>] dev_attr_store+0x18/0x30
[<ffffffff8126f75e>] sysfs_kf_write+0x3e/0x50
[<ffffffff8126ea87>] kernfs_fop_write+0xe7/0x170
[<ffffffff811f5e9f>] vfs_write+0xaf/0x1d0
[<ffffffff811f69bd>] SyS_write+0x4d/0xc0
[<ffffffff81d24692>] system_call_fastpath+0x16/0x1b
776687bce42b ("block, blk-mq: draining can't be skipped even if
bypass_depth was non-zero") made it easier to trigger this bug by
making blk_queue_bypass_start() drain even when it loses the first
bypass test to blk_cleanup_queue(); however, the bug has always been
there even before the commit as blk_queue_bypass_start() could race
against queue destruction, win the initial bypass test but perform the
actual draining after blk_cleanup_queue() already destroyed all blkgs.
Fix it by skippping calling into policy draining if all the blkgs are
already gone.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Shirish Pargaonkar <spargaonkar@suse.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reported-by: Jet Chen <jet.chen@intel.com>
Tested-by: Shirish Pargaonkar <spargaonkar@suse.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
block/blk-cgroup.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index d8f80e733cf8..a573d4bd71d9 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -866,6 +866,13 @@ void blkcg_drain_queue(struct request_queue *q)
if (!q->root_blkg)
return;
+ /*
+ * @q could be exiting and already have destroyed all blkgs as
+ * indicated by NULL root_blkg. If so, don't confuse policies.
+ */
+ if (!q->root_blkg)
+ return;
+
blk_throtl_drain(q);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 116/142] IB/srp: Fix deadlock between host removal and multipathd
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (114 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 115/142] blkcg: don't call into policy draining if root_blkg is already gone Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 117/142] libceph: gracefully handle large reply messages from the mon Jiri Slaby
` (27 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Bart Van Assche, Sebastian Parschauer,
Roland Dreier, Jiri Slaby
From: Bart Van Assche <bvanassche@acm.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bcc05910359183b431da92713e98eed478edf83a upstream.
If scsi_remove_host() is invoked after a SCSI device has been blocked,
if the fast_io_fail_tmo or dev_loss_tmo work gets scheduled on the
workqueue executing srp_remove_work() and if an I/O request is
scheduled after the SCSI device had been blocked by e.g. multipathd
then the following deadlock can occur:
kworker/6:1 D ffff880831f3c460 0 195 2 0x00000000
Call Trace:
[<ffffffff814aafd9>] schedule+0x29/0x70
[<ffffffff814aa0ef>] schedule_timeout+0x10f/0x2a0
[<ffffffff8105af6f>] msleep+0x2f/0x40
[<ffffffff8123b0ae>] __blk_drain_queue+0x4e/0x180
[<ffffffff8123d2d5>] blk_cleanup_queue+0x225/0x230
[<ffffffffa0010732>] __scsi_remove_device+0x62/0xe0 [scsi_mod]
[<ffffffffa000ed2f>] scsi_forget_host+0x6f/0x80 [scsi_mod]
[<ffffffffa0002eba>] scsi_remove_host+0x7a/0x130 [scsi_mod]
[<ffffffffa07cf5c5>] srp_remove_work+0x95/0x180 [ib_srp]
[<ffffffff8106d7aa>] process_one_work+0x1ea/0x6c0
[<ffffffff8106dd9b>] worker_thread+0x11b/0x3a0
[<ffffffff810758bd>] kthread+0xed/0x110
[<ffffffff814b972c>] ret_from_fork+0x7c/0xb0
multipathd D ffff880096acc460 0 5340 1 0x00000000
Call Trace:
[<ffffffff814aafd9>] schedule+0x29/0x70
[<ffffffff814aa0ef>] schedule_timeout+0x10f/0x2a0
[<ffffffff814ab79b>] io_schedule_timeout+0x9b/0xf0
[<ffffffff814abe1c>] wait_for_completion_io_timeout+0xdc/0x110
[<ffffffff81244b9b>] blk_execute_rq+0x9b/0x100
[<ffffffff8124f665>] sg_io+0x1a5/0x450
[<ffffffff8124fd21>] scsi_cmd_ioctl+0x2a1/0x430
[<ffffffff8124fef2>] scsi_cmd_blk_ioctl+0x42/0x50
[<ffffffffa00ec97e>] sd_ioctl+0xbe/0x140 [sd_mod]
[<ffffffff8124bd04>] blkdev_ioctl+0x234/0x840
[<ffffffff811cb491>] block_ioctl+0x41/0x50
[<ffffffff811a0df0>] do_vfs_ioctl+0x300/0x520
[<ffffffff811a1051>] SyS_ioctl+0x41/0x80
[<ffffffff814b9962>] tracesys+0xd0/0xd5
Fix this by scheduling removal work on another workqueue than the
transport layer timers.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: David Dillow <dave@thedillows.org>
Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/ulp/srp/ib_srp.c | 38 +++++++++++++++++++++++++++----------
1 file changed, 28 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 024fa025a7ab..15984e1c0b61 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -93,6 +93,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr);
static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
static struct scsi_transport_template *ib_srp_transport_template;
+static struct workqueue_struct *srp_remove_wq;
static struct ib_client srp_client = {
.name = "srp",
@@ -458,7 +459,7 @@ static bool srp_queue_remove_work(struct srp_target_port *target)
spin_unlock_irq(&target->lock);
if (changed)
- queue_work(system_long_wq, &target->remove_work);
+ queue_work(srp_remove_wq, &target->remove_work);
return changed;
}
@@ -2602,9 +2603,10 @@ static void srp_remove_one(struct ib_device *device)
spin_unlock(&host->target_lock);
/*
- * Wait for target port removal tasks.
+ * Wait for tl_err and target port removal tasks.
*/
flush_workqueue(system_long_wq);
+ flush_workqueue(srp_remove_wq);
kfree(host);
}
@@ -2649,16 +2651,22 @@ static int __init srp_init_module(void)
indirect_sg_entries = cmd_sg_entries;
}
+ srp_remove_wq = create_workqueue("srp_remove");
+ if (IS_ERR(srp_remove_wq)) {
+ ret = PTR_ERR(srp_remove_wq);
+ goto out;
+ }
+
+ ret = -ENOMEM;
ib_srp_transport_template =
srp_attach_transport(&ib_srp_transport_functions);
if (!ib_srp_transport_template)
- return -ENOMEM;
+ goto destroy_wq;
ret = class_register(&srp_class);
if (ret) {
pr_err("couldn't register class infiniband_srp\n");
- srp_release_transport(ib_srp_transport_template);
- return ret;
+ goto release_tr;
}
ib_sa_register_client(&srp_sa_client);
@@ -2666,13 +2674,22 @@ static int __init srp_init_module(void)
ret = ib_register_client(&srp_client);
if (ret) {
pr_err("couldn't register IB client\n");
- srp_release_transport(ib_srp_transport_template);
- ib_sa_unregister_client(&srp_sa_client);
- class_unregister(&srp_class);
- return ret;
+ goto unreg_sa;
}
- return 0;
+out:
+ return ret;
+
+unreg_sa:
+ ib_sa_unregister_client(&srp_sa_client);
+ class_unregister(&srp_class);
+
+release_tr:
+ srp_release_transport(ib_srp_transport_template);
+
+destroy_wq:
+ destroy_workqueue(srp_remove_wq);
+ goto out;
}
static void __exit srp_cleanup_module(void)
@@ -2681,6 +2698,7 @@ static void __exit srp_cleanup_module(void)
ib_sa_unregister_client(&srp_sa_client);
class_unregister(&srp_class);
srp_release_transport(ib_srp_transport_template);
+ destroy_workqueue(srp_remove_wq);
}
module_init(srp_init_module);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 117/142] libceph: gracefully handle large reply messages from the mon
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (115 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 116/142] IB/srp: Fix deadlock between host removal and multipathd Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 118/142] CIFS: Fix directory rename error Jiri Slaby
` (26 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Sage Weil, Jiri Slaby
From: Sage Weil <sage@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 73c3d4812b4c755efeca0140f606f83772a39ce4 upstream.
We preallocate a few of the message types we get back from the mon. If we
get a larger message than we are expecting, fall back to trying to allocate
a new one instead of blindly using the one we have.
Signed-off-by: Sage Weil <sage@redhat.com>
Reviewed-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/ceph/mon_client.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 2ac9ef35110b..dbcbf5a4707f 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -1041,7 +1041,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
if (!m) {
pr_info("alloc_msg unknown type %d\n", type);
*skip = 1;
+ } else if (front_len > m->front_alloc_len) {
+ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
+ front_len, m->front_alloc_len,
+ (unsigned int)con->peer_name.type,
+ le64_to_cpu(con->peer_name.num));
+ ceph_msg_put(m);
+ m = ceph_msg_new(type, front_len, GFP_NOFS, false);
}
+
return m;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 118/142] CIFS: Fix directory rename error
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (116 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 117/142] libceph: gracefully handle large reply messages from the mon Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 119/142] carl9170: fix sending URBs with wrong type when using full-speed Jiri Slaby
` (25 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Pavel Shilovsky, Steve French, Jiri Slaby
From: Pavel Shilovsky <pshilovsky@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Commit a07d322059db66b84c9eb4f98959df468e88b34b upstream.
CIFS servers process nlink counts differently for files and directories.
In cifs_rename() if we the request fails on the existing target, we
try to remove it through cifs_unlink() but this is not what we want
to do for directories. As the result the following sequence of commands
mkdir {1,2}; mv -T 1 2; rmdir {1,2}; mkdir {1,2}; echo foo > 2/bar
and XFS test generic/023 fail with -ENOENT error. That's why the second
mkdir reuses the existing inode (target inode of the mv -T command) with
S_DEAD flag.
Fix this by checking whether the target is directory or not and
calling cifs_rmdir() rather than cifs_unlink() for directories.
Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/cifs/inode.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 36d2b1d6d492..2a93255c0150 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1682,7 +1682,10 @@ cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
unlink_target:
/* Try unlinking the target dentry if it's not negative */
if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
- tmprc = cifs_unlink(target_dir, target_dentry);
+ if (S_ISDIR(target_dentry->d_inode->i_mode))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
+ tmprc = cifs_unlink(target_dir, target_dentry);
if (tmprc)
goto cifs_rename_exit;
rc = cifs_do_rename(xid, source_dentry, from_name,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 119/142] carl9170: fix sending URBs with wrong type when using full-speed
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (117 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 118/142] CIFS: Fix directory rename error Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 120/142] drm/tilcdc: panel: fix dangling sysfs connector node Jiri Slaby
` (24 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Ronald Wahl, John W. Linville, Jiri Slaby
From: Ronald Wahl <ronald.wahl@raritan.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
The driver assumes that endpoint 4 is always an interrupt endpoint.
Unfortunately the type differs between high-speed and full-speed
configurations while in the former case it is indeed an interrupt
endpoint this is not true for the latter case - here it is a bulk
endpoint. When sending URBs with the wrong type the kernel will
generate a warning message including backtrace. In this specific
case there will be a huge amount of warnings which can bring the system
to freeze.
To fix this we are now sending URBs to endpoint 4 using the type
found in the endpoint descriptor.
A side note: The carl9170 firmware currently specifies endpoint 4 as
interrupt endpoint even in the full-speed configuration but this has
no relevance because before this firmware is loaded the endpoint type
is as described above and after the firmware is running the stick is not
reenumerated and so the old descriptor is used.
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/ath/carl9170/carl9170.h | 1 +
drivers/net/wireless/ath/carl9170/usb.c | 31 ++++++++++++++++++++++++----
2 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 8596aba34f96..237d0cda1bcb 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -256,6 +256,7 @@ struct ar9170 {
atomic_t rx_work_urbs;
atomic_t rx_pool_urbs;
kernel_ulong_t features;
+ bool usb_ep_cmd_is_bulk;
/* firmware settings */
struct completion fw_load_wait;
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 307bc0ddff99..83d20c8b2ad7 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
goto err_free;
}
- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
- carl9170_usb_cmd_complete, ar, 1);
+ if (ar->usb_ep_cmd_is_bulk)
+ usb_fill_bulk_urb(urb, ar->udev,
+ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
+ cmd, cmd->hdr.len + 4,
+ carl9170_usb_cmd_complete, ar);
+ else
+ usb_fill_int_urb(urb, ar->udev,
+ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
+ cmd, cmd->hdr.len + 4,
+ carl9170_usb_cmd_complete, ar, 1);
if (free_buf)
urb->transfer_flags |= URB_FREE_BUFFER;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw,
static int carl9170_usb_probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
+ struct usb_endpoint_descriptor *ep;
struct ar9170 *ar;
struct usb_device *udev;
- int err;
+ int i, err;
err = usb_reset_device(interface_to_usbdev(intf));
if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb_interface *intf,
ar->intf = intf;
ar->features = id->driver_info;
+ /* We need to remember the type of endpoint 4 because it differs
+ * between high- and full-speed configuration. The high-speed
+ * configuration specifies it as interrupt and the full-speed
+ * configuration as bulk endpoint. This information is required
+ * later when sending urbs to that endpoint.
+ */
+ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
+ ep = &intf->cur_altsetting->endpoint[i].desc;
+
+ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
+ usb_endpoint_dir_out(ep) &&
+ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
+ ar->usb_ep_cmd_is_bulk = true;
+ }
+
usb_set_intfdata(intf, ar);
SET_IEEE80211_DEV(ar->hw, &intf->dev);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 120/142] drm/tilcdc: panel: fix dangling sysfs connector node
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (118 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 119/142] carl9170: fix sending URBs with wrong type when using full-speed Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 121/142] drm/tilcdc: slave: " Jiri Slaby
` (23 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e396900e649b0af31161634d87fe37076f46c12b upstream.
Add a drm_sysfs_connector_remove call when we destroy the panel to make
sure the connector node in sysfs gets deleted.
This is required for proper unload and re-load of this driver as a
module. Without this, we would get a warning at re-load time like so:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 824 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
sysfs: cannot create duplicate filename '/class/drm/card0-LVDS-1'
Modules linked in: [...]
CPU: 0 PID: 824 Comm: modprobe Not tainted 3.15.0-rc4-00027-g6484f96-dirty #81
[<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
[<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
[<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
[<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
[<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
[<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
[<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
[<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
[<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
[<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1fec>] (panel_modeset_init+0xb8/0x134 [tilcdc])
[<bf0b1fec>] (panel_modeset_init [tilcdc]) from [<bf0b2bf0>] (tilcdc_load+0x214/0x4c0 [tilcdc])
[<bf0b2bf0>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
[ .. snip .. ]
---[ end trace b2d09cd9578b0497 ]---
[drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_panel.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
index 86c67329b605..1943b2f50ca0 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
@@ -151,6 +151,7 @@ struct panel_connector {
static void panel_connector_destroy(struct drm_connector *connector)
{
struct panel_connector *panel_connector = to_panel_connector(connector);
+ drm_sysfs_connector_remove(connector);
drm_connector_cleanup(connector);
kfree(panel_connector);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 121/142] drm/tilcdc: slave: fix dangling sysfs connector node
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (119 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 120/142] drm/tilcdc: panel: fix dangling sysfs connector node Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 122/142] drm/tilcdc: tfp410: " Jiri Slaby
` (22 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit daa15b4cd1eee58eb1322062a3320b1dbe5dc96e upstream.
Add a drm_sysfs_connector_remove call when we destroy the panel to make
sure the connector node in sysfs gets deleted.
This is required for proper unload and re-load of this driver as a
module. Without this, we would get a warning at re-load time like so:
tda998x 0-0070: found TDA19988
------------[ cut here ]------------
WARNING: CPU: 0 PID: 825 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
sysfs: cannot create duplicate filename '/class/drm/card0-HDMI-A-1'
Modules linked in: [..]
CPU: 0 PID: 825 Comm: modprobe Not tainted 3.15.0-rc4-00027-g9dcdef4 #82
[<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
[<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
[<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
[<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
[<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
[<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
[<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
[<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
[<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
[<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1b40>] (slave_modeset_init+0x120/0x1bc [tilcdc])
[<bf0b1b40>] (slave_modeset_init [tilcdc]) from [<bf0b2be8>] (tilcdc_load+0x214/0x4c0 [tilcdc])
[<bf0b2be8>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
[..snip..]
---[ end trace 4df8d614936ebdee ]---
[drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_slave.c b/drivers/gpu/drm/tilcdc/tilcdc_slave.c
index 595068ba2d5e..2f83ffb7f37e 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_slave.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_slave.c
@@ -166,6 +166,7 @@ struct slave_connector {
static void slave_connector_destroy(struct drm_connector *connector)
{
struct slave_connector *slave_connector = to_slave_connector(connector);
+ drm_sysfs_connector_remove(connector);
drm_connector_cleanup(connector);
kfree(slave_connector);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 122/142] drm/tilcdc: tfp410: fix dangling sysfs connector node
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (120 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 121/142] drm/tilcdc: slave: " Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 123/142] drm/tilcdc: panel: fix leak when unloading the module Jiri Slaby
` (21 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 16dcbdef404f4e87dab985494381939fe0a2d456 upstream.
Add a drm_sysfs_connector_remove call when we destroy the panel to make
sure the connector node in sysfs gets deleted.
This is required for proper unload and re-load of this driver, otherwise
we will get a warning about a duplicate filename in sysfs.
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
index c38b56b268ac..ce75ac8de4f8 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
@@ -167,6 +167,7 @@ struct tfp410_connector {
static void tfp410_connector_destroy(struct drm_connector *connector)
{
struct tfp410_connector *tfp410_connector = to_tfp410_connector(connector);
+ drm_sysfs_connector_remove(connector);
drm_connector_cleanup(connector);
kfree(tfp410_connector);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 123/142] drm/tilcdc: panel: fix leak when unloading the module
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (121 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 122/142] drm/tilcdc: tfp410: " Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 124/142] drm/tilcdc: fix release order on exit Jiri Slaby
` (20 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3a49012224ca9016658a831a327ff6a7fe5bb4f9 upstream.
The driver did not unregister the allocated framebuffer, which caused
memory leaks (and memory manager WARNs) when unloading. Also, the
framebuffer device under /dev still existed after unloading.
Add a call to drm_fbdev_cma_fini when unloading the module to prevent
both issues.
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
index 116da199b942..247ab5d60df0 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
@@ -122,6 +122,7 @@ static int tilcdc_unload(struct drm_device *dev)
struct tilcdc_drm_private *priv = dev->dev_private;
struct tilcdc_module *mod, *cur;
+ drm_fbdev_cma_fini(priv->fbdev);
drm_kms_helper_poll_fini(dev);
drm_mode_config_cleanup(dev);
drm_vblank_cleanup(dev);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 124/142] drm/tilcdc: fix release order on exit
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (122 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 123/142] drm/tilcdc: panel: fix leak when unloading the module Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 125/142] drm/tilcdc: fix double kfree Jiri Slaby
` (19 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit eb565a2bbadc6a5030a6dbe58db1aa52453e7edf upstream.
Unregister resources in the correct order on tilcdc_drm_fini, which is
the reverse order they were registered during tilcdc_drm_init.
This also means unregistering the driver before releasing its resources.
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
index 247ab5d60df0..af1b17a0db66 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
@@ -629,10 +629,10 @@ static int __init tilcdc_drm_init(void)
static void __exit tilcdc_drm_fini(void)
{
DBG("fini");
- tilcdc_tfp410_fini();
- tilcdc_slave_fini();
- tilcdc_panel_fini();
platform_driver_unregister(&tilcdc_platform_driver);
+ tilcdc_panel_fini();
+ tilcdc_slave_fini();
+ tilcdc_tfp410_fini();
}
late_initcall(tilcdc_drm_init);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 125/142] drm/tilcdc: fix double kfree
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (123 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 124/142] drm/tilcdc: fix release order on exit Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 126/142] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan() Jiri Slaby
` (18 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guido Martínez, Dave Airlie, Jiri Slaby
From: Guido Martínez <guido@vanguardiasur.com.ar>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca upstream.
display_timings_release calls kfree on the display_timings object passed
to it. Calling kfree after it is wrong. SLUB debug showed the following
warning:
=============================================================================
BUG kmalloc-64 (Tainted: G W ): Object already free
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in of_get_display_timings+0x2c/0x214 age=601 cpu=0
pid=884
__slab_alloc.constprop.79+0x2e0/0x33c
kmem_cache_alloc+0xac/0xdc
of_get_display_timings+0x2c/0x214
panel_probe+0x7c/0x314 [tilcdc]
platform_drv_probe+0x18/0x48
[..snip..]
INFO: Freed in panel_destroy+0x18/0x3c [tilcdc] age=0 cpu=0 pid=907
__slab_free+0x34/0x330
panel_destroy+0x18/0x3c [tilcdc]
tilcdc_unload+0xd0/0x118 [tilcdc]
drm_dev_unregister+0x24/0x98
[..snip..]
Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/tilcdc/tilcdc_panel.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
index 1943b2f50ca0..b085dcc54fb5 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
@@ -286,10 +286,8 @@ static void panel_destroy(struct tilcdc_module *mod)
{
struct panel_module *panel_mod = to_panel_module(mod);
- if (panel_mod->timings) {
+ if (panel_mod->timings)
display_timings_release(panel_mod->timings);
- kfree(panel_mod->timings);
- }
tilcdc_module_cleanup(mod);
kfree(panel_mod->info);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 126/142] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (124 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 125/142] drm/tilcdc: fix double kfree Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 127/142] drm/ttm: Choose a pool to shrink correctly " Jiri Slaby
` (17 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tetsuo Handa, Dave Airlie, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
list_empty(&_manager->pools) being false before taking _manager->lock
does not guarantee that _manager->npools != 0 after taking _manager->lock
because _manager->npools is updated under _manager->lock.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 7957beeeaf73..eeb8527aba90 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1014,6 +1014,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
return SHRINK_STOP;
mutex_lock(&_manager->lock);
+ if (!_manager->npools)
+ goto out;
pool_offset = pool_offset % _manager->npools;
list_for_each_entry(p, &_manager->pools, pools) {
unsigned nr_free;
@@ -1033,6 +1035,7 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
p->pool->dev_name, p->pool->name, current->pid,
nr_free, shrink_pages);
}
+out:
mutex_unlock(&_manager->lock);
return freed;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 127/142] drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (125 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 126/142] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan() Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 128/142] drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions Jiri Slaby
` (16 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tetsuo Handa, Dave Airlie, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
We can use "unsigned int" instead of "atomic_t" by updating start_pool
variable under _manager->lock. This patch will make it possible to avoid
skipping when choosing a pool to shrink in round-robin style, after next
patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index eeb8527aba90..5d49274afd0e 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1003,9 +1003,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
static unsigned long
ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
{
- static atomic_t start_pool = ATOMIC_INIT(0);
+ static unsigned start_pool;
unsigned idx = 0;
- unsigned pool_offset = atomic_add_return(1, &start_pool);
+ unsigned pool_offset;
unsigned shrink_pages = sc->nr_to_scan;
struct device_pools *p;
unsigned long freed = 0;
@@ -1016,7 +1016,7 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
mutex_lock(&_manager->lock);
if (!_manager->npools)
goto out;
- pool_offset = pool_offset % _manager->npools;
+ pool_offset = ++start_pool % _manager->npools;
list_for_each_entry(p, &_manager->pools, pools) {
unsigned nr_free;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 128/142] drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (126 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 127/142] drm/ttm: Choose a pool to shrink correctly " Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 129/142] drm/ttm: Fix possible stack overflow by recursive shrinker calls Jiri Slaby
` (15 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tetsuo Handa, Dave Airlie, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 22e71691fd54c637800d10816bbeba9cf132d218 upstream.
I can observe that RHEL7 environment stalls with 100% CPU usage when a
certain type of memory pressure is given. While the shrinker functions
are called by shrink_slab() before the OOM killer is triggered, the stall
lasts for many minutes.
One of reasons of this stall is that
ttm_dma_pool_shrink_count()/ttm_dma_pool_shrink_scan() are called and
are blocked at mutex_lock(&_manager->lock). GFP_KERNEL allocation with
_manager->lock held causes someone (including kswapd) to deadlock when
these functions are called due to memory pressure. This patch changes
"mutex_lock();" to "if (!mutex_trylock()) return ...;" in order to
avoid deadlock.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 5d49274afd0e..629e344dad1e 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1013,7 +1013,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
if (list_empty(&_manager->pools))
return SHRINK_STOP;
- mutex_lock(&_manager->lock);
+ if (!mutex_trylock(&_manager->lock))
+ return SHRINK_STOP;
if (!_manager->npools)
goto out;
pool_offset = ++start_pool % _manager->npools;
@@ -1046,7 +1047,8 @@ ttm_dma_pool_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
struct device_pools *p;
unsigned long count = 0;
- mutex_lock(&_manager->lock);
+ if (!mutex_trylock(&_manager->lock))
+ return 0;
list_for_each_entry(p, &_manager->pools, pools)
count += p->pool->npages_free;
mutex_unlock(&_manager->lock);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 129/142] drm/ttm: Fix possible stack overflow by recursive shrinker calls.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (127 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 128/142] drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 130/142] drm/ttm: Pass GFP flags in order to avoid deadlock Jiri Slaby
` (14 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tetsuo Handa, Dave Airlie, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 71336e011d1d2312bcbcaa8fcec7365024f3a95d upstream.
While ttm_dma_pool_shrink_scan() tries to take mutex before doing GFP_KERNEL
allocation, ttm_pool_shrink_scan() does not do it. This can result in stack
overflow if kmalloc() in ttm_page_pool_free() triggered recursion due to
memory pressure.
shrink_slab()
=> ttm_pool_shrink_scan()
=> ttm_page_pool_free()
=> kmalloc(GFP_KERNEL)
=> shrink_slab()
=> ttm_pool_shrink_scan()
=> ttm_page_pool_free()
=> kmalloc(GFP_KERNEL)
Change ttm_pool_shrink_scan() to do like ttm_dma_pool_shrink_scan() does.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/ttm/ttm_page_alloc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 863bef9f9234..deba59b6ef83 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -391,14 +391,17 @@ out:
static unsigned long
ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
{
- static atomic_t start_pool = ATOMIC_INIT(0);
+ static DEFINE_MUTEX(lock);
+ static unsigned start_pool;
unsigned i;
- unsigned pool_offset = atomic_add_return(1, &start_pool);
+ unsigned pool_offset;
struct ttm_page_pool *pool;
int shrink_pages = sc->nr_to_scan;
unsigned long freed = 0;
- pool_offset = pool_offset % NUM_POOLS;
+ if (!mutex_trylock(&lock))
+ return SHRINK_STOP;
+ pool_offset = ++start_pool % NUM_POOLS;
/* select start pool in round robin fashion */
for (i = 0; i < NUM_POOLS; ++i) {
unsigned nr_free = shrink_pages;
@@ -408,6 +411,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
shrink_pages = ttm_page_pool_free(pool, nr_free);
freed += nr_free - shrink_pages;
}
+ mutex_unlock(&lock);
return freed;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 130/142] drm/ttm: Pass GFP flags in order to avoid deadlock.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (128 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 129/142] drm/ttm: Fix possible stack overflow by recursive shrinker calls Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 131/142] drm/radeon: load the lm63 driver for an lm64 thermal chip Jiri Slaby
` (13 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tetsuo Handa, Dave Airlie, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a91576d7916f6cce76d30303e60e1ac47cf4a76d upstream.
Commit 7dc19d5a "drivers: convert shrinkers to new count/scan API" added
deadlock warnings that ttm_page_pool_free() and ttm_dma_page_pool_free()
are currently doing GFP_KERNEL allocation.
But these functions did not get updated to receive gfp_t argument.
This patch explicitly passes sc->gfp_mask or GFP_KERNEL to these functions,
and removes the deadlock warning.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/ttm/ttm_page_alloc.c | 19 ++++++++++---------
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 19 +++++++++----------
2 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index deba59b6ef83..cf4bad2c1d59 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -297,8 +297,10 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool,
*
* @pool: to free the pages from
* @free_all: If set to true will free all pages in pool
+ * @gfp: GFP flags.
**/
-static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free)
+static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+ gfp_t gfp)
{
unsigned long irq_flags;
struct page *p;
@@ -309,8 +311,7 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free)
if (NUM_PAGES_TO_ALLOC < nr_free)
npages_to_free = NUM_PAGES_TO_ALLOC;
- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
- GFP_KERNEL);
+ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
if (!pages_to_free) {
pr_err("Failed to allocate memory for pool free operation\n");
return 0;
@@ -382,9 +383,7 @@ out:
*
* XXX: (dchinner) Deadlock warning!
*
- * ttm_page_pool_free() does memory allocation using GFP_KERNEL. that means
- * this can deadlock when called a sc->gfp_mask that is not equal to
- * GFP_KERNEL.
+ * We need to pass sc->gfp_mask to ttm_page_pool_free().
*
* This code is crying out for a shrinker per pool....
*/
@@ -408,7 +407,8 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
if (shrink_pages == 0)
break;
pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
- shrink_pages = ttm_page_pool_free(pool, nr_free);
+ shrink_pages = ttm_page_pool_free(pool, nr_free,
+ sc->gfp_mask);
freed += nr_free - shrink_pages;
}
mutex_unlock(&lock);
@@ -710,7 +710,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
}
spin_unlock_irqrestore(&pool->lock, irq_flags);
if (npages)
- ttm_page_pool_free(pool, npages);
+ ttm_page_pool_free(pool, npages, GFP_KERNEL);
}
/*
@@ -850,7 +850,8 @@ void ttm_page_alloc_fini(void)
ttm_pool_mm_shrink_fini(_manager);
for (i = 0; i < NUM_POOLS; ++i)
- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES);
+ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
+ GFP_KERNEL);
kobject_put(&_manager->kobj);
_manager = NULL;
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 629e344dad1e..ae86e3513631 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -410,8 +410,10 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page)
*
* @pool: to free the pages from
* @nr_free: If set to true will free all pages in pool
+ * @gfp: GFP flags.
**/
-static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free)
+static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+ gfp_t gfp)
{
unsigned long irq_flags;
struct dma_page *dma_p, *tmp;
@@ -429,8 +431,7 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free)
npages_to_free, nr_free);
}
#endif
- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
- GFP_KERNEL);
+ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
if (!pages_to_free) {
pr_err("%s: Failed to allocate memory for pool free operation\n",
@@ -529,7 +530,7 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type)
if (pool->type != type)
continue;
/* Takes a spinlock.. */
- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES);
+ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
/* This code path is called after _all_ references to the
* struct device has been dropped - so nobody should be
@@ -982,7 +983,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
/* shrink pool if necessary (only on !is_cached pools)*/
if (npages)
- ttm_dma_page_pool_free(pool, npages);
+ ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
ttm->state = tt_unpopulated;
}
EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
@@ -992,10 +993,7 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
*
* XXX: (dchinner) Deadlock warning!
*
- * ttm_dma_page_pool_free() does GFP_KERNEL memory allocation, and so attention
- * needs to be paid to sc->gfp_mask to determine if this can be done or not.
- * GFP_KERNEL memory allocation in a GFP_ATOMIC reclaim context woul dbe really
- * bad.
+ * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
*
* I'm getting sadder as I hear more pathetical whimpers about needing per-pool
* shrinkers
@@ -1029,7 +1027,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
if (++idx < pool_offset)
continue;
nr_free = shrink_pages;
- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free);
+ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
+ sc->gfp_mask);
freed += nr_free - shrink_pages;
pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 131/142] drm/radeon: load the lm63 driver for an lm64 thermal chip.
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (129 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 130/142] drm/ttm: Pass GFP flags in order to avoid deadlock Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 132/142] drm/radeon: set VM base addr using the PFP v2 Jiri Slaby
` (12 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alex Deucher, Jiri Slaby
From: Alex Deucher <alexander.deucher@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
Looks like the lm63 driver supports the lm64 as well.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index dfa641277175..402d4630d13e 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1963,7 +1963,7 @@ static const char *thermal_controller_names[] = {
"adm1032",
"adm1030",
"max6649",
- "lm64",
+ "lm63", /* lm64 */
"f75375",
"asc7xxx",
};
@@ -1974,7 +1974,7 @@ static const char *pp_lib_thermal_controller_names[] = {
"adm1032",
"adm1030",
"max6649",
- "lm64",
+ "lm63", /* lm64 */
"f75375",
"RV6xx",
"RV770",
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 132/142] drm/radeon: set VM base addr using the PFP v2
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (130 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 131/142] drm/radeon: load the lm63 driver for an lm64 thermal chip Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 133/142] drm/i915: read HEAD register back in init_ring_common() to enforce ordering Jiri Slaby
` (11 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Christian König, Alex Deucher, Jiri Slaby
From: Christian König <christian.koenig@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f1d2a26b506e9dc7bbe94fae40da0a0d8dcfacd0 upstream.
Seems to make VM flushes more stable on SI and CIK.
v2: only use the PFP on the GFX ring on CIK
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/radeon/cik.c | 5 +++--
drivers/gpu/drm/radeon/si.c | 2 +-
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 85ef9ff42aa6..9d9770d201ae 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4769,12 +4769,13 @@ static void cik_vm_decode_fault(struct radeon_device *rdev,
void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
{
struct radeon_ring *ring = &rdev->ring[ridx];
+ int usepfp = (ridx == RADEON_RING_TYPE_GFX_INDEX);
if (vm == NULL)
return;
radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
WRITE_DATA_DST_SEL(0)));
if (vm->id < 8) {
radeon_ring_write(ring,
@@ -4833,7 +4834,7 @@ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
radeon_ring_write(ring, 1 << vm->id);
/* compute doesn't have PFP */
- if (ridx == RADEON_RING_TYPE_GFX_INDEX) {
+ if (usepfp) {
/* sync PFP to ME, otherwise we might get invalid PFP reads */
radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
radeon_ring_write(ring, 0x0);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 4d41a0dc1796..53769e9cf595 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -4757,7 +4757,7 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
/* write new base address */
radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(1) |
WRITE_DATA_DST_SEL(0)));
if (vm->id < 8) {
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 133/142] drm/i915: read HEAD register back in init_ring_common() to enforce ordering
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (131 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 132/142] drm/radeon: set VM base addr using the PFP v2 Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 134/142] drm/radeon: enable bapm by default on desktop TN/RL boards Jiri Slaby
` (10 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jiri Kosina, Daniel Vetter, Jiri Slaby
From: Jiri Kosina <jkosina@suse.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ece4a17d237a79f63fbfaf3f724a12b6d500555c upstream.
Withtout this, ring initialization fails reliabily during resume with
[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head ffffff8804 tail 00000000 start 000e4000
This is not a complete fix, but it is verified to make the ring
initialization failures during resume much less likely.
We were not able to root-cause this bug (likely HW-specific to Gen4 chips)
yet. This is therefore used as a ducttape before problem is fully
understood and proper fix created, so that people don't suffer from
completely unusable systems in the meantime.
The discussion and debugging is happening at
https://bugs.freedesktop.org/show_bug.cgi?id=76554
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 7507fe036b6e..1ceb95a3bbe0 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -423,6 +423,9 @@ static int init_ring_common(struct intel_ring_buffer *ring)
}
}
+ /* Enforce ordering by reading HEAD register back */
+ I915_READ_HEAD(ring);
+
/* Initialize the ring. This must happen _after_ we've cleared the ring
* registers with the above sequence (the readback of the HEAD registers
* also enforces ordering), otherwise the hw might lose the new ring
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 134/142] drm/radeon: enable bapm by default on desktop TN/RL boards
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (132 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 133/142] drm/i915: read HEAD register back in init_ring_common() to enforce ordering Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 135/142] drm/radeon/TN: only enable bapm on MSI systems Jiri Slaby
` (9 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alex Deucher, Jiri Slaby
From: Alex Deucher <alexander.deucher@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0c78a44964db3d483b0c09a8236e0fe123aa9cfc upstream.
bapm enabled the GPU and CPU to share TDP headroom. It was
disabled by default since some laptops hung when it was enabled
in conjunction with dpm. It seems to be stable on desktop
boards and fixes hangs on boot with dpm enabled on certain
boards, so enable it by default on desktop boards.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=72921
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/radeon/trinity_dpm.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index d700698a1f22..37023884d102 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1868,7 +1868,15 @@ int trinity_dpm_init(struct radeon_device *rdev)
for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
pi->at[i] = TRINITY_AT_DFLT;
- pi->enable_bapm = false;
+ /* There are stability issues reported on latops with
+ * bapm installed when switching between AC and battery
+ * power. At the same time, some desktop boards hang
+ * if it's not enabled and dpm is enabled.
+ */
+ if (rdev->flags & RADEON_IS_MOBILITY)
+ pi->enable_bapm = false;
+ else
+ pi->enable_bapm = true;
pi->enable_nbps_policy = true;
pi->enable_sclk_ds = true;
pi->enable_gfx_power_gating = true;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 135/142] drm/radeon/TN: only enable bapm on MSI systems
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (133 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 134/142] drm/radeon: enable bapm by default on desktop TN/RL boards Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 136/142] libata: widen Crucial M550 blacklist matching Jiri Slaby
` (8 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alex Deucher, Jiri Slaby
From: Alex Deucher <alexander.deucher@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 730a336c33a3398d65896e8ee3ef9f5679fe30a9 upstream.
There still seem to be stability problems with other systems.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=72921
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/radeon/trinity_dpm.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 37023884d102..bf980ea2b593 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1868,15 +1868,16 @@ int trinity_dpm_init(struct radeon_device *rdev)
for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
pi->at[i] = TRINITY_AT_DFLT;
- /* There are stability issues reported on latops with
- * bapm installed when switching between AC and battery
- * power. At the same time, some desktop boards hang
- * if it's not enabled and dpm is enabled.
+ /* There are stability issues reported on with
+ * bapm enabled when switching between AC and battery
+ * power. At the same time, some MSI boards hang
+ * if it's not enabled and dpm is enabled. Just enable
+ * it for MSI boards right now.
*/
- if (rdev->flags & RADEON_IS_MOBILITY)
- pi->enable_bapm = false;
- else
+ if (rdev->pdev->subsystem_vendor == 0x1462)
pi->enable_bapm = true;
+ else
+ pi->enable_bapm = false;
pi->enable_nbps_policy = true;
pi->enable_sclk_ds = true;
pi->enable_gfx_power_gating = true;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 136/142] libata: widen Crucial M550 blacklist matching
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (134 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 135/142] drm/radeon/TN: only enable bapm on MSI systems Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 137/142] pata_scc: propagate return value of scc_wait_after_reset Jiri Slaby
` (7 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tejun Heo, Jiri Slaby
From: Tejun Heo <tj@kernel.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2a13772a144d2956a7fedd18685921d0a9b8b783 upstream.
Crucial M550 may cause data corruption on queued trims and is
blacklisted. The pattern used for it fails to match 1TB one as the
capacity section will be four chars instead of three. Widen the
pattern.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Charles Reiss <woggling@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81071
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0d9a2f674819..5d0bc51bafea 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4227,7 +4227,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
{ "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
{ "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
{ "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
- { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
/*
* Some WD SATA-I drives spin up and down erratically when the link
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 137/142] pata_scc: propagate return value of scc_wait_after_reset
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (135 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 136/142] libata: widen Crucial M550 blacklist matching Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 138/142] ahci: Add Device IDs for Intel 9 Series PCH Jiri Slaby
` (6 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Arjun Sreedharan, Tejun Heo, Jiri Slaby
From: Arjun Sreedharan <arjun024@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.
scc_bus_softreset not necessarily should return zero.
Propagate the error code.
Signed-off-by: Arjun Sreedharan <arjun024@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/pata_scc.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
index f35f15f4d83e..f7badaa39eb6 100644
--- a/drivers/ata/pata_scc.c
+++ b/drivers/ata/pata_scc.c
@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct ata_link *link, unsigned int devmask,
* Note: Original code is ata_bus_softreset().
*/
-static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+static int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
unsigned long deadline)
{
struct ata_ioports *ioaddr = &ap->ioaddr;
@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
udelay(20);
out_be32(ioaddr->ctl_addr, ap->ctl);
- scc_wait_after_reset(&ap->link, devmask, deadline);
-
- return 0;
+ return scc_wait_after_reset(&ap->link, devmask, deadline);
}
/**
@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
{
struct ata_port *ap = link->ap;
unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS;
- unsigned int devmask = 0, err_mask;
+ unsigned int devmask = 0;
+ int rc;
u8 err;
DPRINTK("ENTER\n");
@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
/* issue bus reset */
DPRINTK("about to softreset, devmask=%x\n", devmask);
- err_mask = scc_bus_softreset(ap, devmask, deadline);
- if (err_mask) {
- ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", err_mask);
+ rc = scc_bus_softreset(ap, devmask, deadline);
+ if (rc) {
+ ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", rc);
return -EIO;
}
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 138/142] ahci: Add Device IDs for Intel 9 Series PCH
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (136 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 137/142] pata_scc: propagate return value of scc_wait_after_reset Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 139/142] ahci: add pcid for Marvel 0x9182 controller Jiri Slaby
` (5 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, James Ralston, Tejun Heo, Jiri Slaby
From: James Ralston <james.d.ralston@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1b071a0947dbce5c184c12262e02540fbc493457 upstream.
This patch adds the AHCI mode SATA Device IDs for the Intel 9 Series PCH.
Signed-off-by: James Ralston <james.d.ralston@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/ahci.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index efa328bf6724..7edbd1e41164 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -304,6 +304,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
{ PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
{ PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
+ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
+ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */
{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 139/142] ahci: add pcid for Marvel 0x9182 controller
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (137 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 138/142] ahci: Add Device IDs for Intel 9 Series PCH Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 140/142] ibmveth: Fix endian issues with rx_no_buffer statistic Jiri Slaby
` (4 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Murali Karicheri, Tejun Heo, Santosh Shilimkar,
Jiri Slaby
From: Murali Karicheri <m-karicheri2@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c5edfff9db6f4d2c35c802acb4abe0df178becee upstream.
Keystone K2E EVM uses Marvel 0x9182 controller. This requires support
for the ID in the ahci driver.
Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/ahci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 7edbd1e41164..a875de67fb7c 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -449,6 +449,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 140/142] ibmveth: Fix endian issues with rx_no_buffer statistic
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (138 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 139/142] ahci: add pcid for Marvel 0x9182 controller Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 141/142] aio: add missing smp_rmb() in read_events_ring Jiri Slaby
` (3 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Anton Blanchard, David S. Miller, Jiri Slaby
From: Anton Blanchard <anton@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.
Hidden away in the last 8 bytes of the buffer_list page is a solitary
statistic. It needs to be byte swapped or else ethtool -S will
produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a
comment explaining what is going on.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 6c0fd8e0f9bf..895b086ec261 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -293,6 +293,18 @@ failure:
atomic_add(buffers_added, &(pool->available));
}
+/*
+ * The final 8 bytes of the buffer list is a counter of frames dropped
+ * because there was not a buffer in the buffer list capable of holding
+ * the frame.
+ */
+static void ibmveth_update_rx_no_buffer(struct ibmveth_adapter *adapter)
+{
+ __be64 *p = adapter->buffer_list_addr + 4096 - 8;
+
+ adapter->rx_no_buffer = be64_to_cpup(p);
+}
+
/* replenish routine */
static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
{
@@ -308,8 +320,7 @@ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
ibmveth_replenish_buffer_pool(adapter, pool);
}
- adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);
}
/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -699,8 +710,7 @@ static int ibmveth_close(struct net_device *netdev)
free_irq(netdev->irq, netdev);
- adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);
ibmveth_cleanup(adapter);
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 141/142] aio: add missing smp_rmb() in read_events_ring
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (139 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 140/142] ibmveth: Fix endian issues with rx_no_buffer statistic Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 9:45 ` [PATCH 3.12 142/142] arm64: flush TLS registers during exec Jiri Slaby
` (2 subsequent siblings)
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jeff Moyer, Benjamin LaHaise, Jiri Slaby
From: Jeff Moyer <jmoyer@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2ff396be602f10b5eab8e73b24f20348fa2de159 upstream.
We ran into a case on ppc64 running mariadb where io_getevents would
return zeroed out I/O events. After adding instrumentation, it became
clear that there was some missing synchronization between reading the
tail pointer and the events themselves. This small patch fixes the
problem in testing.
Thanks to Zach for helping to look into this, and suggesting the fix.
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/aio.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/aio.c b/fs/aio.c
index 6d68e01dc7ca..b732a9c32042 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1065,6 +1065,12 @@ static long aio_read_events_ring(struct kioctx *ctx,
tail = ring->tail;
kunmap_atomic(ring);
+ /*
+ * Ensure that once we've read the current tail pointer, that
+ * we also see the events that were stored up to the tail.
+ */
+ smp_rmb();
+
pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events);
if (head == tail)
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* [PATCH 3.12 142/142] arm64: flush TLS registers during exec
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (140 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 141/142] aio: add missing smp_rmb() in read_events_ring Jiri Slaby
@ 2014-09-26 9:45 ` Jiri Slaby
2014-09-26 15:45 ` [PATCH 3.12 000/142] 3.12.29-stable review Guenter Roeck
2014-09-29 16:52 ` Shuah Khan
143 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-09-26 9:45 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Will Deacon, Jiri Slaby
From: Will Deacon <will.deacon@arm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream.
Nathan reports that we leak TLS information from the parent context
during an exec, as we don't clear the TLS registers when flushing the
thread state.
This patch updates the flushing code so that we:
(1) Unconditionally zero the tpidr_el0 register (since this is fully
context switched for native tasks and zeroed for compat tasks)
(2) Zero the tp_value state in thread_info before clearing the
tpidrr0_el0 register for compat tasks (since this is only writable
by the set_tls compat syscall and therefore not fully switched).
A missing compiler barrier is also added to the compat set_tls syscall.
Acked-by: Nathan Lynch <Nathan_Lynch@mentor.com>
Reported-by: Nathan Lynch <Nathan_Lynch@mentor.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm64/kernel/process.c | 18 ++++++++++++++++++
arch/arm64/kernel/sys_compat.c | 6 ++++++
2 files changed, 24 insertions(+)
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 7ae8a1f00c3c..7af6183daa2e 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -183,9 +183,27 @@ void exit_thread(void)
{
}
+static void tls_thread_flush(void)
+{
+ asm ("msr tpidr_el0, xzr");
+
+ if (is_compat_task()) {
+ current->thread.tp_value = 0;
+
+ /*
+ * We need to ensure ordering between the shadow state and the
+ * hardware state, so that we don't corrupt the hardware state
+ * with a stale shadow state during context switch.
+ */
+ barrier();
+ asm ("msr tpidrro_el0, xzr");
+ }
+}
+
void flush_thread(void)
{
fpsimd_flush_thread();
+ tls_thread_flush();
flush_ptrace_hw_breakpoint(current);
}
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 26e9c4eeaba8..78039927c807 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *regs)
case __ARM_NR_compat_set_tls:
current->thread.tp_value = regs->regs[0];
+
+ /*
+ * Protect against register corruption from context switch.
+ * See comment in tls_thread_flush.
+ */
+ barrier();
asm ("msr tpidrro_el0, %0" : : "r" (regs->regs[0]));
return 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 150+ messages in thread* Re: [PATCH 3.12 000/142] 3.12.29-stable review
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (141 preceding siblings ...)
2014-09-26 9:45 ` [PATCH 3.12 142/142] arm64: flush TLS registers during exec Jiri Slaby
@ 2014-09-26 15:45 ` Guenter Roeck
2014-09-27 21:54 ` Satoru Takeuchi
2014-09-29 16:52 ` Shuah Khan
143 siblings, 1 reply; 150+ messages in thread
From: Guenter Roeck @ 2014-09-26 15:45 UTC (permalink / raw)
To: Jiri Slaby; +Cc: stable, satoru.takeuchi, shuah.kh, linux-kernel
On Fri, Sep 26, 2014 at 11:45:33AM +0200, Jiri Slaby wrote:
> This is the start of the stable review cycle for the 3.12.29 release.
> There are 142 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Sep 30 11:45:24 CEST 2014.
> Anything received after that time might be too late.
>
Hi Jiri,
Build results:
total: 135 pass: 135 fail: 0
Qemu test results:
total: 21 pass: 21 fail: 0
Both obviously look good, however my tree doesn't match your review request.
It includes 245 patches instead of just 142.
Looks like your tree is a bit ahead of time, so I guess that is ok.
Is there a way for me to avoid this when pulling in your pending changes ?
So far I pull the changes from the stable-3.12-queue branch in your
repository at kernel.org.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 150+ messages in thread* Re: [PATCH 3.12 000/142] 3.12.29-stable review
2014-09-26 15:45 ` [PATCH 3.12 000/142] 3.12.29-stable review Guenter Roeck
@ 2014-09-27 21:54 ` Satoru Takeuchi
2014-10-01 7:54 ` Jiri Slaby
0 siblings, 1 reply; 150+ messages in thread
From: Satoru Takeuchi @ 2014-09-27 21:54 UTC (permalink / raw)
To: Guenter Roeck; +Cc: Jiri Slaby, stable, satoru.takeuchi, shuah.kh, linux-kernel
At Fri, 26 Sep 2014 08:45:36 -0700,
Guenter Roeck wrote:
>
> On Fri, Sep 26, 2014 at 11:45:33AM +0200, Jiri Slaby wrote:
> > This is the start of the stable review cycle for the 3.12.29 release.
> > There are 142 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Tue Sep 30 11:45:24 CEST 2014.
> > Anything received after that time might be too late.
> >
>
> Hi Jiri,
>
> Build results:
> total: 135 pass: 135 fail: 0
>
> Qemu test results:
> total: 21 pass: 21 fail: 0
>
> Both obviously look good, however my tree doesn't match your review request.
> It includes 245 patches instead of just 142.
>
> Looks like your tree is a bit ahead of time, so I guess that is ok.
> Is there a way for me to avoid this when pulling in your pending changes ?
> So far I pull the changes from the stable-3.12-queue branch in your
> repository at kernel.org.
>
> Thanks,
> Guenter
Plus, this kernel passed my test.
- Test Cases:
- Build this kernel.
- Boot this kernel.
- Build the latest mainline kernel with this kernel.
- Test Tool:
https://github.com/satoru-takeuchi/test-linux-stable
- Test Result (kernel .config, ktest config and test log):
http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
- Build Environment:
- OS: Debian Jessy x86_64
- CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
- memory: 8GB
- Test Target Environment:
- Debian Jessy x86_64 (KVM guest on the Build Environment)
- # of vCPU: 2
- memory: 2GB
Thanks,
Satoru
^ permalink raw reply [flat|nested] 150+ messages in thread
* Re: [PATCH 3.12 000/142] 3.12.29-stable review
2014-09-27 21:54 ` Satoru Takeuchi
@ 2014-10-01 7:54 ` Jiri Slaby
0 siblings, 0 replies; 150+ messages in thread
From: Jiri Slaby @ 2014-10-01 7:54 UTC (permalink / raw)
To: Satoru Takeuchi, Guenter Roeck; +Cc: stable, shuah.kh, linux-kernel
On 09/27/2014, 11:54 PM, Satoru Takeuchi wrote:
> At Fri, 26 Sep 2014 08:45:36 -0700,
> Guenter Roeck wrote:
>>
>> On Fri, Sep 26, 2014 at 11:45:33AM +0200, Jiri Slaby wrote:
>>> This is the start of the stable review cycle for the 3.12.29 release.
>>> There are 142 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Tue Sep 30 11:45:24 CEST 2014.
>>> Anything received after that time might be too late.
>>>
>>
>> Hi Jiri,
>>
>> Build results:
>> total: 135 pass: 135 fail: 0
>>
>> Qemu test results:
>> total: 21 pass: 21 fail: 0
>
> Plus, this kernel passed my test.
On 09/29/2014, 06:52 PM, Shuah Khan wrote:
> Compiled and booted on my test system. No dmesg regressions.
Hi, and thanks to all of you.
>> Both obviously look good, however my tree doesn't match your review
request.
>> It includes 245 patches instead of just 142.
It is because I went wild and already uploaded 3.12.30-rc1 (aka
performance release).
>> Looks like your tree is a bit ahead of time, so I guess that is ok.
>> Is there a way for me to avoid this when pulling in your pending
changes ?
>> So far I pull the changes from the stable-3.12-queue branch in your
>> repository at kernel.org.
Yeah, it is fine. You will receive a 30-rc1 message in a minute. (And if
you tested the stable-queue already, no need to retest :).)
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 150+ messages in thread
* Re: [PATCH 3.12 000/142] 3.12.29-stable review
2014-09-26 9:45 [PATCH 3.12 000/142] 3.12.29-stable review Jiri Slaby
` (142 preceding siblings ...)
2014-09-26 15:45 ` [PATCH 3.12 000/142] 3.12.29-stable review Guenter Roeck
@ 2014-09-29 16:52 ` Shuah Khan
143 siblings, 0 replies; 150+ messages in thread
From: Shuah Khan @ 2014-09-29 16:52 UTC (permalink / raw)
To: Jiri Slaby, stable
Cc: linux, satoru.takeuchi, shuah.kh, linux-kernel, Shuah Khan
On 09/26/2014 03:45 AM, Jiri Slaby wrote:
> This is the start of the stable review cycle for the 3.12.29 release.
> There are 142 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Sep 30 11:45:24 CEST 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.29-rc1.xz
> and the diffstat can be found below.
>
> thanks,
> js
>
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 150+ messages in thread