* [PATCH 3.12 001/182] dlm: Avoid that dlm_release_lockspace() incorrectly returns -EBUSY
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 002/182] ALSA: hda - automute via amp instead of pinctl on some AIO models Jiri Slaby
` (182 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Bart Van Assche, David Teigland, Jiri Slaby
From: Bart Van Assche <bvanassche@acm.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a97f4a66d8ee4faf0f31cc4ad3f4aa0baef23fc7 upstream.
When dlm_release_lockspace(ls, 1) is invoked on a busy system
immediately after the last dlm_unlock() AST has finished it can occur
that lkb_idr_is_local() is invoked for the unlocked LKB since removal
from ls_lkbidr only occurs after the AST has returned. If that happens
dlm_release_lockspace(ls, 1) will return -EBUSY instead of releasing
the lockspace. Fix this race condition by changing lkb_idr_is_local()
such that it only returns true for LKB's that have not yet been
unlocked.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/dlm/lockspace.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 88556dc0458e..d5abafd56a6d 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -706,9 +706,7 @@ static int lkb_idr_is_local(int id, void *p, void *data)
{
struct dlm_lkb *lkb = p;
- if (!lkb->lkb_nodeid)
- return 1;
- return 0;
+ return lkb->lkb_nodeid == 0 && lkb->lkb_grmode != DLM_LOCK_IV;
}
static int lkb_idr_is_any(int id, void *p, void *data)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 002/182] ALSA: hda - automute via amp instead of pinctl on some AIO models
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 001/182] dlm: Avoid that dlm_release_lockspace() incorrectly returns -EBUSY Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 003/182] iser-target: Match FRMR descriptors to available session tags Jiri Slaby
` (181 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hui Wang, David Henningsson, Takashi Iwai,
Jiri Slaby
From: Hui Wang <hui.wang@canonical.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 493a52a9b6645f61954580c7d4bd52fa62110934 upstream.
On some AIO (All In One) models with the codec alc668
(Vendor ID: 0x10ec0668) on it, when we plug a headphone into the jack,
the system will switch the output to headphone and set the speaker to
automute as well as change the speaker Pin-ctls from 0x40 to 0x00,
this will bring loud noise to the headphone.
I tried to disable the corresponding EAPD, but it did not help to
eliminate the noise.
According to Takashi's suggestion, we use amp operation to replace the
pinctl modification for the automute, this really eliminate the noise.
BugLink: https://bugs.launchpad.net/bugs/1268468
Cc: David Henningsson <david.henningsson@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 6a32c857f704..855074950e6c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3480,6 +3480,15 @@ static void alc_fixup_no_shutup(struct hda_codec *codec,
}
}
+static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ struct alc_spec *spec = codec->spec;
+ spec->gen.auto_mute_via_amp = 1;
+ }
+}
+
static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
@@ -4646,6 +4655,7 @@ enum {
ALC662_FIXUP_BASS_CHMAP,
ALC662_FIXUP_BASS_1A,
ALC662_FIXUP_BASS_1A_CHMAP,
+ ALC668_FIXUP_AUTO_MUTE,
};
static const struct hda_fixup alc662_fixups[] = {
@@ -4806,6 +4816,12 @@ static const struct hda_fixup alc662_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc_fixup_inv_dmic_0x12,
},
+ [ALC668_FIXUP_AUTO_MUTE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_auto_mute_via_amp,
+ .chained = true,
+ .chain_id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE
+ },
[ALC668_FIXUP_DELL_MIC_NO_PRESENCE] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -4851,11 +4867,11 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1028, 0x0623, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1028, 0x0624, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0623, "Dell", ALC668_FIXUP_AUTO_MUTE),
+ SND_PCI_QUIRK(0x1028, 0x0624, "Dell", ALC668_FIXUP_AUTO_MUTE),
SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 003/182] iser-target: Match FRMR descriptors to available session tags
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 001/182] dlm: Avoid that dlm_release_lockspace() incorrectly returns -EBUSY Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 002/182] ALSA: hda - automute via amp instead of pinctl on some AIO models Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 004/182] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err Jiri Slaby
` (180 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Nicholas Bellinger, Sagi Grimberg, Or Gerlitz,
Jiri Slaby
From: Nicholas Bellinger <nab@linux-iscsi.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f46d6a8a01d6bbd83a97140f30a72a89b038807b upstream.
This patch changes isert_conn_create_fastreg_pool() to follow
logic in iscsi_target_locate_portal() for determining how many
FRMR descriptors to allocate based upon the number of possible
per-session command slots that are available.
This addresses an OOPs in isert_reg_rdma() where due to the
use of ISCSI_DEF_XMIT_CMDS_MAX could end up returning a bogus
fast_reg_descriptor when the number of active tags exceeded
the original hardcoded max.
Note this also includes moving isert_conn_create_fastreg_pool()
from isert_connect_request() to isert_put_login_tx() before
posting the final Login Response PDU in order to determine the
se_nacl->queue_depth (eg: number of tags) per session the target
will be enforcing.
v2 changes:
- Move isert_conn->conn_fr_pool list_head init into
isert_conn_request()
v3 changes:
- Drop unnecessary list_empty() check in isert_reg_rdma()
(Sagi)
(Fix up v3.12.y context changes - nab)
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Cc: <stable@vger.kernel.org> #3.12+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/ulp/isert/ib_isert.c | 34 +++++++++++++++++++--------------
1 file changed, 20 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 09c71293ab4b..65f979979005 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -426,11 +426,18 @@ isert_conn_create_frwr_pool(struct isert_conn *isert_conn)
{
struct fast_reg_descriptor *fr_desc;
struct isert_device *device = isert_conn->conn_device;
- int i, ret;
+ struct se_session *se_sess = isert_conn->conn->sess->se_sess;
+ struct se_node_acl *se_nacl = se_sess->se_node_acl;
+ int i, ret, tag_num;
+ /*
+ * Setup the number of FRMRs based upon the number of tags
+ * available to session in iscsi_target_locate_portal().
+ */
+ tag_num = max_t(u32, ISCSIT_MIN_TAGS, se_nacl->queue_depth);
+ tag_num = (tag_num * 2) + ISCSIT_EXTRA_TAGS;
- INIT_LIST_HEAD(&isert_conn->conn_frwr_pool);
isert_conn->conn_frwr_pool_size = 0;
- for (i = 0; i < ISCSI_DEF_XMIT_CMDS_MAX; i++) {
+ for (i = 0; i < tag_num; i++) {
fr_desc = kzalloc(sizeof(*fr_desc), GFP_KERNEL);
if (!fr_desc) {
pr_err("Failed to allocate fast_reg descriptor\n");
@@ -502,6 +509,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
kref_get(&isert_conn->conn_kref);
mutex_init(&isert_conn->conn_mutex);
spin_lock_init(&isert_conn->conn_lock);
+ INIT_LIST_HEAD(&isert_conn->conn_frwr_pool);
cma_id->context = isert_conn;
isert_conn->conn_cm_id = cma_id;
@@ -559,14 +567,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
isert_conn->conn_pd = device->dev_pd;
isert_conn->conn_mr = device->dev_mr;
- if (device->use_frwr) {
- ret = isert_conn_create_frwr_pool(isert_conn);
- if (ret) {
- pr_err("Conn: %p failed to create frwr_pool\n", isert_conn);
- goto out_frwr;
- }
- }
-
ret = isert_conn_setup_qp(isert_conn, cma_id);
if (ret)
goto out_conn_dev;
@@ -580,9 +580,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
return 0;
out_conn_dev:
- if (device->use_frwr)
- isert_conn_free_frwr_pool(isert_conn);
-out_frwr:
isert_device_try_release(device);
out_rsp_dma_map:
ib_dma_unmap_single(ib_dev, isert_conn->login_rsp_dma,
@@ -930,6 +927,15 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
}
if (!login->login_failed) {
if (login->login_complete) {
+ if (isert_conn->conn_device->use_frwr) {
+ ret = isert_conn_create_frwr_pool(isert_conn);
+ if (ret) {
+ pr_err("Conn: %p failed to create"
+ " frwr_pool\n", isert_conn);
+ return ret;
+ }
+ }
+
ret = isert_alloc_rx_descriptors(isert_conn);
if (ret)
return ret;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 004/182] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (2 preceding siblings ...)
2014-05-13 9:25 ` [PATCH 3.12 003/182] iser-target: Match FRMR descriptors to available session tags Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 005/182] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts Jiri Slaby
` (179 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Nicholas Bellinger, Or Gerlitz, Jiri Slaby
From: Nicholas Bellinger <nab@linux-iscsi.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 03e7848a64ed535a30f5d7fc6dede2d5a6a2534b upstream.
This patch fixes a bug where outstanding RDMA_READs with WRITE_PENDING
status require an extra target_put_sess_cmd() in isert_put_cmd() code
when called from isert_cq_tx_comp_err() + isert_cq_drain_comp_llist()
context during session shutdown.
The extra kref PUT is required so that transport_generic_free_cmd()
invokes the last target_put_sess_cmd() -> target_release_cmd_kref(),
which will complete(&se_cmd->cmd_wait_comp) the outstanding se_cmd
descriptor with WRITE_PENDING status, and awake the completion in
target_wait_for_sess_cmds() to invoke TFO->release_cmd().
The bug was manifesting itself in target_wait_for_sess_cmds() where
a se_cmd descriptor with WRITE_PENDING status would end up sleeping
indefinately.
(Fix up v3.12.y context changes - nab)
Acked-by: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Cc: <stable@vger.kernel.org> #3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/ulp/isert/ib_isert.c | 31 ++++++++++++++++++++++---------
1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 65f979979005..02e4d2efa208 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1420,7 +1420,7 @@ isert_unreg_rdma_frwr(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn
}
static void
-isert_put_cmd(struct isert_cmd *isert_cmd)
+isert_put_cmd(struct isert_cmd *isert_cmd, bool comp_err)
{
struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
struct isert_conn *isert_conn = isert_cmd->conn;
@@ -1436,8 +1436,21 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
list_del_init(&cmd->i_conn_node);
spin_unlock_bh(&conn->cmd_lock);
- if (cmd->data_direction == DMA_TO_DEVICE)
+ if (cmd->data_direction == DMA_TO_DEVICE) {
iscsit_stop_dataout_timer(cmd);
+ /*
+ * Check for special case during comp_err where
+ * WRITE_PENDING has been handed off from core,
+ * but requires an extra target_put_sess_cmd()
+ * before transport_generic_free_cmd() below.
+ */
+ if (comp_err &&
+ cmd->se_cmd.t_state == TRANSPORT_WRITE_PENDING) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ target_put_sess_cmd(se_cmd->se_sess, se_cmd);
+ }
+ }
device->unreg_rdma_mem(isert_cmd, isert_conn);
transport_generic_free_cmd(&cmd->se_cmd, 0);
@@ -1492,7 +1505,7 @@ isert_unmap_tx_desc(struct iser_tx_desc *tx_desc, struct ib_device *ib_dev)
static void
isert_completion_put(struct iser_tx_desc *tx_desc, struct isert_cmd *isert_cmd,
- struct ib_device *ib_dev)
+ struct ib_device *ib_dev, bool comp_err)
{
if (isert_cmd->pdu_buf_dma != 0) {
pr_debug("Calling ib_dma_unmap_single for isert_cmd->pdu_buf_dma\n");
@@ -1502,7 +1515,7 @@ isert_completion_put(struct iser_tx_desc *tx_desc, struct isert_cmd *isert_cmd,
}
isert_unmap_tx_desc(tx_desc, ib_dev);
- isert_put_cmd(isert_cmd);
+ isert_put_cmd(isert_cmd, comp_err);
}
static void
@@ -1546,14 +1559,14 @@ isert_do_control_comp(struct work_struct *work)
iscsit_tmr_post_handler(cmd, cmd->conn);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
case ISTATE_SEND_REJECT:
pr_debug("Got isert_do_control_comp ISTATE_SEND_REJECT: >>>\n");
atomic_dec(&isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
case ISTATE_SEND_LOGOUTRSP:
pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
@@ -1567,7 +1580,7 @@ isert_do_control_comp(struct work_struct *work)
case ISTATE_SEND_TEXTRSP:
atomic_dec(&isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
default:
pr_err("Unknown do_control_comp i_state %d\n", cmd->i_state);
@@ -1598,7 +1611,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(tx_desc, isert_cmd, ib_dev, false);
}
static void
@@ -1652,7 +1665,7 @@ isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn
if (!isert_cmd)
isert_unmap_tx_desc(tx_desc, ib_dev);
else
- isert_completion_put(tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(tx_desc, isert_cmd, ib_dev, true);
}
static void
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 005/182] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (3 preceding siblings ...)
2014-05-13 9:25 ` [PATCH 3.12 004/182] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 006/182] arm64: Do not synchronise I and D caches for special ptes Jiri Slaby
` (178 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, K. Y. Srinivasan, Jiri Slaby
From: "K. Y. Srinivasan" <kys@microsoft.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 03367ef5ea811475187a0732aada068919e14d61 upstream.
Only ws2012r2 hosts support the ability to reconnect to the host on VMBUS.
This functionality is needed by kexec in Linux. To use this functionality
we need to negotiate version 3.0 of the VMBUS protocol.
This patch has been backported to apply against the 3.12 stable tree.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: <stable@vger.kernel.org> [3.9+]
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/hv/connection.c | 6 ++++++
include/linux/hyperv.h | 7 +++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 13c23a4789de..b2ee81e19b59 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -55,6 +55,9 @@ static __u32 vmbus_get_next_version(__u32 current_version)
case (VERSION_WIN8):
return VERSION_WIN7;
+ case (VERSION_WIN8_1):
+ return VERSION_WIN8;
+
case (VERSION_WS2008):
default:
return VERSION_INVAL;
@@ -80,6 +83,9 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
(void *)((unsigned long)vmbus_connection.monitor_pages +
PAGE_SIZE));
+ if (version == VERSION_WIN8_1)
+ msg->target_vcpu = hv_context.vp_index[smp_processor_id()];
+
/*
* Add to list before we send the request since we may
* receive the response before returning from this routine
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index d98503bde7e9..b6043a0c629f 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -473,15 +473,18 @@ hv_get_ringbuffer_availbytes(struct hv_ring_buffer_info *rbi,
* 0 . 13 (Windows Server 2008)
* 1 . 1 (Windows 7)
* 2 . 4 (Windows 8)
+ * 3 . 0 (Windows 8 R2)
*/
#define VERSION_WS2008 ((0 << 16) | (13))
#define VERSION_WIN7 ((1 << 16) | (1))
#define VERSION_WIN8 ((2 << 16) | (4))
+#define VERSION_WIN8_1 ((3 << 16) | (0))
+
#define VERSION_INVAL -1
-#define VERSION_CURRENT VERSION_WIN8
+#define VERSION_CURRENT VERSION_WIN8_1
/* Make maximum size of pipe payload of 16K */
#define MAX_PIPE_DATA_PAYLOAD (sizeof(u8) * 16384)
@@ -884,7 +887,7 @@ struct vmbus_channel_relid_released {
struct vmbus_channel_initiate_contact {
struct vmbus_channel_message_header header;
u32 vmbus_version_requested;
- u32 padding2;
+ u32 target_vcpu; /* The VCPU the host should respond to */
u64 interrupt_page;
u64 monitor_page1;
u64 monitor_page2;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 006/182] arm64: Do not synchronise I and D caches for special ptes
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (4 preceding siblings ...)
2014-05-13 9:25 ` [PATCH 3.12 005/182] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:25 ` [PATCH 3.12 007/182] arm64: Make DMA coherent and strongly ordered mappings not executable Jiri Slaby
` (177 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Catalin Marinas, Jiri Slaby
From: Catalin Marinas <catalin.marinas@arm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 71fdb6bf61bf0692f004f9daf5650392c0cfe300 upstream.
Special pte mappings are not intended to be executable and do not even
have an associated struct page. This patch ensures that we do not call
__sync_icache_dcache() on such ptes.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Steve Capper <Steve.Capper@arm.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Tested-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm64/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 82d95a7e9466..62713586d6e3 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -168,7 +168,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
pte_t *ptep, pte_t pte)
{
if (pte_valid_user(pte)) {
- if (pte_exec(pte))
+ if (!pte_special(pte) && pte_exec(pte))
__sync_icache_dcache(pte, addr);
if (!pte_dirty(pte))
pte = pte_wrprotect(pte);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 007/182] arm64: Make DMA coherent and strongly ordered mappings not executable
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (5 preceding siblings ...)
2014-05-13 9:25 ` [PATCH 3.12 006/182] arm64: Do not synchronise I and D caches for special ptes Jiri Slaby
@ 2014-05-13 9:25 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 008/182] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols Jiri Slaby
` (176 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:25 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Catalin Marinas, Jiri Slaby
From: Catalin Marinas <catalin.marinas@arm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit de2db7432917a82b62d55bb59635586eeca6d1bd upstream.
pgprot_{dmacoherent,writecombine,noncached} don't need to generate
executable mappings with side-effects like __sync_icache_dcache() being
called when the mapping is in user space.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Tested-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm64/include/asm/pgtable.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 62713586d6e3..05fe332c1061 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -253,11 +253,11 @@ static inline int has_transparent_hugepage(void)
* Mark the prot value as uncacheable and unbufferable.
*/
#define pgprot_noncached(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE) | PTE_PXN | PTE_UXN)
#define pgprot_writecombine(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
#define pgprot_dmacoherent(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
#define __HAVE_PHYS_MEM_ACCESS_PROT
struct file;
extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 008/182] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (6 preceding siblings ...)
2014-05-13 9:25 ` [PATCH 3.12 007/182] arm64: Make DMA coherent and strongly ordered mappings not executable Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 009/182] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE Jiri Slaby
` (175 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Brian Austin, Mark Brown, Jiri Slaby
From: Brian Austin <brian.austin@cirrus.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7272e051157ccd5871b5d939548d0ba5a94a2965 upstream.
The shift values for the ADC,PCM, and Analog kcontrols were wrong causing wrong values for the SOC_DOUBLE_R_SX_TLV macros
Fixed the TLV for aout_tlv to show -102dB correctly
Fixes: 1d99f2436d (ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV)
Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/cs42l51.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
index 1e0fa3b5f79a..e1dfebbea650 100644
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -124,9 +124,8 @@ static int cs42l51_set_chan_mix(struct snd_kcontrol *kcontrol,
static const DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -5150, 50, 0);
static const DECLARE_TLV_DB_SCALE(tone_tlv, -1050, 150, 0);
-/* This is a lie. after -102 db, it stays at -102 */
-/* maybe a range would be better */
-static const DECLARE_TLV_DB_SCALE(aout_tlv, -11550, 50, 0);
+
+static const DECLARE_TLV_DB_SCALE(aout_tlv, -10200, 50, 0);
static const DECLARE_TLV_DB_SCALE(boost_tlv, 1600, 1600, 0);
static const char *chan_mix[] = {
@@ -141,7 +140,7 @@ static const struct soc_enum cs42l51_chan_mix =
static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
SOC_DOUBLE_R_SX_TLV("PCM Playback Volume",
CS42L51_PCMA_VOL, CS42L51_PCMB_VOL,
- 6, 0x19, 0x7F, adc_pcm_tlv),
+ 0, 0x19, 0x7F, adc_pcm_tlv),
SOC_DOUBLE_R("PCM Playback Switch",
CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, 7, 1, 1),
SOC_DOUBLE_R_SX_TLV("Analog Playback Volume",
@@ -149,7 +148,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
0, 0x34, 0xE4, aout_tlv),
SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
CS42L51_ADCA_VOL, CS42L51_ADCB_VOL,
- 6, 0x19, 0x7F, adc_pcm_tlv),
+ 0, 0x19, 0x7F, adc_pcm_tlv),
SOC_DOUBLE_R("ADC Mixer Switch",
CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, 7, 1, 1),
SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0),
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 009/182] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (7 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 008/182] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 010/182] ASoC: cs42l73: " Jiri Slaby
` (174 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Brian Austin, Mark Brown, Jiri Slaby
From: Brian Austin <brian.austin@cirrus.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d31a33dd7792c7d6c11fda226a3b9e4fb7f86f95 upstream.
The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the PCM/ADC Swap controls
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/cs42l52.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index be2ba1b6fe4a..ab3ac7b1fce2 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -352,7 +352,7 @@ static const char * const right_swap_text[] = {
static const unsigned int swap_values[] = { 0, 1, 3 };
static const struct soc_enum adca_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 3,
ARRAY_SIZE(left_swap_text),
left_swap_text,
swap_values);
@@ -361,7 +361,7 @@ static const struct snd_kcontrol_new adca_mixer =
SOC_DAPM_ENUM("Route", adca_swap_enum);
static const struct soc_enum pcma_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 3,
ARRAY_SIZE(left_swap_text),
left_swap_text,
swap_values);
@@ -370,7 +370,7 @@ static const struct snd_kcontrol_new pcma_mixer =
SOC_DAPM_ENUM("Route", pcma_swap_enum);
static const struct soc_enum adcb_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 3,
ARRAY_SIZE(right_swap_text),
right_swap_text,
swap_values);
@@ -379,7 +379,7 @@ static const struct snd_kcontrol_new adcb_mixer =
SOC_DAPM_ENUM("Route", adcb_swap_enum);
static const struct soc_enum pcmb_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 3,
ARRAY_SIZE(right_swap_text),
right_swap_text,
swap_values);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 010/182] ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (8 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 009/182] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 011/182] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts Jiri Slaby
` (173 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Brian Austin, Mark Brown, Jiri Slaby
From: Brian Austin <brian.austin@cirrus.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1555b652970e541fa1cb80c61ffc696bbfb92bb7 upstream.
The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the mono mix controls.
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/codecs/cs42l73.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index 3b20c86cdb01..eade6e2d883d 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -325,7 +325,7 @@ static const char * const cs42l73_mono_mix_texts[] = {
static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 };
static const struct soc_enum spk_asp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
@@ -343,7 +343,7 @@ static const struct snd_kcontrol_new spk_xsp_mixer =
SOC_DAPM_ENUM("Route", spk_xsp_enum);
static const struct soc_enum esl_asp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
@@ -352,7 +352,7 @@ static const struct snd_kcontrol_new esl_asp_mixer =
SOC_DAPM_ENUM("Route", esl_asp_enum);
static const struct soc_enum esl_xsp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 011/182] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (9 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 010/182] ASoC: cs42l73: " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 012/182] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM Jiri Slaby
` (172 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Stefan Sørensen, Tony Lindgren, Jiri Slaby
From: Stefan Sørensen <stefan.sorensen@spectralink.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 698b48532539484b012fb7c4176b959d32a17d00 upstream.
When an interrupt has become active on the INTC it will stay active
until it is acked, even if masked or de-asserted. The
INTC_PENDING_IRQn registers are however updated and since these are
used by omap_intc_handle_irq to determine which interrupt to handle,
it will never see the active interrupt. This will result in a storm of
useless interrupts that is only stopped when another higher priority
interrupt is asserted.
Fix by sending the INTC an acknowledge if we find no interrupts to
handle.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/mach-omap2/irq.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
index e022a869bff2..6037a9a01ed5 100644
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -222,6 +222,7 @@ void __init ti81xx_init_irq(void)
static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs *regs)
{
u32 irqnr;
+ int handled_irq = 0;
do {
irqnr = readl_relaxed(base_addr + 0x98);
@@ -249,8 +250,15 @@ out:
if (irqnr) {
irqnr = irq_find_mapping(domain, irqnr);
handle_IRQ(irqnr, regs);
+ handled_irq = 1;
}
} while (irqnr);
+
+ /* If an irq is masked or deasserted while active, we will
+ * keep ending up here with no irq handled. So remove it from
+ * the INTC with an ack.*/
+ if (!handled_irq)
+ omap_ack_irq(NULL);
}
asmlinkage void __exception_irq_entry omap2_intc_handle_irq(struct pt_regs *regs)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 012/182] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (10 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 011/182] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 013/182] ARM: OMAP3: hwmod data: Correct clock domains for USB modules Jiri Slaby
` (171 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Nishanth Menon, Tony Lindgren, Jiri Slaby
From: Nishanth Menon <nm@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 07484ca33ef83900f5cfbde075c1a19e5a237aa1 upstream.
Just like IS_PM34XX_ERRATUM, IS_PM44XX_ERRATUM is valid only if
CONFIG_PM is enabled, else, disabling CONFIG_PM results in build
failure complaining about the following:
arch/arm/mach-omap2/built-in.o: In function `omap4_boot_secondary':
:(.text+0x8a70): undefined reference to `pm44xx_errata'
Fixes: c962184 (ARM: OMAP4: PM: add errata support)
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.ocm>
Acked-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/mach-omap2/pm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index 7bdd22afce69..d4d0fce325c7 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -103,7 +103,7 @@ static inline void enable_omap3630_toggle_l2_on_restore(void) { }
#define PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD (1 << 0)
-#if defined(CONFIG_ARCH_OMAP4)
+#if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP4)
extern u16 pm44xx_errata;
#define IS_PM44XX_ERRATUM(id) (pm44xx_errata & (id))
#else
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 013/182] ARM: OMAP3: hwmod data: Correct clock domains for USB modules
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (11 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 012/182] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 014/182] ARM: dts: am33xx: correcting dt node unit address for usb Jiri Slaby
` (170 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Roger Quadros, Paul Walmsley, Keshava Munegowda,
Partha Basak, Jiri Slaby
From: Roger Quadros <rogerq@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c6c56697ae4bf1226263c19e8353343d7083f40e upstream.
OMAP3 doesn't contain "l3_init_clkdm" clock domain. Use the
proper clock domains for USB Host and USB TLL modules.
Gets rid of the following warnings during boot
omap_hwmod: usb_host_hs: could not associate to clkdm l3_init_clkdm
omap_hwmod: usb_tll_hs: could not associate to clkdm l3_init_clkdm
Reported-by: Nishanth Menon <nm@ti.com>
Cc: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Fixes: de231388cb80a8ef3e779bbfa0564ba0157b7377 ("ARM: OMAP: USB: EHCI and OHCI hwmod structures for OMAP3")
Cc: Keshava Munegowda <keshava_mgowda@ti.com>
Cc: Partha Basak <parthab@india.ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 60f23440082e..857e76c38a15 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1968,7 +1968,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_host_hs_irqs[] = {
static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = {
.name = "usb_host_hs",
.class = &omap3xxx_usb_host_hs_hwmod_class,
- .clkdm_name = "l3_init_clkdm",
+ .clkdm_name = "usbhost_clkdm",
.mpu_irqs = omap3xxx_usb_host_hs_irqs,
.main_clk = "usbhost_48m_fck",
.prcm = {
@@ -2053,7 +2053,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_tll_hs_irqs[] = {
static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = {
.name = "usb_tll_hs",
.class = &omap3xxx_usb_tll_hs_hwmod_class,
- .clkdm_name = "l3_init_clkdm",
+ .clkdm_name = "core_l4_clkdm",
.mpu_irqs = omap3xxx_usb_tll_hs_irqs,
.main_clk = "usbtll_fck",
.prcm = {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 014/182] ARM: dts: am33xx: correcting dt node unit address for usb
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (12 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 013/182] ARM: OMAP3: hwmod data: Correct clock domains for USB modules Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 015/182] ARM: dts: Keep G3D regulator always on for exynos5250-arndale Jiri Slaby
` (169 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mugunthan V N, Tony Lindgren, Jiri Slaby
From: Mugunthan V N <mugunthanvnm@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8abcdd680d543fb582371e146e62ba9f2af8a816 upstream.
DT node's unit address should be its own register offset address to make it a
unique across the system. This patch corrects the incorrect USB entries with
correct register offset for unit address.
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/boot/dts/am33xx.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index f9c5da9c7fe1..e9b6775299d0 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -346,7 +346,7 @@
ti,hwmods = "usb_otg_hs";
status = "disabled";
- ctrl_mod: control@44e10000 {
+ ctrl_mod: control@44e10620 {
compatible = "ti,am335x-usb-ctrl-module";
reg = <0x44e10620 0x10
0x44e10648 0x4>;
@@ -449,7 +449,7 @@
"tx14", "tx15";
};
- cppi41dma: dma-controller@07402000 {
+ cppi41dma: dma-controller@47402000 {
compatible = "ti,am3359-cppi41";
reg = <0x47400000 0x1000
0x47402000 0x1000
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 015/182] ARM: dts: Keep G3D regulator always on for exynos5250-arndale
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (13 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 014/182] ARM: dts: am33xx: correcting dt node unit address for usb Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 016/182] ARM: 7954/1: mm: remove remaining domain support from ARMv6 Jiri Slaby
` (168 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tomasz Figa, Kukjin Kim, Jiri Slaby
From: Tomasz Figa <t.figa@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bfeda827278f09f4db35877e5f1ca9c149ca2890 upstream.
Apparently, if G3D regulator is powered off, the SoC cannot enter low
power modes and just hangs. This patch fixes this by keeping the
regulator always on when the system is running, as suggested by Exynos 4
User's Manual in case of Exynos4210/4x12 SoCs (Exynos5250 UM does not
have such note, but observed behavior seems to confirm that it is true
for this SoC as well).
This fixes an issue preventing Arndale board from entering sleep mode
observed since commit
346f372f7b72a0 clk: exynos5250: Add CLK_IGNORE_UNUSED flag for pmu clock
that landed in kernel 3.10, which has fixed the clock driver to make the
SoC actually try to enter the sleep mode.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Acked-by: Kyungmin Park <kyungmin.park@samsung.com>
Tested-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/boot/dts/exynos5250-arndale.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
index cee55fa33731..47fa5aba20a1 100644
--- a/arch/arm/boot/dts/exynos5250-arndale.dts
+++ b/arch/arm/boot/dts/exynos5250-arndale.dts
@@ -286,6 +286,7 @@
regulator-name = "vdd_g3d";
regulator-min-microvolt = <1000000>;
regulator-max-microvolt = <1000000>;
+ regulator-always-on;
regulator-boot-on;
op_mode = <1>;
};
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 016/182] ARM: 7954/1: mm: remove remaining domain support from ARMv6
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (14 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 015/182] ARM: dts: Keep G3D regulator always on for exynos5250-arndale Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 017/182] ARM: Fix default CPU selection for ARCH_MULTI_V5 Jiri Slaby
` (167 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Will Deacon, Russell King, Jiri Slaby
From: Will Deacon <will.deacon@arm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b6ccb9803e90c16b212cf4ed62913a7591e79a39 upstream.
CPU_32v6 currently selects CPU_USE_DOMAINS if CPU_V6 and MMU. This is
because ARM 1136 r0pX CPUs lack the v6k extensions, and therefore do
not have hardware thread registers. The lack of these registers requires
the kernel to update the vectors page at each context switch in order to
write a new TLS pointer. This write must be done via the userspace
mapping, since aliasing caches can lead to expensive flushing when using
kmap. Finally, this requires the vectors page to be mapped r/w for
kernel and r/o for user, which has implications for things like put_user
which must trigger CoW appropriately when targetting user pages.
The upshot of all this is that a v6/v7 kernel makes use of domains to
segregate kernel and user memory accesses. This has the nasty
side-effect of making device mappings executable, which has been
observed to cause subtle bugs on recent cores (e.g. Cortex-A15
performing a speculative instruction fetch from the GIC and acking an
interrupt in the process).
This patch solves this problem by removing the remaining domain support
from ARMv6. A new memory type is added specifically for the vectors page
which allows that page (and only that page) to be mapped as user r/o,
kernel r/w. All other user r/o pages are mapped also as kernel r/o.
Patch co-developed with Russell King.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/include/asm/futex.h | 6 ------
arch/arm/include/asm/pgtable-2level.h | 1 +
arch/arm/mm/Kconfig | 3 +--
arch/arm/mm/mmu.c | 10 ++++++++++
arch/arm/mm/proc-macros.S | 19 ++++++-------------
arch/arm/mm/proc-v7-2level.S | 7 -------
6 files changed, 18 insertions(+), 28 deletions(-)
diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
index e42cf597f6e6..2aff798fbef4 100644
--- a/arch/arm/include/asm/futex.h
+++ b/arch/arm/include/asm/futex.h
@@ -3,11 +3,6 @@
#ifdef __KERNEL__
-#if defined(CONFIG_CPU_USE_DOMAINS) && defined(CONFIG_SMP)
-/* ARM doesn't provide unprivileged exclusive memory accessors */
-#include <asm-generic/futex.h>
-#else
-
#include <linux/futex.h>
#include <linux/uaccess.h>
#include <asm/errno.h>
@@ -164,6 +159,5 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
return ret;
}
-#endif /* !(CPU_USE_DOMAINS && SMP) */
#endif /* __KERNEL__ */
#endif /* _ASM_ARM_FUTEX_H */
diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
index f97ee02386ee..c98c9c89b95c 100644
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -140,6 +140,7 @@
#define L_PTE_MT_DEV_NONSHARED (_AT(pteval_t, 0x0c) << 2) /* 1100 */
#define L_PTE_MT_DEV_WC (_AT(pteval_t, 0x09) << 2) /* 1001 */
#define L_PTE_MT_DEV_CACHED (_AT(pteval_t, 0x0b) << 2) /* 1011 */
+#define L_PTE_MT_VECTORS (_AT(pteval_t, 0x0f) << 2) /* 1111 */
#define L_PTE_MT_MASK (_AT(pteval_t, 0x0f) << 2)
#ifndef __ASSEMBLY__
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index cd2c88e7a8f7..b3b1b883bd08 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -446,7 +446,6 @@ config CPU_32v5
config CPU_32v6
bool
- select CPU_USE_DOMAINS if CPU_V6 && MMU
select TLS_REG_EMUL if !CPU_32v6K && !MMU
config CPU_32v6K
@@ -671,7 +670,7 @@ config ARM_VIRT_EXT
config SWP_EMULATE
bool "Emulate SWP/SWPB instructions"
- depends on !CPU_USE_DOMAINS && CPU_V7
+ depends on CPU_V7
default y if SMP
select HAVE_PROC_CPU if PROC_FS
help
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 0222ba7603af..b7c987dbb604 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -464,6 +464,16 @@ static void __init build_mem_type_table(void)
s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
/*
+ * We don't use domains on ARMv6 (since this causes problems with
+ * v6/v7 kernels), so we must use a separate memory type for user
+ * r/o, kernel r/w to map the vectors page.
+ */
+#ifndef CONFIG_ARM_LPAE
+ if (cpu_arch == CPU_ARCH_ARMv6)
+ vecs_pgprot |= L_PTE_MT_VECTORS;
+#endif
+
+ /*
* ARMv6 and above have extended page tables.
*/
if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index e3c48a3fe063..ee1d80593958 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -112,13 +112,9 @@
* 100x 1 0 1 r/o no acc
* 10x0 1 0 1 r/o no acc
* 1011 0 0 1 r/w no acc
- * 110x 0 1 0 r/w r/o
- * 11x0 0 1 0 r/w r/o
- * 1111 0 1 1 r/w r/w
- *
- * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed:
* 110x 1 1 1 r/o r/o
* 11x0 1 1 1 r/o r/o
+ * 1111 0 1 1 r/w r/w
*/
.macro armv6_mt_table pfx
\pfx\()_mt_table:
@@ -137,7 +133,7 @@
.long PTE_EXT_TEX(2) @ L_PTE_MT_DEV_NONSHARED
.long 0x00 @ unused
.long 0x00 @ unused
- .long 0x00 @ unused
+ .long PTE_CACHEABLE | PTE_BUFFERABLE | PTE_EXT_APX @ L_PTE_MT_VECTORS
.endm
.macro armv6_set_pte_ext pfx
@@ -158,24 +154,21 @@
tst r1, #L_PTE_USER
orrne r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
- @ allow kernel read/write access to read-only user pages
tstne r3, #PTE_EXT_APX
- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
+
+ @ user read-only -> kernel read-only
+ bicne r3, r3, #PTE_EXT_AP0
tst r1, #L_PTE_XN
orrne r3, r3, #PTE_EXT_XN
- orr r3, r3, r2
+ eor r3, r3, r2
tst r1, #L_PTE_YOUNG
tstne r1, #L_PTE_PRESENT
moveq r3, #0
-#ifndef CONFIG_CPU_USE_DOMAINS
tstne r1, #L_PTE_NONE
movne r3, #0
-#endif
str r3, [r0]
mcr p15, 0, r0, c7, c10, 1 @ flush_pte
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index bdd3be4be77a..1f52915f2b28 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -90,21 +90,14 @@ ENTRY(cpu_v7_set_pte_ext)
tst r1, #L_PTE_USER
orrne r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
- @ allow kernel read/write access to read-only user pages
- tstne r3, #PTE_EXT_APX
- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
tst r1, #L_PTE_XN
orrne r3, r3, #PTE_EXT_XN
tst r1, #L_PTE_YOUNG
tstne r1, #L_PTE_VALID
-#ifndef CONFIG_CPU_USE_DOMAINS
eorne r1, r1, #L_PTE_NONE
tstne r1, #L_PTE_NONE
-#endif
moveq r3, #0
ARM( str r3, [r0, #2048]! )
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 017/182] ARM: Fix default CPU selection for ARCH_MULTI_V5
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (15 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 016/182] ARM: 7954/1: mm: remove remaining domain support from ARMv6 Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 018/182] ARM: 8007/1: Remove extraneous kcmp syscall ignore Jiri Slaby
` (166 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Andrew Lunn, Jason Cooper, Jiri Slaby
From: Andrew Lunn <andrew@lunn.ch>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 12567bbdee7ea553237085a2bbc0ffa5240f5248 upstream.
CPU_ARM926T should be selected if no other CPU is. Put the ! in the
right place so this works.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Fixes: 24e860fbfdb1c ("ARM: multiplatform: always pick one CPU type")
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 1ad6fb6c094d..e47fcd1e9645 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -892,7 +892,7 @@ config ARCH_MULTI_V5
bool "ARMv5 based platforms (ARM926T, XSCALE, PJ1, ...)"
depends on !ARCH_MULTI_V6_V7
select ARCH_MULTI_V4_V5
- select CPU_ARM926T if (!CPU_ARM946E || CPU_ARM1020 || \
+ select CPU_ARM926T if !(CPU_ARM946E || CPU_ARM1020 || \
CPU_ARM1020E || CPU_ARM1022 || CPU_ARM1026 || \
CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_FEROCEON)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 018/182] ARM: 8007/1: Remove extraneous kcmp syscall ignore
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (16 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 017/182] ARM: Fix default CPU selection for ARCH_MULTI_V5 Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 019/182] ARM: 8027/1: fix do_div() bug in big-endian systems Jiri Slaby
` (165 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Christopher Covington, Russell King, Jiri Slaby
From: Christopher Covington <cov@codeaurora.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 95c52fe063351192e0f4ffb70ef9bac1aa26f5a4 upstream.
The kcmp system call was ported to ARM in
commit 3f7d1fe108dbaefd0c57a41753fc2c90b395f458
"ARM: 7665/1: Wire up kcmp syscall".
Fixes: 3f7d1fe108db ("ARM: 7665/1: Wire up kcmp syscall")
Signed-off-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/include/asm/unistd.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 141baa3f9a72..cbd61977c996 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -48,6 +48,5 @@
*/
#define __IGNORE_fadvise64_64
#define __IGNORE_migrate_pages
-#define __IGNORE_kcmp
#endif /* __ASM_ARM_UNISTD_H */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 019/182] ARM: 8027/1: fix do_div() bug in big-endian systems
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (17 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 018/182] ARM: 8007/1: Remove extraneous kcmp syscall ignore Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 020/182] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo Jiri Slaby
` (164 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Xiangyu Lu, Alex Wu, Russell King, Jiri Slaby
From: Xiangyu Lu <luxiangyu@huawei.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 80bb3ef109ff40a7593d9481c17de9bbc4d7c0e2 upstream.
In big-endian systems, "%1" get the most significant part of the value, cause the instruction to get the wrong result.
When viewing ftrace record in big-endian ARM systems, we found that
the timestamp errors:
swapper-0 [001] 1325.970000: 0:120:R ==> [001] 16:120:R events/1
events/1-16 [001] 1325.970000: 16:120:S ==> [001] 0:120:R swapper
swapper-0 [000] 1325.1000000: 0:120:R + [000] 15:120:R events/0
swapper-0 [000] 1325.1000000: 0:120:R ==> [000] 15:120:R events/0
swapper-0 [000] 1326.030000: 0:120:R + [000] 1150:120:R sshd
swapper-0 [000] 1326.030000: 0:120:R ==> [000] 1150:120:R sshd
When viewed ftrace records, it will call the do_div(n, base) function, which achieved arch/arm/include/asm/div64.h in. When n = 10000000, base = 1000000, in do_div(n, base) will execute "umull %Q0, %R0, %1, %Q2".
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Alex Wu <wuquanming@huawei.com>
Signed-off-by: Xiangyu Lu <luxiangyu@huawei.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/include/asm/div64.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h
index 191ada6e4d2d..662c7bd06108 100644
--- a/arch/arm/include/asm/div64.h
+++ b/arch/arm/include/asm/div64.h
@@ -156,7 +156,7 @@
/* Select the best insn combination to perform the */ \
/* actual __m * __n / (__p << 64) operation. */ \
if (!__c) { \
- asm ( "umull %Q0, %R0, %1, %Q2\n\t" \
+ asm ( "umull %Q0, %R0, %Q1, %Q2\n\t" \
"mov %Q0, #0" \
: "=&r" (__res) \
: "r" (__m), "r" (__n) \
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 020/182] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (18 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 019/182] ARM: 8027/1: fix do_div() bug in big-endian systems Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 021/182] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP Jiri Slaby
` (163 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Liu Hua, Russell King, Jiri Slaby
From: Liu Hua <sdu.liu@huawei.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 56b700fd6f1e49149880fb1b6ffee0dca5be45fb upstream.
For vmcore generated by LPAE enabled kernel, user space
utility such as crash needs additional infomation to
parse.
So this patch add arch_crash_save_vmcoreinfo as what PAE enabled
i386 linux does.
Reviewed-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Liu Hua <sdu.liu@huawei.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/kernel/machine_kexec.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 57221e349a7c..faa3d4c41ece 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -181,3 +181,10 @@ void machine_kexec(struct kimage *image)
soft_restart(reboot_code_buffer_phys);
}
+
+void arch_crash_save_vmcoreinfo(void)
+{
+#ifdef CONFIG_ARM_LPAE
+ VMCOREINFO_CONFIG(ARM_LPAE);
+#endif
+}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 021/182] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (19 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 020/182] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 022/182] ALSA: hda - Enable beep for ASUS 1015E Jiri Slaby
` (162 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Thomas Petazzoni, Jason Cooper, Jiri Slaby
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a6e03dd451c724f785277d8ecca5d1a0b886d892 upstream.
The mvmdio driver accesses some register of the Ethernet unit. It
therefore takes a reference and enables a clock. However, on Armada
370/XP, no clock specification was given in the Device Tree, which
leads the mvmdio driver to fail when being used as a module and loaded
before the mvneta driver: it tries to access a register from a
hardware unit that isn't clocked.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1395790439-21332-2-git-send-email-thomas.petazzoni@free-electrons.com
Acked-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/boot/dts/armada-370-xp.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index 364a63dce6c5..beae26c4f3fb 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -156,6 +156,7 @@
#size-cells = <0>;
compatible = "marvell,orion-mdio";
reg = <0x72004 0x4>;
+ clocks = <&gateclk 4>;
};
eth0: ethernet@70000 {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 022/182] ALSA: hda - Enable beep for ASUS 1015E
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (20 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 021/182] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 023/182] ALSA: ice1712: Fix boundary checks in PCM pointer ops Jiri Slaby
` (161 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, W. Trevor King, Takashi Iwai, Jiri Slaby
From: "W. Trevor King" <wking@tremily.us>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a4b7f21d7b42b33609df3f86992a8deff80abfaf upstream.
The `lspci -nnvv` output contains (wrapped for line length):
00:1b.0 Audio device [0403]:
Intel Corporation 7 Series/C210 Series Chipset Family
High Definition Audio Controller [8086:1e20] (rev 04)
Subsystem: ASUSTeK Computer Inc. Device [1043:115d]
Signed-off-by: W. Trevor King <wking@tremily.us>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 855074950e6c..69ae2ef1b138 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -944,6 +944,7 @@ static int alc_codec_rename_from_preset(struct hda_codec *codec)
static const struct snd_pci_quirk beep_white_list[] = {
SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1),
+ SND_PCI_QUIRK(0x1043, 0x115d, "ASUS", 1),
SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
SND_PCI_QUIRK(0x1043, 0x8376, "EeePC", 1),
SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 023/182] ALSA: ice1712: Fix boundary checks in PCM pointer ops
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (21 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 022/182] ALSA: hda - Enable beep for ASUS 1015E Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 024/182] ALSA: hda - Fix silent speaker output due to mute LED fixup Jiri Slaby
` (160 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Takashi Iwai, Jiri Slaby
From: Takashi Iwai <tiwai@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4f8e940095536bc002a81666a4107a581c84e9b9 upstream.
PCM pointer callbacks in ice1712 driver check the buffer size boundary
wrongly between bytes and frames. This leads to PCM core warnings
like:
snd_pcm_update_hw_ptr0: 105 callbacks suppressed
ALSA pcm_lib.c:352 BUG: pcmC3D0c:0, pos = 5461, buffer size = 5461, period size = 2730
This patch fixes these checks to be placed after the proper unit
conversions.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/ice1712/ice1712.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
index 28ec872e54c0..b6e278fe8f67 100644
--- a/sound/pci/ice1712/ice1712.c
+++ b/sound/pci/ice1712/ice1712.c
@@ -685,9 +685,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pointer(struct snd_pcm_substream *
if (!(snd_ice1712_read(ice, ICE1712_IREG_PBK_CTRL) & 1))
return 0;
ptr = runtime->buffer_size - inw(ice->ddma_port + 4);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substream *substream)
@@ -704,9 +705,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substrea
addr = ICE1712_DSC_ADDR0;
ptr = snd_ice1712_ds_read(ice, substream->number * 2, addr) -
ice->playback_con_virt_addr[substream->number];
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *substream)
@@ -717,9 +719,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *s
if (!(snd_ice1712_read(ice, ICE1712_IREG_CAP_CTRL) & 1))
return 0;
ptr = inl(ICEREG(ice, CONCAP_ADDR)) - ice->capture_con_virt_addr;
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static const struct snd_pcm_hardware snd_ice1712_playback = {
@@ -1113,9 +1116,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pro_pointer(struct snd_pcm_substre
if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_PLAYBACK_START))
return 0;
ptr = ice->playback_pro_size - (inw(ICEMT(ice, PLAYBACK_SIZE)) << 2);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substream *substream)
@@ -1126,9 +1130,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substrea
if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_CAPTURE_START_SHADOW))
return 0;
ptr = ice->capture_pro_size - (inw(ICEMT(ice, CAPTURE_SIZE)) << 2);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static const struct snd_pcm_hardware snd_ice1712_playback_pro = {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 024/182] ALSA: hda - Fix silent speaker output due to mute LED fixup
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (22 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 023/182] ALSA: ice1712: Fix boundary checks in PCM pointer ops Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 025/182] ALSA: hda/realtek - Add support of ALC288 codec Jiri Slaby
` (159 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Takashi Iwai, Jiri Slaby
From: Takashi Iwai <tiwai@suse.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 415d555e6b398b00fc1733f0113065a54df9106a upstream.
The recent fixups for HP laptops to support the mute LED made the
speaker output silent on some machines. It turned out that they use
the NID 0x18 for the speaker while it's also used for controlling the
LED via VREF bits although the current driver code blindly assumes
that such a node is a mic pin (where 0x18 is usually so).
This patch fixes the problem by only changing the VREF bits and
keeping the other pin ctl bits.
Reported-and-tested-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/hda/patch_realtek.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 69ae2ef1b138..27d7af5a430b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3050,8 +3050,9 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
if (spec->mute_led_polarity)
enabled = !enabled;
- pinval = AC_PINCTL_IN_EN |
- (enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80);
+ pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
+ pinval &= ~AC_PINCTL_VREFEN;
+ pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
if (spec->mute_led_nid)
snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 025/182] ALSA: hda/realtek - Add support of ALC288 codec
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (23 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 024/182] ALSA: hda - Fix silent speaker output due to mute LED fixup Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 026/182] ALSA: hda/realtek - Add headset Mic support for Dell machine Jiri Slaby
` (158 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kailang Yang, Takashi Iwai, Jiri Slaby
From: Kailang Yang <kailang@realtek.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7c66593286bcd153e4868383e675673a27071bd5 upstream.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 27d7af5a430b..2b56bf413f88 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4310,6 +4310,7 @@ static int patch_alc269(struct hda_codec *codec)
spec->codec_variant = ALC269_TYPE_ALC284;
break;
case 0x10ec0286:
+ case 0x10ec0288:
spec->codec_variant = ALC269_TYPE_ALC286;
break;
case 0x10ec0255:
@@ -5113,6 +5114,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
{ .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
{ .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
+ { .id = 0x10ec0288, .name = "ALC288", .patch = patch_alc269 },
{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 026/182] ALSA: hda/realtek - Add headset Mic support for Dell machine
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (24 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 025/182] ALSA: hda/realtek - Add support of ALC288 codec Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 027/182] ACPICA: Restore code that repairs NULL package elements in return values Jiri Slaby
` (157 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kailang Yang, Takashi Iwai, Jiri Slaby
From: Kailang Yang <kailang@realtek.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8dc9abb93dde94e7f2bc719032fe16f5713df05c upstream.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 2b56bf413f88..d859dd5b99a8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4875,6 +4875,8 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
+ SND_PCI_QUIRK(0x1028, 0x0696, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 027/182] ACPICA: Restore code that repairs NULL package elements in return values.
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (25 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 026/182] ALSA: hda/realtek - Add headset Mic support for Dell machine Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 028/182] spi: efm32: use $vendor,$device scheme for compatible string Jiri Slaby
` (156 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Lv Zheng, Bob Moore, Rafael J. Wysocki, Jiri Slaby
From: Lv Zheng <lv.zheng@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 61db45ca21630f5ab7f678d54c5d969c21647854 upstream.
The original code was lost accidently, it was not generated along with the
following commit of mechanism improvements and thus not get merged:
Commit: d5a36100f62fa6db5541344e08b361b34e9114c5
Subject: ACPICA: Add mechanism for early object repairs on a per-name basis
Adds the framework to allow object repairs very early in the
return object analysis. Enables repairs like string->unicode,
etc.
This patch restores the implementation of the NULL element repair code for
ACPI_RTYPE_NONE. In the original design, ACPI_RTYPE_NONE is defined to
collect simple NULL object repairs.
Lv Zheng.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=67901
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/acpi/acpica/nsrepair.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
index f8e71ea60319..b2d247356c7d 100644
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -207,13 +207,30 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
* this predefined name. Either one return value is expected, or none,
* for both methods and other objects.
*
- * Exit now if there is no return object. Warning if one was expected.
+ * Try to fix if there was no return object. Warning if failed to fix.
*/
if (!return_object) {
if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
- ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
- ACPI_WARN_ALWAYS,
- "Missing expected return value"));
+ if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Found unexpected NULL package element"));
+
+ status =
+ acpi_ns_repair_null_element(info,
+ expected_btypes,
+ package_index,
+ return_object_ptr);
+ if (ACPI_SUCCESS(status)) {
+ return (AE_OK); /* Repair was successful */
+ }
+ } else {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Missing expected return value"));
+ }
return (AE_AML_NO_RETURN_VALUE);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 028/182] spi: efm32: use $vendor,$device scheme for compatible string
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (26 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 027/182] ACPICA: Restore code that repairs NULL package elements in return values Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 029/182] s390/cio: fix driver callback initialization for ccw consoles Jiri Slaby
` (155 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Uwe Kleine-König, Mark Brown, Jiri Slaby
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 12f6dd860cf8bf036c0bec38c00a53da71bcd43a upstream.
Wolfram Sang pointed out that "efm32,$device" is non-standard. So use the
common scheme and prefix device with "efm32-". The old compatible string
is left in place until arch/arm/boot/dts/efm32* is fixed.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
Documentation/devicetree/bindings/spi/efm32-spi.txt | 4 ++--
drivers/spi/spi-efm32.c | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/Documentation/devicetree/bindings/spi/efm32-spi.txt b/Documentation/devicetree/bindings/spi/efm32-spi.txt
index a590ca51be75..f762e11bfe11 100644
--- a/Documentation/devicetree/bindings/spi/efm32-spi.txt
+++ b/Documentation/devicetree/bindings/spi/efm32-spi.txt
@@ -3,7 +3,7 @@
Required properties:
- #address-cells: see spi-bus.txt
- #size-cells: see spi-bus.txt
-- compatible: should be "efm32,spi"
+- compatible: should be "energymicro,efm32-spi"
- reg: Offset and length of the register set for the controller
- interrupts: pair specifying rx and tx irq
- clocks: phandle to the spi clock
@@ -15,7 +15,7 @@ Example:
spi1: spi@0x4000c400 { /* USART1 */
#address-cells = <1>;
#size-cells = <0>;
- compatible = "efm32,spi";
+ compatible = "energymicro,efm32-spi";
reg = <0x4000c400 0x400>;
interrupts = <15 16>;
clocks = <&cmu 20>;
diff --git a/drivers/spi/spi-efm32.c b/drivers/spi/spi-efm32.c
index 7d84418a01d8..cc6a997d4cda 100644
--- a/drivers/spi/spi-efm32.c
+++ b/drivers/spi/spi-efm32.c
@@ -491,6 +491,9 @@ static int efm32_spi_remove(struct platform_device *pdev)
static const struct of_device_id efm32_spi_dt_ids[] = {
{
+ .compatible = "energymicro,efm32-spi",
+ }, {
+ /* doesn't follow the "vendor,device" scheme, don't use */
.compatible = "efm32,spi",
}, {
/* sentinel */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 029/182] s390/cio: fix driver callback initialization for ccw consoles
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (27 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 028/182] spi: efm32: use $vendor,$device scheme for compatible string Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 030/182] KVM: s390: Optimize ucontrol path Jiri Slaby
` (154 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Sebastian Ott, Martin Schwidefsky, Jiri Slaby
From: Sebastian Ott <sebott@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2253e8d79237c69086ded391e6767afe16972527 upstream.
ccw consoles are in use before they can be properly registered with
the driver core. For devices which are in use by a device driver we
rely on the ccw_device's pointer to the driver callbacks to be valid.
For ccw consoles this pointer is NULL until they are registered later
during boot and we dereferenced this pointer. This worked by
chance on 64 bit builds (cdev->drv was NULL but the optional callback
cdev->drv->path_event was also NULL by coincidence) and was unnoticed
until we received reports about boot failures on 31 bit systems.
Fix it by initializing the driver pointer for ccw consoles.
Reported-by: Mike Frysinger <vapier@gentoo.org>
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/s390/include/asm/ccwdev.h | 2 +-
drivers/s390/char/con3215.c | 2 +-
drivers/s390/char/con3270.c | 6 +-----
drivers/s390/char/raw3270.c | 10 +++++++++-
drivers/s390/char/raw3270.h | 2 +-
drivers/s390/cio/device.c | 3 ++-
6 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/arch/s390/include/asm/ccwdev.h b/arch/s390/include/asm/ccwdev.h
index f201af8be580..31b5ca8f8c3d 100644
--- a/arch/s390/include/asm/ccwdev.h
+++ b/arch/s390/include/asm/ccwdev.h
@@ -219,7 +219,7 @@ extern void ccw_device_get_id(struct ccw_device *, struct ccw_dev_id *);
#define to_ccwdev(n) container_of(n, struct ccw_device, dev)
#define to_ccwdrv(n) container_of(n, struct ccw_driver, driver)
-extern struct ccw_device *ccw_device_probe_console(void);
+extern struct ccw_device *ccw_device_probe_console(struct ccw_driver *);
extern void ccw_device_wait_idle(struct ccw_device *);
extern int ccw_device_force_console(struct ccw_device *);
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index eb5d22795c47..bb86494e2b7b 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -922,7 +922,7 @@ static int __init con3215_init(void)
raw3215_freelist = req;
}
- cdev = ccw_device_probe_console();
+ cdev = ccw_device_probe_console(&raw3215_ccw_driver);
if (IS_ERR(cdev))
return -ENODEV;
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index 699fd3e363df..bb6b0df50b33 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -576,7 +576,6 @@ static struct console con3270 = {
static int __init
con3270_init(void)
{
- struct ccw_device *cdev;
struct raw3270 *rp;
void *cbuf;
int i;
@@ -591,10 +590,7 @@ con3270_init(void)
cpcmd("TERM AUTOCR OFF", NULL, 0, NULL);
}
- cdev = ccw_device_probe_console();
- if (IS_ERR(cdev))
- return -ENODEV;
- rp = raw3270_setup_console(cdev);
+ rp = raw3270_setup_console();
if (IS_ERR(rp))
return PTR_ERR(rp);
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 24a08e8f19e1..651d1f5da7c4 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -776,16 +776,24 @@ raw3270_setup_device(struct ccw_device *cdev, struct raw3270 *rp, char *ascebc)
}
#ifdef CONFIG_TN3270_CONSOLE
+/* Tentative definition - see below for actual definition. */
+static struct ccw_driver raw3270_ccw_driver;
+
/*
* Setup 3270 device configured as console.
*/
-struct raw3270 __init *raw3270_setup_console(struct ccw_device *cdev)
+struct raw3270 __init *raw3270_setup_console(void)
{
+ struct ccw_device *cdev;
unsigned long flags;
struct raw3270 *rp;
char *ascebc;
int rc;
+ cdev = ccw_device_probe_console(&raw3270_ccw_driver);
+ if (IS_ERR(cdev))
+ return ERR_CAST(cdev);
+
rp = kzalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA);
ascebc = kzalloc(256, GFP_KERNEL);
rc = raw3270_setup_device(cdev, rp, ascebc);
diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h
index 7b73ff8c1bd7..359276a88396 100644
--- a/drivers/s390/char/raw3270.h
+++ b/drivers/s390/char/raw3270.h
@@ -190,7 +190,7 @@ raw3270_put_view(struct raw3270_view *view)
wake_up(&raw3270_wait_queue);
}
-struct raw3270 *raw3270_setup_console(struct ccw_device *cdev);
+struct raw3270 *raw3270_setup_console(void);
void raw3270_wait_cons_dev(struct raw3270 *);
/* Notifier for device addition/removal */
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e4a7ab2bb629..3a33be681fbe 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1610,7 +1610,7 @@ out_unlock:
return rc;
}
-struct ccw_device *ccw_device_probe_console(void)
+struct ccw_device *ccw_device_probe_console(struct ccw_driver *drv)
{
struct io_subchannel_private *io_priv;
struct ccw_device *cdev;
@@ -1632,6 +1632,7 @@ struct ccw_device *ccw_device_probe_console(void)
kfree(io_priv);
return cdev;
}
+ cdev->drv = drv;
set_io_private(sch, io_priv);
ret = ccw_device_console_enable(cdev, sch);
if (ret) {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 030/182] KVM: s390: Optimize ucontrol path
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (28 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 029/182] s390/cio: fix driver callback initialization for ccw consoles Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 031/182] mei: fix memory leak of pending write cb objects Jiri Slaby
` (153 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Christian Borntraeger, Jiri Slaby
From: Christian Borntraeger <borntraeger@de.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2955c83f72801245afd0fe5c560cc75b82bea9aa upstream.
Since commit 7c470539c95630c1f2a10f109e96f249730b75eb
(s390/kvm: avoid automatic sie reentry) we will run through the C code
of KVM on host interrupts instead of just reentering the guest. This
will result in additional ucontrol exits (at least HZ per second). Let
handle a 0 intercept in the kernel and dont return to userspace,
even if in ucontrol mode.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/s390/kvm/kvm-s390.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 776dafe918db..48bb1c129963 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -788,7 +788,8 @@ rerun_vcpu:
if (rc)
break;
if (kvm_is_ucontrol(vcpu->kvm))
- rc = -EOPNOTSUPP;
+ /* Don't exit for host interrupts. */
+ rc = vcpu->arch.sie_block->icptcode ? -EOPNOTSUPP : 0;
else
rc = kvm_handle_sie_intercept(vcpu);
} while (!signal_pending(current) && !rc);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 031/182] mei: fix memory leak of pending write cb objects
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (29 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 030/182] KVM: s390: Optimize ucontrol path Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 032/182] mei: me: do not load the driver if the FW doesn't support MEI interface Jiri Slaby
` (152 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tomas Winkler, Alexander Usyskin, Jiri Slaby
From: Tomas Winkler <tomas.winkler@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cc99ecfdac01215594c73907726b12f251c21e20 upstream.
Write callbacks are released on the write completed path but
when file handler is closed before the writes are
completed those are left dangling on write and write_waiting queues.
We add mei_io_list_free function to perform this task
Also move static functions to client.c form client.h
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/misc/mei/client.c | 76 ++++++++++++++++++++++++++++++++++-------------
drivers/misc/mei/client.h | 18 -----------
2 files changed, 55 insertions(+), 39 deletions(-)
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index b66cec93ebb3..9abe5a4e3ef7 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -74,23 +74,69 @@ int mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
/**
- * mei_io_list_flush - removes list entry belonging to cl.
+ * mei_cl_cmp_id - tells if the clients are the same
*
- * @list: An instance of our list structure
- * @cl: host client
+ * @cl1: host client 1
+ * @cl2: host client 2
+ *
+ * returns true - if the clients has same host and me ids
+ * false - otherwise
+ */
+static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
+ const struct mei_cl *cl2)
+{
+ return cl1 && cl2 &&
+ (cl1->host_client_id == cl2->host_client_id) &&
+ (cl1->me_client_id == cl2->me_client_id);
+}
+
+/**
+ * mei_io_list_flush - removes cbs belonging to cl.
+ *
+ * @list: an instance of our list structure
+ * @cl: host client, can be NULL for flushing the whole list
+ * @free: whether to free the cbs
*/
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+static void __mei_io_list_flush(struct mei_cl_cb *list,
+ struct mei_cl *cl, bool free)
{
struct mei_cl_cb *cb;
struct mei_cl_cb *next;
+ /* enable removing everything if no cl is specified */
list_for_each_entry_safe(cb, next, &list->list, list) {
- if (cb->cl && mei_cl_cmp_id(cl, cb->cl))
+ if (!cl || (cb->cl && mei_cl_cmp_id(cl, cb->cl))) {
list_del(&cb->list);
+ if (free)
+ mei_io_cb_free(cb);
+ }
}
}
/**
+ * mei_io_list_flush - removes list entry belonging to cl.
+ *
+ * @list: An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+ __mei_io_list_flush(list, cl, false);
+}
+
+
+/**
+ * mei_io_list_free - removes cb belonging to cl and free them
+ *
+ * @list: An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_free(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+ __mei_io_list_flush(list, cl, true);
+}
+
+/**
* mei_io_cb_free - free mei_cb_private related memory
*
* @cb: mei callback struct
@@ -192,8 +238,8 @@ int mei_cl_flush_queues(struct mei_cl *cl)
dev_dbg(&cl->dev->pdev->dev, "remove list entry belonging to cl\n");
mei_io_list_flush(&cl->dev->read_list, cl);
- mei_io_list_flush(&cl->dev->write_list, cl);
- mei_io_list_flush(&cl->dev->write_waiting_list, cl);
+ mei_io_list_free(&cl->dev->write_list, cl);
+ mei_io_list_free(&cl->dev->write_waiting_list, cl);
mei_io_list_flush(&cl->dev->ctrl_wr_list, cl);
mei_io_list_flush(&cl->dev->ctrl_rd_list, cl);
mei_io_list_flush(&cl->dev->amthif_cmd_list, cl);
@@ -916,20 +962,8 @@ void mei_cl_all_wakeup(struct mei_device *dev)
*/
void mei_cl_all_write_clear(struct mei_device *dev)
{
- struct mei_cl_cb *cb, *next;
- struct list_head *list;
-
- list = &dev->write_list.list;
- list_for_each_entry_safe(cb, next, list, list) {
- list_del(&cb->list);
- mei_io_cb_free(cb);
- }
-
- list = &dev->write_waiting_list.list;
- list_for_each_entry_safe(cb, next, list, list) {
- list_del(&cb->list);
- mei_io_cb_free(cb);
- }
+ mei_io_list_free(&dev->write_list, NULL);
+ mei_io_list_free(&dev->write_waiting_list, NULL);
}
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 892cc4207fa2..5d75ab523490 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -45,8 +45,6 @@ static inline void mei_io_list_init(struct mei_cl_cb *list)
{
INIT_LIST_HEAD(&list->list);
}
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl);
-
/*
* MEI Host Client Functions
*/
@@ -61,22 +59,6 @@ int mei_cl_unlink(struct mei_cl *cl);
int mei_cl_flush_queues(struct mei_cl *cl);
struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl);
-/**
- * mei_cl_cmp_id - tells if file private data have same id
- *
- * @fe1: private data of 1. file object
- * @fe2: private data of 2. file object
- *
- * returns true - if ids are the same and not NULL
- */
-static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
- const struct mei_cl *cl2)
-{
- return cl1 && cl2 &&
- (cl1->host_client_id == cl2->host_client_id) &&
- (cl1->me_client_id == cl2->me_client_id);
-}
-
int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 032/182] mei: me: do not load the driver if the FW doesn't support MEI interface
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (30 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 031/182] mei: fix memory leak of pending write cb objects Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 033/182] mei: ignore client writing state during cb completion Jiri Slaby
` (151 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tomas Winkler, Jiri Slaby
From: Tomas Winkler <tomas.winkler@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5e6533a6f52f1a8283b2f818f5828be99a417dd6 upstream.
NM and SPS FW types that may run on ME device on server platforms
do not have valid MEI/HECI interface and driver should not
be bound to it as this might lead to system hung.
In practice not all BIOSes effectively hide such devices from the
OS and in some cases it is not possible.
We determine FW type by examining Host FW status registers in order to
unbind the driver.
In this patch we are adding check for ME on Cougar Point, Lynx Point
Devices
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Tested-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/misc/mei/hw-me-regs.h | 5 +++++
drivers/misc/mei/pci-me.c | 30 +++++++++++++++++++++++-------
2 files changed, 28 insertions(+), 7 deletions(-)
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 66f411a6e8ea..cabc04383685 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -115,6 +115,11 @@
#define MEI_DEV_ID_LPT_HR 0x8CBA /* Lynx Point H Refresh */
#define MEI_DEV_ID_WPT_LP 0x9CBA /* Wildcat Point LP */
+
+/* Host Firmware Status Registers in PCI Config Space */
+#define PCI_CFG_HFS_1 0x40
+#define PCI_CFG_HFS_2 0x48
+
/*
* MEI HW Section
*/
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index e637318b79ba..20fb058f6ae8 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -100,15 +100,31 @@ static bool mei_me_quirk_probe(struct pci_dev *pdev,
const struct pci_device_id *ent)
{
u32 reg;
- if (ent->device == MEI_DEV_ID_PBG_1) {
- pci_read_config_dword(pdev, 0x48, ®);
- /* make sure that bit 9 is up and bit 10 is down */
- if ((reg & 0x600) == 0x200) {
- dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
- return false;
- }
+ /* Cougar Point || Patsburg */
+ if (ent->device == MEI_DEV_ID_CPT_1 ||
+ ent->device == MEI_DEV_ID_PBG_1) {
+ pci_read_config_dword(pdev, PCI_CFG_HFS_2, ®);
+ /* make sure that bit 9 (NM) is up and bit 10 (DM) is down */
+ if ((reg & 0x600) == 0x200)
+ goto no_mei;
}
+
+ /* Lynx Point */
+ if (ent->device == MEI_DEV_ID_LPT_H ||
+ ent->device == MEI_DEV_ID_LPT_W ||
+ ent->device == MEI_DEV_ID_LPT_HR) {
+ /* Read ME FW Status check for SPS Firmware */
+ pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®);
+ /* if bits [19:16] = 15, running SPS Firmware */
+ if ((reg & 0xf0000) == 0xf0000)
+ goto no_mei;
+ }
+
return true;
+
+no_mei:
+ dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+ return false;
}
/**
* mei_probe - Device Initialization Routine
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 033/182] mei: ignore client writing state during cb completion
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (31 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 032/182] mei: me: do not load the driver if the FW doesn't support MEI interface Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 034/182] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error Jiri Slaby
` (150 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alexander Usyskin, Tomas Winkler, Jiri Slaby
From: Alexander Usyskin <alexander.usyskin@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 34ec43661fe8f1977dd0f05353302ae2ed10aabb upstream.
Ignore client writing state during cb completion to fix a memory
leak.
When moving cbs to the completion list we should not look at
writing_state as this state can be already overwritten by next
write, the fact that a cb is on the write waiting list means
that it was already written to the HW and we can safely complete it.
Same pays for wait in poll handler, we do not have to check the state
wake is done after completion list processing.
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/misc/mei/interrupt.c | 3 +--
drivers/misc/mei/main.c | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 1b922e971d3e..41b4b4818b04 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -420,8 +420,7 @@ int mei_irq_write_handler(struct mei_device *dev, struct mei_cl_cb *cmpl_list)
cl->status = 0;
list_del(&cb->list);
- if (MEI_WRITING == cl->writing_state &&
- cb->fop_type == MEI_FOP_WRITE &&
+ if (cb->fop_type == MEI_FOP_WRITE &&
cl != &dev->iamthif_cl) {
dev_dbg(&dev->pdev->dev, "MEI WRITE COMPLETE\n");
cl->writing_state = MEI_WRITE_COMPLETE;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index cabeddd66c1f..9558bef37eea 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -648,8 +648,7 @@ static unsigned int mei_poll(struct file *file, poll_table *wait)
goto out;
}
- if (MEI_WRITE_COMPLETE == cl->writing_state)
- mask |= (POLLIN | POLLRDNORM);
+ mask |= (POLLIN | POLLRDNORM);
out:
mutex_unlock(&dev->device_lock);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 034/182] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (32 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 033/182] mei: ignore client writing state during cb completion Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 035/182] mfd: 88pm860x: Fix possible NULL pointer dereference on " Jiri Slaby
` (149 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 65aba1e04916d72b30c028730a1e31860c225412 upstream.
During probe the sec-core driver allocates dummy I2C device for RTC with
i2c_new_dummy() but return value is not checked. In case of error
(i2c_new_device(): memory allocation failure or I2C address cannot be
used) this function returns NULL which is later used by
devm_regmap_init_i2c() or i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/sec-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index f530e4b73f19..d02546b0a8cc 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -274,6 +274,10 @@ static int sec_pmic_probe(struct i2c_client *i2c,
}
sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+ if (!sec_pmic->rtc) {
+ dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
if (pdata && pdata->cfg_pmic_irq)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 035/182] mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (33 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 034/182] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 036/182] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail Jiri Slaby
` (148 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream.
During probe the driver allocates dummy I2C device for companion chip
with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by regmap_init_i2c().
If i2c_new_dummy() fails for companion device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/88pm860x-core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index 7ebe9ef1eba6..675f96b37643 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_client *client,
chip->companion_addr = pdata->companion_addr;
chip->companion = i2c_new_dummy(chip->client->adapter,
chip->companion_addr);
+ if (!chip->companion) {
+ dev_err(&client->dev,
+ "Failed to allocate I2C companion device\n");
+ return -ENODEV;
+ }
chip->regmap_companion = regmap_init_i2c(chip->companion,
&pm860x_regmap_config);
if (IS_ERR(chip->regmap_companion)) {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 036/182] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (34 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 035/182] mfd: 88pm860x: Fix possible NULL pointer dereference on " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 037/182] mfd: 88pm800: Fix I2C device resource leak if probe fails Jiri Slaby
` (147 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a7ab1c8b261305af583ce26bb4a14f555fdaa73e upstream.
During probe the driver allocates dummy I2C device for companion chip
and then allocates a regmap for it. If regmap_init_i2c() fails then the
I2C driver (allocated with i2c_new_dummy()) is not freed and this
resource leaks.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/88pm860x-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index 675f96b37643..a141b460697d 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_client *client,
ret = PTR_ERR(chip->regmap_companion);
dev_err(&chip->companion->dev,
"Failed to allocate register map: %d\n", ret);
+ i2c_unregister_device(chip->companion);
return ret;
}
i2c_set_clientdata(chip->companion, chip);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 037/182] mfd: 88pm800: Fix I2C device resource leak if probe fails
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (35 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 036/182] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 038/182] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error Jiri Slaby
` (146 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 141050cf3d84fc303df58796d68dc1376b0e8f67 upstream.
During probe the driver allocates two dummy I2C devices for subchips in
function pm800_pages_init(). Additionally this function allocates
regmaps for these subchips. If any of these steps fail then these dummy
I2C devices are not freed and resources leak.
On pm800_pages_init() fail the driver must call pm800_pages_exit() to
unregister dummy I2C devices.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/88pm800.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/mfd/88pm800.c b/drivers/mfd/88pm800.c
index a65447d65605..da1ef3290be5 100644
--- a/drivers/mfd/88pm800.c
+++ b/drivers/mfd/88pm800.c
@@ -571,7 +571,7 @@ static int pm800_probe(struct i2c_client *client,
ret = pm800_pages_init(chip);
if (ret) {
dev_err(&client->dev, "pm800_pages_init failed!\n");
- goto err_page_init;
+ goto err_device_init;
}
ret = device_800_init(chip, pdata);
@@ -587,7 +587,6 @@ static int pm800_probe(struct i2c_client *client,
err_device_init:
pm800_pages_exit(chip);
-err_page_init:
err_subchip_alloc:
pm80x_deinit();
out_init:
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 038/182] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (36 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 037/182] mfd: 88pm800: Fix I2C device resource leak if probe fails Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 039/182] mfd: max77693: " Jiri Slaby
` (145 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b9e183a1d495cd65412abe0f9df19b151716bfe7 upstream.
During probe the driver allocates dummy I2C device for RTC with
i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/max77686.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index 108453b75ccc..fc2e0b946f8d 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -120,6 +120,10 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
dev_info(max77686->dev, "device found\n");
max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+ if (!max77686->rtc) {
+ dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max77686->rtc, max77686);
max77686_irq_init(max77686);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 039/182] mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (37 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 038/182] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 040/182] mfd: max8925: " Jiri Slaby
` (144 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ad09dd6a1f5d6244bd89314015af506ba7f9810a upstream.
During probe the driver allocates dummy I2C devices for MUIC and haptic
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by devm_regmap_init_i2c() and i2c_unregister_device().
If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/max77693.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index c04723efc707..8abfd3f0af5b 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -149,9 +149,18 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+ if (!max77693->muic) {
+ dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max77693->muic, max77693);
max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+ if (!max77693->haptic) {
+ dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n");
+ ret = -ENODEV;
+ goto err_i2c_haptic;
+ }
i2c_set_clientdata(max77693->haptic, max77693);
/*
@@ -187,8 +196,9 @@ err_mfd:
max77693_irq_exit(max77693);
err_irq:
err_regmap_muic:
- i2c_unregister_device(max77693->muic);
i2c_unregister_device(max77693->haptic);
+err_i2c_haptic:
+ i2c_unregister_device(max77693->muic);
return ret;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 040/182] mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (38 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 039/182] mfd: max77693: " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 041/182] mfd: max8998: " Jiri Slaby
` (143 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream.
During probe the driver allocates dummy I2C devices for RTC and ADC
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/max8925-i2c.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c
index de7fb80a6052..afd07718dcab 100644
--- a/drivers/mfd/max8925-i2c.c
+++ b/drivers/mfd/max8925-i2c.c
@@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_client *client,
mutex_init(&chip->io_lock);
chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR);
+ if (!chip->rtc) {
+ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(chip->rtc, chip);
chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR);
+ if (!chip->adc) {
+ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n");
+ i2c_unregister_device(chip->rtc);
+ return -ENODEV;
+ }
i2c_set_clientdata(chip->adc, chip);
device_init_wakeup(&client->dev, 1);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 041/182] mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (39 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 040/182] mfd: max8925: " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 042/182] mfd: max8997: " Jiri Slaby
` (142 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream.
During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/max8998.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index fe6332dcabee..25e131a0840a 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
mutex_init(&max8998->iolock);
max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+ if (!max8998->rtc) {
+ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max8998->rtc, max8998);
max8998_irq_init(max8998);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 042/182] mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (40 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 041/182] mfd: max8998: " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 043/182] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail Jiri Slaby
` (141 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream.
During probe the driver allocates dummy I2C devices for RTC, haptic and
MUIC with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
probe for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/max8997.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index cee098c0dae3..20a20051108f 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -217,10 +217,26 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
mutex_init(&max8997->iolock);
max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+ if (!max8997->rtc) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max8997->rtc, max8997);
+
max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+ if (!max8997->haptic) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n");
+ ret = -ENODEV;
+ goto err_i2c_haptic;
+ }
i2c_set_clientdata(max8997->haptic, max8997);
+
max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+ if (!max8997->muic) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n");
+ ret = -ENODEV;
+ goto err_i2c_muic;
+ }
i2c_set_clientdata(max8997->muic, max8997);
pm_runtime_set_active(max8997->dev);
@@ -247,7 +263,9 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
err_mfd:
mfd_remove_devices(max8997->dev);
i2c_unregister_device(max8997->muic);
+err_i2c_muic:
i2c_unregister_device(max8997->haptic);
+err_i2c_haptic:
i2c_unregister_device(max8997->rtc);
return ret;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 043/182] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (41 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 042/182] mfd: max8997: " Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 044/182] mfd: kempld-core: Fix potential hang-up during boot Jiri Slaby
` (140 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Lee Jones, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.
Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:
1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
(because regmap_add_irq_chip() will free it on error)
This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/tps65910.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index d79277204835..de87eafbeb05 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -254,8 +254,10 @@ static int tps65910_irq_init(struct tps65910 *tps65910, int irq,
ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq,
IRQF_ONESHOT, pdata->irq_base,
tps6591x_irqs_chip, &tps65910->irq_data);
- if (ret < 0)
+ if (ret < 0) {
dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret);
+ tps65910->chip_irq = 0;
+ }
return ret;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 044/182] mfd: kempld-core: Fix potential hang-up during boot
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (42 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 043/182] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 045/182] w1: fix w1_send_slave dropping a slave id Jiri Slaby
` (139 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Guenter Roeck, Lee Jones, Jiri Slaby
From: Guenter Roeck <linux@roeck-us.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 204747c970c0d568721c76ab8a57dde0e5dcf0d5 upstream.
On PXT and COMe-cPC2 boards it is observed that the hardware
mutex is acquired but not being released during initialization.
This can result in a hang-up during boot if the driver is built
into the kernel.
Releasing the mutex twice if it was acquired fixes the problem.
Subsequent request/release cycles work as expected, so the fix is
only needed during initialization.
Reviewed-by: Michael Brunner <michael.brunner@kontron.com>
Tested-by: Michael Brunner <michael.brunner@kontron.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mfd/kempld-core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
index d3e23278d299..38917a822335 100644
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -322,9 +322,12 @@ static int kempld_detect_device(struct kempld_device_data *pld)
return -ENODEV;
}
- /* Release hardware mutex if aquired */
- if (!(index_reg & KEMPLD_MUTEX_KEY))
+ /* Release hardware mutex if acquired */
+ if (!(index_reg & KEMPLD_MUTEX_KEY)) {
iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+ /* PXT and COMe-cPC2 boards may require a second release */
+ iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+ }
mutex_unlock(&pld->lock);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 045/182] w1: fix w1_send_slave dropping a slave id
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (43 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 044/182] mfd: kempld-core: Fix potential hang-up during boot Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 046/182] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer Jiri Slaby
` (138 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, David Fries, Jiri Slaby
From: David Fries <David@Fries.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.
Previous logic,
if (avail > 8) {
store slave;
return;
}
send data; clear;
The logic error is, if there isn't space send the buffer and clear,
but the slave wasn't added to the now empty buffer loosing that slave
id. It also should have been "if (avail >= 8)" because when it is 8,
there is space.
Instead, if there isn't space send and clear the buffer, then there is
always space for the slave id.
Signed-off-by: David Fries <David@Fries.net>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/w1/w1_netlink.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index 40788c925d1c..73705aff53cb 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_master *dev, u64 rn)
struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1);
struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1);
int avail;
+ u64 *data;
/* update kernel slave list */
w1_slave_found(dev, rn);
avail = dev->priv_size - cmd->len;
- if (avail > 8) {
- u64 *data = (void *)(cmd + 1) + cmd->len;
+ if (avail < 8) {
+ msg->ack++;
+ cn_netlink_send(msg, 0, GFP_KERNEL);
- *data = rn;
- cmd->len += 8;
- hdr->len += 8;
- msg->len += 8;
- return;
+ msg->len = sizeof(struct w1_netlink_msg) +
+ sizeof(struct w1_netlink_cmd);
+ hdr->len = sizeof(struct w1_netlink_cmd);
+ cmd->len = 0;
}
- msg->ack++;
- cn_netlink_send(msg, 0, GFP_KERNEL);
+ data = (void *)(cmd + 1) + cmd->len;
- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd);
- hdr->len = sizeof(struct w1_netlink_cmd);
- cmd->len = 0;
+ *data = rn;
+ cmd->len += 8;
+ hdr->len += 8;
+ msg->len += 8;
}
static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 046/182] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (44 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 045/182] w1: fix w1_send_slave dropping a slave id Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 047/182] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0 Jiri Slaby
` (137 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Himangi Saraogi, Jiri Slaby
From: Himangi Saraogi <himangi774@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.
This patch fixes the following sparse warning :
drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/serqt_usb2/serqt_usb2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c
index 73fc3cc19e33..18d4856c092f 100644
--- a/drivers/staging/serqt_usb2/serqt_usb2.c
+++ b/drivers/staging/serqt_usb2/serqt_usb2.c
@@ -725,7 +725,7 @@ static int qt_startup(struct usb_serial *serial)
goto startup_error;
}
- switch (serial->dev->descriptor.idProduct) {
+ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) {
case QUATECH_DSU100:
case QUATECH_QSU100:
case QUATECH_ESU100A:
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 047/182] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (45 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 046/182] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 048/182] staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data Jiri Slaby
` (136 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.
Zero-initializing ether_type masked that the ether type would never be
obtained for 8021x packets and the comparison against eapol_type
would always fail.
Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/rtl8712/rtl871x_recv.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
index 23ec684b60e1..274c359279ef 100644
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
struct sta_info *psta;
struct sta_priv *pstapriv;
union recv_frame *prtnframe;
- u16 ether_type = 0;
+ u16 ether_type;
pstapriv = &adapter->stapriv;
ptr = get_recvframe_data(precv_frame);
@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
psta = r8712_get_stainfo(pstapriv, psta_addr);
auth_alg = adapter->securitypriv.AuthAlgrthm;
if (auth_alg == 2) {
+ /* get ether_type */
+ ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+ memcpy(ðer_type, ptr, 2);
+ ether_type = ntohs((unsigned short)ether_type);
+
if ((psta != NULL) && (psta->ieee8021x_blocked)) {
/* blocked
* only accept EAPOL frame */
- prtnframe = precv_frame;
- /*get ether_type */
- ptr = ptr + pfhdr->attrib.hdrlen +
- pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
- memcpy(ðer_type, ptr, 2);
- ether_type = ntohs((unsigned short)ether_type);
if (ether_type == 0x888e)
prtnframe = precv_frame;
else {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 048/182] staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (46 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 047/182] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0 Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 049/182] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL Jiri Slaby
` (135 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, H Hartley Sweeten, Jiri Slaby
From: H Hartley Sweeten <hsweeten@visionengravers.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2704f807f9498054b8153002bafa3e818079e9a5 upstream.
In usbdux_ao_cmd(), the channels for the command are transfered from the
cmd->chanlist and stored in the private data 'ao_chanlist'. The channel
numbers are bit-shifted when stored so that they become the "command"
that is transfered to the device. The channel to command conversion
results in the 'ao_chanlist' having these values for the channels:
channel 0 -> ao_chanlist = 0x00
channel 1 -> ao_chanlist = 0x40
channel 2 -> ao_chanlist = 0x80
channel 3 -> ao_chanlist = 0xc0
The problem is, the usbduxsub_ao_isoc_irq() function uses the 'chan' value
from 'ao_chanlist' to access the 'ao_readback' array in the private data.
So instead of accessing the array as 0, 1, 2, 3, it accesses it as 0x00,
0x40, 0x80, 0xc0.
Fix this by storing the raw channel number in 'ao_chanlist' and doing the
bit-shift when creating the command.
Fixes: a998a3db530bff80 "staging: comedi: usbdux: cleanup the private data 'outBuffer'"
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Acked-by: Bernd Porr <mail@berndporr.me.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/comedi/drivers/usbdux.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 701ad1a69394..4fbe303e8186 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -494,7 +494,7 @@ static void usbduxsub_ao_isoc_irq(struct urb *urb)
/* pointer to the DA */
*datap++ = val & 0xff;
*datap++ = (val >> 8) & 0xff;
- *datap++ = chan;
+ *datap++ = chan << 6;
devpriv->ao_readback[chan] = val;
s->async->events |= COMEDI_CB_BLOCK;
@@ -1040,11 +1040,8 @@ static int usbdux_ao_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
/* set current channel of the running acquisition to zero */
s->async->cur_chan = 0;
- for (i = 0; i < cmd->chanlist_len; ++i) {
- unsigned int chan = CR_CHAN(cmd->chanlist[i]);
-
- devpriv->ao_chanlist[i] = chan << 6;
- }
+ for (i = 0; i < cmd->chanlist_len; ++i)
+ devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
/* we count in steps of 1ms (125us) */
/* 125us mode not used yet */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 049/182] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (47 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 048/182] staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 050/182] ftrace/x86: One more missing sync after fixup of function modification failure Jiri Slaby
` (134 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9452bf560273e4de2395ffdd79024debfb0c1290 upstream.
This makes the follow-on check for psta != NULL pointless and makes
the whole exercise rather pointless. This is another case of why
blindly zero-initializing variables when they are declared is bad.
Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/staging/rtl8188eu/core/rtw_recv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 201165787362..33243ed40a1e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -555,7 +555,7 @@ _func_exit_;
/* set the security information in the recv_frame */
static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *precv_frame)
{
- u8 *psta_addr = NULL, *ptr;
+ u8 *psta_addr, *ptr;
uint auth_alg;
struct recv_frame_hdr *pfhdr;
struct sta_info *psta;
@@ -569,7 +569,6 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre
_func_enter_;
pstapriv = &adapter->stapriv;
- psta = rtw_get_stainfo(pstapriv, psta_addr);
auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
@@ -577,6 +576,7 @@ _func_enter_;
pfhdr = &precv_frame->u.hdr;
pattrib = &pfhdr->attrib;
psta_addr = pattrib->ta;
+ psta = rtw_get_stainfo(pstapriv, psta_addr);
prtnframe = NULL;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 050/182] ftrace/x86: One more missing sync after fixup of function modification failure
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (48 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 049/182] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 051/182] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels Jiri Slaby
` (133 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Petr Mladek, Steven Rostedt, Jiri Slaby
From: Petr Mladek <pmladek@suse.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 12729f14d8357fb845d75155228b21e76360272d upstream.
If a failure occurs while modifying ftrace function, it bails out and will
remove the tracepoints to be back to what the code originally was.
There is missing the final sync run across the CPUs after the fix up is done
and before the ftrace int3 handler flag is reset.
Here's the description of the problem:
CPU0 CPU1
---- ----
remove_breakpoint();
modifying_ftrace_code = 0;
[still sees breakpoint]
<takes trap>
[sees modifying_ftrace_code as zero]
[no breakpoint handler]
[goto failed case]
[trap exception - kernel breakpoint, no
handler]
BUG()
Link: http://lkml.kernel.org/r/1393258342-29978-2-git-send-email-pmladek@suse.cz
Fixes: 8a4d0a687a5 "ftrace: Use breakpoint method to update ftrace caller"
Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
Acked-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/kernel/ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index e6253195a301..1ffc32dbe450 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -659,8 +659,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
ret = -EPERM;
goto out;
}
- run_sync();
out:
+ run_sync();
return ret;
fail_update:
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 051/182] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (49 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 050/182] ftrace/x86: One more missing sync after fixup of function modification failure Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 052/182] regulator: arizona-ldo1: Correct default regulator init_data Jiri Slaby
` (132 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, H. Peter Anvin, Linus Torvalds, Jiri Slaby
From: "H. Peter Anvin" <hpa@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b3b42ac2cbae1f3cecbb6229964a4d48af31d382 upstream.
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. We have
a software workaround for that ("espfix") for the 32-bit kernel, but
it relies on a nonzero stack segment base which is not available in
32-bit mode.
Since 16-bit support is somewhat crippled anyway on a 64-bit kernel
(no V86 mode), and most (if not quite all) 64-bit processors support
virtualization for the users who really need it, simply reject
attempts at creating a 16-bit segment when running on top of a 64-bit
kernel.
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/kernel/ldt.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ebc987398923..af1d14a9ebda 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
}
}
+ /*
+ * On x86-64 we do not support 16-bit segments due to
+ * IRET leaking the high bits of the kernel stack address.
+ */
+#ifdef CONFIG_X86_64
+ if (!ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out_unlock;
+ }
+#endif
+
fill_ldt(&ldt, &ldt_info);
if (oldmode)
ldt.avl = 0;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 052/182] regulator: arizona-ldo1: Correct default regulator init_data
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (50 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 051/182] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 053/182] PCI: mvebu: Fix potential issue in range parsing Jiri Slaby
` (131 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Charles Keepax, Mark Brown, Jiri Slaby
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a35ff2861690eaf9dbb38fa744a8a9e6f4ebfd61 upstream.
Both 5102 and 8997 have the regulator capable of supplying 1.8V, and the
voltage step from the 5110 regulator is different from what is specified
in the default description. This patch updates the default regulator
description to match 5110 and selects the 1.8V capable description for
8997.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/regulator/arizona-ldo1.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c
index 81d8681c3195..7917bb2fa834 100644
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -153,11 +153,9 @@ static const struct regulator_desc arizona_ldo1 = {
.vsel_reg = ARIZONA_LDO1_CONTROL_1,
.vsel_mask = ARIZONA_LDO1_VSEL_MASK,
- .bypass_reg = ARIZONA_LDO1_CONTROL_1,
- .bypass_mask = ARIZONA_LDO1_BYPASS,
.min_uV = 900000,
- .uV_step = 50000,
- .n_voltages = 7,
+ .uV_step = 25000,
+ .n_voltages = 13,
.enable_time = 500,
.owner = THIS_MODULE,
@@ -203,6 +201,7 @@ static int arizona_ldo1_probe(struct platform_device *pdev)
*/
switch (arizona->type) {
case WM5102:
+ case WM8997:
desc = &arizona_ldo1_hc;
ldo1->init_data = arizona_ldo1_dvfs;
break;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 053/182] PCI: mvebu: Fix potential issue in range parsing
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (51 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 052/182] regulator: arizona-ldo1: Correct default regulator init_data Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 054/182] USB: fix crash during hotplug of PCI USB controller card Jiri Slaby
` (130 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jean-Jacques Hiblot, Bjorn Helgaas, Jiri Slaby
From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4f4bde1df33bde076f53325bdf2c6430cf85e1bb upstream.
The second parameter of of_read_number() is not the index, but a size. As
it happens, in this case it may work just fine because of the conversion to
u32 and the favorable endianness on this architecture.
Fixes: 11be65472a427 ("PCI: mvebu: Adapt to the new device tree layout")
Tested-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/pci/host/pci-mvebu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 8efd11dafd44..b4214cba58b7 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -749,7 +749,7 @@ static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
for (i = 0; i < nranges; i++) {
u32 flags = of_read_number(range, 1);
- u32 slot = of_read_number(range, 2);
+ u32 slot = of_read_number(range + 1, 1);
u64 cpuaddr = of_read_number(range + na, pna);
unsigned long rtype;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 054/182] USB: fix crash during hotplug of PCI USB controller card
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (52 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 053/182] PCI: mvebu: Fix potential issue in range parsing Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 055/182] iio: querying buffer scan_mask should return 0/1 Jiri Slaby
` (129 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alan Stern, Jiri Slaby
From: Alan Stern <stern@rowland.harvard.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a2ff864b53eac9a0e9b05bfe9d1781ccd6c2af71 upstream.
The code in hcd-pci.c that matches up EHCI controllers with their
companion UHCI or OHCI controllers assumes that the private drvdata
fields don't get set too early. However, it turns out that this field
gets set by usb_create_hcd(), before hcd-pci expects it, and this can
result in a crash when two controllers are probed in parallel (as can
happen when a new controller card is hotplugged).
The companions_rwsem lock was supposed to prevent this sort of thing,
but usb_create_hcd() is called outside the scope of the rwsem.
A simple solution is to check that the root-hub pointer has been
initialized as well as the drvdata field. This doesn't happen until
usb_add_hcd() is called; that call and the check are both protected by
the rwsem.
This patch should be applied to stable kernels from 3.10 onward.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Stefani Seibold <stefani@seibold.net>
Tested-by: Stefani Seibold <stefani@seibold.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/core/hcd-pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index b9d3c43e3859..3f7ef6129874 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -75,7 +75,7 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd,
PCI_SLOT(companion->devfn) != slot)
continue;
companion_hcd = pci_get_drvdata(companion);
- if (!companion_hcd)
+ if (!companion_hcd || !companion_hcd->self.root_hub)
continue;
fn(pdev, hcd, companion, companion_hcd);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 055/182] iio: querying buffer scan_mask should return 0/1
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (53 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 054/182] USB: fix crash during hotplug of PCI USB controller card Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 056/182] NFSv4: Fix a use-after-free problem in open() Jiri Slaby
` (128 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alec Berg, Jonathan Cameron, Jiri Slaby
From: Alec Berg <alecaberg@chromium.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2076a20fc1a06f7b0333c62a2bb4eeeac7ed1bcb upstream.
Ensure that querying the IIO buffer scan_mask returns a value of
0 or 1. Currently querying the scan mask has the value returned
by test_bit(), which returns either true or false. For some
architectures test_bit() may return -1 for true, which will appear
to return an error when returning from iio_scan_mask_query().
Additionally, it's important for the sysfs interface to consistently
return the same thing when querying the scan_mask.
Signed-off-by: Alec Berg <alecaberg@chromium.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/iio/industrialio-buffer.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 2db7dcd826b9..376de1cc85db 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -119,7 +119,8 @@ static ssize_t iio_scan_el_show(struct device *dev,
int ret;
struct iio_dev *indio_dev = dev_to_iio_dev(dev);
- ret = test_bit(to_iio_dev_attr(attr)->address,
+ /* Ensure ret is 0 or 1. */
+ ret = !!test_bit(to_iio_dev_attr(attr)->address,
indio_dev->buffer->scan_mask);
return sprintf(buf, "%d\n", ret);
@@ -789,7 +790,8 @@ int iio_scan_mask_query(struct iio_dev *indio_dev,
if (!buffer->scan_mask)
return 0;
- return test_bit(bit, buffer->scan_mask);
+ /* Ensure return value is 0 or 1. */
+ return !!test_bit(bit, buffer->scan_mask);
};
EXPORT_SYMBOL_GPL(iio_scan_mask_query);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 056/182] NFSv4: Fix a use-after-free problem in open()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (54 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 055/182] iio: querying buffer scan_mask should return 0/1 Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 057/182] nfsd4: session needs room for following op to error out Jiri Slaby
` (127 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Trond Myklebust, Jiri Slaby
From: Trond Myklebust <trond.myklebust@primarydata.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e911b8158ee1def8153849b1641b736026b036e0 upstream.
If we interrupt the nfs4_wait_for_completion_rpc_task() call in
nfs4_run_open_task(), then we don't prevent the RPC call from
completing. So freeing up the opendata->f_attr.mdsthreshold
in the error path in _nfs4_do_open() leads to a use-after-free
when the XDR decoder tries to decode the mdsthreshold information
from the server.
Fixes: 82be417aa37c0 (NFSv4.1 cache mdsthreshold values on OPEN)
Tested-by: Steve Dickson <SteveD@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfs/nfs4proc.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index bcd42fbc04e7..40062e42c955 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1064,6 +1064,7 @@ static void nfs4_opendata_free(struct kref *kref)
dput(p->dentry);
nfs_sb_deactive(sb);
nfs_fattr_free_names(&p->f_attr);
+ kfree(p->f_attr.mdsthreshold);
kfree(p);
}
@@ -2236,10 +2237,12 @@ static int _nfs4_do_open(struct inode *dir,
}
}
- if (ctx_th && server->attr_bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD) {
- opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
- if (!opendata->f_attr.mdsthreshold)
- goto err_free_label;
+ if (server->attr_bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD) {
+ if (!opendata->f_attr.mdsthreshold) {
+ opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
+ if (!opendata->f_attr.mdsthreshold)
+ goto err_free_label;
+ }
opendata->o_arg.open_bitmap = &nfs4_pnfs_open_bitmap[0];
}
if (dentry->d_inode != NULL)
@@ -2267,11 +2270,10 @@ static int _nfs4_do_open(struct inode *dir,
if (opendata->file_created)
*opened |= FILE_CREATED;
- if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server))
+ if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server)) {
*ctx_th = opendata->f_attr.mdsthreshold;
- else
- kfree(opendata->f_attr.mdsthreshold);
- opendata->f_attr.mdsthreshold = NULL;
+ opendata->f_attr.mdsthreshold = NULL;
+ }
nfs4_label_free(olabel);
@@ -2281,7 +2283,6 @@ static int _nfs4_do_open(struct inode *dir,
err_free_label:
nfs4_label_free(olabel);
err_opendata_put:
- kfree(opendata->f_attr.mdsthreshold);
nfs4_opendata_put(opendata);
err_put_state_owner:
nfs4_put_state_owner(sp);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 057/182] nfsd4: session needs room for following op to error out
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (55 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 056/182] NFSv4: Fix a use-after-free problem in open() Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 058/182] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT Jiri Slaby
` (126 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4c69d5855a16f7378648c5733632628fa10431db upstream.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4proc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 419572f33b72..622ede143585 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1349,6 +1349,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
/* If op is non-idempotent */
if (opdesc->op_flags & OP_MODIFIES_SOMETHING) {
plen = opdesc->op_rsize_bop(rqstp, op);
+ /*
+ * If there's still another operation, make sure
+ * we'll have space to at least encode an error:
+ */
+ if (resp->opcnt < args->opcnt)
+ plen += COMPOUND_ERR_SLACK_SPACE;
op->status = nfsd4_check_resp_size(resp, plen);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 058/182] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (56 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 057/182] nfsd4: session needs room for following op to error out Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 059/182] nfsd4: fix test_stateid error reply encoding Jiri Slaby
` (125 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Benny Halevy, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.
This was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39
"nfsd41: SUPPATTR_EXCLCREAT attribute".
Cc: Benny Halevy <bhalevy@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4xdr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index ecc735e30bea..0407ba4990e0 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2502,6 +2502,8 @@ out_acl:
goto out;
}
if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
+ if ((buflen -= 16) < 0)
+ goto out_resource;
WRITE32(3);
WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0);
WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 059/182] nfsd4: fix test_stateid error reply encoding
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (57 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 058/182] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 060/182] nfsd4: leave reply buffer space for failed setattr Jiri Slaby
` (124 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a11fcce1544df08c723d950ff0edef3adac40405 upstream.
If the entire operation fails then there's nothing to encode.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4xdr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 0407ba4990e0..4ab5ff492ca1 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3512,6 +3512,9 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, __be32 nfserr,
struct nfsd4_test_stateid_id *stateid, *next;
__be32 *p;
+ if (nfserr)
+ return nfserr;
+
RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids));
*p++ = htonl(test_stateid->ts_num_ids);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 060/182] nfsd4: leave reply buffer space for failed setattr
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (58 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 059/182] nfsd4: fix test_stateid error reply encoding Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 061/182] nfsd: notify_change needs elevated write count Jiri Slaby
` (123 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 04819bf6449094e62cebaf5199d85d68d711e667 upstream.
This fixes an ommission from 18032ca062e621e15683cb61c066ef3dc5414a7b
"NFSD: Server implementation of MAC Labeling", which increased the size
of the setattr error reply without increasing COMPOUND_ERR_SLACK_SPACE.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfsd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 30f34ab02137..479eb681c27c 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -282,7 +282,7 @@ void nfsd_lockd_shutdown(void);
* reason.
*/
#define COMPOUND_SLACK_SPACE 140 /* OP_GETFH */
-#define COMPOUND_ERR_SLACK_SPACE 12 /* OP_SETATTR */
+#define COMPOUND_ERR_SLACK_SPACE 16 /* OP_SETATTR */
#define NFSD_LAUNDROMAT_MINTIMEOUT 1 /* seconds */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 061/182] nfsd: notify_change needs elevated write count
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (59 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 060/182] nfsd4: leave reply buffer space for failed setattr Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 062/182] nfsd: check passed socket's net matches NFSd superblock's one Jiri Slaby
` (122 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.
Looks like this bug has been here since these write counts were
introduced, not sure why it was just noticed now.
Thanks also to Jan Kara for pointing out the problem.
Reported-by: Matthew Rahtz <mrahtz@rapitasystems.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/vfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 72cb28e73ca0..e9a80e4553a3 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -407,6 +407,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
umode_t ftype = 0;
__be32 err;
int host_err;
+ bool get_write_count;
int size_change = 0;
if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
@@ -414,10 +415,18 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
if (iap->ia_valid & ATTR_SIZE)
ftype = S_IFREG;
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+
/* Get inode */
err = fh_verify(rqstp, fhp, ftype, accmode);
if (err)
goto out;
+ if (get_write_count) {
+ host_err = fh_want_write(fhp);
+ if (host_err)
+ return nfserrno(host_err);
+ }
dentry = fhp->fh_dentry;
inode = dentry->d_inode;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 062/182] nfsd: check passed socket's net matches NFSd superblock's one
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (60 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 061/182] nfsd: notify_change needs elevated write count Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 063/182] nfsd4: fix setclientid encode size Jiri Slaby
` (121 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Stanislav Kinsbursky, J. Bruce Fields, Jiri Slaby
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3064639423c48d6e0eb9ecc27c512a58e38c6c57 upstream.
There could be a case, when NFSd file system is mounted in network, different
to socket's one, like below:
"ip netns exec" creates new network and mount namespace, which duplicates NFSd
mount point, created in init_net context. And thus NFS server stop in nested
network context leads to RPCBIND client destruction in init_net.
Then, on NFSd start in nested network context, rpc.nfsd process creates socket
in nested net and passes it into "write_ports", which leads to RPCBIND sockets
creation in init_net context because of the same reason (NFSd monut point was
created in init_net context). An attempt to register passed socket in nested
net leads to panic, because no RPCBIND client present in nexted network
namespace.
This patch add check that passed socket's net matches NFSd superblock's one.
And returns -EINVAL error to user psace otherwise.
v2: Put socket on exit.
Reported-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfsctl.c | 5 +++++
include/linux/sunrpc/svcsock.h | 1 +
net/sunrpc/svcsock.c | 16 ++++++++++++++++
3 files changed, 22 insertions(+)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 7f555179bf81..f34d9de802ab 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -699,6 +699,11 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net)
if (err != 0 || fd < 0)
return -EINVAL;
+ if (svc_alien_sock(net, fd)) {
+ printk(KERN_ERR "%s: socket net is different to NFSd's one\n", __func__);
+ return -EINVAL;
+ }
+
err = nfsd_create_serv(net);
if (err != 0)
return err;
diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
index 62fd1b756e99..947009ed5996 100644
--- a/include/linux/sunrpc/svcsock.h
+++ b/include/linux/sunrpc/svcsock.h
@@ -56,6 +56,7 @@ int svc_recv(struct svc_rqst *, long);
int svc_send(struct svc_rqst *);
void svc_drop(struct svc_rqst *);
void svc_sock_update_bufs(struct svc_serv *serv);
+bool svc_alien_sock(struct net *net, int fd);
int svc_addsock(struct svc_serv *serv, const int fd,
char *name_return, const size_t len);
void svc_init_xprt_sock(void);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 9c9caaa5e0d3..6ac0f1c3fc28 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1395,6 +1395,22 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
return svsk;
}
+bool svc_alien_sock(struct net *net, int fd)
+{
+ int err;
+ struct socket *sock = sockfd_lookup(fd, &err);
+ bool ret = false;
+
+ if (!sock)
+ goto out;
+ if (sock_net(sock->sk) != net)
+ ret = true;
+ sockfd_put(sock);
+out:
+ return ret;
+}
+EXPORT_SYMBOL_GPL(svc_alien_sock);
+
/**
* svc_addsock - add a listener socket to an RPC service
* @serv: pointer to RPC service to which to add a new listener
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 063/182] nfsd4: fix setclientid encode size
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (61 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 062/182] nfsd: check passed socket's net matches NFSd superblock's one Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 064/182] NFSD: Traverse unconfirmed client through hash-table Jiri Slaby
` (120 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, J. Bruce Fields, Jiri Slaby
From: "J. Bruce Fields" <bfields@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 480efaee085235bb848f1063f959bf144103c342 upstream.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 622ede143585..b9e784486729 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1519,7 +1519,8 @@ static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *o
static inline u32 nfsd4_setclientid_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
{
- return (op_encode_hdr_size + 2 + 1024) * sizeof(__be32);
+ return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) *
+ sizeof(__be32);
}
static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 064/182] NFSD: Traverse unconfirmed client through hash-table
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (62 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 063/182] nfsd4: fix setclientid encode size Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 065/182] nfsd: set timeparms.to_maxval in setup_callback_client Jiri Slaby
` (119 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kinglong Mee, J. Bruce Fields, Jiri Slaby
From: Kinglong Mee <kinglongmee@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2b9056359889c78ea5decb5b654a512c2e8a945c upstream.
When stopping nfsd, I got BUG messages, and soft lockup messages,
The problem is cuased by double rb_erase() in nfs4_state_destroy_net()
and destroy_client().
This patch just let nfsd traversing unconfirmed client through
hash-table instead of rbtree.
[ 2325.021995] BUG: unable to handle kernel NULL pointer dereference at
(null)
[ 2325.022809] IP: [<ffffffff8133c18c>] rb_erase+0x14c/0x390
[ 2325.022982] PGD 7a91b067 PUD 7a33d067 PMD 0
[ 2325.022982] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 2325.022982] Modules linked in: nfsd(OF) cfg80211 rfkill bridge stp
llc snd_intel8x0 snd_ac97_codec ac97_bus auth_rpcgss nfs_acl serio_raw
e1000 i2c_piix4 ppdev snd_pcm snd_timer lockd pcspkr joydev parport_pc
snd parport i2c_core soundcore microcode sunrpc ata_generic pata_acpi
[last unloaded: nfsd]
[ 2325.022982] CPU: 1 PID: 2123 Comm: nfsd Tainted: GF O
3.14.0-rc8+ #2
[ 2325.022982] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 2325.022982] task: ffff88007b384800 ti: ffff8800797f6000 task.ti:
ffff8800797f6000
[ 2325.022982] RIP: 0010:[<ffffffff8133c18c>] [<ffffffff8133c18c>]
rb_erase+0x14c/0x390
[ 2325.022982] RSP: 0018:ffff8800797f7d98 EFLAGS: 00010246
[ 2325.022982] RAX: ffff880079c1f010 RBX: ffff880079f4c828 RCX:
0000000000000000
[ 2325.022982] RDX: 0000000000000000 RSI: ffff880079bcb070 RDI:
ffff880079f4c810
[ 2325.022982] RBP: ffff8800797f7d98 R08: 0000000000000000 R09:
ffff88007964fc70
[ 2325.022982] R10: 0000000000000000 R11: 0000000000000400 R12:
ffff880079f4c800
[ 2325.022982] R13: ffff880079bcb000 R14: ffff8800797f7da8 R15:
ffff880079f4c860
[ 2325.022982] FS: 0000000000000000(0000) GS:ffff88007f900000(0000)
knlGS:0000000000000000
[ 2325.022982] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2325.022982] CR2: 0000000000000000 CR3: 000000007a3ef000 CR4:
00000000000006e0
[ 2325.022982] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2325.022982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 2325.022982] Stack:
[ 2325.022982] ffff8800797f7de0 ffffffffa0191c6e ffff8800797f7da8
ffff8800797f7da8
[ 2325.022982] ffff880079f4c810 ffff880079bcb000 ffffffff81cc26c0
ffff880079c1f010
[ 2325.022982] ffff880079bcb070 ffff8800797f7e28 ffffffffa01977f2
ffff8800797f7df0
[ 2325.022982] Call Trace:
[ 2325.022982] [<ffffffffa0191c6e>] destroy_client+0x32e/0x3b0 [nfsd]
[ 2325.022982] [<ffffffffa01977f2>] nfs4_state_shutdown_net+0x1a2/0x220
[nfsd]
[ 2325.022982] [<ffffffffa01700b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
[ 2325.022982] [<ffffffffa017013e>] nfsd_last_thread+0x4e/0x80 [nfsd]
[ 2325.022982] [<ffffffffa001f1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
[ 2325.022982] [<ffffffffa017064b>] nfsd_destroy+0x5b/0x80 [nfsd]
[ 2325.022982] [<ffffffffa0170773>] nfsd+0x103/0x130 [nfsd]
[ 2325.022982] [<ffffffffa0170670>] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 2325.022982] [<ffffffff810a8232>] kthread+0xd2/0xf0
[ 2325.022982] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 2325.022982] [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
[ 2325.022982] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 2325.022982] Code: 48 83 e1 fc 48 89 10 0f 84 02 01 00 00 48 3b 41 10
0f 84 08 01 00 00 48 89 51 08 48 89 fa e9 74 ff ff ff 0f 1f 40 00 48 8b
50 10 <f6> 02 01 0f 84 93 00 00 00 48 8b 7a 10 48 85 ff 74 05 f6 07 01
[ 2325.022982] RIP [<ffffffff8133c18c>] rb_erase+0x14c/0x390
[ 2325.022982] RSP <ffff8800797f7d98>
[ 2325.022982] CR2: 0000000000000000
[ 2325.022982] ---[ end trace 28c27ed011655e57 ]---
[ 228.064071] BUG: soft lockup - CPU#0 stuck for 22s! [nfsd:558]
[ 228.064428] Modules linked in: ip6t_rpfilter ip6t_REJECT cfg80211
xt_conntrack rfkill ebtable_nat ebtable_broute bridge stp llc
ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw
ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4
nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security
iptable_raw nfsd(OF) auth_rpcgss nfs_acl lockd snd_intel8x0
snd_ac97_codec ac97_bus joydev snd_pcm snd_timer e1000 sunrpc snd ppdev
parport_pc serio_raw pcspkr i2c_piix4 microcode parport soundcore
i2c_core ata_generic pata_acpi
[ 228.064539] CPU: 0 PID: 558 Comm: nfsd Tainted: GF O
3.14.0-rc8+ #2
[ 228.064539] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 228.064539] task: ffff880076adec00 ti: ffff880074616000 task.ti:
ffff880074616000
[ 228.064539] RIP: 0010:[<ffffffff8133ba17>] [<ffffffff8133ba17>]
rb_next+0x27/0x50
[ 228.064539] RSP: 0018:ffff880074617de0 EFLAGS: 00000282
[ 228.064539] RAX: ffff880074478010 RBX: ffff88007446f860 RCX:
0000000000000014
[ 228.064539] RDX: ffff880074478010 RSI: 0000000000000000 RDI:
ffff880074478010
[ 228.064539] RBP: ffff880074617de0 R08: 0000000000000000 R09:
0000000000000012
[ 228.064539] R10: 0000000000000001 R11: ffffffffffffffec R12:
ffffea0001d11a00
[ 228.064539] R13: ffff88007f401400 R14: ffff88007446f800 R15:
ffff880074617d50
[ 228.064539] FS: 0000000000000000(0000) GS:ffff88007f800000(0000)
knlGS:0000000000000000
[ 228.064539] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 228.064539] CR2: 00007fe9ac6ec000 CR3: 000000007a5d6000 CR4:
00000000000006f0
[ 228.064539] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 228.064539] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 228.064539] Stack:
[ 228.064539] ffff880074617e28 ffffffffa01ab7db ffff880074617df0
ffff880074617df0
[ 228.064539] ffff880079273000 ffffffff81cc26c0 ffffffff81cc26c0
0000000000000000
[ 228.064539] 0000000000000000 ffff880074617e48 ffffffffa01840b8
ffffffff81cc26c0
[ 228.064539] Call Trace:
[ 228.064539] [<ffffffffa01ab7db>] nfs4_state_shutdown_net+0x18b/0x220
[nfsd]
[ 228.064539] [<ffffffffa01840b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
[ 228.064539] [<ffffffffa018413e>] nfsd_last_thread+0x4e/0x80 [nfsd]
[ 228.064539] [<ffffffffa00aa1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
[ 228.064539] [<ffffffffa018464b>] nfsd_destroy+0x5b/0x80 [nfsd]
[ 228.064539] [<ffffffffa0184773>] nfsd+0x103/0x130 [nfsd]
[ 228.064539] [<ffffffffa0184670>] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 228.064539] [<ffffffff810a8232>] kthread+0xd2/0xf0
[ 228.064539] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 228.064539] [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
[ 228.064539] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 228.064539] Code: 1f 44 00 00 55 48 8b 17 48 89 e5 48 39 d7 74 3b 48
8b 47 08 48 85 c0 75 0e eb 25 66 0f 1f 84 00 00 00 00 00 48 89 d0 48 8b
50 10 <48> 85 d2 75 f4 5d c3 66 90 48 3b 78 08 75 f6 48 8b 10 48 89 c7
Fixes: ac55fdc408039 (nfsd: move the confirmed and unconfirmed hlists...)
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4state.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 0874998a49cd..5cbdf38ffc66 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5048,7 +5048,6 @@ nfs4_state_destroy_net(struct net *net)
int i;
struct nfs4_client *clp = NULL;
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- struct rb_node *node, *tmp;
for (i = 0; i < CLIENT_HASH_SIZE; i++) {
while (!list_empty(&nn->conf_id_hashtbl[i])) {
@@ -5057,13 +5056,11 @@ nfs4_state_destroy_net(struct net *net)
}
}
- node = rb_first(&nn->unconf_name_tree);
- while (node != NULL) {
- tmp = node;
- node = rb_next(tmp);
- clp = rb_entry(tmp, struct nfs4_client, cl_namenode);
- rb_erase(tmp, &nn->unconf_name_tree);
- destroy_client(clp);
+ for (i = 0; i < CLIENT_HASH_SIZE; i++) {
+ while (!list_empty(&nn->unconf_id_hashtbl[i])) {
+ clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
+ destroy_client(clp);
+ }
}
kfree(nn->sessionid_hashtbl);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 065/182] nfsd: set timeparms.to_maxval in setup_callback_client
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (63 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 064/182] NFSD: Traverse unconfirmed client through hash-table Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 066/182] IB/ipath: Fix potential buffer overrun in sending diag packet routine Jiri Slaby
` (118 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jeff Layton, J. Bruce Fields, Jiri Slaby
From: Jeff Layton <jlayton@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3758cf7e14b753838fe754ede3862af10b35fdac upstream.
...otherwise the logic in the timeout handling doesn't work correctly.
Spotted-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/nfsd/nfs4callback.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 7f05cd140de3..3eaa6e30a2dc 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -637,9 +637,11 @@ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc
static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
{
+ int maxtime = max_cb_time(clp->net);
struct rpc_timeout timeparms = {
- .to_initval = max_cb_time(clp->net),
+ .to_initval = maxtime,
.to_retries = 0,
+ .to_maxval = maxtime,
};
struct rpc_create_args args = {
.net = clp->net,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 066/182] IB/ipath: Fix potential buffer overrun in sending diag packet routine
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (64 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 065/182] nfsd: set timeparms.to_maxval in setup_callback_client Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:26 ` [PATCH 3.12 067/182] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL Jiri Slaby
` (117 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dennis Dalessandro, Roland Dreier, Jiri Slaby
From: Dennis Dalessandro <dennis.dalessandro@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a2cb0eb8a64adb29a99fd864013de957028f36ae upstream.
Guard against a potential buffer overrun. The size to read from the
user is passed in, and due to the padding that needs to be taken into
account, as well as the place holder for the ICRC it is possible to
overflow the 32bit value which would cause more data to be copied from
user space than is allocated in the buffer.
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/ipath/ipath_diag.c | 66 ++++++++++++--------------------
1 file changed, 25 insertions(+), 41 deletions(-)
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index 714293b78518..e2f9a51f4a38 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -326,7 +326,7 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
size_t count, loff_t *off)
{
u32 __iomem *piobuf;
- u32 plen, clen, pbufn;
+ u32 plen, pbufn, maxlen_reserve;
struct ipath_diag_pkt odp;
struct ipath_diag_xpkt dp;
u32 *tmpbuf = NULL;
@@ -335,51 +335,29 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
u64 val;
u32 l_state, lt_state; /* LinkState, LinkTrainingState */
- if (count < sizeof(odp)) {
- ret = -EINVAL;
- goto bail;
- }
if (count == sizeof(dp)) {
if (copy_from_user(&dp, data, sizeof(dp))) {
ret = -EFAULT;
goto bail;
}
- } else if (copy_from_user(&odp, data, sizeof(odp))) {
- ret = -EFAULT;
+ } else if (count == sizeof(odp)) {
+ if (copy_from_user(&odp, data, sizeof(odp))) {
+ ret = -EFAULT;
+ goto bail;
+ }
+ } else {
+ ret = -EINVAL;
goto bail;
}
- /*
- * Due to padding/alignment issues (lessened with new struct)
- * the old and new structs are the same length. We need to
- * disambiguate them, which we can do because odp.len has never
- * been less than the total of LRH+BTH+DETH so far, while
- * dp.unit (same offset) unit is unlikely to get that high.
- * Similarly, dp.data, the pointer to user at the same offset
- * as odp.unit, is almost certainly at least one (512byte)page
- * "above" NULL. The if-block below can be omitted if compatibility
- * between a new driver and older diagnostic code is unimportant.
- * compatibility the other direction (new diags, old driver) is
- * handled in the diagnostic code, with a warning.
- */
- if (dp.unit >= 20 && dp.data < 512) {
- /* very probable version mismatch. Fix it up */
- memcpy(&odp, &dp, sizeof(odp));
- /* We got a legacy dp, copy elements to dp */
- dp.unit = odp.unit;
- dp.data = odp.data;
- dp.len = odp.len;
- dp.pbc_wd = 0; /* Indicate we need to compute PBC wd */
- }
-
/* send count must be an exact number of dwords */
if (dp.len & 3) {
ret = -EINVAL;
goto bail;
}
- clen = dp.len >> 2;
+ plen = dp.len >> 2;
dd = ipath_lookup(dp.unit);
if (!dd || !(dd->ipath_flags & IPATH_PRESENT) ||
@@ -422,16 +400,22 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
goto bail;
}
- /* need total length before first word written */
- /* +1 word is for the qword padding */
- plen = sizeof(u32) + dp.len;
-
- if ((plen + 4) > dd->ipath_ibmaxlen) {
+ /*
+ * need total length before first word written, plus 2 Dwords. One Dword
+ * is for padding so we get the full user data when not aligned on
+ * a word boundary. The other Dword is to make sure we have room for the
+ * ICRC which gets tacked on later.
+ */
+ maxlen_reserve = 2 * sizeof(u32);
+ if (dp.len > dd->ipath_ibmaxlen - maxlen_reserve) {
ipath_dbg("Pkt len 0x%x > ibmaxlen %x\n",
- plen - 4, dd->ipath_ibmaxlen);
+ dp.len, dd->ipath_ibmaxlen);
ret = -EINVAL;
- goto bail; /* before writing pbc */
+ goto bail;
}
+
+ plen = sizeof(u32) + dp.len;
+
tmpbuf = vmalloc(plen);
if (!tmpbuf) {
dev_info(&dd->pcidev->dev, "Unable to allocate tmp buffer, "
@@ -473,11 +457,11 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
*/
if (dd->ipath_flags & IPATH_PIO_FLUSH_WC) {
ipath_flush_wc();
- __iowrite32_copy(piobuf + 2, tmpbuf, clen - 1);
+ __iowrite32_copy(piobuf + 2, tmpbuf, plen - 1);
ipath_flush_wc();
- __raw_writel(tmpbuf[clen - 1], piobuf + clen + 1);
+ __raw_writel(tmpbuf[plen - 1], piobuf + plen + 1);
} else
- __iowrite32_copy(piobuf + 2, tmpbuf, clen);
+ __iowrite32_copy(piobuf + 2, tmpbuf, plen);
ipath_flush_wc();
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 067/182] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (65 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 066/182] IB/ipath: Fix potential buffer overrun in sending diag packet routine Jiri Slaby
@ 2014-05-13 9:26 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 068/182] IB/mthca: Return an error on ib_copy_to_udata() failure Jiri Slaby
` (116 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:26 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Yann Droneaud, Roland Dreier, Jiri Slaby
From: Yann Droneaud <ydroneaud@opteya.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9d194d1025f463392feafa26ff8c2d8247f71be1 upstream.
In case of error while accessing to userspace memory, function
nes_create_qp() returns NULL instead of an error code wrapped through
ERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it
check for error with IS_ERR().
As page 0 is likely not mapped, it is going to trigger an Oops when
the kernel will try to dereference NULL pointer to access to struct
ib_qp's fields.
In some rare cases, page 0 could be mapped by userspace, which could
turn this bug to a vulnerability that could be exploited: the function
pointers in struct ib_device will be under userspace total control.
This was caught when using spatch (aka. coccinelle)
to rewrite calls to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/nes/nes_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 5b53ca5a2284..09999cdec3b1 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1186,7 +1186,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
kfree(nesqp->allocated_buffer);
nes_debug(NES_DBG_QP, "ib_copy_from_udata() Failed \n");
- return NULL;
+ return ERR_PTR(-EFAULT);
}
if (req.user_wqe_buffers) {
virt_wqs = 1;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 068/182] IB/mthca: Return an error on ib_copy_to_udata() failure
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (66 preceding siblings ...)
2014-05-13 9:26 ` [PATCH 3.12 067/182] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 069/182] IB/ehca: Returns " Jiri Slaby
` (115 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Yann Droneaud, Roland Dreier, Jiri Slaby
From: Yann Droneaud <ydroneaud@opteya.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 08e74c4b00c30c232d535ff368554959403d0432 upstream.
In case of error when writing to userspace, the function mthca_create_cq()
does not set an error code before following its error path.
This patch sets the error code to -EFAULT when ib_copy_to_udata() fails.
This was caught when using spatch (aka. coccinelle)
to rewrite call to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/mthca/mthca_provider.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 5b71d43bd89c..42dde06fdb91 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -695,6 +695,7 @@ static struct ib_cq *mthca_create_cq(struct ib_device *ibdev, int entries,
if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) {
mthca_free_cq(to_mdev(ibdev), cq);
+ err = -EFAULT;
goto err_free;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 069/182] IB/ehca: Returns an error on ib_copy_to_udata() failure
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (67 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 068/182] IB/mthca: Return an error on ib_copy_to_udata() failure Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 070/182] IB/qib: Fix debugfs ordering issue with multiple HCAs Jiri Slaby
` (114 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Yann Droneaud, Roland Dreier, Jiri Slaby
From: Yann Droneaud <ydroneaud@opteya.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5bdb0f02add5994b0bc17494f4726925ca5d6ba1 upstream.
In case of error when writing to userspace, function ehca_create_cq()
does not set an error code before following its error path.
This patch sets the error code to -EFAULT when ib_copy_to_udata()
fails.
This was caught when using spatch (aka. coccinelle)
to rewrite call to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/ehca/ehca_cq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 212150c25ea0..8cc837537768 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -283,6 +283,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
(my_cq->galpas.user.fw_handle & (PAGE_SIZE - 1));
if (ib_copy_to_udata(udata, &resp, sizeof(resp))) {
ehca_err(device, "Copy to udata failed.");
+ cq = ERR_PTR(-EFAULT);
goto create_cq_exit4;
}
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 070/182] IB/qib: Fix debugfs ordering issue with multiple HCAs
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (68 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 069/182] IB/ehca: Returns " Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 071/182] IB/qib: add missing braces in do_qib_user_sdma_queue_create() Jiri Slaby
` (113 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mike Marciniszyn, Roland Dreier, Jiri Slaby
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f8b6c47a44c063062317646683a73371c24c69ee upstream.
The debugfs init code was incorrectly called before the idr mechanism
is used to get the unit number, so the dd->unit hasn't been
initialized. This caused the unit relative directory creation to fail
after the first.
This patch moves the init for the debugfs stuff until after all of the
failures and after the unit number has been determined.
A bug in unwind code in qib_alloc_devdata() is also fixed.
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/qib/qib_init.c | 25 +++++++++++--------------
1 file changed, 11 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 24e802f4ea2f..76c3e177164d 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1097,14 +1097,10 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
int ret;
dd = (struct qib_devdata *) ib_alloc_device(sizeof(*dd) + extra);
- if (!dd) {
- dd = ERR_PTR(-ENOMEM);
- goto bail;
- }
+ if (!dd)
+ return ERR_PTR(-ENOMEM);
-#ifdef CONFIG_DEBUG_FS
- qib_dbg_ibdev_init(&dd->verbs_dev);
-#endif
+ INIT_LIST_HEAD(&dd->list);
idr_preload(GFP_KERNEL);
spin_lock_irqsave(&qib_devs_lock, flags);
@@ -1121,11 +1117,6 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
if (ret < 0) {
qib_early_err(&pdev->dev,
"Could not allocate unit ID: error %d\n", -ret);
-#ifdef CONFIG_DEBUG_FS
- qib_dbg_ibdev_exit(&dd->verbs_dev);
-#endif
- ib_dealloc_device(&dd->verbs_dev.ibdev);
- dd = ERR_PTR(ret);
goto bail;
}
@@ -1139,9 +1130,15 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
qib_early_err(&pdev->dev,
"Could not alloc cpulist info, cpu affinity might be wrong\n");
}
-
-bail:
+#ifdef CONFIG_DEBUG_FS
+ qib_dbg_ibdev_init(&dd->verbs_dev);
+#endif
return dd;
+bail:
+ if (!list_empty(&dd->list))
+ list_del_init(&dd->list);
+ ib_dealloc_device(&dd->verbs_dev.ibdev);
+ return ERR_PTR(ret);;
}
/*
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 071/182] IB/qib: add missing braces in do_qib_user_sdma_queue_create()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (69 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 070/182] IB/qib: Fix debugfs ordering issue with multiple HCAs Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 072/182] ib_srpt: Use correct ib_sg_dma primitives Jiri Slaby
` (112 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Yann Droneaud, Mike Marciniszyn, infinipath,
Julia Lawall, cocci, Roland Dreier, Jiri Slaby
From: Yann Droneaud <ydroneaud@opteya.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 37a967651caf99dd267017023737bd442f5acb3d upstream.
Commit c804f07248895ff9c moved qib_assign_ctxt() to
do_qib_user_sdma_queue_create() but dropped the braces
around the statements.
This was spotted by coccicheck (coccinelle/spatch):
$ make C=2 CHECK=scripts/coccicheck drivers/infiniband/hw/qib/
CHECK drivers/infiniband/hw/qib/qib_file_ops.c
drivers/infiniband/hw/qib/qib_file_ops.c:1583:2-23: code aligned with following code on line 1587
This patch adds braces back.
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
Cc: infinipath@intel.com
Cc: Julia Lawall <julia.lawall@lip6.fr>
Cc: cocci@systeme.lip6.fr
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Acked-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/hw/qib/qib_file_ops.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 275f247f9fca..2023cd61b897 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -1578,7 +1578,7 @@ static int do_qib_user_sdma_queue_create(struct file *fp)
struct qib_ctxtdata *rcd = fd->rcd;
struct qib_devdata *dd = rcd->dd;
- if (dd->flags & QIB_HAS_SEND_DMA)
+ if (dd->flags & QIB_HAS_SEND_DMA) {
fd->pq = qib_user_sdma_queue_create(&dd->pcidev->dev,
dd->unit,
@@ -1586,6 +1586,7 @@ static int do_qib_user_sdma_queue_create(struct file *fp)
fd->subctxt);
if (!fd->pq)
return -ENOMEM;
+ }
return 0;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 072/182] ib_srpt: Use correct ib_sg_dma primitives
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (70 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 071/182] IB/qib: add missing braces in do_qib_user_sdma_queue_create() Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 073/182] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc() Jiri Slaby
` (111 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Mike Marciniszyn, Bart Van Assche,
Nicholas Bellinger, Jiri Slaby
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.
The code was incorrectly using sg_dma_address() and
sg_dma_len() instead of ib_sg_dma_address() and
ib_sg_dma_len().
This prevents srpt from functioning with the
Intel HCA and indeed will corrupt memory
badly.
Cc: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Tested-by: Vinod Kumar <vinod.kumar@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 6c923c7039a1..56f2cf790779 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(struct srpt_rdma_ch *ch,
static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
struct srpt_send_ioctx *ioctx)
{
+ struct ib_device *dev = ch->sport->sdev->device;
struct se_cmd *cmd;
struct scatterlist *sg, *sg_orig;
int sg_cnt;
@@ -1124,7 +1125,7 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
db = ioctx->rbufs;
tsize = cmd->data_length;
- dma_len = sg_dma_len(&sg[0]);
+ dma_len = ib_sg_dma_len(dev, &sg[0]);
riu = ioctx->rdma_ius;
/*
@@ -1155,7 +1156,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
++j;
if (j < count) {
sg = sg_next(sg);
- dma_len = sg_dma_len(sg);
+ dma_len = ib_sg_dma_len(
+ dev, sg);
}
}
} else {
@@ -1192,8 +1194,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
tsize = cmd->data_length;
riu = ioctx->rdma_ius;
sg = sg_orig;
- dma_len = sg_dma_len(&sg[0]);
- dma_addr = sg_dma_address(&sg[0]);
+ dma_len = ib_sg_dma_len(dev, &sg[0]);
+ dma_addr = ib_sg_dma_address(dev, &sg[0]);
/* this second loop is really mapped sg_addres to rdma_iu->ib_sge */
for (i = 0, j = 0;
@@ -1216,8 +1218,10 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
++j;
if (j < count) {
sg = sg_next(sg);
- dma_len = sg_dma_len(sg);
- dma_addr = sg_dma_address(sg);
+ dma_len = ib_sg_dma_len(
+ dev, sg);
+ dma_addr = ib_sg_dma_address(
+ dev, sg);
}
}
} else {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 073/182] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (71 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 072/182] ib_srpt: Use correct ib_sg_dma primitives Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 074/182] SCSI: arcmsr: upper 32 of dma address lost Jiri Slaby
` (110 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dan Carpenter, James Bottomley, Jiri Slaby
From: Dan Carpenter <dan.carpenter@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b2a72ec32d0f499aaadf41264232517a12326df0 upstream.
qla2x00_mem_alloc() returns 1 on success and -ENOMEM on failure. On the
one hand the caller assumes non-zero is success but on the other hand
the caller also assumes that it returns an error code.
I've fixed it to return zero on success and a negative error code on
failure. This matches the documentation as well.
[jejb: checkpatch fix]
Fixes: e315cd28b9ef ('[SCSI] qla2xxx: Code changes for qla data structure refactoring')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/qla2xxx/qla_os.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 9f01bbbf3a26..36d62fd53511 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2616,7 +2616,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
ha->flags.enable_64bit_addressing ? "enable" :
"disable");
ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
- if (!ret) {
+ if (ret) {
ql_log_pci(ql_log_fatal, pdev, 0x0031,
"Failed to allocate memory for adapter, aborting.\n");
@@ -3541,10 +3541,10 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
else {
qla2x00_set_reserved_loop_ids(ha);
ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
- "loop_id_map=%p. \n", ha->loop_id_map);
+ "loop_id_map=%p.\n", ha->loop_id_map);
}
- return 1;
+ return 0;
fail_async_pd:
dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 074/182] SCSI: arcmsr: upper 32 of dma address lost
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (72 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 073/182] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc() Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 075/182] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug Jiri Slaby
` (109 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dan Carpenter, James Bottomley, Jiri Slaby
From: Dan Carpenter <dan.carpenter@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.
The original code always set the upper 32 bits to zero because it was
doing a shift of the wrong variable.
Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 278c9fa62067..1822cb9ec623 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2501,16 +2501,15 @@ static int arcmsr_polling_ccbdone(struct AdapterControlBlock *acb,
static int arcmsr_iop_confirm(struct AdapterControlBlock *acb)
{
uint32_t cdb_phyaddr, cdb_phyaddr_hi32;
- dma_addr_t dma_coherent_handle;
+
/*
********************************************************************
** here we need to tell iop 331 our freeccb.HighPart
** if freeccb.HighPart is not zero
********************************************************************
*/
- dma_coherent_handle = acb->dma_coherent_handle;
- cdb_phyaddr = (uint32_t)(dma_coherent_handle);
- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16);
+ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle);
+ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle);
acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32;
/*
***********************************************************************
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 075/182] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (73 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 074/182] SCSI: arcmsr: upper 32 of dma address lost Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 076/182] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist Jiri Slaby
` (108 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Nicholas Bellinger, Jiri Slaby
From: Nicholas Bellinger <nab@linux-iscsi.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.
This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
where during ERL=2 connection recovery, a bogus conn_p pointer could
end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
notifying the initiator that cmd->logout_cid has failed.
The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
a bogus conn_p pointer in iscsit_build_conn_drop_async_message().
Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/target/iscsi/iscsi_target.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index b5e574659785..b47c2be1c427 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -2476,6 +2476,7 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn)
{
struct iscsi_cmd *cmd;
struct iscsi_conn *conn_p;
+ bool found = false;
/*
* Only send a Asynchronous Message on connections whos network
@@ -2484,11 +2485,12 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn)
list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
iscsit_inc_conn_usage_count(conn_p);
+ found = true;
break;
}
}
- if (!conn_p)
+ if (!found)
return;
cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 076/182] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (74 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 075/182] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 077/182] target/tcm_fc: Fix use-after-free of ft_tpg Jiri Slaby
` (107 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Martin Svec, Nicholas Bellinger, Jiri Slaby
From: Martin Svec <martin.svec@zoner.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a1e1774c6dfa3a524dd8df51ca95185fe5ef3247 upstream.
When compiled with CONFIG_DEBUG_SG set, uninitialized SGL leads
to BUG() in compare_and_write_callback().
Signed-off-by: Martin Svec <martin.svec@zoner.cz>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/target/target_core_sbc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index d9b92b2c524d..e84149895af2 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -409,13 +409,14 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
goto out;
}
- write_sg = kzalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
+ write_sg = kmalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
GFP_KERNEL);
if (!write_sg) {
pr_err("Unable to allocate compare_and_write sg\n");
ret = TCM_OUT_OF_RESOURCES;
goto out;
}
+ sg_init_table(write_sg, cmd->t_data_nents);
/*
* Setup verify and write data payloads from total NumberLBAs.
*/
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 077/182] target/tcm_fc: Fix use-after-free of ft_tpg
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (75 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 076/182] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 078/182] x86/efi: Correct EFI boot stub use of code32_start Jiri Slaby
` (106 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Andy Grover, Nicholas Bellinger, Jiri Slaby
From: Andy Grover <agrover@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.
ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
tport when the tpg is being removed. Set this pointer in ft_tport_create,
or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
a deleted object.
This patch sets tpg->tport in ft_tport_create, because that's what
ft_del_tpg checks, and is the only way to get back to the tport to
clear tport->tpg.
The bug was occuring when:
- lport created, tport (our per-lport, per-provider context) is
allocated.
tport->tpg = NULL
- tpg created
- a PRLI is received. ft_tport_create is called, tpg is found and
tport->tpg is set
- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
set, tport->tpg is not cleared and points at freed memory
- Future calls to ft_tport_create return tport via first conditional,
instead of searching for new tpg by calling ft_lport_find_tpg.
tport->tpg is still invalid, and will access freed memory.
see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/target/tcm_fc/tfc_sess.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 4859505ae2ed..639fdb395fb7 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -68,6 +68,7 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport)
if (tport) {
tport->tpg = tpg;
+ tpg->tport = tport;
return tport;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 078/182] x86/efi: Correct EFI boot stub use of code32_start
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (76 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 077/182] target/tcm_fc: Fix use-after-free of ft_tpg Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 079/182] reiserfs: fix race in readdir Jiri Slaby
` (105 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Matt Fleming, Matt Fleming, Jiri Slaby
From: Matt Fleming <matt@console-pimps.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7e8213c1f3acc064aef37813a39f13cbfe7c3ce7 upstream.
code32_start should point at the start of the protected mode code, and
*not* at the beginning of the bzImage. This is much easier to do in
assembly so document that callers of make_boot_params() need to fill out
code32_start.
The fallout from this bug is that we would end up relocating the image
but copying the image at some offset, resulting in what appeared to be
memory corruption.
Reported-by: Thomas Bächler <thomas@archlinux.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/boot/compressed/eboot.c | 5 +++--
arch/x86/boot/compressed/head_32.S | 14 ++++++++------
arch/x86/boot/compressed/head_64.S | 9 +++------
3 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index b7388a425f09..9b883a89aad5 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -865,6 +865,9 @@ fail:
* Because the x86 boot code expects to be passed a boot_params we
* need to create one ourselves (usually the bootloader would create
* one for us).
+ *
+ * The caller is responsible for filling out ->code32_start in the
+ * returned boot_params.
*/
struct boot_params *make_boot_params(void *handle, efi_system_table_t *_table)
{
@@ -921,8 +924,6 @@ struct boot_params *make_boot_params(void *handle, efi_system_table_t *_table)
hdr->vid_mode = 0xffff;
hdr->boot_flag = 0xAA55;
- hdr->code32_start = (__u64)(unsigned long)image->image_base;
-
hdr->type_of_loader = 0x21;
/* Convert unicode cmdline to ascii */
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 5d6f6891b188..b1bd969e26aa 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -50,6 +50,13 @@ ENTRY(efi_pe_entry)
pushl %eax
pushl %esi
pushl %ecx
+
+ call reloc
+reloc:
+ popl %ecx
+ subl reloc, %ecx
+ movl %ecx, BP_code32_start(%eax)
+
sub $0x4, %esp
ENTRY(efi_stub_entry)
@@ -63,12 +70,7 @@ ENTRY(efi_stub_entry)
hlt
jmp 1b
2:
- call 3f
-3:
- popl %eax
- subl $3b, %eax
- subl BP_pref_address(%esi), %eax
- add BP_code32_start(%esi), %eax
+ movl BP_code32_start(%esi), %eax
leal preferred_addr(%eax), %eax
jmp *%eax
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index c337422b575d..a55840367359 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -215,6 +215,8 @@ ENTRY(efi_pe_entry)
cmpq $0,%rax
je 1f
mov %rax, %rdx
+ leaq startup_32(%rip), %rax
+ movl %eax, BP_code32_start(%rdx)
popq %rsi
popq %rdi
@@ -228,12 +230,7 @@ ENTRY(efi_stub_entry)
hlt
jmp 1b
2:
- call 3f
-3:
- popq %rax
- subq $3b, %rax
- subq BP_pref_address(%rsi), %rax
- add BP_code32_start(%esi), %eax
+ movl BP_code32_start(%esi), %eax
leaq preferred_addr(%rax), %rax
jmp *%rax
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 079/182] reiserfs: fix race in readdir
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (77 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 078/182] x86/efi: Correct EFI boot stub use of code32_start Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 080/182] usb: gadget: tcm_usb_gadget: stop format strings Jiri Slaby
` (104 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jeff Mahoney, Jan Kara, Jiri Slaby
From: Jeff Mahoney <jeffm@suse.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 01d8885785a60ae8f4c37b0ed75bdc96d0fc6a44 upstream.
jdm-20004 reiserfs_delete_xattrs: Couldn't delete all xattrs (-2)
The -ENOENT is due to readdir calling dir_emit on the same entry twice.
If the dir_emit callback sleeps and the tree is changed underneath us,
we won't be able to trust deh_offset(deh) anymore. We need to save
next_pos before we might sleep so we can find the next entry.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/reiserfs/dir.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index 1fd2051109a3..af677353a3f5 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -125,6 +125,7 @@ int reiserfs_readdir_inode(struct inode *inode, struct dir_context *ctx)
int d_reclen;
char *d_name;
ino_t d_ino;
+ loff_t cur_pos = deh_offset(deh);
if (!de_visible(deh))
/* it is hidden entry */
@@ -196,8 +197,9 @@ int reiserfs_readdir_inode(struct inode *inode, struct dir_context *ctx)
if (local_buf != small_buf) {
kfree(local_buf);
}
- // next entry should be looked for with such offset
- next_pos = deh_offset(deh) + 1;
+
+ /* deh_offset(deh) may be invalid now. */
+ next_pos = cur_pos + 1;
if (item_moved(&tmp_ih, &path_to_entry)) {
set_cpu_key_k_offset(&pos_key,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 080/182] usb: gadget: tcm_usb_gadget: stop format strings
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (78 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 079/182] reiserfs: fix race in readdir Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 081/182] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled Jiri Slaby
` (103 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kees Cook, Jiri Slaby
From: Kees Cook <keescook@chromium.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aba37fd975f0dd58e025c99c2a79b61b20190831 upstream.
This makes sure that the name coming out of configfs cannot be used
accidentally as a format string.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/gadget/tcm_usb_gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 0ff33396eef3..d9e15e85258d 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -1613,7 +1613,7 @@ static struct se_wwn *usbg_make_tport(
return ERR_PTR(-ENOMEM);
}
tport->tport_wwpn = wwpn;
- snprintf(tport->tport_name, sizeof(tport->tport_name), wnn_name);
+ snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
return &tport->tport_wwn;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 081/182] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (79 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 080/182] usb: gadget: tcm_usb_gadget: stop format strings Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 082/182] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1 Jiri Slaby
` (102 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Gregory CLEMENT, Felipe Balbi, Jiri Slaby
From: Gregory CLEMENT <gregory.clement@free-electrons.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d8eb6c653ef6b323d630de3c5685478469e248bc upstream.
commit 511f3c5 (usb: gadget: udc-core: fix a regression during gadget driver
unbinding) introduced a crash when DEBUG is enabled.
The debug trace in the atmel_usba_stop function made the assumption that the
driver pointer passed in parameter was not NULL, but since the commit above,
such assumption was no longer always true.
This commit now uses the driver pointer stored in udc which fixes this
issue.
[ balbi@ti.com : improved commit log a bit ]
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/gadget/atmel_usba_udc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index 2cb52e0438df..1e53092e93c5 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -1827,12 +1827,12 @@ static int atmel_usba_stop(struct usb_gadget *gadget,
toggle_bias(0);
usba_writel(udc, CTRL, USBA_DISABLE_MASK);
- udc->driver = NULL;
-
clk_disable_unprepare(udc->hclk);
clk_disable_unprepare(udc->pclk);
- DBG(DBG_GADGET, "unregistered driver `%s'\n", driver->driver.name);
+ DBG(DBG_GADGET, "unregistered driver `%s'\n", udc->driver->driver.name);
+
+ udc->driver = NULL;
return 0;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 082/182] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (80 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 081/182] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 083/182] xhci: Prevent runtime pm from autosuspending during initialization Jiri Slaby
` (101 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Roger Quadros, Felipe Balbi, Jiri Slaby
From: Roger Quadros <rogerq@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9c1b70361e0b38e4acb8e62b54da66538cb77ff2 upstream.
It was impossible to enumerate on a SuperSpeed (XHCI) host
with alternate setting = 1 due to the wrongly set 'bMaxBurst'
field in the SuperSpeed Endpoint Companion descriptor.
Testcase:
<host> modprobe -r usbtest; modprobe usbtest alt=1
<device> modprobe g_zero
plug device to SuperSpeed port on the host.
Without this patch the host always complains like so
"usb 12-2: Not enough bandwidth for new device state.
usb 12-2: Not enough bandwidth for altsetting 1"
Bug was introduced by commit cf9a08ae in v3.9
Fixes: cf9a08ae5aec (usb: gadget: convert source sink and loopback to
new function interface)
Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/gadget/zero.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 0deb9d6cde26..d31814c7238f 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -280,7 +280,7 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
ss_opts->isoc_interval = gzero_options.isoc_interval;
ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
ss_opts->isoc_mult = gzero_options.isoc_mult;
- ss_opts->isoc_maxburst = gzero_options.isoc_maxpacket;
+ ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
ss_opts->bulk_buflen = gzero_options.bulk_buflen;
func_ss = usb_get_function(func_inst_ss);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 083/182] xhci: Prevent runtime pm from autosuspending during initialization
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (81 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 082/182] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1 Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 084/182] xhci: Switch Intel Lynx Point ports to EHCI on shutdown Jiri Slaby
` (100 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mathias Nyman, Sarah Sharp, Jiri Slaby
From: Mathias Nyman <mathias.nyman@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bcffae7708eb8352f44dc510b326541fe43a02a4 upstream.
xHCI driver has its own pci probe function that will call usb_hcd_pci_probe
to register its usb-2 bus, and then continue to manually register the
usb-3 bus. usb_hcd_pci_probe does a pm_runtime_put_noidle at the end and
might thus trigger a runtime suspend before the usb-3 bus is ready.
Prevent the runtime suspend by increasing the usage count in the
beginning of xhci_pci_probe, and decrease it once the usb-3 bus is
ready.
xhci-platform driver is not using usb_hcd_pci_probe to set up
busses and should not need to have it's usage count increased during probe.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-pci.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 1af67a214d33..d06922469000 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -190,6 +190,10 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
struct usb_hcd *hcd;
driver = (struct hc_driver *)id->driver_data;
+
+ /* Prevent runtime suspending between USB-2 and USB-3 initialization */
+ pm_runtime_get_noresume(&dev->dev);
+
/* Register the USB 2.0 roothub.
* FIXME: USB core must know to register the USB 2.0 roothub first.
* This is sort of silly, because we could just set the HCD driver flags
@@ -199,7 +203,7 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
retval = usb_hcd_pci_probe(dev, id);
if (retval)
- return retval;
+ goto put_runtime_pm;
/* USB 2.0 roothub is stored in the PCI device now. */
hcd = dev_get_drvdata(&dev->dev);
@@ -228,12 +232,17 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
if (xhci->quirks & XHCI_LPM_SUPPORT)
hcd_to_bus(xhci->shared_hcd)->root_hub->lpm_capable = 1;
+ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ pm_runtime_put_noidle(&dev->dev);
+
return 0;
put_usb3_hcd:
usb_put_hcd(xhci->shared_hcd);
dealloc_usb2_hcd:
usb_hcd_pci_remove(dev);
+put_runtime_pm:
+ pm_runtime_put_noidle(&dev->dev);
return retval;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 084/182] xhci: Switch Intel Lynx Point ports to EHCI on shutdown.
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (82 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 083/182] xhci: Prevent runtime pm from autosuspending during initialization Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 085/182] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM Jiri Slaby
` (99 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Denis Turischev, Denis Turischev, Mathias Nyman,
Jiri Slaby
From: Denis Turischev <denis.turischev@compulab.co.il>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c09ec25d3684cad74d851c0f028a495999591279 upstream.
The same issue like with Panther Point chipsets. If the USB ports are
switched to xHCI on shutdown, the xHCI host will send a spurious interrupt,
which will wake the system. Some BIOS have work around for this, but not all.
One example is Compulab's mini-desktop, the Intense-PC2.
The bug can be avoided if the USB ports are switched back to EHCI on
shutdown.
This patch should be backported to stable kernels as old as 3.12,
that contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016
"xhci: Fix spurious wakeups after S5 on Haswell"
Signed-off-by: Denis Turischev <denis@compulab.co.il>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index d06922469000..67394da1c645 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -134,6 +134,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
*/
if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
}
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 085/182] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (83 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 084/182] xhci: Switch Intel Lynx Point ports to EHCI on shutdown Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 086/182] media: uvcvideo: Do not use usb_set_interface on bulk EP Jiri Slaby
` (98 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, David Cohen, Mathias Nyman, Jiri Slaby
From: David Cohen <david.a.cohen@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 01bb59ebffdec314da8da66266edf29529372f9b upstream.
When CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this
warning:
drivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined
but not used [-Wunused-function]
Instead of creating nested #ifdefs, this patch fixes it by defining the
xHCI PCI stubs as inline.
This warning has been in since 3.2 kernel and was
caused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c
"usb/xhci: hide MSI code behind PCI bars", but wasn't noticed
until 3.13 when a configuration with these options was tried
Signed-off-by: David Cohen <david.a.cohen@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f178f762b543..f07f32b5a526 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -400,16 +400,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
#else
-static int xhci_try_enable_msi(struct usb_hcd *hcd)
+static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
{
return 0;
}
-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
{
}
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
{
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 086/182] media: uvcvideo: Do not use usb_set_interface on bulk EP
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (84 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 085/182] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 087/182] media: videodev2.h: add parenthesis around macro arguments Jiri Slaby
` (97 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Oleksij Rempel, Laurent Pinchart,
Mauro Carvalho Chehab, Jiri Slaby
From: Oleksij Rempel <linux@rempel-privat.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b1e43f232698274871e1358c276d7b0242a7d607 upstream.
The UVC specification uses alternate setting selection to notify devices
of stream start/stop. This breaks when using bulk-based devices, as the
video streaming interface has a single alternate setting in that case,
making video stream start and video stream stop events to appear
identical to the device. Bulk-based devices are thus not well supported
by UVC.
The webcam built in the Asus Zenbook UX302LA ignores the set interface
request and will keep the video stream enabled when the driver tries to
stop it. If USB autosuspend is enabled the device will then be suspended
and will crash, requiring a cold reboot.
USB trace capture showed that Windows sends a CLEAR_FEATURE(HALT)
request to the bulk endpoint when stopping the stream instead of
selecting alternate setting 0. The camera then behaves correctly, and
thus seems to require that behaviour.
Replace selection of alternate setting 0 with clearing of the endpoint
halt feature at video stream stop for bulk-based devices. Let's refrain
from blaming Microsoft this time, as it's not clear whether this
Windows-specific but USB-compliant behaviour was specifically developed
to handle bulkd-based UVC devices, or if the camera just took advantage
of it.
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/usb/uvc/uvc_video.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 3394c3432011..e1c5bf3ea112 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1846,7 +1846,25 @@ int uvc_video_enable(struct uvc_streaming *stream, int enable)
if (!enable) {
uvc_uninit_video(stream, 1);
- usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+ if (stream->intf->num_altsetting > 1) {
+ usb_set_interface(stream->dev->udev,
+ stream->intfnum, 0);
+ } else {
+ /* UVC doesn't specify how to inform a bulk-based device
+ * when the video stream is stopped. Windows sends a
+ * CLEAR_FEATURE(HALT) request to the video streaming
+ * bulk endpoint, mimic the same behaviour.
+ */
+ unsigned int epnum = stream->header.bEndpointAddress
+ & USB_ENDPOINT_NUMBER_MASK;
+ unsigned int dir = stream->header.bEndpointAddress
+ & USB_ENDPOINT_DIR_MASK;
+ unsigned int pipe;
+
+ pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir;
+ usb_clear_halt(stream->dev->udev, pipe);
+ }
+
uvc_queue_enable(&stream->queue, 0);
uvc_video_clock_cleanup(stream);
return 0;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 087/182] media: videodev2.h: add parenthesis around macro arguments
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (85 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 086/182] media: uvcvideo: Do not use usb_set_interface on bulk EP Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 088/182] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode Jiri Slaby
` (96 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Hans Verkuil, Hans Verkuil, Mauro Carvalho Chehab,
Jiri Slaby
From: Hans Verkuil <hverkuil@xs4all.nl>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aee786acfc0a12bcd37a1c60f3198fb25cf7181a upstream.
bt->width should be (bt)->width, and same for the other fields.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
include/uapi/linux/videodev2.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index 437f1b0f8937..c5e2c7df1b0f 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -1059,14 +1059,14 @@ struct v4l2_bt_timings {
/* A few useful defines to calculate the total blanking and frame sizes */
#define V4L2_DV_BT_BLANKING_WIDTH(bt) \
- (bt->hfrontporch + bt->hsync + bt->hbackporch)
+ ((bt)->hfrontporch + (bt)->hsync + (bt)->hbackporch)
#define V4L2_DV_BT_FRAME_WIDTH(bt) \
- (bt->width + V4L2_DV_BT_BLANKING_WIDTH(bt))
+ ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt))
#define V4L2_DV_BT_BLANKING_HEIGHT(bt) \
- (bt->vfrontporch + bt->vsync + bt->vbackporch + \
- bt->il_vfrontporch + bt->il_vsync + bt->il_vbackporch)
+ ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \
+ (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch)
#define V4L2_DV_BT_FRAME_HEIGHT(bt) \
- (bt->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
+ ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
/** struct v4l2_dv_timings - DV timings
* @type: the type of the timings
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 088/182] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (86 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 087/182] media: videodev2.h: add parenthesis around macro arguments Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 089/182] media: v4l2-dv-timings: add module name, description, license Jiri Slaby
` (95 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Antoine Ténart, Tomi Valkeinen, Jiri Slaby
From: Antoine Ténart <antoine.tenart@free-electrons.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7d3477d801808a5037a511cf5a5aae5718e7ecce upstream.
If no driver takeover the atmel_lcdfb, the lcd won't be in a working state
since atmel_lcdfb_set_par() will never be called. Enabling a driver which does,
like fbcon, will call the function and put atmel_lcdfb in a working state.
Fixes: b985172b328a (video: atmel_lcdfb: add device tree suport)
Signed-off-by: Antoine Ténart <antoine.tenart@free-electrons.com>
Reported-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/atmel_lcdfb.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 088511a58a26..0aca4e6b2871 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -1081,6 +1081,12 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
goto free_cmap;
}
+ ret = atmel_lcdfb_set_par(info);
+ if (ret < 0) {
+ dev_err(dev, "set par failed: %d\n", ret);
+ goto unregister_irqs;
+ }
+
dev_set_drvdata(dev, info);
/*
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 089/182] media: v4l2-dv-timings: add module name, description, license
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (87 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 088/182] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 090/182] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support Jiri Slaby
` (94 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hans Verkuil, Mauro Carvalho Chehab, Jiri Slaby
From: Hans Verkuil <hans.verkuil@cisco.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c4885ada88e4331f8ac56d14296d0058359db2d7 upstream.
I completely forgot to add them when I made this module. Loading this module
without it will taint the kernel, which is not intended.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index ee52b9f4a944..c0895f88ce9c 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -26,6 +26,10 @@
#include <linux/v4l2-dv-timings.h>
#include <media/v4l2-dv-timings.h>
+MODULE_AUTHOR("Hans Verkuil");
+MODULE_DESCRIPTION("V4L2 DV Timings Helper Functions");
+MODULE_LICENSE("GPL");
+
const struct v4l2_dv_timings v4l2_dv_timings_presets[] = {
V4L2_DV_BT_CEA_640X480P59_94,
V4L2_DV_BT_CEA_720X480I59_94,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 090/182] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (88 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 089/182] media: v4l2-dv-timings: add module name, description, license Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 091/182] media: m88rs2000: prevent frontend crash on continuous transponder scans Jiri Slaby
` (93 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hans Verkuil, Mauro Carvalho Chehab, Jiri Slaby
From: Hans Verkuil <hans.verkuil@cisco.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bc826d6e39fe5f09cbadf8723e9183e6331b586f upstream.
The wrong ioctl numbers were used due to a copy-and-paste error.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 8f7a6a454a4c..b63a5e584aa0 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -787,8 +787,8 @@ static int put_v4l2_subdev_edid32(struct v4l2_subdev_edid *kp, struct v4l2_subde
#define VIDIOC_DQBUF32 _IOWR('V', 17, struct v4l2_buffer32)
#define VIDIOC_ENUMSTD32 _IOWR('V', 25, struct v4l2_standard32)
#define VIDIOC_ENUMINPUT32 _IOWR('V', 26, struct v4l2_input32)
-#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 63, struct v4l2_subdev_edid32)
-#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 64, struct v4l2_subdev_edid32)
+#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 40, struct v4l2_subdev_edid32)
+#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 41, struct v4l2_subdev_edid32)
#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32)
#define VIDIOC_G_EXT_CTRLS32 _IOWR('V', 71, struct v4l2_ext_controls32)
#define VIDIOC_S_EXT_CTRLS32 _IOWR('V', 72, struct v4l2_ext_controls32)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 091/182] media: m88rs2000: prevent frontend crash on continuous transponder scans
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (89 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 090/182] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 092/182] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO Jiri Slaby
` (92 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Malcolm Priestley, Michael Krufky,
Mauro Carvalho Chehab, Jiri Slaby
From: Malcolm Priestley <tvboxspy@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8272d0a0c0d374a01721e579df6e8add5577132b upstream.
Add m88rs2000_get_tune_settings, min delay of 2000 ms on symbol
rate more than 3000000 and delay of 3000ms less than this.
Adding min delay prevents crashing the frontend on continuous
transponder scans. Other dvb_frontend_tune_settings remain as default.
This makes very little time difference to good channel scans, but slows down
the set frontend where lock can never be achieved i.e. DVB-S2.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/dvb-frontends/m88rs2000.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/media/dvb-frontends/m88rs2000.c b/drivers/media/dvb-frontends/m88rs2000.c
index 02699c111019..acd4ff58f902 100644
--- a/drivers/media/dvb-frontends/m88rs2000.c
+++ b/drivers/media/dvb-frontends/m88rs2000.c
@@ -712,6 +712,22 @@ static int m88rs2000_get_frontend(struct dvb_frontend *fe)
return 0;
}
+static int m88rs2000_get_tune_settings(struct dvb_frontend *fe,
+ struct dvb_frontend_tune_settings *tune)
+{
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+ if (c->symbol_rate > 3000000)
+ tune->min_delay_ms = 2000;
+ else
+ tune->min_delay_ms = 3000;
+
+ tune->step_size = c->symbol_rate / 16000;
+ tune->max_drift = c->symbol_rate / 2000;
+
+ return 0;
+}
+
static int m88rs2000_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
{
struct m88rs2000_state *state = fe->demodulator_priv;
@@ -763,6 +779,7 @@ static struct dvb_frontend_ops m88rs2000_ops = {
.set_frontend = m88rs2000_set_frontend,
.get_frontend = m88rs2000_get_frontend,
+ .get_tune_settings = m88rs2000_get_tune_settings,
};
struct dvb_frontend *m88rs2000_attach(const struct m88rs2000_config *config,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 092/182] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (90 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 091/182] media: m88rs2000: prevent frontend crash on continuous transponder scans Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 093/182] media: em28xx: fix PCTV 290e LNA oops Jiri Slaby
` (91 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Malcolm Priestley, Michael Krufky,
Mauro Carvalho Chehab, Jiri Slaby
From: Malcolm Priestley <tvboxspy@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3c8023a782964c72574ad8268ba0ea4e2d9772fc upstream.
The m88rs2000 frontend is always auto inversion.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/dvb-frontends/m88rs2000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/m88rs2000.c b/drivers/media/dvb-frontends/m88rs2000.c
index acd4ff58f902..c7a1c8eba475 100644
--- a/drivers/media/dvb-frontends/m88rs2000.c
+++ b/drivers/media/dvb-frontends/m88rs2000.c
@@ -759,7 +759,7 @@ static struct dvb_frontend_ops m88rs2000_ops = {
.symbol_rate_tolerance = 500, /* ppm */
.caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 |
- FE_CAN_QPSK |
+ FE_CAN_QPSK | FE_CAN_INVERSION_AUTO |
FE_CAN_FEC_AUTO
},
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 093/182] media: em28xx: fix PCTV 290e LNA oops
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (91 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 092/182] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 094/182] media: saa7134: fix WARN_ON during resume Jiri Slaby
` (90 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Antti Palosaari, Mauro Carvalho Chehab, Jiri Slaby
From: Antti Palosaari <crope@iki.fi>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3ec40dcfb413214b2874aec858870502b61c2202 upstream.
Pointer to device state has been moved to different location during
some change. PCTV 290e LNA function still uses old pointer, carried
over FE priv, and it crash.
Reported-by: Janne Kujanpää <jikuja@iki.fi>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/usb/em28xx/em28xx-dvb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index bb1e8dca80cd..069b7f0dfb36 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -673,7 +673,8 @@ static void pctv_520e_init(struct em28xx *dev)
static int em28xx_pctv_290e_set_lna(struct dvb_frontend *fe)
{
struct dtv_frontend_properties *c = &fe->dtv_property_cache;
- struct em28xx *dev = fe->dvb->priv;
+ struct em28xx_i2c_bus *i2c_bus = fe->dvb->priv;
+ struct em28xx *dev = i2c_bus->dev;
#ifdef CONFIG_GPIOLIB
struct em28xx_dvb *dvb = dev->dvb;
int ret;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 094/182] media: saa7134: fix WARN_ON during resume
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (92 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 093/182] media: em28xx: fix PCTV 290e LNA oops Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 095/182] media: omap3isp: preview: Fix the crop margins Jiri Slaby
` (89 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hans Verkuil, Mauro Carvalho Chehab, Jiri Slaby
From: Hans Verkuil <hans.verkuil@cisco.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 30d652823de5fd7907d40e969a2d8e23938d8d03 upstream.
Do not attempt to reload the tuner modules when resuming after a suspend.
This triggers a WARN_ON in kernel/kmod.c:148 __request_module.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=69581.
This has always been wrong, but it was never noticed until the WARN_ON
was added in 3.9.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/pci/saa7134/saa7134-cards.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c
index d45e7f6ff332..e87a734637a9 100644
--- a/drivers/media/pci/saa7134/saa7134-cards.c
+++ b/drivers/media/pci/saa7134/saa7134-cards.c
@@ -8045,8 +8045,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
break;
} /* switch() */
- /* initialize tuner */
- if (TUNER_ABSENT != dev->tuner_type) {
+ /* initialize tuner (don't do this when resuming) */
+ if (!dev->insuspend && TUNER_ABSENT != dev->tuner_type) {
int has_demod = (dev->tda9887_conf & TDA9887_PRESENT);
/* Note: radio tuner address is always filled in,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 095/182] media: omap3isp: preview: Fix the crop margins
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (93 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 094/182] media: saa7134: fix WARN_ON during resume Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 096/182] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2 Jiri Slaby
` (88 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Florian Vaussard, Laurent Pinchart,
Mauro Carvalho Chehab, Jiri Slaby
From: Florian Vaussard <florian.vaussard@epfl.ch>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8b57b9669aa884ac75b8d09c251d6b1755533c15 upstream.
Commit 3fdfedaaa "[media] omap3isp: preview: Lower the crop margins"
accidentally changed the previewer's cropping, causing the previewer
to miss four pixels on each line, thus corrupting the final image.
Restored the removed setting.
Signed-off-by: Florian Vaussard <florian.vaussard@epfl.ch>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/media/platform/omap3isp/isppreview.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
index cd8831aebdeb..e2e4610d5550 100644
--- a/drivers/media/platform/omap3isp/isppreview.c
+++ b/drivers/media/platform/omap3isp/isppreview.c
@@ -1079,6 +1079,7 @@ static void preview_config_input_format(struct isp_prev_device *prev,
*/
static void preview_config_input_size(struct isp_prev_device *prev, u32 active)
{
+ const struct v4l2_mbus_framefmt *format = &prev->formats[PREV_PAD_SINK];
struct isp_device *isp = to_isp_device(prev);
unsigned int sph = prev->crop.left;
unsigned int eph = prev->crop.left + prev->crop.width - 1;
@@ -1086,6 +1087,14 @@ static void preview_config_input_size(struct isp_prev_device *prev, u32 active)
unsigned int elv = prev->crop.top + prev->crop.height - 1;
u32 features;
+ if (format->code != V4L2_MBUS_FMT_Y8_1X8 &&
+ format->code != V4L2_MBUS_FMT_Y10_1X10) {
+ sph -= 2;
+ eph += 2;
+ slv -= 2;
+ elv += 2;
+ }
+
features = (prev->params.params[0].features & active)
| (prev->params.params[1].features & ~active);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 096/182] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (94 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 095/182] media: omap3isp: preview: Fix the crop margins Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 097/182] usb: dwc3: fix wrong bit mask in dwc3_event_devt Jiri Slaby
` (87 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Wolfram Sang, Hans de Goede, Mauro Carvalho Chehab,
Jiri Slaby
From: Wolfram Sang <wsa@the-dreams.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 61f0319193c44adbbada920162d880b1fdb3aeb3 upstream.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
Documentation/video4linux/gspca.txt | 1 +
drivers/media/usb/gspca/sn9c20x.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 1e6b6531bbcc..d2ba80bb7af5 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -55,6 +55,7 @@ zc3xx 0458:700f Genius VideoCam Web V2
sonixj 0458:7025 Genius Eye 311Q
sn9c20x 0458:7029 Genius Look 320s
sonixj 0458:702e Genius Slim 310 NB
+sn9c20x 0458:7045 Genius Look 1320 V2
sn9c20x 0458:704a Genius Slim 1320
sn9c20x 0458:704c Genius i-Look 1321
sn9c20x 045e:00f4 LifeCam VX-6000 (SN9C20x + OV9650)
diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
index f4453d52801b..ceb5404045b4 100644
--- a/drivers/media/usb/gspca/sn9c20x.c
+++ b/drivers/media/usb/gspca/sn9c20x.c
@@ -2359,6 +2359,7 @@ static const struct usb_device_id device_table[] = {
{USB_DEVICE(0x045e, 0x00f4), SN9C20X(OV9650, 0x30, 0)},
{USB_DEVICE(0x145f, 0x013d), SN9C20X(OV7660, 0x21, 0)},
{USB_DEVICE(0x0458, 0x7029), SN9C20X(HV7131R, 0x11, 0)},
+ {USB_DEVICE(0x0458, 0x7045), SN9C20X(MT9M112, 0x5d, LED_REVERSE)},
{USB_DEVICE(0x0458, 0x704a), SN9C20X(MT9M112, 0x5d, 0)},
{USB_DEVICE(0x0458, 0x704c), SN9C20X(MT9M112, 0x5d, 0)},
{USB_DEVICE(0xa168, 0x0610), SN9C20X(HV7131R, 0x11, 0)},
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 097/182] usb: dwc3: fix wrong bit mask in dwc3_event_devt
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (95 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 096/182] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2 Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 098/182] usb: dwc3: fix randconfig build errors Jiri Slaby
` (86 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Huang Rui, Felipe Balbi, Jiri Slaby
From: Huang Rui <ray.huang@amd.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 06f9b6e59661cee510b04513b13ea7927727d758 upstream.
Around DWC USB3 2.30a release another bit has been added to the
Device-Specific Event (DEVT) Event Information (EvtInfo) bitfield.
Because of that, what used to be 8 bits long, has become 9 bits long.
Per dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of
Event Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits
not 8 bits. And the following reserved field uses [31:25] bits not
[31:24] bits, and it has 7 bits.
So in dwc3_event_devt, the bit mask should be:
event_info [24:16] 9 bits
reserved31_25 [31:25] 7 bits
This patch makes sure that newer core releases will work fine with
Linux and that we will decode the event information properly on new
core releases.
[ balbi@ti.com : improve commit log a bit ]
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/dwc3/core.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index f8af8d44af85..69c4583933d1 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -815,15 +815,15 @@ struct dwc3_event_depevt {
* 12 - VndrDevTstRcved
* @reserved15_12: Reserved, not used
* @event_info: Information about this event
- * @reserved31_24: Reserved, not used
+ * @reserved31_25: Reserved, not used
*/
struct dwc3_event_devt {
u32 one_bit:1;
u32 device_event:7;
u32 type:4;
u32 reserved15_12:4;
- u32 event_info:8;
- u32 reserved31_24:8;
+ u32 event_info:9;
+ u32 reserved31_25:7;
} __packed;
/**
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 098/182] usb: dwc3: fix randconfig build errors
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (96 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 097/182] usb: dwc3: fix wrong bit mask in dwc3_event_devt Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 099/182] usb: musb: avoid NULL pointer dereference Jiri Slaby
` (85 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felipe Balbi, Jiri Slaby
From: Felipe Balbi <balbi@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 610183051d8f9421f138c4203ca894387f9f8839 upstream.
commit 388e5c5 (usb: dwc3: remove dwc3 dependency
on host AND gadget.) created the possibility for
host-only and peripheral-only dwc3 builds but
left a possible randconfig build error when host-only
builds are selected.
Reported-by: Jim Davis <jim.epost@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/dwc3/core.h | 33 +++++++++++++++++++++++++++++++++
drivers/usb/dwc3/gadget.h | 12 ------------
2 files changed, 33 insertions(+), 12 deletions(-)
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 69c4583933d1..546e67a2e4cd 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -856,6 +856,19 @@ union dwc3_event {
struct dwc3_event_gevt gevt;
};
+/**
+ * struct dwc3_gadget_ep_cmd_params - representation of endpoint command
+ * parameters
+ * @param2: third parameter
+ * @param1: second parameter
+ * @param0: first parameter
+ */
+struct dwc3_gadget_ep_cmd_params {
+ u32 param2;
+ u32 param1;
+ u32 param0;
+};
+
/*
* DWC3 Features to be used as Driver Data
*/
@@ -881,11 +894,31 @@ static inline void dwc3_host_exit(struct dwc3 *dwc)
#if IS_ENABLED(CONFIG_USB_DWC3_GADGET) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
int dwc3_gadget_init(struct dwc3 *dwc);
void dwc3_gadget_exit(struct dwc3 *dwc);
+int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode);
+int dwc3_gadget_get_link_state(struct dwc3 *dwc);
+int dwc3_gadget_set_link_state(struct dwc3 *dwc, enum dwc3_link_state state);
+int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ unsigned cmd, struct dwc3_gadget_ep_cmd_params *params);
+int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param);
#else
static inline int dwc3_gadget_init(struct dwc3 *dwc)
{ return 0; }
static inline void dwc3_gadget_exit(struct dwc3 *dwc)
{ }
+static inline int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode)
+{ return 0; }
+static inline int dwc3_gadget_get_link_state(struct dwc3 *dwc)
+{ return 0; }
+static inline int dwc3_gadget_set_link_state(struct dwc3 *dwc,
+ enum dwc3_link_state state)
+{ return 0; }
+
+static inline int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ unsigned cmd, struct dwc3_gadget_ep_cmd_params *params)
+{ return 0; }
+static inline int dwc3_send_gadget_generic_command(struct dwc3 *dwc,
+ int cmd, u32 param)
+{ return 0; }
#endif
/* power management interface */
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index febe1aa7b714..a0ee75b68a80 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -56,12 +56,6 @@ struct dwc3;
/* DEPXFERCFG parameter 0 */
#define DWC3_DEPXFERCFG_NUM_XFER_RES(n) ((n) & 0xffff)
-struct dwc3_gadget_ep_cmd_params {
- u32 param2;
- u32 param1;
- u32 param0;
-};
-
/* -------------------------------------------------------------------------- */
#define to_dwc3_request(r) (container_of(r, struct dwc3_request, request))
@@ -85,9 +79,6 @@ static inline void dwc3_gadget_move_request_queued(struct dwc3_request *req)
void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
int status);
-int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode);
-int dwc3_gadget_set_link_state(struct dwc3 *dwc, enum dwc3_link_state state);
-
void dwc3_ep0_interrupt(struct dwc3 *dwc,
const struct dwc3_event_depevt *event);
void dwc3_ep0_out_start(struct dwc3 *dwc);
@@ -95,9 +86,6 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
gfp_t gfp_flags);
int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
-int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- unsigned cmd, struct dwc3_gadget_ep_cmd_params *params);
-int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param);
/**
* dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 099/182] usb: musb: avoid NULL pointer dereference
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (97 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 098/182] usb: dwc3: fix randconfig build errors Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 100/182] hvc: ensure hvc_init is only ever called once in hvc_console.c Jiri Slaby
` (84 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felipe Balbi, Jiri Slaby
From: Felipe Balbi <balbi@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit eee3f15d5f1f4f0c283dd4db67dc1b874a2852d1 upstream.
instead of relying on the otg pointer, which
can be NULL in certain cases, we can use the
gadget and host pointers we already hold inside
struct musb.
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/musb/musb_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index f7dca0b92bfb..2cca870d9762 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -439,7 +439,6 @@ void musb_hnp_stop(struct musb *musb)
static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
u8 devctl)
{
- struct usb_otg *otg = musb->xceiv->otg;
irqreturn_t handled = IRQ_NONE;
dev_dbg(musb->controller, "<== DevCtl=%02x, int_usb=0x%x\n", devctl,
@@ -654,7 +653,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
break;
case OTG_STATE_B_PERIPHERAL:
musb_g_suspend(musb);
- musb->is_active = otg->gadget->b_hnp_enable;
+ musb->is_active = musb->g.b_hnp_enable;
if (musb->is_active) {
musb->xceiv->state = OTG_STATE_B_WAIT_ACON;
dev_dbg(musb->controller, "HNP: Setting timer for b_ase0_brst\n");
@@ -670,7 +669,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
break;
case OTG_STATE_A_HOST:
musb->xceiv->state = OTG_STATE_A_SUSPEND;
- musb->is_active = otg->host->b_hnp_enable;
+ musb->is_active = musb->hcd->self.b_hnp_enable;
break;
case OTG_STATE_B_HOST:
/* Transition to B_PERIPHERAL, see 6.8.2.6 p 44 */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 100/182] hvc: ensure hvc_init is only ever called once in hvc_console.c
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (98 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 099/182] usb: musb: avoid NULL pointer dereference Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 101/182] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210 Jiri Slaby
` (83 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Paul Gortmaker, Rusty Russell, Greg Kroah-Hartman,
Jiri Slaby
From: Paul Gortmaker <paul.gortmaker@windriver.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.
Commit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 ("Delay creation of
khcvd thread") moved the call of hvc_init from being a device_initcall
into hvc_alloc, and used a non-null hvc_driver as indication of whether
hvc_init had already been called.
The problem with this is that hvc_driver is only assigned a value
at the bottom of hvc_init, and so there is a window where multiple
hvc_alloc calls can be in progress at the same time and hence try
and call hvc_init multiple times. Previously the use of device_init
guaranteed that hvc_init was only called once.
This manifests itself as sporadic instances of two hvc_init calls
racing each other, and with the loser of the race getting -EBUSY
from tty_register_driver() and hence that virtual console fails:
Couldn't register hvc console driver
virtio-ports vport0p1: error -16 allocating hvc for port
Here we add an atomic_t to guarantee we'll never run hvc_init twice.
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 3e6c6f630a52 ("Delay creation of khcvd thread")
Reported-by: Jim Somerville <Jim.Somerville@windriver.com>
Tested-by: Jim Somerville <Jim.Somerville@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/tty/hvc/hvc_console.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 9eba119bcdd3..620da5f88e91 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -31,6 +31,7 @@
#include <linux/list.h>
#include <linux/module.h>
#include <linux/major.h>
+#include <linux/atomic.h>
#include <linux/sysrq.h>
#include <linux/tty.h>
#include <linux/tty_flip.h>
@@ -70,6 +71,9 @@ static struct task_struct *hvc_task;
/* Picks up late kicks after list walk but before schedule() */
static int hvc_kicked;
+/* hvc_init is triggered from hvc_alloc, i.e. only when actually used */
+static atomic_t hvc_needs_init __read_mostly = ATOMIC_INIT(-1);
+
static int hvc_init(void);
#ifdef CONFIG_MAGIC_SYSRQ
@@ -851,7 +855,7 @@ struct hvc_struct *hvc_alloc(uint32_t vtermno, int data,
int i;
/* We wait until a driver actually comes along */
- if (!hvc_driver) {
+ if (atomic_inc_not_zero(&hvc_needs_init)) {
int err = hvc_init();
if (err)
return ERR_PTR(err);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 101/182] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (99 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 100/182] hvc: ensure hvc_init is only ever called once in hvc_console.c Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 102/182] USB: unbind all interfaces before rebinding any Jiri Slaby
` (82 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Michal Simek, Jiri Slaby
From: Michal Simek <michal.simek@xilinx.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ead5178bf442dbae4008ee54bf4f66a1f6a317c9 upstream.
Add new ulpi IDs which are available on Xilinx Zynq boards.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/phy/phy-ulpi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/phy/phy-ulpi.c b/drivers/usb/phy/phy-ulpi.c
index 217339dd7a90..17ea3f271bd8 100644
--- a/drivers/usb/phy/phy-ulpi.c
+++ b/drivers/usb/phy/phy-ulpi.c
@@ -47,6 +47,8 @@ struct ulpi_info {
static struct ulpi_info ulpi_ids[] = {
ULPI_INFO(ULPI_ID(0x04cc, 0x1504), "NXP ISP1504"),
ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB331x"),
+ ULPI_INFO(ULPI_ID(0x0424, 0x0007), "SMSC USB3320"),
+ ULPI_INFO(ULPI_ID(0x0451, 0x1507), "TI TUSB1210"),
};
static int ulpi_set_otg_flags(struct usb_phy *phy)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 102/182] USB: unbind all interfaces before rebinding any
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (100 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 101/182] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210 Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 103/182] mtip32xx: Set queue bounce limit Jiri Slaby
` (81 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alan Stern, Jiri Slaby
From: Alan Stern <stern@rowland.harvard.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.
When a driver doesn't have pre_reset, post_reset, or reset_resume
methods, the USB core unbinds that driver when its device undergoes a
reset or a reset-resume, and then rebinds it afterward.
The existing straightforward implementation can lead to problems,
because each interface gets unbound and rebound before the next
interface is handled. If a driver claims additional interfaces, the
claim may fail because the old binding instance may still own the
additional interface when the new instance tries to claim it.
This patch fixes the problem by first unbinding all the interfaces
that are marked (i.e., their needs_binding flag is set) and then
rebinding all of them.
The patch also makes the helper functions in driver.c a little more
uniform and adjusts some out-of-date comments.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: "Poulain, Loic" <loic.poulain@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/core/driver.c | 94 ++++++++++++++++++++++++++++-------------------
drivers/usb/core/hub.c | 5 ++-
drivers/usb/core/usb.h | 2 +-
3 files changed, 60 insertions(+), 41 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 689433cdef25..2ddc586457c8 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -959,8 +959,7 @@ EXPORT_SYMBOL_GPL(usb_deregister);
* it doesn't support pre_reset/post_reset/reset_resume or
* because it doesn't support suspend/resume.
*
- * The caller must hold @intf's device's lock, but not its pm_mutex
- * and not @intf->dev.sem.
+ * The caller must hold @intf's device's lock, but not @intf's lock.
*/
void usb_forced_unbind_intf(struct usb_interface *intf)
{
@@ -973,16 +972,37 @@ void usb_forced_unbind_intf(struct usb_interface *intf)
intf->needs_binding = 1;
}
+/*
+ * Unbind drivers for @udev's marked interfaces. These interfaces have
+ * the needs_binding flag set, for example by usb_resume_interface().
+ *
+ * The caller must hold @udev's device lock.
+ */
+static void unbind_marked_interfaces(struct usb_device *udev)
+{
+ struct usb_host_config *config;
+ int i;
+ struct usb_interface *intf;
+
+ config = udev->actconfig;
+ if (config) {
+ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+ intf = config->interface[i];
+ if (intf->dev.driver && intf->needs_binding)
+ usb_forced_unbind_intf(intf);
+ }
+ }
+}
+
/* Delayed forced unbinding of a USB interface driver and scan
* for rebinding.
*
- * The caller must hold @intf's device's lock, but not its pm_mutex
- * and not @intf->dev.sem.
+ * The caller must hold @intf's device's lock, but not @intf's lock.
*
* Note: Rebinds will be skipped if a system sleep transition is in
* progress and the PM "complete" callback hasn't occurred yet.
*/
-void usb_rebind_intf(struct usb_interface *intf)
+static void usb_rebind_intf(struct usb_interface *intf)
{
int rc;
@@ -999,68 +1019,66 @@ void usb_rebind_intf(struct usb_interface *intf)
}
}
-#ifdef CONFIG_PM
-
-/* Unbind drivers for @udev's interfaces that don't support suspend/resume
- * There is no check for reset_resume here because it can be determined
- * only during resume whether reset_resume is needed.
+/*
+ * Rebind drivers to @udev's marked interfaces. These interfaces have
+ * the needs_binding flag set.
*
* The caller must hold @udev's device lock.
*/
-static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
+static void rebind_marked_interfaces(struct usb_device *udev)
{
struct usb_host_config *config;
int i;
struct usb_interface *intf;
- struct usb_driver *drv;
config = udev->actconfig;
if (config) {
for (i = 0; i < config->desc.bNumInterfaces; ++i) {
intf = config->interface[i];
-
- if (intf->dev.driver) {
- drv = to_usb_driver(intf->dev.driver);
- if (!drv->suspend || !drv->resume)
- usb_forced_unbind_intf(intf);
- }
+ if (intf->needs_binding)
+ usb_rebind_intf(intf);
}
}
}
-/* Unbind drivers for @udev's interfaces that failed to support reset-resume.
- * These interfaces have the needs_binding flag set by usb_resume_interface().
+/*
+ * Unbind all of @udev's marked interfaces and then rebind all of them.
+ * This ordering is necessary because some drivers claim several interfaces
+ * when they are first probed.
*
* The caller must hold @udev's device lock.
*/
-static void unbind_no_reset_resume_drivers_interfaces(struct usb_device *udev)
+void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev)
{
- struct usb_host_config *config;
- int i;
- struct usb_interface *intf;
-
- config = udev->actconfig;
- if (config) {
- for (i = 0; i < config->desc.bNumInterfaces; ++i) {
- intf = config->interface[i];
- if (intf->dev.driver && intf->needs_binding)
- usb_forced_unbind_intf(intf);
- }
- }
+ unbind_marked_interfaces(udev);
+ rebind_marked_interfaces(udev);
}
-static void do_rebind_interfaces(struct usb_device *udev)
+#ifdef CONFIG_PM
+
+/* Unbind drivers for @udev's interfaces that don't support suspend/resume
+ * There is no check for reset_resume here because it can be determined
+ * only during resume whether reset_resume is needed.
+ *
+ * The caller must hold @udev's device lock.
+ */
+static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
{
struct usb_host_config *config;
int i;
struct usb_interface *intf;
+ struct usb_driver *drv;
config = udev->actconfig;
if (config) {
for (i = 0; i < config->desc.bNumInterfaces; ++i) {
intf = config->interface[i];
- if (intf->needs_binding)
- usb_rebind_intf(intf);
+
+ if (intf->dev.driver) {
+ drv = to_usb_driver(intf->dev.driver);
+ if (!drv->suspend || !drv->resume)
+ usb_forced_unbind_intf(intf);
+ }
}
}
}
@@ -1389,7 +1407,7 @@ int usb_resume_complete(struct device *dev)
* whose needs_binding flag is set
*/
if (udev->state != USB_STATE_NOTATTACHED)
- do_rebind_interfaces(udev);
+ rebind_marked_interfaces(udev);
return 0;
}
@@ -1411,7 +1429,7 @@ int usb_resume(struct device *dev, pm_message_t msg)
pm_runtime_disable(dev);
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
- unbind_no_reset_resume_drivers_interfaces(udev);
+ unbind_marked_interfaces(udev);
}
/* Avoid PM error messages for devices disconnected while suspended
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 3670086fb7c8..5064fc8ba14f 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5308,10 +5308,11 @@ int usb_reset_device(struct usb_device *udev)
else if (cintf->condition ==
USB_INTERFACE_BOUND)
rebind = 1;
+ if (rebind)
+ cintf->needs_binding = 1;
}
- if (ret == 0 && rebind)
- usb_rebind_intf(cintf);
}
+ usb_unbind_and_rebind_marked_interfaces(udev);
}
usb_autosuspend_device(udev);
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 823857767a16..0923add72b59 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -55,7 +55,7 @@ extern int usb_match_one_id_intf(struct usb_device *dev,
extern int usb_match_device(struct usb_device *dev,
const struct usb_device_id *id);
extern void usb_forced_unbind_intf(struct usb_interface *intf);
-extern void usb_rebind_intf(struct usb_interface *intf);
+extern void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev);
extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port,
struct dev_state *owner);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 103/182] mtip32xx: Set queue bounce limit
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (101 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 102/182] USB: unbind all interfaces before rebinding any Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 104/182] mtip32xx: Unmap the DMA segments before completing the IO request Jiri Slaby
` (80 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felipe Franciosi, Jens Axboe, Jiri Slaby
From: Felipe Franciosi <felipe@paradoxo.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1044b1bb9278f2e656a1a7b63dc24a59506540aa upstream.
We need to set the queue bounce limit during the device initialization to
prevent excessive bouncing on 32 bit architectures.
Signed-off-by: Felipe Franciosi <felipe@paradoxo.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/block/mtip32xx/mtip32xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 952dbfe22126..bd3d20741958 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4040,6 +4040,7 @@ skip_create_disk:
blk_queue_max_hw_sectors(dd->queue, 0xffff);
blk_queue_max_segment_size(dd->queue, 0x400000);
blk_queue_io_min(dd->queue, 4096);
+ blk_queue_bounce_limit(dd->queue, dd->pdev->dma_mask);
/*
* write back cache is not supported in the device. FUA depends on
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 104/182] mtip32xx: Unmap the DMA segments before completing the IO request
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (102 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 103/182] mtip32xx: Set queue bounce limit Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 105/182] sh: fix format string bug in stack tracer Jiri Slaby
` (79 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felipe Franciosi, Jens Axboe, Jiri Slaby
From: Felipe Franciosi <felipe@paradoxo.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 368c89d7ac70f937c93cd6f3b65bcfdfb3ba794f upstream.
If the buffers are unmapped after completing a request, then stale data
might be in the request.
Signed-off-by: Felipe Franciosi <felipe@paradoxo.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/block/mtip32xx/mtip32xx.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index bd3d20741958..4d26c25aa9c5 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -621,6 +621,12 @@ static void mtip_timeout_function(unsigned long int data)
*/
writel(1 << bit, port->completed[group]);
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&port->dd->pdev->dev,
+ command->sg,
+ command->scatter_ents,
+ command->direction);
+
/* Call the async completion callback. */
if (likely(command->async_callback))
command->async_callback(command->async_data,
@@ -628,12 +634,6 @@ static void mtip_timeout_function(unsigned long int data)
command->async_callback = NULL;
command->comp_func = NULL;
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&port->dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
-
/*
* Clear the allocated bit and active tag for the
* command.
@@ -711,6 +711,12 @@ static void mtip_async_complete(struct mtip_port *port,
"Command tag %d failed due to TFE\n", tag);
}
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&dd->pdev->dev,
+ command->sg,
+ command->scatter_ents,
+ command->direction);
+
/* Upper layer callback */
if (likely(command->async_callback))
command->async_callback(command->async_data, cb_status);
@@ -718,12 +724,6 @@ static void mtip_async_complete(struct mtip_port *port,
command->async_callback = NULL;
command->comp_func = NULL;
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
-
/* Clear the allocated and active bits for the command */
atomic_set(&port->commands[tag].active, 0);
release_slot(port, tag);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 105/182] sh: fix format string bug in stack tracer
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (103 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 104/182] mtip32xx: Unmap the DMA segments before completing the IO request Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 106/182] mm: page_alloc: spill to remote nodes before waking kswapd Jiri Slaby
` (78 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Matt Fleming, Paul Mundt, Andrew Morton,
Linus Torvalds, Jiri Slaby
From: Matt Fleming <matt.fleming@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a0c32761e73c9999cbf592b702f284221fea8040 upstream.
Kees reported the following error:
arch/sh/kernel/dumpstack.c: In function 'print_trace_address':
arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror=format-security]
Use the "%s" format so that it's impossible to interpret 'data' as a
format string.
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Reported-by: Kees Cook <keescook@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/sh/kernel/dumpstack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sh/kernel/dumpstack.c b/arch/sh/kernel/dumpstack.c
index b959f5592604..8dfe645bcc4b 100644
--- a/arch/sh/kernel/dumpstack.c
+++ b/arch/sh/kernel/dumpstack.c
@@ -115,7 +115,7 @@ static int print_trace_stack(void *data, char *name)
*/
static void print_trace_address(void *data, unsigned long addr, int reliable)
{
- printk(data);
+ printk("%s", (char *)data);
printk_address(addr, reliable);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 106/182] mm: page_alloc: spill to remote nodes before waking kswapd
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (104 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 105/182] sh: fix format string bug in stack tracer Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 107/182] mm: try_to_unmap_cluster() should lock_page() before mlocking Jiri Slaby
` (77 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Johannes Weiner, Andrew Morton, Linus Torvalds,
Jiri Slaby
From: Johannes Weiner <hannes@cmpxchg.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3a025760fc158b3726eac89ee95d7f29599e9dfa upstream.
On NUMA systems, a node may start thrashing cache or even swap anonymous
pages while there are still free pages on remote nodes.
This is a result of commits 81c0a2bb515f ("mm: page_alloc: fair zone
allocator policy") and fff4068cba48 ("mm: page_alloc: revert NUMA aspect
of fair allocation policy").
Before those changes, the allocator would first try all allowed zones,
including those on remote nodes, before waking any kswapds. But now,
the allocator fastpath doubles as the fairness pass, which in turn can
only consider the local node to prevent remote spilling based on
exhausted fairness batches alone. Remote nodes are only considered in
the slowpath, after the kswapds are woken up. But if remote nodes still
have free memory, kswapd should not be woken to rebalance the local node
or it may thrash cash or swap prematurely.
Fix this by adding one more unfair pass over the zonelist that is
allowed to spill to remote nodes after the local fairness pass fails but
before entering the slowpath and waking the kswapds.
This also gets rid of the GFP_THISNODE exemption from the fairness
protocol because the unfair pass is no longer tied to kswapd, which
GFP_THISNODE is not allowed to wake up.
However, because remote spills can be more frequent now - we prefer them
over local kswapd reclaim - the allocation batches on remote nodes could
underflow more heavily. When resetting the batches, use
atomic_long_read() directly instead of zone_page_state() to calculate the
delta as the latter filters negative counter values.
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
mm/internal.h | 1 +
mm/page_alloc.c | 89 +++++++++++++++++++++++++++++----------------------------
2 files changed, 46 insertions(+), 44 deletions(-)
diff --git a/mm/internal.h b/mm/internal.h
index 8b6cfd63b5a5..fdddbc83ac5f 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -369,5 +369,6 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
#define ALLOC_HIGH 0x20 /* __GFP_HIGH set */
#define ALLOC_CPUSET 0x40 /* check for correct cpuset */
#define ALLOC_CMA 0x80 /* allow allocations from CMA areas */
+#define ALLOC_FAIR 0x100 /* fair zone allocation */
#endif /* __MM_INTERNAL_H */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6fca39097766..09459deb0b51 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1219,15 +1219,6 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
}
local_irq_restore(flags);
}
-static bool gfp_thisnode_allocation(gfp_t gfp_mask)
-{
- return (gfp_mask & GFP_THISNODE) == GFP_THISNODE;
-}
-#else
-static bool gfp_thisnode_allocation(gfp_t gfp_mask)
-{
- return false;
-}
#endif
/*
@@ -1564,12 +1555,7 @@ again:
get_pageblock_migratetype(page));
}
- /*
- * NOTE: GFP_THISNODE allocations do not partake in the kswapd
- * aging protocol, so they can't be fair.
- */
- if (!gfp_thisnode_allocation(gfp_flags))
- __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+ __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
__count_zone_vm_events(PGALLOC, zone, 1 << order);
zone_statistics(preferred_zone, zone, gfp_flags);
@@ -1935,23 +1921,12 @@ zonelist_scan:
* zone size to ensure fair page aging. The zone a
* page was allocated in should have no effect on the
* time the page has in memory before being reclaimed.
- *
- * Try to stay in local zones in the fastpath. If
- * that fails, the slowpath is entered, which will do
- * another pass starting with the local zones, but
- * ultimately fall back to remote zones that do not
- * partake in the fairness round-robin cycle of this
- * zonelist.
- *
- * NOTE: GFP_THISNODE allocations do not partake in
- * the kswapd aging protocol, so they can't be fair.
*/
- if ((alloc_flags & ALLOC_WMARK_LOW) &&
- !gfp_thisnode_allocation(gfp_mask)) {
- if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
- continue;
+ if (alloc_flags & ALLOC_FAIR) {
if (!zone_local(preferred_zone, zone))
continue;
+ if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
+ continue;
}
/*
* When allocating a page cache page for writing, we
@@ -2399,32 +2374,40 @@ __alloc_pages_high_priority(gfp_t gfp_mask, unsigned int order,
return page;
}
-static void prepare_slowpath(gfp_t gfp_mask, unsigned int order,
- struct zonelist *zonelist,
- enum zone_type high_zoneidx,
- struct zone *preferred_zone)
+static void reset_alloc_batches(struct zonelist *zonelist,
+ enum zone_type high_zoneidx,
+ struct zone *preferred_zone)
{
struct zoneref *z;
struct zone *zone;
for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
- if (!(gfp_mask & __GFP_NO_KSWAPD))
- wakeup_kswapd(zone, order, zone_idx(preferred_zone));
/*
* Only reset the batches of zones that were actually
- * considered in the fast path, we don't want to
- * thrash fairness information for zones that are not
+ * considered in the fairness pass, we don't want to
+ * trash fairness information for zones that are not
* actually part of this zonelist's round-robin cycle.
*/
if (!zone_local(preferred_zone, zone))
continue;
mod_zone_page_state(zone, NR_ALLOC_BATCH,
- high_wmark_pages(zone) -
- low_wmark_pages(zone) -
- zone_page_state(zone, NR_ALLOC_BATCH));
+ high_wmark_pages(zone) - low_wmark_pages(zone) -
+ atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
}
}
+static void wake_all_kswapds(unsigned int order,
+ struct zonelist *zonelist,
+ enum zone_type high_zoneidx,
+ struct zone *preferred_zone)
+{
+ struct zoneref *z;
+ struct zone *zone;
+
+ for_each_zone_zonelist(zone, z, zonelist, high_zoneidx)
+ wakeup_kswapd(zone, order, zone_idx(preferred_zone));
+}
+
static inline int
gfp_to_alloc_flags(gfp_t gfp_mask)
{
@@ -2513,12 +2496,13 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
* allowed per node queues are empty and that nodes are
* over allocated.
*/
- if (gfp_thisnode_allocation(gfp_mask))
+ if (IS_ENABLED(CONFIG_NUMA) &&
+ (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
goto nopage;
restart:
- prepare_slowpath(gfp_mask, order, zonelist,
- high_zoneidx, preferred_zone);
+ if (!(gfp_mask & __GFP_NO_KSWAPD))
+ wake_all_kswapds(order, zonelist, high_zoneidx, preferred_zone);
/*
* OK, we're below the kswapd watermark and have kicked background
@@ -2695,7 +2679,7 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
struct page *page = NULL;
int migratetype = allocflags_to_migratetype(gfp_mask);
unsigned int cpuset_mems_cookie;
- int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET;
+ int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET|ALLOC_FAIR;
struct mem_cgroup *memcg = NULL;
gfp_mask &= gfp_allowed_mask;
@@ -2736,12 +2720,29 @@ retry_cpuset:
if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
alloc_flags |= ALLOC_CMA;
#endif
+retry:
/* First allocation attempt */
page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order,
zonelist, high_zoneidx, alloc_flags,
preferred_zone, migratetype);
if (unlikely(!page)) {
/*
+ * The first pass makes sure allocations are spread
+ * fairly within the local node. However, the local
+ * node might have free pages left after the fairness
+ * batches are exhausted, and remote zones haven't
+ * even been considered yet. Try once more without
+ * fairness, and include remote zones now, before
+ * entering the slowpath and waking kswapd: prefer
+ * spilling to a remote zone over swapping locally.
+ */
+ if (alloc_flags & ALLOC_FAIR) {
+ reset_alloc_batches(zonelist, high_zoneidx,
+ preferred_zone);
+ alloc_flags &= ~ALLOC_FAIR;
+ goto retry;
+ }
+ /*
* Runtime PM, block IO and its error handling path
* can deadlock because I/O on the device might not
* complete.
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 107/182] mm: try_to_unmap_cluster() should lock_page() before mlocking
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (105 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 106/182] mm: page_alloc: spill to remote nodes before waking kswapd Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 108/182] mm: hugetlb: fix softlockup when a large number of hugepages are freed Jiri Slaby
` (76 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Vlastimil Babka, Bob Liu, Wanpeng Li,
Michel Lespinasse, KOSAKI Motohiro, David Rientjes, Mel Gorman,
Hugh Dickins, Joonsoo Kim, Andrew Morton, Linus Torvalds,
Jiri Slaby
From: Vlastimil Babka <vbabka@suse.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 57e68e9cd65b4b8eb4045a1e0d0746458502554c upstream.
A BUG_ON(!PageLocked) was triggered in mlock_vma_page() by Sasha Levin
fuzzing with trinity. The call site try_to_unmap_cluster() does not lock
the pages other than its check_page parameter (which is already locked).
The BUG_ON in mlock_vma_page() is not documented and its purpose is
somewhat unclear, but apparently it serializes against page migration,
which could otherwise fail to transfer the PG_mlocked flag. This would
not be fatal, as the page would be eventually encountered again, but
NR_MLOCK accounting would become distorted nevertheless. This patch adds
a comment to the BUG_ON in mlock_vma_page() and munlock_vma_page() to that
effect.
The call site try_to_unmap_cluster() is fixed so that for page !=
check_page, trylock_page() is attempted (to avoid possible deadlocks as we
already have check_page locked) and mlock_vma_page() is performed only
upon success. If the page lock cannot be obtained, the page is left
without PG_mlocked, which is again not a problem in the whole unevictable
memory design.
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
mm/mlock.c | 2 ++
mm/rmap.c | 14 ++++++++++++--
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/mm/mlock.c b/mm/mlock.c
index 192e6eebe4f2..1b12dfad0794 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -79,6 +79,7 @@ void clear_page_mlock(struct page *page)
*/
void mlock_vma_page(struct page *page)
{
+ /* Serialize with page migration */
BUG_ON(!PageLocked(page));
if (!TestSetPageMlocked(page)) {
@@ -153,6 +154,7 @@ unsigned int munlock_vma_page(struct page *page)
{
unsigned int nr_pages;
+ /* For try_to_munlock() and to serialize with page migration */
BUG_ON(!PageLocked(page));
if (TestClearPageMlocked(page)) {
diff --git a/mm/rmap.c b/mm/rmap.c
index b9d2222a0ecb..6e3139835e00 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1392,9 +1392,19 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
BUG_ON(!page || PageAnon(page));
if (locked_vma) {
- mlock_vma_page(page); /* no-op if already mlocked */
- if (page == check_page)
+ if (page == check_page) {
+ /* we know we have check_page locked */
+ mlock_vma_page(page);
ret = SWAP_MLOCK;
+ } else if (trylock_page(page)) {
+ /*
+ * If we can lock the page, perform mlock.
+ * Otherwise leave the page alone, it will be
+ * eventually encountered again later.
+ */
+ mlock_vma_page(page);
+ unlock_page(page);
+ }
continue; /* don't unmap */
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 108/182] mm: hugetlb: fix softlockup when a large number of hugepages are freed.
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (106 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 107/182] mm: try_to_unmap_cluster() should lock_page() before mlocking Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 109/182] xattr: guard against simultaneous glibc header inclusion Jiri Slaby
` (75 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Mizuma, Masayoshi, Joonsoo Kim, Michal Hocko,
Wanpeng Li, Aneesh Kumar, KOSAKI Motohiro, Naoya Horiguchi,
Andrew Morton, Linus Torvalds, Jiri Slaby
From: "Mizuma, Masayoshi" <m.mizuma@jp.fujitsu.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 55f67141a8927b2be3e51840da37b8a2320143ed upstream.
When I decrease the value of nr_hugepage in procfs a lot, softlockup
happens. It is because there is no chance of context switch during this
process.
On the other hand, when I allocate a large number of hugepages, there is
some chance of context switch. Hence softlockup doesn't happen during
this process. So it's necessary to add the context switch in the
freeing process as same as allocating process to avoid softlockup.
When I freed 12 TB hugapages with kernel-2.6.32-358.el6, the freeing
process occupied a CPU over 150 seconds and following softlockup message
appeared twice or more.
$ echo 6000000 > /proc/sys/vm/nr_hugepages
$ cat /proc/sys/vm/nr_hugepages
6000000
$ grep ^Huge /proc/meminfo
HugePages_Total: 6000000
HugePages_Free: 6000000
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
$ echo 0 > /proc/sys/vm/nr_hugepages
BUG: soft lockup - CPU#16 stuck for 67s! [sh:12883] ...
Pid: 12883, comm: sh Not tainted 2.6.32-358.el6.x86_64 #1
Call Trace:
free_pool_huge_page+0xb8/0xd0
set_max_huge_pages+0x128/0x190
hugetlb_sysctl_handler_common+0x113/0x140
hugetlb_sysctl_handler+0x1e/0x20
proc_sys_call_handler+0x97/0xd0
proc_sys_write+0x14/0x20
vfs_write+0xb8/0x1a0
sys_write+0x51/0x90
__audit_syscall_exit+0x265/0x290
system_call_fastpath+0x16/0x1b
I have not confirmed this problem with upstream kernels because I am not
able to prepare the machine equipped with 12TB memory now. However I
confirmed that the amount of decreasing hugepages was directly
proportional to the amount of required time.
I measured required times on a smaller machine. It showed 130-145
hugepages decreased in a millisecond.
Amount of decreasing Required time Decreasing rate
hugepages (msec) (pages/msec)
------------------------------------------------------------
10,000 pages == 20GB 70 - 74 135-142
30,000 pages == 60GB 208 - 229 131-144
It means decrement of 6TB hugepages will trigger softlockup with the
default threshold 20sec, in this decreasing rate.
Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f0a4ca4cc219..efbb9dc67f2f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1552,6 +1552,7 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
while (min_count < persistent_huge_pages(h)) {
if (!free_pool_huge_page(h, nodes_allowed, 0))
break;
+ cond_resched_lock(&hugetlb_lock);
}
while (count < persistent_huge_pages(h)) {
if (!adjust_pool_surplus(h, nodes_allowed, 1))
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 109/182] xattr: guard against simultaneous glibc header inclusion
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (107 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 108/182] mm: hugetlb: fix softlockup when a large number of hugepages are freed Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 110/182] ocfs2: dlm: fix lock migration crash Jiri Slaby
` (74 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Serge Hallyn, Andrew Morton, Allan McRae,
Linus Torvalds, Jiri Slaby
From: Serge Hallyn <serge.hallyn@ubuntu.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ea1a8217b06b41b31a2b60b0b83f75c77ef9c873 upstream.
If the glibc xattr.h header is included after the uapi header,
compilation fails due to an enum re-using a #define from the uapi
header.
Protect against this by guarding the define and enum inclusions against
each other.
(See https://lists.debian.org/debian-glibc/2014/03/msg00029.html
and https://sourceware.org/glibc/wiki/Synchronizing_Headers
for more information.)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Allan McRae <allan@archlinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
include/uapi/linux/libc-compat.h | 9 +++++++++
include/uapi/linux/xattr.h | 7 +++++++
2 files changed, 16 insertions(+)
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index 335e8a7cad39..c140620dad92 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -85,6 +85,12 @@
#endif /* _NETINET_IN_H */
+/* Definitions for xattr.h */
+#if defined(_SYS_XATTR_H)
+#define __UAPI_DEF_XATTR 0
+#else
+#define __UAPI_DEF_XATTR 1
+#endif
/* If we did not see any headers from any supported C libraries,
* or we are being included in the kernel, then define everything
@@ -98,6 +104,9 @@
#define __UAPI_DEF_IPV6_MREQ 1
#define __UAPI_DEF_IPPROTO_V6 1
+/* Definitions for xattr.h */
+#define __UAPI_DEF_XATTR 1
+
#endif /* __GLIBC__ */
#endif /* _UAPI_LIBC_COMPAT_H */
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index e4629b93bdd6..a63c14607f86 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -7,11 +7,18 @@
Copyright (c) 2001-2002 Silicon Graphics, Inc. All Rights Reserved.
Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
*/
+
+#include <linux/libc-compat.h>
+
#ifndef _UAPI_LINUX_XATTR_H
#define _UAPI_LINUX_XATTR_H
+#ifdef __UAPI_DEF_XATTR
+#define __USE_KERNEL_XATTR_DEFS
+
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
#define XATTR_REPLACE 0x2 /* set value, fail if attr does not exist */
+#endif
/* Namespaces */
#define XATTR_OS2_PREFIX "os2."
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 110/182] ocfs2: dlm: fix lock migration crash
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (108 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 109/182] xattr: guard against simultaneous glibc header inclusion Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 111/182] ocfs2: dlm: fix recovery hung Jiri Slaby
` (73 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Junxiao Bi, Sunil Mushran, Joel Becker, Mark Fasheh,
Andrew Morton, Linus Torvalds, Jiri Slaby
From: Junxiao Bi <junxiao.bi@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 34aa8dac482f1358d59110d5e3a12f4351f6acaa upstream.
This issue was introduced by commit 800deef3f6f8 ("ocfs2: use
list_for_each_entry where benefical") in 2007 where it replaced
list_for_each with list_for_each_entry. The variable "lock" will point
to invalid data if "tmpq" list is empty and a panic will be triggered
due to this. Sunil advised reverting it back, but the old version was
also not right. At the end of the outer for loop, that
list_for_each_entry will also set "lock" to an invalid data, then in the
next loop, if the "tmpq" list is empty, "lock" will be an stale invalid
data and cause the panic. So reverting the list_for_each back and reset
"lock" to NULL to fix this issue.
Another concern is that this seemes can not happen because the "tmpq"
list should not be empty. Let me describe how.
old lock resource owner(node 1): migratation target(node 2):
image there's lockres with a EX lock from node 2 in
granted list, a NR lock from node x with convert_type
EX in converting list.
dlm_empty_lockres() {
dlm_pick_migration_target() {
pick node 2 as target as its lock is the first one
in granted list.
}
dlm_migrate_lockres() {
dlm_mark_lockres_migrating() {
res->state |= DLM_LOCK_RES_BLOCK_DIRTY;
wait_event(dlm->ast_wq, !dlm_lockres_is_dirty(dlm, res));
//after the above code, we can not dirty lockres any more,
// so dlm_thread shuffle list will not run
downconvert lock from EX to NR
upconvert lock from NR to EX
<<< migration may schedule out here, then
<<< node 2 send down convert request to convert type from EX to
<<< NR, then send up convert request to convert type from NR to
<<< EX, at this time, lockres granted list is empty, and two locks
<<< in the converting list, node x up convert lock followed by
<<< node 2 up convert lock.
// will set lockres RES_MIGRATING flag, the following
// lock/unlock can not run
dlm_lockres_release_ast(dlm, res);
}
dlm_send_one_lockres()
dlm_process_recovery_data()
for (i=0; i<mres->num_locks; i++)
if (ml->node == dlm->node_num)
for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
list_for_each_entry(lock, tmpq, list)
if (lock) break; <<< lock is invalid as grant list is empty.
}
if (lock->ml.node != ml->node)
BUG() >>> crash here
}
I see the above locks status from a vmcore of our internal bug.
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
Cc: Sunil Mushran <sunil.mushran@gmail.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ocfs2/dlm/dlmrecovery.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 0b5adca1b178..723063bf0842 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1750,13 +1750,13 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
struct dlm_migratable_lockres *mres)
{
struct dlm_migratable_lock *ml;
- struct list_head *queue;
+ struct list_head *queue, *iter;
struct list_head *tmpq = NULL;
struct dlm_lock *newlock = NULL;
struct dlm_lockstatus *lksb = NULL;
int ret = 0;
int i, j, bad;
- struct dlm_lock *lock = NULL;
+ struct dlm_lock *lock;
u8 from = O2NM_MAX_NODES;
unsigned int added = 0;
__be64 c;
@@ -1791,14 +1791,16 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
/* MIGRATION ONLY! */
BUG_ON(!(mres->flags & DLM_MRES_MIGRATION));
+ lock = NULL;
spin_lock(&res->spinlock);
for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
tmpq = dlm_list_idx_to_ptr(res, j);
- list_for_each_entry(lock, tmpq, list) {
- if (lock->ml.cookie != ml->cookie)
- lock = NULL;
- else
+ list_for_each(iter, tmpq) {
+ lock = list_entry(iter,
+ struct dlm_lock, list);
+ if (lock->ml.cookie == ml->cookie)
break;
+ lock = NULL;
}
if (lock)
break;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 111/182] ocfs2: dlm: fix recovery hung
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (109 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 110/182] ocfs2: dlm: fix lock migration crash Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 112/182] ocfs2: do not put bh when buffer_uptodate failed Jiri Slaby
` (72 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Junxiao Bi, Joel Becker, Mark Fasheh, Andrew Morton,
Linus Torvalds, Jiri Slaby
From: Junxiao Bi <junxiao.bi@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ded2cf71419b9353060e633b59e446c42a6a2a09 upstream.
There is a race window in dlm_do_recovery() between dlm_remaster_locks()
and dlm_reset_recovery() when the recovery master nearly finish the
recovery process for a dead node. After the master sends FINALIZE_RECO
message in dlm_remaster_locks(), another node may become the recovery
master for another dead node, and then send the BEGIN_RECO message to
all the nodes included the old master, in the handler of this message
dlm_begin_reco_handler() of old master, dlm->reco.dead_node and
dlm->reco.new_master will be set to the second dead node and the new
master, then in dlm_reset_recovery(), these two variables will be reset
to default value. This will cause new recovery master can not finish
the recovery process and hung, at last the whole cluster will hung for
recovery.
old recovery master: new recovery master:
dlm_remaster_locks()
become recovery master for
another dead node.
dlm_send_begin_reco_message()
dlm_begin_reco_handler()
{
if (dlm->reco.state & DLM_RECO_STATE_FINALIZE) {
return -EAGAIN;
}
dlm_set_reco_master(dlm, br->node_idx);
dlm_set_reco_dead_node(dlm, br->dead_node);
}
dlm_reset_recovery()
{
dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);
dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);
}
will hang in dlm_remaster_locks() for
request dlm locks info
Before send FINALIZE_RECO message, recovery master should set
DLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,
this can break the race windows as the BEGIN_RECO messages will not be
handled before DLM_RECO_STATE_FINALIZE flag is cleared.
A similar race may happen between new recovery master and normal node
which is in dlm_finalize_reco_handler(), also fix it.
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ocfs2/dlm/dlmrecovery.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 723063bf0842..7b4a3fa63fab 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -537,7 +537,10 @@ master_here:
/* success! see if any other nodes need recovery */
mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n",
dlm->name, dlm->reco.dead_node, dlm->node_num);
- dlm_reset_recovery(dlm);
+ spin_lock(&dlm->spinlock);
+ __dlm_reset_recovery(dlm);
+ dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE;
+ spin_unlock(&dlm->spinlock);
}
dlm_end_recovery(dlm);
@@ -695,6 +698,14 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
if (all_nodes_done) {
int ret;
+ /* Set this flag on recovery master to avoid
+ * a new recovery for another dead node start
+ * before the recovery is not done. That may
+ * cause recovery hung.*/
+ spin_lock(&dlm->spinlock);
+ dlm->reco.state |= DLM_RECO_STATE_FINALIZE;
+ spin_unlock(&dlm->spinlock);
+
/* all nodes are now in DLM_RECO_NODE_DATA_DONE state
* just send a finalize message to everyone and
* clean up */
@@ -2877,8 +2888,8 @@ int dlm_finalize_reco_handler(struct o2net_msg *msg, u32 len, void *data,
BUG();
}
dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE;
+ __dlm_reset_recovery(dlm);
spin_unlock(&dlm->spinlock);
- dlm_reset_recovery(dlm);
dlm_kick_recovery_thread(dlm);
break;
default:
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 112/182] ocfs2: do not put bh when buffer_uptodate failed
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (110 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 111/182] ocfs2: dlm: fix recovery hung Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 113/182] ocfs2: fix panic on kfree(xattr->name) Jiri Slaby
` (71 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, alex chen, Mark Fasheh, Andrew Morton,
Linus Torvalds, Jiri Slaby
From: alex chen <alex.chen@huawei.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f7cf4f5bfe073ad792ab49c04f247626b3e38db6 upstream.
Do not put bh when buffer_uptodate failed in ocfs2_write_block and
ocfs2_write_super_or_backup, because it will put bh in b_end_io.
Otherwise it will hit a warning "VFS: brelse: Trying to free free
buffer".
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ocfs2/buffer_head_io.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index 5d18ad10c27f..4f66e007dae1 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -90,7 +90,6 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
* information for this bh as it's not marked locally
* uptodate. */
ret = -EIO;
- put_bh(bh);
mlog_errno(ret);
}
@@ -420,7 +419,6 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
if (!buffer_uptodate(bh)) {
ret = -EIO;
- put_bh(bh);
mlog_errno(ret);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 113/182] ocfs2: fix panic on kfree(xattr->name)
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (111 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 112/182] ocfs2: do not put bh when buffer_uptodate failed Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 114/182] clk: s2mps11: Fix possible NULL pointer dereference Jiri Slaby
` (70 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Tetsuo Handa, Joel Becker, Mark Fasheh,
Andrew Morton, Linus Torvalds, Jiri Slaby
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f81c20158f8d5f7938d5eb86ecc42ecc09273ce6 upstream.
Commit 9548906b2bb7 ('xattr: Constify ->name member of "struct xattr"')
missed that ocfs2 is calling kfree(xattr->name). As a result, kernel
panic occurs upon calling kfree(xattr->name) because xattr->name refers
static constant names. This patch removes kfree(xattr->name) from
ocfs2_mknod() and ocfs2_symlink().
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: Tariq Saeed <tariq.x.saeed@oracle.com>
Tested-by: Tariq Saeed <tariq.x.saeed@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ocfs2/namei.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index be3f8676a438..c19c2c57650b 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -430,7 +430,6 @@ leave:
brelse(new_fe_bh);
brelse(parent_fe_bh);
- kfree(si.name);
kfree(si.value);
ocfs2_free_dir_lookup_result(&lookup);
@@ -1818,7 +1817,6 @@ bail:
brelse(new_fe_bh);
brelse(parent_fe_bh);
- kfree(si.name);
kfree(si.value);
ocfs2_free_dir_lookup_result(&lookup);
if (inode_ac)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 114/182] clk: s2mps11: Fix possible NULL pointer dereference
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (112 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 113/182] ocfs2: fix panic on kfree(xattr->name) Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 115/182] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS Jiri Slaby
` (69 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Krzysztof Kozlowski, Mike Turquette, Jiri Slaby
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 238e14055da87d0d012257788e39fe0df3a82226 upstream.
If parent device does not have of_node set the s2mps11_clk_parse_dt()
returned NULL. This NULL was later passed to of_clk_add_provider() which
dereferenced it in pr_debug() call.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/clk/clk-s2mps11.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 7be41e676a64..aa21299ec7d2 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -130,7 +130,7 @@ static struct device_node *s2mps11_clk_parse_dt(struct platform_device *pdev)
int i;
if (!iodev->dev->of_node)
- return NULL;
+ return ERR_PTR(-EINVAL);
clk_np = of_find_node_by_name(iodev->dev->of_node, "clocks");
if (!clk_np) {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 115/182] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (113 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 114/182] clk: s2mps11: Fix possible NULL pointer dereference Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 116/182] ext4: note the error in ext4_end_bio() Jiri Slaby
` (68 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Kazuya Mio, Theodore Ts'o, Jiri Slaby
From: Kazuya Mio <k-mio@sx.jp.nec.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4adb6ab3e0fa71363a5ef229544b2d17de6600d7 upstream.
When we try to get 2^32-1 block of the file which has the extent
(ee_block=2^32-2, ee_len=1) with FIBMAP ioctl, it causes BUG_ON
in ext4_ext_put_gap_in_cache().
To avoid the problem, ext4_map_blocks() needs to check the file logical block
number. ext4_ext_put_gap_in_cache() called via ext4_map_blocks() cannot
handle 2^32-1 because the maximum file logical block number is 2^32-2.
Note that ext4_ind_map_blocks() returns -EIO when the block number is invalid.
So ext4_map_blocks() should also return the same errno.
Signed-off-by: Kazuya Mio <k-mio@sx.jp.nec.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/inode.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index f173ef12c97a..8fdf99bf18d6 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -515,6 +515,10 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
"logical block %lu\n", inode->i_ino, flags, map->m_len,
(unsigned long) map->m_lblk);
+ /* We can handle the block number less than EXT_MAX_BLOCKS */
+ if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))
+ return -EIO;
+
/* Lookup extent status tree firstly */
if (ext4_es_lookup_extent(inode, map->m_lblk, &es)) {
ext4_es_lru_add(inode);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 116/182] ext4: note the error in ext4_end_bio()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (114 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 115/182] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 117/182] ext4: fix jbd2 warning under heavy xattr load Jiri Slaby
` (67 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Matthew Wilcox, Matthew Wilcox, Theodore Ts'o,
Jiri Slaby
From: Matthew Wilcox <willy@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9503c67c93ed0b95ba62d12d1fd09da6245dbdd6 upstream.
ext4_end_bio() currently throws away the error that it receives. Chances
are this is part of a spate of errors, one of which will end up getting
the error returned to userspace somehow, but we shouldn't take that risk.
Also print out the errno to aid in debug.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/page-io.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index d7d0c7b46ed4..02e94ef1489b 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -307,13 +307,14 @@ static void ext4_end_bio(struct bio *bio, int error)
if (error) {
struct inode *inode = io_end->inode;
- ext4_warning(inode->i_sb, "I/O error writing to inode %lu "
+ ext4_warning(inode->i_sb, "I/O error %d writing to inode %lu "
"(offset %llu size %ld starting block %llu)",
- inode->i_ino,
+ error, inode->i_ino,
(unsigned long long) io_end->offset,
(long) io_end->size,
(unsigned long long)
bi_sector >> (inode->i_blkbits - 9));
+ mapping_set_error(inode->i_mapping, error);
}
if (io_end->flag & EXT4_IO_END_UNWRITTEN) {
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 117/182] ext4: fix jbd2 warning under heavy xattr load
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (115 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 116/182] ext4: note the error in ext4_end_bio() Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 118/182] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent() Jiri Slaby
` (66 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jan Kara, Theodore Ts'o, Jiri Slaby
From: Jan Kara <jack@suse.cz>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ec4cb1aa2b7bae18dd8164f2e9c7c51abcf61280 upstream.
When heavily exercising xattr code the assertion that
jbd2_journal_dirty_metadata() shouldn't return error was triggered:
WARNING: at /srv/autobuild-ceph/gitbuilder.git/build/fs/jbd2/transaction.c:1237
jbd2_journal_dirty_metadata+0x1ba/0x260()
CPU: 0 PID: 8877 Comm: ceph-osd Tainted: G W 3.10.0-ceph-00049-g68d04c9 #1
Hardware name: Dell Inc. PowerEdge R410/01V648, BIOS 1.6.3 02/07/2011
ffffffff81a1d3c8 ffff880214469928 ffffffff816311b0 ffff880214469968
ffffffff8103fae0 ffff880214469958 ffff880170a9dc30 ffff8802240fbe80
0000000000000000 ffff88020b366000 ffff8802256e7510 ffff880214469978
Call Trace:
[<ffffffff816311b0>] dump_stack+0x19/0x1b
[<ffffffff8103fae0>] warn_slowpath_common+0x70/0xa0
[<ffffffff8103fb2a>] warn_slowpath_null+0x1a/0x20
[<ffffffff81267c2a>] jbd2_journal_dirty_metadata+0x1ba/0x260
[<ffffffff81245093>] __ext4_handle_dirty_metadata+0xa3/0x140
[<ffffffff812561f3>] ext4_xattr_release_block+0x103/0x1f0
[<ffffffff81256680>] ext4_xattr_block_set+0x1e0/0x910
[<ffffffff8125795b>] ext4_xattr_set_handle+0x38b/0x4a0
[<ffffffff810a319d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81257b32>] ext4_xattr_set+0xc2/0x140
[<ffffffff81258547>] ext4_xattr_user_set+0x47/0x50
[<ffffffff811935ce>] generic_setxattr+0x6e/0x90
[<ffffffff81193ecb>] __vfs_setxattr_noperm+0x7b/0x1c0
[<ffffffff811940d4>] vfs_setxattr+0xc4/0xd0
[<ffffffff8119421e>] setxattr+0x13e/0x1e0
[<ffffffff811719c7>] ? __sb_start_write+0xe7/0x1b0
[<ffffffff8118f2e8>] ? mnt_want_write_file+0x28/0x60
[<ffffffff8118c65c>] ? fget_light+0x3c/0x130
[<ffffffff8118f2e8>] ? mnt_want_write_file+0x28/0x60
[<ffffffff8118f1f8>] ? __mnt_want_write+0x58/0x70
[<ffffffff811946be>] SyS_fsetxattr+0xbe/0x100
[<ffffffff816407c2>] system_call_fastpath+0x16/0x1b
The reason for the warning is that buffer_head passed into
jbd2_journal_dirty_metadata() didn't have journal_head attached. This is
caused by the following race of two ext4_xattr_release_block() calls:
CPU1 CPU2
ext4_xattr_release_block() ext4_xattr_release_block()
lock_buffer(bh);
/* False */
if (BHDR(bh)->h_refcount == cpu_to_le32(1))
} else {
le32_add_cpu(&BHDR(bh)->h_refcount, -1);
unlock_buffer(bh);
lock_buffer(bh);
/* True */
if (BHDR(bh)->h_refcount == cpu_to_le32(1))
get_bh(bh);
ext4_free_blocks()
...
jbd2_journal_forget()
jbd2_journal_unfile_buffer()
-> JH is gone
error = ext4_handle_dirty_xattr_block(handle, inode, bh);
-> triggers the warning
We fix the problem by moving ext4_handle_dirty_xattr_block() under the
buffer lock. Sadly this cannot be done in nojournal mode as that
function can call sync_dirty_buffer() which would deadlock. Luckily in
nojournal mode the race is harmless (we only dirty already freed buffer)
and thus for nojournal mode we leave the dirtying outside of the buffer
lock.
Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/xattr.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 1423c4816a47..298e9c8da364 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -517,8 +517,8 @@ static void ext4_xattr_update_super_block(handle_t *handle,
}
/*
- * Release the xattr block BH: If the reference count is > 1, decrement
- * it; otherwise free the block.
+ * Release the xattr block BH: If the reference count is > 1, decrement it;
+ * otherwise free the block.
*/
static void
ext4_xattr_release_block(handle_t *handle, struct inode *inode,
@@ -538,16 +538,31 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
if (ce)
mb_cache_entry_free(ce);
get_bh(bh);
+ unlock_buffer(bh);
ext4_free_blocks(handle, inode, bh, 0, 1,
EXT4_FREE_BLOCKS_METADATA |
EXT4_FREE_BLOCKS_FORGET);
- unlock_buffer(bh);
} else {
le32_add_cpu(&BHDR(bh)->h_refcount, -1);
if (ce)
mb_cache_entry_release(ce);
+ /*
+ * Beware of this ugliness: Releasing of xattr block references
+ * from different inodes can race and so we have to protect
+ * from a race where someone else frees the block (and releases
+ * its journal_head) before we are done dirtying the buffer. In
+ * nojournal mode this race is harmless and we actually cannot
+ * call ext4_handle_dirty_xattr_block() with locked buffer as
+ * that function can call sync_dirty_buffer() so for that case
+ * we handle the dirtying after unlocking the buffer.
+ */
+ if (ext4_handle_valid(handle))
+ error = ext4_handle_dirty_xattr_block(handle, inode,
+ bh);
unlock_buffer(bh);
- error = ext4_handle_dirty_xattr_block(handle, inode, bh);
+ if (!ext4_handle_valid(handle))
+ error = ext4_handle_dirty_xattr_block(handle, inode,
+ bh);
if (IS_SYNC(inode))
ext4_handle_sync(handle);
dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 118/182] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (116 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 117/182] ext4: fix jbd2 warning under heavy xattr load Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 119/182] ext4: use i_size_read in ext4_unaligned_aio() Jiri Slaby
` (65 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Theodore Ts'o, Jiri Slaby
From: Theodore Ts'o <tytso@mit.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 622cad1325e404598fe3b148c3fa640dbaabc235 upstream.
The function ext4_update_i_disksize() is used in only one place, in
the function mpage_map_and_submit_extent(). Move its code to simplify
the code paths, and also move the call to ext4_mark_inode_dirty() into
the i_data_sem's critical region, to be consistent with all of the
other places where we update i_disksize. That way, we also keep the
raw_inode's i_disksize protected, to avoid the following race:
CPU #1 CPU #2
down_write(&i_data_sem)
Modify i_disk_size
up_write(&i_data_sem)
down_write(&i_data_sem)
Modify i_disk_size
Copy i_disk_size to on-disk inode
up_write(&i_data_sem)
Copy i_disk_size to on-disk inode
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/ext4.h | 17 -----------------
fs/ext4/inode.c | 16 +++++++++++++---
2 files changed, 13 insertions(+), 20 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index a9d2bf941066..1e25d6b57bc5 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2445,23 +2445,6 @@ static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
up_write(&EXT4_I(inode)->i_data_sem);
}
-/*
- * Update i_disksize after writeback has been started. Races with truncate
- * are avoided by checking i_size under i_data_sem.
- */
-static inline void ext4_wb_update_i_disksize(struct inode *inode, loff_t newsize)
-{
- loff_t i_size;
-
- down_write(&EXT4_I(inode)->i_data_sem);
- i_size = i_size_read(inode);
- if (newsize > i_size)
- newsize = i_size;
- if (newsize > EXT4_I(inode)->i_disksize)
- EXT4_I(inode)->i_disksize = newsize;
- up_write(&EXT4_I(inode)->i_data_sem);
-}
-
struct ext4_group_info {
unsigned long bb_state;
struct rb_root bb_free_root;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 8fdf99bf18d6..ea9793d8a77f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2233,13 +2233,23 @@ static int mpage_map_and_submit_extent(handle_t *handle,
return err;
} while (map->m_len);
- /* Update on-disk size after IO is submitted */
+ /*
+ * Update on-disk size after IO is submitted. Races with
+ * truncate are avoided by checking i_size under i_data_sem.
+ */
disksize = ((loff_t)mpd->first_page) << PAGE_CACHE_SHIFT;
if (disksize > EXT4_I(inode)->i_disksize) {
int err2;
-
- ext4_wb_update_i_disksize(inode, disksize);
+ loff_t i_size;
+
+ down_write(&EXT4_I(inode)->i_data_sem);
+ i_size = i_size_read(inode);
+ if (disksize > i_size)
+ disksize = i_size;
+ if (disksize > EXT4_I(inode)->i_disksize)
+ EXT4_I(inode)->i_disksize = disksize;
err2 = ext4_mark_inode_dirty(handle, inode);
+ up_write(&EXT4_I(inode)->i_data_sem);
if (err2)
ext4_error(inode->i_sb,
"Failed to mark inode %lu dirty",
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 119/182] ext4: use i_size_read in ext4_unaligned_aio()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (117 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 118/182] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent() Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 120/182] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb Jiri Slaby
` (64 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Theodore Ts'o, Jiri Slaby
From: Theodore Ts'o <tytso@mit.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6e6358fc3c3c862bfe9a5bc029d3f8ce43dc9765 upstream.
We haven't taken i_mutex yet, so we need to use i_size_read().
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ext4/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 3da21945ff1f..1b890101397b 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -82,7 +82,7 @@ ext4_unaligned_aio(struct inode *inode, const struct iovec *iov,
size_t count = iov_length(iov, nr_segs);
loff_t final_size = pos + count;
- if (pos >= inode->i_size)
+ if (pos >= i_size_read(inode))
return 0;
if ((pos & blockmask) || (final_size & blockmask))
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 120/182] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (118 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 119/182] ext4: use i_size_read in ext4_unaligned_aio() Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 121/182] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays Jiri Slaby
` (63 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Julius Werner, Mathias Nyman, Jiri Slaby
From: Julius Werner <jwerner@chromium.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1f81b6d22a5980955b01e08cf27fb745dc9b686f upstream.
We have observed a rare cycle state desync bug after Set TR Dequeue
Pointer commands on Intel LynxPoint xHCs (resulting in an endpoint that
doesn't fetch new TRBs and thus an unresponsive USB device). It always
triggers when a previous Set TR Dequeue Pointer command has set the
pointer to the final Link TRB of a segment, and then another URB gets
enqueued and cancelled again before it can be completed. Further
investigation showed that the xHC had returned the Link TRB in the TRB
Pointer field of the Transfer Event (CC == Stopped -- Length Invalid),
but when xhci_find_new_dequeue_state() later accesses the Endpoint
Context's TR Dequeue Pointer field it is set to the first TRB of the
next segment.
The driver expects those two values to be the same in this situation,
and uses the cycle state of the latter together with the address of the
former. This should be fine according to the XHCI specification, since
the endpoint ring should be stopped when returning the Transfer Event
and thus should not advance over the Link TRB before it gets restarted.
However, real-world XHCI implementations apparently don't really care
that much about these details, so the driver should follow a more
defensive approach to try to work around HC spec violations.
This patch removes the stopped_trb variable that had been used to store
the TRB Pointer from the last Transfer Event of a stopped TRB. Instead,
xhci_find_new_dequeue_state() now relies only on the Endpoint Context,
requiring a small amount of additional processing to find the virtual
address corresponding to the TR Dequeue Pointer. Some other parts of the
function were slightly rearranged to better fit into this model.
This patch should be backported to kernels as old as 2.6.31 that contain
the commit ae636747146ea97efa18e04576acd3416e2514f5 "USB: xhci: URB
cancellation support."
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-ring.c | 67 ++++++++++++++++++++------------------------
drivers/usb/host/xhci.c | 1 -
drivers/usb/host/xhci.h | 2 --
3 files changed, 31 insertions(+), 39 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6bfbd80ec2b9..cbecb5ff7d90 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -556,6 +556,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
struct xhci_generic_trb *trb;
struct xhci_ep_ctx *ep_ctx;
dma_addr_t addr;
+ u64 hw_dequeue;
ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
ep_index, stream_id);
@@ -565,56 +566,57 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
stream_id);
return;
}
- state->new_cycle_state = 0;
- xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
- "Finding segment containing stopped TRB.");
- state->new_deq_seg = find_trb_seg(cur_td->start_seg,
- dev->eps[ep_index].stopped_trb,
- &state->new_cycle_state);
- if (!state->new_deq_seg) {
- WARN_ON(1);
- return;
- }
/* Dig out the cycle state saved by the xHC during the stop ep cmd */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Finding endpoint context");
ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
- state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
+ hw_dequeue = le64_to_cpu(ep_ctx->deq);
+
+ /* Find virtual address and segment of hardware dequeue pointer */
+ state->new_deq_seg = ep_ring->deq_seg;
+ state->new_deq_ptr = ep_ring->dequeue;
+ while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
+ != (dma_addr_t)(hw_dequeue & ~0xf)) {
+ next_trb(xhci, ep_ring, &state->new_deq_seg,
+ &state->new_deq_ptr);
+ if (state->new_deq_ptr == ep_ring->dequeue) {
+ WARN_ON(1);
+ return;
+ }
+ }
+ /*
+ * Find cycle state for last_trb, starting at old cycle state of
+ * hw_dequeue. If there is only one segment ring, find_trb_seg() will
+ * return immediately and cannot toggle the cycle state if this search
+ * wraps around, so add one more toggle manually in that case.
+ */
+ state->new_cycle_state = hw_dequeue & 0x1;
+ if (ep_ring->first_seg == ep_ring->first_seg->next &&
+ cur_td->last_trb < state->new_deq_ptr)
+ state->new_cycle_state ^= 0x1;
state->new_deq_ptr = cur_td->last_trb;
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Finding segment containing last TRB in TD.");
state->new_deq_seg = find_trb_seg(state->new_deq_seg,
- state->new_deq_ptr,
- &state->new_cycle_state);
+ state->new_deq_ptr, &state->new_cycle_state);
if (!state->new_deq_seg) {
WARN_ON(1);
return;
}
+ /* Increment to find next TRB after last_trb. Cycle if appropriate. */
trb = &state->new_deq_ptr->generic;
if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
(trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
state->new_cycle_state ^= 0x1;
next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
- /*
- * If there is only one segment in a ring, find_trb_seg()'s while loop
- * will not run, and it will return before it has a chance to see if it
- * needs to toggle the cycle bit. It can't tell if the stalled transfer
- * ended just before the link TRB on a one-segment ring, or if the TD
- * wrapped around the top of the ring, because it doesn't have the TD in
- * question. Look for the one-segment case where stalled TRB's address
- * is greater than the new dequeue pointer address.
- */
- if (ep_ring->first_seg == ep_ring->first_seg->next &&
- state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
- state->new_cycle_state ^= 0x1;
+ /* Don't update the ring cycle state for the producer (us). */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Cycle state = 0x%x", state->new_cycle_state);
- /* Don't update the ring cycle state for the producer (us). */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"New dequeue segment = %p (virtual)",
state->new_deq_seg);
@@ -802,7 +804,6 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
if (list_empty(&ep->cancelled_td_list)) {
xhci_stop_watchdog_timer_in_irq(xhci, ep);
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
return;
}
@@ -870,11 +871,9 @@ remove_finished_td:
ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
}
- /* Clear stopped_td and stopped_trb if endpoint is not halted */
- if (!(ep->ep_state & EP_HALTED)) {
+ /* Clear stopped_td if endpoint is not halted */
+ if (!(ep->ep_state & EP_HALTED))
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
- }
/*
* Drop the lock and complete the URBs in the cancelled TD list.
@@ -1870,14 +1869,12 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
ep->ep_state |= EP_HALTED;
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
ep->stopped_stream = stream_id;
xhci_queue_reset_ep(xhci, slot_id, ep_index);
xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
ep->stopped_stream = 0;
xhci_ring_cmd_db(xhci);
@@ -1959,7 +1956,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
* the ring dequeue pointer or take this TD off any lists yet.
*/
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
return 0;
} else {
if (trb_comp_code == COMP_STALL) {
@@ -1971,7 +1967,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
* USB class driver clear the stall later.
*/
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
ep->stopped_stream = ep_ring->stream_id;
} else if (xhci_requires_manual_halt_cleanup(xhci,
ep_ctx, trb_comp_code)) {
@@ -2588,7 +2583,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
* successful event after a short transfer.
* Ignore it.
*/
- if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) &&
+ if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) &&
ep_ring->last_td_was_short) {
ep_ring->last_td_was_short = false;
ret = 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f07f32b5a526..01aa4c9fa558 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2932,7 +2932,6 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
xhci_ring_cmd_db(xhci);
}
virt_ep->stopped_td = NULL;
- virt_ep->stopped_trb = NULL;
virt_ep->stopped_stream = 0;
spin_unlock_irqrestore(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index ed3a425de8ce..75f775c993ee 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -864,8 +864,6 @@ struct xhci_virt_ep {
#define EP_GETTING_NO_STREAMS (1 << 5)
/* ---- Related to URB cancellation ---- */
struct list_head cancelled_td_list;
- /* The TRB that was last reported in a stopped endpoint ring */
- union xhci_trb *stopped_trb;
struct xhci_td *stopped_td;
unsigned int stopped_stream;
/* Watchdog timer for stop endpoint command to cancel URBs */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 121/182] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (119 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 120/182] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 122/182] ARM: dts: am335x: update USB DT references Jiri Slaby
` (62 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Aaron Sanders, Johan Hovold, Jiri Slaby
From: Aaron Sanders <aaron.sanders@hp.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b16c02fbfb963fa2941b7517ebf1f8a21946775e upstream.
Add device ids to pl2303 for the Hewlett-Packard HP POS pole displays:
LD960: 03f0:0B39
LCM220: 03f0:3139
LCM960: 03f0:3239
[ Johan: fix indentation and sort PIDs numerically ]
Signed-off-by: Aaron Sanders <aaron.sanders@hp.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/pl2303.c | 3 +++
drivers/usb/serial/pl2303.h | 5 ++++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index beb8edce4ef2..6e09306b2a5e 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -83,6 +83,9 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index c38b8c00c06f..42bc082896ac 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -121,8 +121,11 @@
#define SUPERIAL_VENDOR_ID 0x5372
#define SUPERIAL_PRODUCT_ID 0x2303
-/* Hewlett-Packard LD220-HP POS Pole Display */
+/* Hewlett-Packard POS Pole Displays */
#define HP_VENDOR_ID 0x03f0
+#define HP_LD960_PRODUCT_ID 0x0b39
+#define HP_LCM220_PRODUCT_ID 0x3139
+#define HP_LCM960_PRODUCT_ID 0x3239
#define HP_LD220_PRODUCT_ID 0x3524
/* Cressi Edy (diving computer) PC interface */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 122/182] ARM: dts: am335x: update USB DT references
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (120 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 121/182] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 123/182] drivers/tty/hvc: don't free hvc_console_setup after init Jiri Slaby
` (61 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Leigh Brown, Tony Lindgren, Johan Hovold,
Jiri Slaby
From: Leigh Brown <leigh@solinno.co.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a2f8d6b303213a98436455aece7e14cdd1240629 upstream.
In "ARM: dts: am33xx: correcting dt node unit address for usb", the
usb_ctrl_mod and cppi41dma nodes were updated with the correct register
addresses. However, the dts files that reference these nodes were not
updated, and those devices are no longer being enabled.
This patch corrects the references for the affected dts files.
Signed-off-by: Leigh Brown <leigh@solinno.co.uk>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/boot/dts/am335x-bone-common.dtsi | 4 ++--
arch/arm/boot/dts/am335x-evm.dts | 4 ++--
arch/arm/boot/dts/am335x-evmsk.dts | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 2f66deda9f5c..e6e952e32117 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -120,7 +120,7 @@
musb: usb@47400000 {
status = "okay";
- control@44e10000 {
+ control@44e10620 {
status = "okay";
};
@@ -141,7 +141,7 @@
dr_mode = "host";
};
- dma-controller@07402000 {
+ dma-controller@47402000 {
status = "okay";
};
};
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index e8ec8756e498..b2f476911e13 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -174,7 +174,7 @@
musb: usb@47400000 {
status = "okay";
- control@44e10000 {
+ control@44e10620 {
status = "okay";
};
@@ -195,7 +195,7 @@
dr_mode = "host";
};
- dma-controller@07402000 {
+ dma-controller@47402000 {
status = "okay";
};
};
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 4f339fa91c57..521d92afc78a 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -211,7 +211,7 @@
musb: usb@47400000 {
status = "okay";
- control@44e10000 {
+ control@44e10620 {
status = "okay";
};
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 123/182] drivers/tty/hvc: don't free hvc_console_setup after init
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (121 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 122/182] ARM: dts: am335x: update USB DT references Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 124/182] tty: serial: 8250_core.c Bug fix for Exar chips Jiri Slaby
` (60 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tomoki Sekiyama, Jiri Slaby
From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream.
When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest,
hvc console is setup within a kthread. However, that will cause SEGV
and the boot will fail when the driver is builtin to the kernel,
because currently hvc_console_setup() is annotated with '__init'. This
patch removes '__init' to boot the guest successfully with 'console=hvc0'.
Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/tty/hvc/hvc_console.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 620da5f88e91..e8e06d82acf0 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_device(struct console *c, int *index)
return hvc_driver;
}
-static int __init hvc_console_setup(struct console *co, char *options)
+static int hvc_console_setup(struct console *co, char *options)
{
if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES)
return -ENODEV;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 124/182] tty: serial: 8250_core.c Bug fix for Exar chips.
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (122 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 123/182] drivers/tty/hvc: don't free hvc_console_setup after init Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 125/182] tty: Fix lockless tty buffer race Jiri Slaby
` (59 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Michael Welling, Jiri Slaby
From: Michael Welling <mwelling@ieee.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b790f210fe8423eff881b2a8a93ba5dbc45534d0 upstream.
The sleep function was updated to put the serial port to sleep only when necessary.
This appears to resolve the errant behavior of the driver as described in
Kernel Bug 61961 – "My Exar Corp. XR17C/D152 Dual PCI UART modem does not
work with 3.8.0".
Signed-off-by: Michael Welling <mwelling@ieee.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/tty/serial/8250/8250_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 4f6e01cf67f7..aa6db8f4ee18 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -555,7 +555,7 @@ static void serial8250_set_sleep(struct uart_8250_port *p, int sleep)
*/
if ((p->port.type == PORT_XR17V35X) ||
(p->port.type == PORT_XR17D15X)) {
- serial_out(p, UART_EXAR_SLEEP, 0xff);
+ serial_out(p, UART_EXAR_SLEEP, sleep ? 0xff : 0);
return;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 125/182] tty: Fix lockless tty buffer race
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (123 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 124/182] tty: serial: 8250_core.c Bug fix for Exar chips Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 126/182] n_tty: Fix n_tty_write crash when echoing in raw mode Jiri Slaby
` (58 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Peter Hurley, Jiri Slaby
From: Peter Hurley <peter@hurleysoftware.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 62a0d8d7c2b29f92850e4ee3c38e5dfd936e92b2 upstream.
Commit 6a20dbd6caa2358716136144bf524331d70b1e03,
"tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
correctly identifies an unsafe race condition between
__tty_buffer_request_room() and flush_to_ldisc(), where the consumer
flush_to_ldisc() prematurely advances the head before consuming the
last of the data committed. For example:
CPU 0 | CPU 1
__tty_buffer_request_room | flush_to_ldisc
... | ...
| count = head->commit - head->read
n = tty_buffer_alloc() |
b->commit = b->used |
b->next = n |
| if (!count) /* T */
| if (head->next == NULL) /* F */
| buf->head = head->next
In this case, buf->head has been advanced but head->commit may have
been updated with a new value.
Instead of reintroducing an unnecessary lock, fix the race locklessly.
Read the commit-next pair in the reverse order of writing, which guarantees
the commit value read is the latest value written if the head is
advancing.
Reported-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/tty/tty_buffer.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 2b52d807934e..4847fc57f3e2 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -248,7 +248,11 @@ int tty_buffer_request_room(struct tty_port *port, size_t size)
if ((n = tty_buffer_alloc(port, size)) != NULL) {
buf->tail = n;
b->commit = b->used;
- smp_mb();
+ /* paired w/ barrier in flush_to_ldisc(); ensures the
+ * latest commit value can be read before the head is
+ * advanced to the next buffer
+ */
+ smp_wmb();
b->next = n;
} else
size = left;
@@ -449,17 +453,24 @@ static void flush_to_ldisc(struct work_struct *work)
while (1) {
struct tty_buffer *head = buf->head;
+ struct tty_buffer *next;
int count;
/* Ldisc or user is trying to gain exclusive access */
if (atomic_read(&buf->priority))
break;
+ next = head->next;
+ /* paired w/ barrier in __tty_buffer_request_room();
+ * ensures commit value read is not stale if the head
+ * is advancing to the next buffer
+ */
+ smp_rmb();
count = head->commit - head->read;
if (!count) {
- if (head->next == NULL)
+ if (next == NULL)
break;
- buf->head = head->next;
+ buf->head = next;
tty_buffer_free(port, head);
continue;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 126/182] n_tty: Fix n_tty_write crash when echoing in raw mode
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (124 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 125/182] tty: Fix lockless tty buffer race Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:27 ` [PATCH 3.12 127/182] floppy: ignore kernel-only members in FDRAWCMD ioctl input Jiri Slaby
` (57 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Peter Hurley, Jiri Slaby, Linus Torvalds, Alan Cox
From: Peter Hurley <peter@hurleysoftware.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.
If we look into tty_insert_flip_string_fixed_flag, there is:
int space = __tty_buffer_request_room(port, goal, flags);
struct tty_buffer *tb = port->buf.tail;
...
memcpy(char_buf_ptr(tb, tb->used), chars, space);
...
tb->used += space;
so the race of the two can result in something like this:
A B
__tty_buffer_request_room
__tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
memcpy(buf(tb->used), ...) ->BOOM
B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.
Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.
Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.
js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/tty/n_tty.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index d4a89db511b5..bd73dc25b41d 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2350,8 +2350,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
if (tty->ops->flush_chars)
tty->ops->flush_chars(tty);
} else {
+ struct n_tty_data *ldata = tty->disc_data;
+
while (nr > 0) {
+ mutex_lock(&ldata->output_lock);
c = tty->ops->write(tty, b, nr);
+ mutex_unlock(&ldata->output_lock);
if (c < 0) {
retval = c;
goto break_out;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 127/182] floppy: ignore kernel-only members in FDRAWCMD ioctl input
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (125 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 126/182] n_tty: Fix n_tty_write crash when echoing in raw mode Jiri Slaby
@ 2014-05-13 9:27 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 128/182] floppy: don't write kernel-only members to FDRAWCMD ioctl output Jiri Slaby
` (56 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:27 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Matthew Daley, Linus Torvalds, Jiri Slaby
From: Matthew Daley <mattd@bugfuzz.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.
Always clear out these floppy_raw_cmd struct members after copying the
entire structure from userspace so that the in-kernel version is always
valid and never left in an interdeterminate state.
Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/block/floppy.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 690011de912a..b836e1a9047f 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3107,10 +3107,11 @@ loop:
return -ENOMEM;
*rcmd = ptr;
ret = copy_from_user(ptr, param, sizeof(*ptr));
- if (ret)
- return -EFAULT;
ptr->next = NULL;
ptr->buffer_length = 0;
+ ptr->kernel_data = NULL;
+ if (ret)
+ return -EFAULT;
param += sizeof(struct floppy_raw_cmd);
if (ptr->cmd_count > 33)
/* the command may now also take up the space
@@ -3126,7 +3127,6 @@ loop:
for (i = 0; i < 16; i++)
ptr->reply[i] = 0;
ptr->resultcode = 0;
- ptr->kernel_data = NULL;
if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
if (ptr->length <= 0)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 128/182] floppy: don't write kernel-only members to FDRAWCMD ioctl output
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (126 preceding siblings ...)
2014-05-13 9:27 ` [PATCH 3.12 127/182] floppy: ignore kernel-only members in FDRAWCMD ioctl input Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 129/182] KVM: ARM: vgic: Fix sgi dispatch problem Jiri Slaby
` (55 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Matthew Daley, Linus Torvalds, Jiri Slaby
From: Matthew Daley <mattd@bugfuzz.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2145e15e0557a01b9195d1c7199a1b92cb9be81f upstream.
Do not leak kernel-only floppy_raw_cmd structure members to userspace.
This includes the linked-list pointer and the pointer to the allocated
DMA space.
Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/block/floppy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b836e1a9047f..cf3e5042193c 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3053,7 +3053,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
int ret;
while (ptr) {
- ret = copy_to_user(param, ptr, sizeof(*ptr));
+ struct floppy_raw_cmd cmd = *ptr;
+ cmd.next = NULL;
+ cmd.kernel_data = NULL;
+ ret = copy_to_user(param, &cmd, sizeof(cmd));
if (ret)
return -EFAULT;
param += sizeof(struct floppy_raw_cmd);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 129/182] KVM: ARM: vgic: Fix sgi dispatch problem
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (127 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 128/182] floppy: don't write kernel-only members to FDRAWCMD ioctl output Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 130/182] arm: KVM: fix possible misalignment of PGDs and bounce page Jiri Slaby
` (54 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Haibin Wang, Christoffer Dall, Jiri Slaby
From: Haibin Wang <wanghaibin.wang@huawei.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 91021a6c8ffdc55804dab5acdfc7de4f278b9ac3 upstream.
When dispatch SGI(mode == 0), that is the vcpu of VM should send
sgi to the cpu which the target_cpus list.
So, there must add the "break" to branch of case 0.
Signed-off-by: Haibin Wang <wanghaibin.wang@huawei.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
virt/kvm/arm/vgic.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 685fc72fc751..b001dbff0f38 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -751,6 +751,7 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
case 0:
if (!target_cpus)
return;
+ break;
case 1:
target_cpus = ((1 << nrcpus) - 1) & ~(1 << vcpu_id) & 0xff;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 130/182] arm: KVM: fix possible misalignment of PGDs and bounce page
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (128 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 129/182] KVM: ARM: vgic: Fix sgi dispatch problem Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 131/182] MIPS: KVM: Pass reserved instruction exceptions to guest Jiri Slaby
` (53 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mark Salter, Christoffer Dall, Jiri Slaby
From: Mark Salter <msalter@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5d4e08c45a6cf8f1ab3c7fa375007635ac569165 upstream.
The kvm/mmu code shared by arm and arm64 uses kalloc() to allocate
a bounce page (if hypervisor init code crosses page boundary) and
hypervisor PGDs. The problem is that kalloc() does not guarantee
the proper alignment. In the case of the bounce page, the page sized
buffer allocated may also cross a page boundary negating the purpose
and leading to a hang during kvm initialization. Likewise the PGDs
allocated may not meet the minimum alignment requirements of the
underlying MMU. This patch uses __get_free_page() to guarantee the
worst case alignment needs of the bounce page and PGDs on both arm
and arm64.
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arm/kvm/mmu.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index cb79a5dd6d96..fe59e4a19022 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -41,6 +41,8 @@ static unsigned long hyp_idmap_start;
static unsigned long hyp_idmap_end;
static phys_addr_t hyp_idmap_vector;
+#define pgd_order get_order(PTRS_PER_PGD * sizeof(pgd_t))
+
static void kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
{
/*
@@ -172,14 +174,14 @@ void free_boot_hyp_pgd(void)
if (boot_hyp_pgd) {
unmap_range(NULL, boot_hyp_pgd, hyp_idmap_start, PAGE_SIZE);
unmap_range(NULL, boot_hyp_pgd, TRAMPOLINE_VA, PAGE_SIZE);
- kfree(boot_hyp_pgd);
+ free_pages((unsigned long)boot_hyp_pgd, pgd_order);
boot_hyp_pgd = NULL;
}
if (hyp_pgd)
unmap_range(NULL, hyp_pgd, TRAMPOLINE_VA, PAGE_SIZE);
- kfree(init_bounce_page);
+ free_page((unsigned long)init_bounce_page);
init_bounce_page = NULL;
mutex_unlock(&kvm_hyp_pgd_mutex);
@@ -209,7 +211,7 @@ void free_hyp_pgds(void)
for (addr = VMALLOC_START; is_vmalloc_addr((void*)addr); addr += PGDIR_SIZE)
unmap_range(NULL, hyp_pgd, KERN_TO_HYP(addr), PGDIR_SIZE);
- kfree(hyp_pgd);
+ free_pages((unsigned long)hyp_pgd, pgd_order);
hyp_pgd = NULL;
}
@@ -781,7 +783,7 @@ int kvm_mmu_init(void)
size_t len = __hyp_idmap_text_end - __hyp_idmap_text_start;
phys_addr_t phys_base;
- init_bounce_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ init_bounce_page = (void *)__get_free_page(GFP_KERNEL);
if (!init_bounce_page) {
kvm_err("Couldn't allocate HYP init bounce page\n");
err = -ENOMEM;
@@ -807,8 +809,9 @@ int kvm_mmu_init(void)
(unsigned long)phys_base);
}
- hyp_pgd = kzalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL);
- boot_hyp_pgd = kzalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL);
+ hyp_pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, pgd_order);
+ boot_hyp_pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, pgd_order);
+
if (!hyp_pgd || !boot_hyp_pgd) {
kvm_err("Hyp mode PGD not allocated\n");
err = -ENOMEM;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 131/182] MIPS: KVM: Pass reserved instruction exceptions to guest
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (129 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 130/182] arm: KVM: fix possible misalignment of PGDs and bounce page Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 132/182] MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume() Jiri Slaby
` (52 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, James Hogan, Ralf Baechle, Gleb Natapov,
Paolo Bonzini, Sanjay Lal, linux-mips, kvm, Jiri Slaby
From: James Hogan <james.hogan@imgtec.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 15505679362270d02c449626385cb74af8905514 upstream.
Previously a reserved instruction exception while in guest code would
cause a KVM internal error if kvm_mips_handle_ri() didn't recognise the
instruction (including a RDHWR from an unrecognised hardware register).
However the guest OS should really have the opportunity to catch the
exception so that it can take the appropriate actions such as sending a
SIGILL to the guest user process or emulating the instruction itself.
Therefore in these cases emulate a guest RI exception and only return
EMULATE_FAIL if that fails, being careful to revert the PC first in case
the exception occurred in a branch delay slot in which case the PC will
already point to the branch target.
Also turn the printk messages relating to these cases into kvm_debug
messages so that they aren't usually visible.
This allows crashme to run in the guest without killing the entire VM.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sanjay Lal <sanjayl@kymasys.com>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/kvm/kvm_mips_emul.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c
index 4b6274b47f33..e75ef8219caf 100644
--- a/arch/mips/kvm/kvm_mips_emul.c
+++ b/arch/mips/kvm/kvm_mips_emul.c
@@ -1571,17 +1571,17 @@ kvm_mips_handle_ri(unsigned long cause, uint32_t *opc,
arch->gprs[rt] = kvm_read_c0_guest_userlocal(cop0);
#else
/* UserLocal not implemented */
- er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu);
+ er = EMULATE_FAIL;
#endif
break;
default:
- printk("RDHWR not supported\n");
+ kvm_debug("RDHWR %#x not supported @ %p\n", rd, opc);
er = EMULATE_FAIL;
break;
}
} else {
- printk("Emulate RI not supported @ %p: %#x\n", opc, inst);
+ kvm_debug("Emulate RI not supported @ %p: %#x\n", opc, inst);
er = EMULATE_FAIL;
}
@@ -1590,6 +1590,7 @@ kvm_mips_handle_ri(unsigned long cause, uint32_t *opc,
*/
if (er == EMULATE_FAIL) {
vcpu->arch.pc = curr_pc;
+ er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu);
}
return er;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 132/182] MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (130 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 131/182] MIPS: KVM: Pass reserved instruction exceptions to guest Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 133/182] virtio-scsi: Skip setting affinity on uninitialized vq Jiri Slaby
` (51 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Huacai Chen, John Crispin, Steven J. Hill,
Aurelien Jarno, linux-mips, Fuxin Zhang, Zhangjin Wu,
Ralf Baechle, Jiri Slaby
From: Huacai Chen <chenhc@lemote.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c14af233fbe279d0e561ecf84f1208b1bae087ef upstream.
The original MIPS hibernate code flushes cache and TLB entries in
swsusp_arch_resume(). But they are removed in Commit 44eeab67416711
(MIPS: Hibernation: Remove SMP TLB and cacheflushing code.). A cross-
CPU flush is surely unnecessary because all but the local CPU have
already been disabled. But a local flush (at least the TLB flush) is
needed. When we do hibernation on Loongson-3 with an E1000E NIC, it is
very easy to produce a kernel panic (kernel page fault, or unaligned
access). The root cause is E1000E driver use vzalloc_node() to allocate
pages, the stale TLB entries of the booting kernel will be misused by
the resumed target kernel.
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/6643/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/power/hibernate.S | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
index 7e0277a1048f..32a7c828f073 100644
--- a/arch/mips/power/hibernate.S
+++ b/arch/mips/power/hibernate.S
@@ -43,6 +43,7 @@ LEAF(swsusp_arch_resume)
bne t1, t3, 1b
PTR_L t0, PBE_NEXT(t0)
bnez t0, 0b
+ jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
PTR_LA t0, saved_regs
PTR_L ra, PT_R31(t0)
PTR_L sp, PT_R29(t0)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 133/182] virtio-scsi: Skip setting affinity on uninitialized vq
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (131 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 132/182] MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume() Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 134/182] mpt2sas: Don't disable device twice at suspend Jiri Slaby
` (50 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Fam Zheng, James Bottomley, Jiri Slaby
From: Fam Zheng <famz@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0c8482ac92db5ac15792caf23b7f7df9e4f48ae1 upstream.
virtscsi_init calls virtscsi_remove_vqs on err, even before initializing
the vqs. The latter calls virtscsi_set_affinity, so let's check the
pointer there before setting affinity on it.
This fixes a panic when setting device's num_queues=2 on RHEL 6.5:
qemu-system-x86_64 ... \
-device virtio-scsi-pci,id=scsi0,addr=0x13,...,num_queues=2 \
-drive file=/stor/vm/dummy.raw,id=drive-scsi-disk,... \
-device scsi-hd,drive=drive-scsi-disk,...
[ 0.354734] scsi0 : Virtio SCSI HBA
[ 0.379504] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
[ 0.380141] IP: [<ffffffff814741ef>] __virtscsi_set_affinity+0x4f/0x120
[ 0.380141] PGD 0
[ 0.380141] Oops: 0000 [#1] SMP
[ 0.380141] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.14.0+ #5
[ 0.380141] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
[ 0.380141] task: ffff88003c9f0000 ti: ffff88003c9f8000 task.ti: ffff88003c9f8000
[ 0.380141] RIP: 0010:[<ffffffff814741ef>] [<ffffffff814741ef>] __virtscsi_set_affinity+0x4f/0x120
[ 0.380141] RSP: 0000:ffff88003c9f9c08 EFLAGS: 00010256
[ 0.380141] RAX: 0000000000000000 RBX: ffff88003c3a9d40 RCX: 0000000000001070
[ 0.380141] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
[ 0.380141] RBP: ffff88003c9f9c28 R08: 00000000000136c0 R09: ffff88003c801c00
[ 0.380141] R10: ffffffff81475229 R11: 0000000000000008 R12: 0000000000000000
[ 0.380141] R13: ffffffff81cc7ca8 R14: ffff88003cac3d40 R15: ffff88003cac37a0
[ 0.380141] FS: 0000000000000000(0000) GS:ffff88003e400000(0000) knlGS:0000000000000000
[ 0.380141] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 0.380141] CR2: 0000000000000020 CR3: 0000000001c0e000 CR4: 00000000000006f0
[ 0.380141] Stack:
[ 0.380141] ffff88003c3a9d40 0000000000000000 ffff88003cac3d80 ffff88003cac3d40
[ 0.380141] ffff88003c9f9c48 ffffffff814742e8 ffff88003c26d000 ffff88003c26d000
[ 0.380141] ffff88003c9f9c68 ffffffff81474321 ffff88003c26d000 ffff88003c3a9d40
[ 0.380141] Call Trace:
[ 0.380141] [<ffffffff814742e8>] virtscsi_set_affinity+0x28/0x40
[ 0.380141] [<ffffffff81474321>] virtscsi_remove_vqs+0x21/0x50
[ 0.380141] [<ffffffff81475231>] virtscsi_init+0x91/0x240
[ 0.380141] [<ffffffff81365290>] ? vp_get+0x50/0x70
[ 0.380141] [<ffffffff81475544>] virtscsi_probe+0xf4/0x280
[ 0.380141] [<ffffffff81363ea5>] virtio_dev_probe+0xe5/0x140
[ 0.380141] [<ffffffff8144c669>] driver_probe_device+0x89/0x230
[ 0.380141] [<ffffffff8144c8ab>] __driver_attach+0x9b/0xa0
[ 0.380141] [<ffffffff8144c810>] ? driver_probe_device+0x230/0x230
[ 0.380141] [<ffffffff8144c810>] ? driver_probe_device+0x230/0x230
[ 0.380141] [<ffffffff8144ac1c>] bus_for_each_dev+0x8c/0xb0
[ 0.380141] [<ffffffff8144c499>] driver_attach+0x19/0x20
[ 0.380141] [<ffffffff8144bf28>] bus_add_driver+0x198/0x220
[ 0.380141] [<ffffffff8144ce9f>] driver_register+0x5f/0xf0
[ 0.380141] [<ffffffff81d27c91>] ? spi_transport_init+0x79/0x79
[ 0.380141] [<ffffffff8136403b>] register_virtio_driver+0x1b/0x30
[ 0.380141] [<ffffffff81d27d19>] init+0x88/0xd6
[ 0.380141] [<ffffffff81d27c18>] ? scsi_init_procfs+0x5b/0x5b
[ 0.380141] [<ffffffff81ce88a7>] do_one_initcall+0x7f/0x10a
[ 0.380141] [<ffffffff81ce8aa7>] kernel_init_freeable+0x14a/0x1de
[ 0.380141] [<ffffffff81ce8b3b>] ? kernel_init_freeable+0x1de/0x1de
[ 0.380141] [<ffffffff817dec20>] ? rest_init+0x80/0x80
[ 0.380141] [<ffffffff817dec29>] kernel_init+0x9/0xf0
[ 0.380141] [<ffffffff817e68fc>] ret_from_fork+0x7c/0xb0
[ 0.380141] [<ffffffff817dec20>] ? rest_init+0x80/0x80
[ 0.380141] RIP [<ffffffff814741ef>] __virtscsi_set_affinity+0x4f/0x120
[ 0.380141] RSP <ffff88003c9f9c08>
[ 0.380141] CR2: 0000000000000020
[ 0.380141] ---[ end trace 8074b70c3d5e1d73 ]---
[ 0.475018] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[ 0.475018]
[ 0.475068] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
[ 0.475068] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[jejb: checkpatch fixes]
Signed-off-by: Fam Zheng <famz@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/virtio_scsi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index b26f1a5cc0ec..95a5d73e675c 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -751,8 +751,12 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
vscsi->affinity_hint_set = true;
} else {
- for (i = 0; i < vscsi->num_queues; i++)
+ for (i = 0; i < vscsi->num_queues; i++) {
+ if (!vscsi->req_vqs[i].vq)
+ continue;
+
virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
+ }
vscsi->affinity_hint_set = false;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 134/182] mpt2sas: Don't disable device twice at suspend.
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (132 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 133/182] virtio-scsi: Skip setting affinity on uninitialized vq Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 135/182] powerpc/compat: 32-bit little endian machine name is ppcle, not ppc Jiri Slaby
` (49 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Tyler Stachecki, James Bottomley, Jiri Slaby
From: Tyler Stachecki <tstache1@binghamton.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.
On suspend, _scsih_suspend calls mpt2sas_base_free_resources, which
in turn calls pci_disable_device if the device is enabled prior to
suspending. However, _scsih_suspend also calls pci_disable_device
itself.
Thus, in the event that the device is enabled prior to suspending,
pci_disable_device will be called twice. This patch removes the
duplicate call to pci_disable_device in _scsi_suspend as it is both
unnecessary and results in a kernel oops.
Signed-off-by: Tyler Stachecki <tstache1@binghamton.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/scsi/mpt2sas/mpt2sas_scsih.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 7f0af4fcc001..6fd7d40b2c4d 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -8293,7 +8293,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
mpt2sas_base_free_resources(ioc);
pci_save_state(pdev);
- pci_disable_device(pdev);
pci_set_power_state(pdev, device_state);
return 0;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 135/182] powerpc/compat: 32-bit little endian machine name is ppcle, not ppc
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (133 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 134/182] mpt2sas: Don't disable device twice at suspend Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 136/182] powerpc/tm: Disable IRQ in tm_recheckpoint Jiri Slaby
` (48 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Anton Blanchard, Benjamin Herrenschmidt, Jiri Slaby
From: Anton Blanchard <anton@samba.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 422b9b9684db3c511e65c91842275c43f5910ae9 upstream.
I noticed this when testing setarch. No, we don't magically
support a big endian userspace on a little endian kernel.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/include/asm/compat.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/powerpc/include/asm/compat.h b/arch/powerpc/include/asm/compat.h
index a613d2c82fd9..b142b8e0ed9e 100644
--- a/arch/powerpc/include/asm/compat.h
+++ b/arch/powerpc/include/asm/compat.h
@@ -8,7 +8,11 @@
#include <linux/sched.h>
#define COMPAT_USER_HZ 100
+#ifdef __BIG_ENDIAN__
#define COMPAT_UTS_MACHINE "ppc\0\0"
+#else
+#define COMPAT_UTS_MACHINE "ppcle\0\0"
+#endif
typedef u32 compat_size_t;
typedef s32 compat_ssize_t;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 136/182] powerpc/tm: Disable IRQ in tm_recheckpoint
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (134 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 135/182] powerpc/compat: 32-bit little endian machine name is ppcle, not ppc Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 137/182] s390/chsc: fix SEI usage on old FW levels Jiri Slaby
` (47 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Michael Neuling, Benjamin Herrenschmidt, Jiri Slaby
From: Michael Neuling <mikey@neuling.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e6b8fd028b584ffca7a7255b8971f254932c9fce upstream.
We can't take an IRQ when we're about to do a trechkpt as our GPR state is set
to user GPR values.
We've hit this when running some IBM Java stress tests in the lab resulting in
the following dump:
cpu 0x3f: Vector: 700 (Program Check) at [c000000007eb3d40]
pc: c000000000050074: restore_gprs+0xc0/0x148
lr: 00000000b52a8184
sp: ac57d360
msr: 8000000100201030
current = 0xc00000002c500000
paca = 0xc000000007dbfc00 softe: 0 irq_happened: 0x00
pid = 34535, comm = Pooled Thread #
R00 = 00000000b52a8184 R16 = 00000000b3e48fda
R01 = 00000000ac57d360 R17 = 00000000ade79bd8
R02 = 00000000ac586930 R18 = 000000000fac9bcc
R03 = 00000000ade60000 R19 = 00000000ac57f930
R04 = 00000000f6624918 R20 = 00000000ade79be8
R05 = 00000000f663f238 R21 = 00000000ac218a54
R06 = 0000000000000002 R22 = 000000000f956280
R07 = 0000000000000008 R23 = 000000000000007e
R08 = 000000000000000a R24 = 000000000000000c
R09 = 00000000b6e69160 R25 = 00000000b424cf00
R10 = 0000000000000181 R26 = 00000000f66256d4
R11 = 000000000f365ec0 R27 = 00000000b6fdcdd0
R12 = 00000000f66400f0 R28 = 0000000000000001
R13 = 00000000ada71900 R29 = 00000000ade5a300
R14 = 00000000ac2185a8 R30 = 00000000f663f238
R15 = 0000000000000004 R31 = 00000000f6624918
pc = c000000000050074 restore_gprs+0xc0/0x148
cfar= c00000000004fe28 dont_restore_vec+0x1c/0x1a4
lr = 00000000b52a8184
msr = 8000000100201030 cr = 24804888
ctr = 0000000000000000 xer = 0000000000000000 trap = 700
This moves tm_recheckpoint to a C function and moves the tm_restore_sprs into
that function. It then adds IRQ disabling over the trechkpt critical section.
It also sets the TEXASR FS in the signals code to ensure this is never set now
that we explictly write the TM sprs in tm_recheckpoint.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/powerpc/include/asm/reg.h | 1 +
arch/powerpc/kernel/process.c | 34 ++++++++++++++++++++++++++++------
arch/powerpc/kernel/signal_32.c | 2 ++
arch/powerpc/kernel/signal_64.c | 2 ++
arch/powerpc/kernel/tm.S | 2 +-
5 files changed, 34 insertions(+), 7 deletions(-)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 7ca729cac073..cb9c1740cee0 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -208,6 +208,7 @@
#define SPRN_ACOP 0x1F /* Available Coprocessor Register */
#define SPRN_TFIAR 0x81 /* Transaction Failure Inst Addr */
#define SPRN_TEXASR 0x82 /* Transaction EXception & Summary */
+#define TEXASR_FS __MASK(63-36) /* Transaction Failure Summary */
#define SPRN_TEXASRU 0x83 /* '' '' '' Upper 32 */
#define SPRN_TFHAR 0x80 /* Transaction Failure Handler Addr */
#define SPRN_CTRLF 0x088
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index aa75b2beba7d..f1106103634b 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -525,6 +525,31 @@ out_and_saveregs:
tm_save_sprs(thr);
}
+extern void __tm_recheckpoint(struct thread_struct *thread,
+ unsigned long orig_msr);
+
+void tm_recheckpoint(struct thread_struct *thread,
+ unsigned long orig_msr)
+{
+ unsigned long flags;
+
+ /* We really can't be interrupted here as the TEXASR registers can't
+ * change and later in the trecheckpoint code, we have a userspace R1.
+ * So let's hard disable over this region.
+ */
+ local_irq_save(flags);
+ hard_irq_disable();
+
+ /* The TM SPRs are restored here, so that TEXASR.FS can be set
+ * before the trecheckpoint and no explosion occurs.
+ */
+ tm_restore_sprs(thread);
+
+ __tm_recheckpoint(thread, orig_msr);
+
+ local_irq_restore(flags);
+}
+
static inline void tm_recheckpoint_new_task(struct task_struct *new)
{
unsigned long msr;
@@ -543,13 +568,10 @@ static inline void tm_recheckpoint_new_task(struct task_struct *new)
if (!new->thread.regs)
return;
- /* The TM SPRs are restored here, so that TEXASR.FS can be set
- * before the trecheckpoint and no explosion occurs.
- */
- tm_restore_sprs(&new->thread);
-
- if (!MSR_TM_ACTIVE(new->thread.regs->msr))
+ if (!MSR_TM_ACTIVE(new->thread.regs->msr)){
+ tm_restore_sprs(&new->thread);
return;
+ }
msr = new->thread.tm_orig_msr;
/* Recheckpoint to restore original checkpointed register state. */
TM_DEBUG("*** tm_recheckpoint of pid %d "
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index fea2dba1226c..50606e4261a1 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -872,6 +872,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
* transactional versions should be loaded.
*/
tm_enable();
+ /* Make sure the transaction is marked as failed */
+ current->thread.tm_texasr |= TEXASR_FS;
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(¤t->thread, msr);
/* Get the top half of the MSR */
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 36b1d1daa236..4456779dba1c 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -519,6 +519,8 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
}
#endif
tm_enable();
+ /* Make sure the transaction is marked as failed */
+ current->thread.tm_texasr |= TEXASR_FS;
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(¤t->thread, msr);
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index cd809eaa8b5c..8b0518519f9f 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -306,7 +306,7 @@ dont_backup_fp:
* Call with IRQs off, stacks get all out of sync for
* some periods in here!
*/
-_GLOBAL(tm_recheckpoint)
+_GLOBAL(__tm_recheckpoint)
mfcr r5
mflr r0
std r5, 8(r1)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 137/182] s390/chsc: fix SEI usage on old FW levels
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (135 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 136/182] powerpc/tm: Disable IRQ in tm_recheckpoint Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 138/182] s390/bpf,jit: initialize A register if 1st insn is BPF_S_LDX_B_MSH Jiri Slaby
` (46 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Sebastian Ott, Martin Schwidefsky, Jiri Slaby
From: Sebastian Ott <sebott@linux.vnet.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 06cd7a874ec6e09d151aeb1fa8600e14f1ff89f6 upstream.
Using a notification type mask for the store event information chsc
is unsupported on some firmware levels. Retry SEI with that mask set
to zero (which is the old way of requesting only channel subsystem
related events).
Reported-and-tested-by: Stefan Haberland <stefan.haberland@de.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/s390/cio/chsc.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 13299f902676..ec0951a788fc 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -560,18 +560,27 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
{
- do {
+ static int ntsm_unsupported;
+
+ while (true) {
memset(sei, 0, sizeof(*sei));
sei->request.length = 0x0010;
sei->request.code = 0x000e;
- sei->ntsm = ntsm;
+ if (!ntsm_unsupported)
+ sei->ntsm = ntsm;
if (chsc(sei))
break;
if (sei->response.code != 0x0001) {
- CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
- sei->response.code);
+ CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x, ntsm=%llx)\n",
+ sei->response.code, sei->ntsm);
+
+ if (sei->response.code == 3 && sei->ntsm) {
+ /* Fallback for old firmware. */
+ ntsm_unsupported = 1;
+ continue;
+ }
break;
}
@@ -587,7 +596,10 @@ static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
CIO_CRW_EVENT(2, "chsc: unhandled nt: %d\n", sei->nt);
break;
}
- } while (sei->u.nt0_area.flags & 0x80);
+
+ if (!(sei->u.nt0_area.flags & 0x80))
+ break;
+ }
}
/*
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 138/182] s390/bpf,jit: initialize A register if 1st insn is BPF_S_LDX_B_MSH
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (136 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 137/182] s390/chsc: fix SEI usage on old FW levels Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 139/182] ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrol Jiri Slaby
` (45 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Martin Schwidefsky, Jiri Slaby
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6e0de817594c61f3b392a9245deeb09609ec707d upstream.
The A register needs to be initialized to zero in the prolog if the
first instruction of the BPF program is BPF_S_LDX_B_MSH to prevent
leaking the content of %r5 to user space.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/s390/net/bpf_jit_comp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 96a4b150f958..906fba63b66d 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -276,7 +276,6 @@ static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
case BPF_S_LD_W_IND:
case BPF_S_LD_H_IND:
case BPF_S_LD_B_IND:
- case BPF_S_LDX_B_MSH:
case BPF_S_LD_IMM:
case BPF_S_LD_MEM:
case BPF_S_MISC_TXA:
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 139/182] ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrol
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (137 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 138/182] s390/bpf,jit: initialize A register if 1st insn is BPF_S_LDX_B_MSH Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 140/182] ARC: Remove ARC_HAS_COH_RTSC Jiri Slaby
` (44 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jarkko Nikula, Mark Brown, Jiri Slaby
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2697e4fb9209dfe1d1b24c92d254158f63d4bc8e upstream.
Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable")
is trying to free the widget it allocated by snd_soc_dapm_new_control()
call in dapm_kcontrol_data_alloc() by adding kfree(data->widget) to
dapm_kcontrol_free().
This is causing a widget double free with auto-disabled DAPM kcontrols
in sound card unregistration because widgets are already freed before
dapm_kcontrol_free() is called.
Reason for that is all widgets are added into dapm->card->widgets list
in snd_soc_dapm_new_control() and freed in dapm_free_widgets() during
execution of snd_soc_dapm_free().
Now snd_soc_dapm_free() calls for different DAPM contexts happens before
snd_card_free() call from where the call chain to dapm_kcontrol_free()
begins:
soc_cleanup_card_resources()
soc_remove_dai_links()
soc_remove_link_dais()
snd_soc_dapm_free(&cpu_dai->dapm)
soc_remove_link_components()
soc_remove_platform()
snd_soc_dapm_free(&platform->dapm)
soc_remove_codec()
snd_soc_dapm_free(&codec->dapm)
snd_soc_dapm_free(&card->dapm)
snd_card_free()
snd_card_do_free()
snd_device_free_all()
snd_device_free()
snd_ctl_dev_free()
snd_ctl_remove()
snd_ctl_free_one()
dapm_kcontrol_free()
This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for
them.
Fixes: 9e1fda4ae158 (ASoC: dapm: Implement mixer input auto-disable)
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
sound/soc/soc-dapm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b2949aed1ac2..4136cc25154e 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -251,7 +251,6 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
{
struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
- kfree(data->widget);
kfree(data->wlist);
kfree(data);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 140/182] ARC: Remove ARC_HAS_COH_RTSC
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (138 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 139/182] ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrol Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 141/182] ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe Jiri Slaby
` (43 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Richard Weinberger, Vineet Gupta, Jiri Slaby
From: Richard Weinberger <richard@nod.at>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d345ea2892ae7a2b70f84cf881c20731e43e4993 upstream.
The symbol is an orphan, get rid of it.
Fixes: 7d0857a54aed ("ARC: [SMP] Disallow RTSC")
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arc/plat-arcfpga/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arc/plat-arcfpga/Kconfig b/arch/arc/plat-arcfpga/Kconfig
index 295cefeb25d3..33058aa40e77 100644
--- a/arch/arc/plat-arcfpga/Kconfig
+++ b/arch/arc/plat-arcfpga/Kconfig
@@ -33,7 +33,6 @@ config ISS_SMP_EXTN
bool "ARC SMP Extensions (ISS Models only)"
default n
depends on SMP
- select ARC_HAS_COH_RTSC
help
SMP Extensions to ARC700, in a "simulation only" Model, supported in
ARC ISS (Instruction Set Simulator).
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 141/182] ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (139 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 140/182] ARC: Remove ARC_HAS_COH_RTSC Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 142/182] framebuffer: fix cfb_copyarea Jiri Slaby
` (42 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Vineet Gupta, Vineet Gupta, Anton Kolesov,
Francois Bedard, Linus Torvalds, Jiri Slaby
From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8aa9e85adac609588eeec356e5a85059b3b819ba upstream.
There was a very small race window where resume to kernel mode from a
Exception Path (or pure kernel mode which is true for most of ARC
exceptions anyways), was not disabling interrupts in restore_regs,
clobbering the exception regs
Anton found the culprit call flow (after many sleepless nights)
| 1. we got a Trap from user land
| 2. started to service it.
| 3. While doing some stuff on user-land memory (I think it is padzero()),
| we got a DataTlbMiss
| 4. On return from it we are taking "resume_kernel_mode" path
| 5. NEED_RESHED is not set, so we go to "return from exception" path in
| restore regs.
| 6. there seems to be IRQ happening
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Cc: Anton Kolesov <Anton.Kolesov@synopsys.com>
Cc: Francois Bedard <Francois.Bedard@synopsys.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/arc/kernel/entry.S | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index b908dde8a331..15588b0611e9 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -610,11 +610,13 @@ resume_user_mode_begin:
resume_kernel_mode:
-#ifdef CONFIG_PREEMPT
-
- ; This is a must for preempt_schedule_irq()
+ ; Disable Interrupts from this point on
+ ; CONFIG_PREEMPT: This is a must for preempt_schedule_irq()
+ ; !CONFIG_PREEMPT: To ensure restore_regs is intr safe
IRQ_DISABLE r9
+#ifdef CONFIG_PREEMPT
+
; Can't preempt if preemption disabled
GET_CURR_THR_INFO_FROM_SP r10
ld r8, [r10, THREAD_INFO_PREEMPT_COUNT]
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 142/182] framebuffer: fix cfb_copyarea
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (140 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 141/182] ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 143/182] matroxfb: restore the registers M_ACCESS and M_PITCH Jiri Slaby
` (41 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mikulas Patocka, Tomi Valkeinen, Jiri Slaby
From: Mikulas Patocka <mpatocka@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.
The function cfb_copyarea is buggy when the copy operation is not aligned on
long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).
How to reproduce:
- use x86-64 machine
- use a framebuffer driver without acceleration (for example uvesafb)
- set the framebuffer to 8-bit depth
(for example fbset -a 1024x768-60 -depth 8)
- load a font with character width that is not a multiple of 8 pixels
note: the console-tools package cannot load a font that has
width different from 8 pixels. You need to install the packages
"kbd" and "console-terminus" and use the program "setfont" to
set font width (for example: setfont Uni2-Terminus20x10)
- move some text left and right on the bash command line and you get a
screen corruption
To expose more bugs, put this line to the end of uvesafb_init_info:
info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;
- Now framebuffer console will use cfb_copyarea for console scrolling.
You get a screen corruption when console is scrolled.
This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this
patch, console scrolling in 8-bit depth with a font width that is not a
multiple of 8 pixels works fine.
The cfb_copyarea code was very buggy and it looks like it was written
and never tried with non-8-pixel font.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/cfbcopyarea.c | 153 ++++++++++++++++++++++----------------------
1 file changed, 78 insertions(+), 75 deletions(-)
diff --git a/drivers/video/cfbcopyarea.c b/drivers/video/cfbcopyarea.c
index bb5a96b1645d..bcb57235fcc7 100644
--- a/drivers/video/cfbcopyarea.c
+++ b/drivers/video/cfbcopyarea.c
@@ -43,13 +43,22 @@
*/
static void
-bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
- const unsigned long __iomem *src, int src_idx, int bits,
+bitcpy(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx,
+ const unsigned long __iomem *src, unsigned src_idx, int bits,
unsigned n, u32 bswapmask)
{
unsigned long first, last;
int const shift = dst_idx-src_idx;
- int left, right;
+
+#if 0
+ /*
+ * If you suspect bug in this function, compare it with this simple
+ * memmove implementation.
+ */
+ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8,
+ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8);
+ return;
+#endif
first = fb_shifted_pixels_mask_long(p, dst_idx, bswapmask);
last = ~fb_shifted_pixels_mask_long(p, (dst_idx+n) % bits, bswapmask);
@@ -98,9 +107,8 @@ bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
unsigned long d0, d1;
int m;
- right = shift & (bits - 1);
- left = -shift & (bits - 1);
- bswapmask &= shift;
+ int const left = shift & (bits - 1);
+ int const right = -shift & (bits - 1);
if (dst_idx+n <= bits) {
// Single destination word
@@ -110,15 +118,15 @@ bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
d0 = fb_rev_pixels_in_long(d0, bswapmask);
if (shift > 0) {
// Single source word
- d0 >>= right;
+ d0 <<= left;
} else if (src_idx+n <= bits) {
// Single source word
- d0 <<= left;
+ d0 >>= right;
} else {
// 2 source words
d1 = FB_READL(src + 1);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0<<left | d1>>right;
+ d0 = d0 >> right | d1 << left;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
@@ -135,60 +143,59 @@ bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
if (shift > 0) {
// Single source word
d1 = d0;
- d0 >>= right;
- dst++;
+ d0 <<= left;
n -= bits - dst_idx;
} else {
// 2 source words
d1 = FB_READL(src++);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0<<left | d1>>right;
- dst++;
+ d0 = d0 >> right | d1 << left;
n -= bits - dst_idx;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
d0 = d1;
+ dst++;
// Main chunk
m = n % bits;
n /= bits;
while ((n >= 4) && !bswapmask) {
d1 = FB_READL(src++);
- FB_WRITEL(d0 << left | d1 >> right, dst++);
+ FB_WRITEL(d0 >> right | d1 << left, dst++);
d0 = d1;
d1 = FB_READL(src++);
- FB_WRITEL(d0 << left | d1 >> right, dst++);
+ FB_WRITEL(d0 >> right | d1 << left, dst++);
d0 = d1;
d1 = FB_READL(src++);
- FB_WRITEL(d0 << left | d1 >> right, dst++);
+ FB_WRITEL(d0 >> right | d1 << left, dst++);
d0 = d1;
d1 = FB_READL(src++);
- FB_WRITEL(d0 << left | d1 >> right, dst++);
+ FB_WRITEL(d0 >> right | d1 << left, dst++);
d0 = d1;
n -= 4;
}
while (n--) {
d1 = FB_READL(src++);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0 << left | d1 >> right;
+ d0 = d0 >> right | d1 << left;
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(d0, dst++);
d0 = d1;
}
// Trailing bits
- if (last) {
- if (m <= right) {
+ if (m) {
+ if (m <= bits - right) {
// Single source word
- d0 <<= left;
+ d0 >>= right;
} else {
// 2 source words
d1 = FB_READL(src);
d1 = fb_rev_pixels_in_long(d1,
bswapmask);
- d0 = d0<<left | d1>>right;
+ d0 = d0 >> right | d1 << left;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
@@ -202,43 +209,46 @@ bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
*/
static void
-bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
- const unsigned long __iomem *src, int src_idx, int bits,
+bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx,
+ const unsigned long __iomem *src, unsigned src_idx, int bits,
unsigned n, u32 bswapmask)
{
unsigned long first, last;
int shift;
- dst += (n-1)/bits;
- src += (n-1)/bits;
- if ((n-1) % bits) {
- dst_idx += (n-1) % bits;
- dst += dst_idx >> (ffs(bits) - 1);
- dst_idx &= bits - 1;
- src_idx += (n-1) % bits;
- src += src_idx >> (ffs(bits) - 1);
- src_idx &= bits - 1;
- }
+#if 0
+ /*
+ * If you suspect bug in this function, compare it with this simple
+ * memmove implementation.
+ */
+ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8,
+ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8);
+ return;
+#endif
+
+ dst += (dst_idx + n - 1) / bits;
+ src += (src_idx + n - 1) / bits;
+ dst_idx = (dst_idx + n - 1) % bits;
+ src_idx = (src_idx + n - 1) % bits;
shift = dst_idx-src_idx;
- first = fb_shifted_pixels_mask_long(p, bits - 1 - dst_idx, bswapmask);
- last = ~fb_shifted_pixels_mask_long(p, bits - 1 - ((dst_idx-n) % bits),
- bswapmask);
+ first = ~fb_shifted_pixels_mask_long(p, (dst_idx + 1) % bits, bswapmask);
+ last = fb_shifted_pixels_mask_long(p, (bits + dst_idx + 1 - n) % bits, bswapmask);
if (!shift) {
// Same alignment for source and dest
if ((unsigned long)dst_idx+1 >= n) {
// Single word
- if (last)
- first &= last;
- FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst);
+ if (first)
+ last &= first;
+ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst);
} else {
// Multiple destination words
// Leading bits
- if (first != ~0UL) {
+ if (first) {
FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst);
dst--;
src--;
@@ -262,7 +272,7 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
FB_WRITEL(FB_READL(src--), dst--);
// Trailing bits
- if (last)
+ if (last != -1UL)
FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst);
}
} else {
@@ -270,29 +280,28 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
unsigned long d0, d1;
int m;
- int const left = -shift & (bits-1);
- int const right = shift & (bits-1);
- bswapmask &= shift;
+ int const left = shift & (bits-1);
+ int const right = -shift & (bits-1);
if ((unsigned long)dst_idx+1 >= n) {
// Single destination word
- if (last)
- first &= last;
+ if (first)
+ last &= first;
d0 = FB_READL(src);
if (shift < 0) {
// Single source word
- d0 <<= left;
+ d0 >>= right;
} else if (1+(unsigned long)src_idx >= n) {
// Single source word
- d0 >>= right;
+ d0 <<= left;
} else {
// 2 source words
d1 = FB_READL(src - 1);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0>>right | d1<<left;
+ d0 = d0 << left | d1 >> right;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
- FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
+ FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
} else {
// Multiple destination words
/** We must always remember the last value read, because in case
@@ -307,12 +316,12 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
if (shift < 0) {
// Single source word
d1 = d0;
- d0 <<= left;
+ d0 >>= right;
} else {
// 2 source words
d1 = FB_READL(src--);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0>>right | d1<<left;
+ d0 = d0 << left | d1 >> right;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
@@ -325,39 +334,39 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
n /= bits;
while ((n >= 4) && !bswapmask) {
d1 = FB_READL(src--);
- FB_WRITEL(d0 >> right | d1 << left, dst--);
+ FB_WRITEL(d0 << left | d1 >> right, dst--);
d0 = d1;
d1 = FB_READL(src--);
- FB_WRITEL(d0 >> right | d1 << left, dst--);
+ FB_WRITEL(d0 << left | d1 >> right, dst--);
d0 = d1;
d1 = FB_READL(src--);
- FB_WRITEL(d0 >> right | d1 << left, dst--);
+ FB_WRITEL(d0 << left | d1 >> right, dst--);
d0 = d1;
d1 = FB_READL(src--);
- FB_WRITEL(d0 >> right | d1 << left, dst--);
+ FB_WRITEL(d0 << left | d1 >> right, dst--);
d0 = d1;
n -= 4;
}
while (n--) {
d1 = FB_READL(src--);
d1 = fb_rev_pixels_in_long(d1, bswapmask);
- d0 = d0 >> right | d1 << left;
+ d0 = d0 << left | d1 >> right;
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(d0, dst--);
d0 = d1;
}
// Trailing bits
- if (last) {
- if (m <= left) {
+ if (m) {
+ if (m <= bits - left) {
// Single source word
- d0 >>= right;
+ d0 <<= left;
} else {
// 2 source words
d1 = FB_READL(src);
d1 = fb_rev_pixels_in_long(d1,
bswapmask);
- d0 = d0>>right | d1<<left;
+ d0 = d0 << left | d1 >> right;
}
d0 = fb_rev_pixels_in_long(d0, bswapmask);
FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
@@ -371,9 +380,9 @@ void cfb_copyarea(struct fb_info *p, const struct fb_copyarea *area)
u32 dx = area->dx, dy = area->dy, sx = area->sx, sy = area->sy;
u32 height = area->height, width = area->width;
unsigned long const bits_per_line = p->fix.line_length*8u;
- unsigned long __iomem *dst = NULL, *src = NULL;
+ unsigned long __iomem *base = NULL;
int bits = BITS_PER_LONG, bytes = bits >> 3;
- int dst_idx = 0, src_idx = 0, rev_copy = 0;
+ unsigned dst_idx = 0, src_idx = 0, rev_copy = 0;
u32 bswapmask = fb_compute_bswapmask(p);
if (p->state != FBINFO_STATE_RUNNING)
@@ -389,7 +398,7 @@ void cfb_copyarea(struct fb_info *p, const struct fb_copyarea *area)
// split the base of the framebuffer into a long-aligned address and the
// index of the first bit
- dst = src = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
+ base = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
dst_idx = src_idx = 8*((unsigned long)p->screen_base & (bytes-1));
// add offset of source and target area
dst_idx += dy*bits_per_line + dx*p->var.bits_per_pixel;
@@ -402,20 +411,14 @@ void cfb_copyarea(struct fb_info *p, const struct fb_copyarea *area)
while (height--) {
dst_idx -= bits_per_line;
src_idx -= bits_per_line;
- dst += dst_idx >> (ffs(bits) - 1);
- dst_idx &= (bytes - 1);
- src += src_idx >> (ffs(bits) - 1);
- src_idx &= (bytes - 1);
- bitcpy_rev(p, dst, dst_idx, src, src_idx, bits,
+ bitcpy_rev(p, base + (dst_idx / bits), dst_idx % bits,
+ base + (src_idx / bits), src_idx % bits, bits,
width*p->var.bits_per_pixel, bswapmask);
}
} else {
while (height--) {
- dst += dst_idx >> (ffs(bits) - 1);
- dst_idx &= (bytes - 1);
- src += src_idx >> (ffs(bits) - 1);
- src_idx &= (bytes - 1);
- bitcpy(p, dst, dst_idx, src, src_idx, bits,
+ bitcpy(p, base + (dst_idx / bits), dst_idx % bits,
+ base + (src_idx / bits), src_idx % bits, bits,
width*p->var.bits_per_pixel, bswapmask);
dst_idx += bits_per_line;
src_idx += bits_per_line;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 143/182] matroxfb: restore the registers M_ACCESS and M_PITCH
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (141 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 142/182] framebuffer: fix cfb_copyarea Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 144/182] mach64: use unaligned access Jiri Slaby
` (40 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mikulas Patocka, Tomi Valkeinen, Jiri Slaby
From: Mikulas Patocka <mpatocka@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a772d4736641ec1b421ad965e13457c17379fc86 upstream.
When X11 is running and the user switches back to console, the card
modifies the content of registers M_MACCESS and M_PITCH in periodic
intervals.
This patch fixes it by restoring the content of these registers before
issuing any accelerator command.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/matrox/matroxfb_accel.c | 38 ++++++++++++++++++++++++++---------
drivers/video/matrox/matroxfb_base.h | 2 ++
2 files changed, 30 insertions(+), 10 deletions(-)
diff --git a/drivers/video/matrox/matroxfb_accel.c b/drivers/video/matrox/matroxfb_accel.c
index 8335a6fe303e..0d5cb85d071a 100644
--- a/drivers/video/matrox/matroxfb_accel.c
+++ b/drivers/video/matrox/matroxfb_accel.c
@@ -192,10 +192,18 @@ void matrox_cfbX_init(struct matrox_fb_info *minfo)
minfo->accel.m_dwg_rect = M_DWG_TRAP | M_DWG_SOLID | M_DWG_ARZERO | M_DWG_SGNZERO | M_DWG_SHIFTZERO;
if (isMilleniumII(minfo)) minfo->accel.m_dwg_rect |= M_DWG_TRANSC;
minfo->accel.m_opmode = mopmode;
+ minfo->accel.m_access = maccess;
+ minfo->accel.m_pitch = mpitch;
}
EXPORT_SYMBOL(matrox_cfbX_init);
+static void matrox_accel_restore_maccess(struct matrox_fb_info *minfo)
+{
+ mga_outl(M_MACCESS, minfo->accel.m_access);
+ mga_outl(M_PITCH, minfo->accel.m_pitch);
+}
+
static void matrox_accel_bmove(struct matrox_fb_info *minfo, int vxres, int sy,
int sx, int dy, int dx, int height, int width)
{
@@ -207,7 +215,8 @@ static void matrox_accel_bmove(struct matrox_fb_info *minfo, int vxres, int sy,
CRITBEGIN
if ((dy < sy) || ((dy == sy) && (dx <= sx))) {
- mga_fifo(2);
+ mga_fifo(4);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_SGNZERO |
M_DWG_BFCOL | M_DWG_REPLACE);
mga_outl(M_AR5, vxres);
@@ -215,7 +224,8 @@ static void matrox_accel_bmove(struct matrox_fb_info *minfo, int vxres, int sy,
start = sy*vxres+sx+curr_ydstorg(minfo);
end = start+width;
} else {
- mga_fifo(3);
+ mga_fifo(5);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_BFCOL | M_DWG_REPLACE);
mga_outl(M_SGN, 5);
mga_outl(M_AR5, -vxres);
@@ -224,7 +234,8 @@ static void matrox_accel_bmove(struct matrox_fb_info *minfo, int vxres, int sy,
start = end+width;
dy += height-1;
}
- mga_fifo(4);
+ mga_fifo(6);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_AR0, end);
mga_outl(M_AR3, start);
mga_outl(M_FXBNDRY, ((dx+width)<<16) | dx);
@@ -246,7 +257,8 @@ static void matrox_accel_bmove_lin(struct matrox_fb_info *minfo, int vxres,
CRITBEGIN
if ((dy < sy) || ((dy == sy) && (dx <= sx))) {
- mga_fifo(2);
+ mga_fifo(4);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_SGNZERO |
M_DWG_BFCOL | M_DWG_REPLACE);
mga_outl(M_AR5, vxres);
@@ -254,7 +266,8 @@ static void matrox_accel_bmove_lin(struct matrox_fb_info *minfo, int vxres,
start = sy*vxres+sx+curr_ydstorg(minfo);
end = start+width;
} else {
- mga_fifo(3);
+ mga_fifo(5);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_BFCOL | M_DWG_REPLACE);
mga_outl(M_SGN, 5);
mga_outl(M_AR5, -vxres);
@@ -263,7 +276,8 @@ static void matrox_accel_bmove_lin(struct matrox_fb_info *minfo, int vxres,
start = end+width;
dy += height-1;
}
- mga_fifo(5);
+ mga_fifo(7);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_AR0, end);
mga_outl(M_AR3, start);
mga_outl(M_FXBNDRY, ((dx+width)<<16) | dx);
@@ -298,7 +312,8 @@ static void matroxfb_accel_clear(struct matrox_fb_info *minfo, u_int32_t color,
CRITBEGIN
- mga_fifo(5);
+ mga_fifo(7);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, minfo->accel.m_dwg_rect | M_DWG_REPLACE);
mga_outl(M_FCOL, color);
mga_outl(M_FXBNDRY, ((sx + width) << 16) | sx);
@@ -341,7 +356,8 @@ static void matroxfb_cfb4_clear(struct matrox_fb_info *minfo, u_int32_t bgx,
width >>= 1;
sx >>= 1;
if (width) {
- mga_fifo(5);
+ mga_fifo(7);
+ matrox_accel_restore_maccess(minfo);
mga_outl(M_DWGCTL, minfo->accel.m_dwg_rect | M_DWG_REPLACE2);
mga_outl(M_FCOL, bgx);
mga_outl(M_FXBNDRY, ((sx + width) << 16) | sx);
@@ -415,7 +431,8 @@ static void matroxfb_1bpp_imageblit(struct matrox_fb_info *minfo, u_int32_t fgx,
CRITBEGIN
- mga_fifo(3);
+ mga_fifo(5);
+ matrox_accel_restore_maccess(minfo);
if (easy)
mga_outl(M_DWGCTL, M_DWG_ILOAD | M_DWG_SGNZERO | M_DWG_SHIFTZERO | M_DWG_BMONOWF | M_DWG_LINEAR | M_DWG_REPLACE);
else
@@ -425,7 +442,8 @@ static void matroxfb_1bpp_imageblit(struct matrox_fb_info *minfo, u_int32_t fgx,
fxbndry = ((xx + width - 1) << 16) | xx;
mmio = minfo->mmio.vbase;
- mga_fifo(6);
+ mga_fifo(8);
+ matrox_accel_restore_maccess(minfo);
mga_writel(mmio, M_FXBNDRY, fxbndry);
mga_writel(mmio, M_AR0, ar0);
mga_writel(mmio, M_AR3, 0);
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
index 11ed57bb704e..556d96ce40bf 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/matrox/matroxfb_base.h
@@ -307,6 +307,8 @@ struct matrox_accel_data {
#endif
u_int32_t m_dwg_rect;
u_int32_t m_opmode;
+ u_int32_t m_access;
+ u_int32_t m_pitch;
};
struct v4l2_queryctrl;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 144/182] mach64: use unaligned access
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (142 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 143/182] matroxfb: restore the registers M_ACCESS and M_PITCH Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 145/182] mach64: fix cursor when character width is not a multiple of 8 pixels Jiri Slaby
` (39 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mikulas Patocka, Tomi Valkeinen, Jiri Slaby
From: Mikulas Patocka <mpatocka@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream.
This patch fixes mach64 to use unaligned access to the font bitmap.
This fixes unaligned access warning on sparc64 when 14x8 font is loaded.
On x86(64), unaligned access is handled in hardware, so both functions
le32_to_cpup and get_unaligned_le32 perform the same operation.
On RISC machines, unaligned access is not handled in hardware, so we
better use get_unaligned_le32 to avoid the unaligned trap and warning.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/aty/mach64_accel.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/video/aty/mach64_accel.c b/drivers/video/aty/mach64_accel.c
index e45833ce975b..182bd680141f 100644
--- a/drivers/video/aty/mach64_accel.c
+++ b/drivers/video/aty/mach64_accel.c
@@ -4,6 +4,7 @@
*/
#include <linux/delay.h>
+#include <asm/unaligned.h>
#include <linux/fb.h>
#include <video/mach64.h>
#include "atyfb.h"
@@ -419,7 +420,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
u32 *pbitmap, dwords = (src_bytes + 3) / 4;
for (pbitmap = (u32*)(image->data); dwords; dwords--, pbitmap++) {
wait_for_fifo(1, par);
- aty_st_le32(HOST_DATA0, le32_to_cpup(pbitmap), par);
+ aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par);
}
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 145/182] mach64: fix cursor when character width is not a multiple of 8 pixels
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (143 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 144/182] mach64: use unaligned access Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 146/182] b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR Jiri Slaby
` (38 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mikulas Patocka, Tomi Valkeinen, Jiri Slaby
From: Mikulas Patocka <mpatocka@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream.
This patch fixes the hardware cursor on mach64 when font width is not a
multiple of 8 pixels.
If you load such a font, the cursor is expanded to the next 8-byte
boundary and a part of the next character after the cursor is not
visible.
For example, when you load a font with 12-pixel width, the cursor width
is 16 pixels and when the cursor is displayed, 4 pixels of the next
character are not visible.
The reason is this: atyfb_cursor is called with proper parameters to
load an image that is 12-pixel wide. However, the number is aligned on
the next 8-pixel boundary on the line
"unsigned int width = (cursor->image.width + 7) >> 3;" and the whole
function acts as it is was loading a 16-pixel image.
This patch fixes it so that the value written to the framebuffer is
padded with 0xaaaa (the transparent pattern) when the image size it not
a multiple of 8 pixels. The transparent pattern causes that the cursor
will not interfere with the next character.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/aty/mach64_cursor.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/video/aty/mach64_cursor.c b/drivers/video/aty/mach64_cursor.c
index 95ec042ddbf8..0fe02e22d9a4 100644
--- a/drivers/video/aty/mach64_cursor.c
+++ b/drivers/video/aty/mach64_cursor.c
@@ -5,6 +5,7 @@
#include <linux/fb.h>
#include <linux/init.h>
#include <linux/string.h>
+#include "../fb_draw.h"
#include <asm/io.h>
@@ -157,24 +158,33 @@ static int atyfb_cursor(struct fb_info *info, struct fb_cursor *cursor)
for (i = 0; i < height; i++) {
for (j = 0; j < width; j++) {
+ u16 l = 0xaaaa;
b = *src++;
m = *msk++;
switch (cursor->rop) {
case ROP_XOR:
// Upper 4 bits of mask data
- fb_writeb(cursor_bits_lookup[(b ^ m) >> 4], dst++);
+ l = cursor_bits_lookup[(b ^ m) >> 4] |
// Lower 4 bits of mask
- fb_writeb(cursor_bits_lookup[(b ^ m) & 0x0f],
- dst++);
+ (cursor_bits_lookup[(b ^ m) & 0x0f] << 8);
break;
case ROP_COPY:
// Upper 4 bits of mask data
- fb_writeb(cursor_bits_lookup[(b & m) >> 4], dst++);
+ l = cursor_bits_lookup[(b & m) >> 4] |
// Lower 4 bits of mask
- fb_writeb(cursor_bits_lookup[(b & m) & 0x0f],
- dst++);
+ (cursor_bits_lookup[(b & m) & 0x0f] << 8);
break;
}
+ /*
+ * If cursor size is not a multiple of 8 characters
+ * we must pad it with transparent pattern (0xaaaa).
+ */
+ if ((j + 1) * 8 > cursor->image.width) {
+ l = comp(l, 0xaaaa,
+ (1 << ((cursor->image.width & 7) * 2)) - 1);
+ }
+ fb_writeb(l & 0xff, dst++);
+ fb_writeb(l >> 8, dst++);
}
dst += offset;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 146/182] b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (144 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 145/182] mach64: fix cursor when character width is not a multiple of 8 pixels Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 147/182] Revert "net: mvneta: fix usage as a module on RGMII configurations" Jiri Slaby
` (37 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Rafał Miłecki, John W. Linville,
Jiri Slaby
From: Rafał Miłecki <zajec5@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream.
Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b
functions isn't safe. On my machine it causes delayed (!) CPU exception:
Disabling lock debugging due to kernel taint
mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f
mce: [Hardware Error]: TSC 164083803dc
mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0
mce: [Hardware Error]: Run the above through 'mcelog --ascii'
mce: [Hardware Error]: Machine check: Processor context corrupt
Kernel panic - not syncing: Fatal machine check on current CPU
Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/b43/phy_n.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 7c970d3ae358..80ecca3e1465 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -5175,22 +5175,22 @@ static void b43_nphy_channel_setup(struct b43_wldev *dev,
int ch = new_channel->hw_value;
u16 old_band_5ghz;
- u32 tmp32;
+ u16 tmp16;
old_band_5ghz =
b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
} else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) {
b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
}
b43_chantab_phy_upload(dev, e);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 147/182] Revert "net: mvneta: fix usage as a module on RGMII configurations"
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (145 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 146/182] b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 148/182] ahci: do not request irq for dummy port Jiri Slaby
` (36 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Thomas Petazzoni, David S. Miller, Jiri Slaby
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cc6ca3023f2c2bbcd062e9d4cf6afc2ba2821ada upstream.
This reverts commit e3a8786c10e75903f1269474e21fe8cb49c3a670. While
this commit allows to use the mvneta driver as a module on some
configurations, it breaks other configurations even if mvneta is used
built-in.
This breakage is due to the fact that on some RGMII platforms, the PCS
bit has to be set, and on some other platforms, it has to be
cleared. At the moment, we lack informations to know exactly the
significance of this bit (the datasheet only says "enables PCS"), and
so we can't produce a patch that will work on all platforms at this
point. And since this change is breaking the network completely for
many users, it's much better to revert it for now. We'll come back
later with a proper fix that takes into account all platforms.
Basically:
* Armada XP GP is configured as RGMII-ID, and needs the PCS bit to be
set.
* Armada 370 Mirabox is configured as RGMII-ID, and needs the PCS bit
to be cleared.
And at the moment, we don't know how to make the distinction between
those two cases. One hint is that the Armada XP GP appears in fact to
be using a QSGMII connection with the PHY (Quad-SGMII), but
configuring it as SGMII doesn't work, while RGMII-ID works. This needs
more investigation, but in the mean time, let's unbreak the network
for all those users.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reported-by: Arnaud Ebalard <arno@natisbad.org>
Reported-by: Alexander Reuter <Alexander.Reuter@gmx.net>
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=73401
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/ethernet/marvell/mvneta.c | 41 ++++++++++++++++++++++++++++-------
1 file changed, 33 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 71d9cad02704..5cdd2b2f18c5 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -88,9 +88,8 @@
#define MVNETA_TX_IN_PRGRS BIT(1)
#define MVNETA_TX_FIFO_EMPTY BIT(8)
#define MVNETA_RX_MIN_FRAME_SIZE 0x247c
-#define MVNETA_SERDES_CFG 0x24A0
+#define MVNETA_SGMII_SERDES_CFG 0x24A0
#define MVNETA_SGMII_SERDES_PROTO 0x0cc7
-#define MVNETA_RGMII_SERDES_PROTO 0x0667
#define MVNETA_TYPE_PRIO 0x24bc
#define MVNETA_FORCE_UNI BIT(21)
#define MVNETA_TXQ_CMD_1 0x24e4
@@ -666,6 +665,35 @@ static void mvneta_rxq_bm_disable(struct mvneta_port *pp,
mvreg_write(pp, MVNETA_RXQ_CONFIG_REG(rxq->id), val);
}
+
+
+/* Sets the RGMII Enable bit (RGMIIEn) in port MAC control register */
+static void mvneta_gmac_rgmii_set(struct mvneta_port *pp, int enable)
+{
+ u32 val;
+
+ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
+
+ if (enable)
+ val |= MVNETA_GMAC2_PORT_RGMII;
+ else
+ val &= ~MVNETA_GMAC2_PORT_RGMII;
+
+ mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+}
+
+/* Config SGMII port */
+static void mvneta_port_sgmii_config(struct mvneta_port *pp)
+{
+ u32 val;
+
+ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
+ val |= MVNETA_GMAC2_PCS_ENABLE;
+ mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+
+ mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
+}
+
/* Start the Ethernet port RX and TX activity */
static void mvneta_port_up(struct mvneta_port *pp)
{
@@ -2695,15 +2723,12 @@ static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
if (phy_mode == PHY_INTERFACE_MODE_SGMII)
- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
- else
- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_RGMII_SERDES_PROTO);
+ mvneta_port_sgmii_config(pp);
- val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
-
- val |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
+ mvneta_gmac_rgmii_set(pp, 1);
/* Cancel Port Reset */
+ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
val &= ~MVNETA_GMAC2_PORT_RESET;
mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 148/182] ahci: do not request irq for dummy port
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (146 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 147/182] Revert "net: mvneta: fix usage as a module on RGMII configurations" Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 149/182] libata/ahci: accommodate tag ordered controllers Jiri Slaby
` (35 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, David Milburn, Alexander Gordeev, Tejun Heo
From: David Milburn <dmilburn@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9ae794ac5e407d3bc3fec785db481d5a2c0fa275 upstream.
System may crash in ahci_hw_interrupt() or ahci_thread_fn() when
accessing the interrupt status in a port's private_data if the port is
actually a DUMMY port.
00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA AHCI Controller
<snip console output for linux-3.15-rc1>
[ 9.352080] ahci 0000:00:1f.2: AHCI 0001.0200 32 slots 6 ports 3 Gbps 0x1 impl SATA mode
[ 9.352084] ahci 0000:00:1f.2: flags: 64bit ncq sntf pm led clo pio slum part ccc
[ 9.368155] Console: switching to colour frame buffer device 128x48
[ 9.439759] mgag200 0000:11:00.0: fb0: mgadrmfb frame buffer device
[ 9.446765] mgag200 0000:11:00.0: registered panic notifier
[ 9.470166] scsi1 : ahci
[ 9.479166] scsi2 : ahci
[ 9.488172] scsi3 : ahci
[ 9.497174] scsi4 : ahci
[ 9.506175] scsi5 : ahci
[ 9.515174] scsi6 : ahci
[ 9.518181] ata1: SATA max UDMA/133 abar m2048@0x95c00000 port 0x95c00100 irq 91
[ 9.526448] ata2: DUMMY
[ 9.529182] ata3: DUMMY
[ 9.531916] ata4: DUMMY
[ 9.534650] ata5: DUMMY
[ 9.537382] ata6: DUMMY
[ 9.576196] [drm] Initialized mgag200 1.0.0 20110418 for 0000:11:00.0 on minor 0
[ 9.845257] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 9.865161] ata1.00: ATAPI: Optiarc DVD RW AD-7580S, FX04, max UDMA/100
[ 9.891407] ata1.00: configured for UDMA/100
[ 9.900525] scsi 1:0:0:0: CD-ROM Optiarc DVD RW AD-7580S FX04 PQ: 0 ANSI: 5
[ 10.247399] iTCO_vendor_support: vendor-support=0
[ 10.261572] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
[ 10.269764] iTCO_wdt: unable to reset NO_REBOOT flag, device disabled by hardware/BIOS
[ 10.301932] sd 0:2:0:0: [sda] 570310656 512-byte logical blocks: (291 GB/271 GiB)
[ 10.317085] sd 0:2:0:0: [sda] Write Protect is off
[ 10.328326] sd 0:2:0:0: [sda] Write cache: disabled, read cache: disabled, supports DPO and FUA
[ 10.375452] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c
[ 10.384217] IP: [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
[ 10.392101] PGD 0
[ 10.394353] Oops: 0000 [#1] SMP
[ 10.397978] Modules linked in: sr_mod(+) cdrom sd_mod iTCO_wdt crc_t10dif iTCO_vendor_support crct10dif_common ahci libahci libata lpc_ich mfd_core mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm drm i2c_core megaraid_sas dm_mirror dm_region_hash
dm_log dm_mod
[ 10.426499] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.15.0-rc1 #1
[ 10.433495] Hardware name: QCI QSSC-S4R/QSSC-S4R, BIOS QSSC-S4R.QCI.01.00.S013.032920111005 03/29/2011
[ 10.443886] task: ffffffff81906460 ti: ffffffff818f0000 task.ti: ffffffff818f0000
[ 10.452239] RIP: 0010:[<ffffffffa0133df0>] [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
[ 10.462838] RSP: 0018:ffff880033c03d98 EFLAGS: 00010046
[ 10.468767] RAX: 0000000000a400a4 RBX: ffff880029a6bc18 RCX: 00000000fffffffa
[ 10.476731] RDX: 00000000000000a4 RSI: ffff880029bb0000 RDI: ffff880029a6bc18
[ 10.484696] RBP: ffff880033c03dc8 R08: 0000000000000000 R09: ffff88002f800490
[ 10.492661] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000000
[ 10.500625] R13: ffff880029a6bd98 R14: 0000000000000000 R15: ffffc90000194000
[ 10.508590] FS: 0000000000000000(0000) GS:ffff880033c00000(0000) knlGS:0000000000000000
[ 10.517623] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 10.524035] CR2: 000000000000003c CR3: 00000000328ff000 CR4: 00000000000007b0
[ 10.531999] Stack:
[ 10.534241] 0000000000000017 ffff880031ba7d00 000000000000005c ffff880031ba7d00
[ 10.542535] 0000000000000000 000000000000005c ffff880033c03e10 ffffffff810c2a1e
[ 10.550827] ffff880031ae2900 000000008108fb4f ffff880031ae2900 ffff880031ae2984
[ 10.559121] Call Trace:
[ 10.561849] <IRQ>
[ 10.563994] [<ffffffff810c2a1e>] handle_irq_event_percpu+0x3e/0x1a0
[ 10.571309] [<ffffffff810c2bbd>] handle_irq_event+0x3d/0x60
[ 10.577631] [<ffffffff810c4fdd>] try_one_irq.isra.6+0x8d/0xf0
[ 10.584142] [<ffffffff810c5313>] note_interrupt+0x173/0x1f0
[ 10.590460] [<ffffffff810c2a8e>] handle_irq_event_percpu+0xae/0x1a0
[ 10.597554] [<ffffffff810c2bbd>] handle_irq_event+0x3d/0x60
[ 10.603872] [<ffffffff810c5727>] handle_edge_irq+0x77/0x130
[ 10.610199] [<ffffffff81014b8f>] handle_irq+0xbf/0x150
[ 10.616040] [<ffffffff8109ff4e>] ? vtime_account_idle+0xe/0x50
[ 10.622654] [<ffffffff815fca1a>] ? atomic_notifier_call_chain+0x1a/0x20
[ 10.630140] [<ffffffff816038cf>] do_IRQ+0x4f/0xf0
[ 10.635490] [<ffffffff815f8aed>] common_interrupt+0x6d/0x6d
[ 10.641805] <EOI>
[ 10.643950] [<ffffffff8149ca9f>] ? cpuidle_enter_state+0x4f/0xc0
[ 10.650972] [<ffffffff8149ca98>] ? cpuidle_enter_state+0x48/0xc0
[ 10.657775] [<ffffffff8149cb47>] cpuidle_enter+0x17/0x20
[ 10.663807] [<ffffffff810b0070>] cpu_startup_entry+0x2c0/0x3d0
[ 10.670423] [<ffffffff815dfcc7>] rest_init+0x77/0x80
[ 10.676065] [<ffffffff81a60f47>] start_kernel+0x40f/0x41a
[ 10.682190] [<ffffffff81a60941>] ? repair_env_string+0x5c/0x5c
[ 10.688799] [<ffffffff81a60120>] ? early_idt_handlers+0x120/0x120
[ 10.695699] [<ffffffff81a605ee>] x86_64_start_reservations+0x2a/0x2c
[ 10.702889] [<ffffffff81a60733>] x86_64_start_kernel+0x143/0x152
[ 10.709689] Code: a0 fc ff 85 c0 8b 4d d4 74 c3 48 8b 7b 08 89 ca 48 c7 c6 60 66 13 a0 31 c0 e8 9d 70 28 e1 8b 4d d4 eb aa 0f 1f 84 00 00 00 00 00 <45> 8b 64 24 3c 48 89 df e8 23 47 4c e1 41 83 fc 01 19 c0 48 83
[ 10.731470] RIP [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
[ 10.739441] RSP <ffff880033c03d98>
[ 10.743333] CR2: 000000000000003c
[ 10.747032] ---[ end trace b6e82636970e2690 ]---
[ 10.760190] Kernel panic - not syncing: Fatal exception in interrupt
[ 10.767291] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
Cc: Alexander Gordeev <agordeev@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-of-by: David Milburn <dmilburn@redhat.com>
Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs")
---
drivers/ata/ahci.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dc11b7a64376..11d34d10f233 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1169,18 +1169,14 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
return rc;
for (i = 0; i < host->n_ports; i++) {
- const char* desc;
struct ahci_port_priv *pp = host->ports[i]->private_data;
/* pp is NULL for dummy ports */
if (pp)
- desc = pp->irq_desc;
- else
- desc = dev_driver_string(host->dev);
-
- rc = devm_request_threaded_irq(host->dev,
- irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
- desc, host->ports[i]);
+ rc = devm_request_threaded_irq(host->dev,
+ irq + i, ahci_hw_interrupt,
+ ahci_thread_fn, IRQF_SHARED,
+ pp->irq_desc, host->ports[i]);
if (rc)
goto out_free_irqs;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 149/182] libata/ahci: accommodate tag ordered controllers
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (147 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 148/182] ahci: do not request irq for dummy port Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 150/182] ahci: Do not receive interrupts sent by dummy ports Jiri Slaby
` (34 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Dan Williams, Dave Jiang, Ed Ciechanowski,
Tejun Heo, Jiri Slaby
From: Dan Williams <dan.j.williams@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream.
The AHCI spec allows implementations to issue commands in tag order
rather than FIFO order:
5.3.2.12 P:SelectCmd
HBA sets pSlotLoc = (pSlotLoc + 1) mod (CAP.NCS + 1)
or HBA selects the command to issue that has had the
PxCI bit set to '1' longer than any other command
pending to be issued.
The result is that commands posted sequentially (time-wise) may play out
of sequence when issued by hardware.
This behavior has likely been hidden by drives that arrange for commands
to complete in issue order. However, it appears recent drives (two from
different vendors that we have found so far) inflict out-of-order
completions as a matter of course. So, we need to take care to maintain
ordered submission, otherwise we risk triggering a drive to fall out of
sequential-io automation and back to random-io processing, which incurs
large latency and degrades throughput.
This issue was found in simple benchmarks where QD=2 seq-write
performance was 30-50% *greater* than QD=32 seq-write performance.
Tagging for -stable and making the change globally since it has a low
risk-to-reward ratio. Also, word is that recent versions of an unnamed
OS also does it this way now. So, drives in the field are already
experienced with this tag ordering scheme.
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ed Ciechanowski <ed.ciechanowski@intel.com>
Reviewed-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/libata-core.c | 21 +++++++++++++--------
include/linux/libata.h | 1 +
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c5d056e974f1..785b496c50bc 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4792,21 +4792,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
{
struct ata_queued_cmd *qc = NULL;
- unsigned int i;
+ unsigned int i, tag;
/* no command while frozen */
if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
return NULL;
- /* the last tag is reserved for internal command. */
- for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
- if (!test_and_set_bit(i, &ap->qc_allocated)) {
- qc = __ata_qc_from_tag(ap, i);
+ for (i = 0; i < ATA_MAX_QUEUE; i++) {
+ tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+ continue;
+
+ if (!test_and_set_bit(tag, &ap->qc_allocated)) {
+ qc = __ata_qc_from_tag(ap, tag);
+ qc->tag = tag;
+ ap->last_tag = tag;
break;
}
-
- if (qc)
- qc->tag = i;
+ }
return qc;
}
diff --git a/include/linux/libata.h b/include/linux/libata.h
index bec6dbe939a0..3fee55e73e5e 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -822,6 +822,7 @@ struct ata_port {
unsigned long qc_allocated;
unsigned int qc_active;
int nr_active_links; /* #links with active qcs */
+ unsigned int last_tag; /* track next tag hw expects */
struct ata_link link; /* host default link */
struct ata_link *slave_link; /* see ata_slave_link_init() */
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 150/182] ahci: Do not receive interrupts sent by dummy ports
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (148 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 149/182] libata/ahci: accommodate tag ordered controllers Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 151/182] libata: Update queued trim blacklist for M5x0 drives Jiri Slaby
` (33 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Alexander Gordeev, Tejun Heo, linux-ide, Jiri Slaby
From: Alexander Gordeev <agordeev@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2cf532f5e67c0cfe38c8c100e49280cdadacd2be upstream.
In multiple MSI mode all AHCI ports (including dummy) get assigned
separate MSI vectors and (as result of execution
pci_enable_msi_exact() function) separate IRQ numbers, (mapped to the
MSI vectors).
Therefore, although interrupts from dummy ports are not desired they
are still enabled. We do not request IRQs for dummy ports, but that
only means we do not assign AHCI-specific ISRs to corresponding IRQ
numbers.
As result, dummy port interrupts still could come and traverse all the
way from the PCI device to the kernel, causing unnecessary overhead.
This update disables IRQs for dummy ports and prevents the described
issue.
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Tested-by: David Milburn <dmilburn@redhat.com>
Cc: linux-ide@vger.kernel.org
Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/ahci.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 11d34d10f233..b4bdb8859485 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1171,12 +1171,16 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
for (i = 0; i < host->n_ports; i++) {
struct ahci_port_priv *pp = host->ports[i]->private_data;
- /* pp is NULL for dummy ports */
- if (pp)
- rc = devm_request_threaded_irq(host->dev,
- irq + i, ahci_hw_interrupt,
- ahci_thread_fn, IRQF_SHARED,
- pp->irq_desc, host->ports[i]);
+ /* Do not receive interrupts sent by dummy ports */
+ if (!pp) {
+ disable_irq(irq + i);
+ continue;
+ }
+
+ rc = devm_request_threaded_irq(host->dev, irq + i,
+ ahci_hw_interrupt,
+ ahci_thread_fn, IRQF_SHARED,
+ pp->irq_desc, host->ports[i]);
if (rc)
goto out_free_irqs;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 151/182] libata: Update queued trim blacklist for M5x0 drives
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (149 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 150/182] ahci: Do not receive interrupts sent by dummy ports Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 152/182] iwlwifi: dvm: take mutex when sending SYNC BT config command Jiri Slaby
` (32 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Martin K. Petersen, Chris Samuel, Marc MERLIN,
Tejun Heo, Jiri Slaby
From: "Martin K. Petersen" <martin.petersen@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d121f7d0cbb875abce249dbf7eb191f9bafe80b7 upstream.
Crucial/Micron M500 drives properly support queued DSM TRIM starting
with firmware MU05. Update the blacklist so we only disable queued trim
for older firmware releases.
Early M550 series drives suffer from the same issue as M500. A bugfix
firmware is in the pipeline but not ready yet. Until then, blacklist
queued trim for M550.
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Chris Samuel <chris@csamuel.org>
Cc: Marc MERLIN <marc@merlins.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/ata/libata-core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 785b496c50bc..97ae08de4b52 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,8 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
{ "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
/* devices that don't properly handle queued TRIM commands */
- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Micron_M500*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Crucial_CT???M500SSD*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
/*
* Some WD SATA-I drives spin up and down erratically when the link
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 152/182] iwlwifi: dvm: take mutex when sending SYNC BT config command
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (150 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 151/182] libata: Update queued trim blacklist for M5x0 drives Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 153/182] mac80211: fix potential use-after-free Jiri Slaby
` (31 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Emmanuel Grumbach, Jiri Slaby
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 82e5a649453a3cf23516277abb84273768a1592b upstream.
There is a flow in which we send the host command in SYNC
mode, but we don't take priv->mutex.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 7aad766865cf..ca9c4f1f9b0a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
struct iwl_priv *priv =
container_of(work, struct iwl_priv, bt_runtime_config);
+ mutex_lock(&priv->mutex);
if (test_bit(STATUS_EXIT_PENDING, &priv->status))
- return;
+ goto out;
/* dont send host command if rf-kill is on */
if (!iwl_is_ready_rf(priv))
- return;
+ goto out;
+
iwlagn_send_advance_bt_config(priv);
+out:
+ mutex_unlock(&priv->mutex);
}
static void iwl_bg_bt_full_concurrency(struct work_struct *work)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 153/182] mac80211: fix potential use-after-free
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (151 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 152/182] iwlwifi: dvm: take mutex when sending SYNC BT config command Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 154/182] mac80211: fix WPA with VLAN on AP side with ps-sta again Jiri Slaby
` (30 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Johannes Berg, Jiri Slaby
From: Johannes Berg <johannes.berg@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d2722f8b87fb172ff2f31d3a2816b31d58678d40 upstream.
The bss struct might be freed in ieee80211_rx_bss_put(),
so we shouldn't use it afterwards.
Fixes: 817cee7675237 ("mac80211: track AP's beacon rate and give it to the driver")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/mac80211/mlme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 8d7f4abe65ba..2af1c38374a4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2881,8 +2881,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
channel);
if (bss) {
- ieee80211_rx_bss_put(local, bss);
sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+ ieee80211_rx_bss_put(local, bss);
}
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 154/182] mac80211: fix WPA with VLAN on AP side with ps-sta again
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (152 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 153/182] mac80211: fix potential use-after-free Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 155/182] mac80211: fix suspend vs. authentication race Jiri Slaby
` (29 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Michael Braun, Johannes Berg, Jiri Slaby
From: Michael Braun <michael-dev@fami-braun.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 112c44b2df0984121a52fbda89425843b8e1a457 upstream.
commit de74a1d9032f4d37ea453ad2a647e1aff4cd2591
"mac80211: fix WPA with VLAN on AP side with ps-sta"
fixed an issue where queued multicast packets would
be sent out encrypted with the key of an other bss.
commit "7cbf9d017dbb5e3276de7d527925d42d4c11e732"
"mac80211: fix oops on mesh PS broadcast forwarding"
essentially reverted it, because vif.type cannot be AP_VLAN
due to the check to vif.type in ieee80211_get_buffered_bc before.
As the later commit intended to fix the MESH case, fix it
by checking for IFTYPE_AP instead of IFTYPE_AP_VLAN.
Fixes: 7cbf9d017dbb ("mac80211: fix oops on mesh PS broadcast forwarding")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/mac80211/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d6a47e76efff..267bc8e4b8b6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2806,7 +2806,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
cpu_to_le16(IEEE80211_FCTL_MOREDATA);
}
- if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ if (sdata->vif.type == NL80211_IFTYPE_AP)
sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
if (!ieee80211_tx_prepare(sdata, &tx, skb))
break;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 155/182] mac80211: fix suspend vs. authentication race
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (153 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 154/182] mac80211: fix WPA with VLAN on AP side with ps-sta again Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 156/182] mac80211: fix software remain-on-channel implementation Jiri Slaby
` (28 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Johannes Berg, Jiri Slaby
From: Johannes Berg <johannes.berg@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1a1cb744de160ee70086a77afff605bbc275d291 upstream.
Since Stanislaw's patch removing the quiescing code, mac80211 had
a race regarding suspend vs. authentication: as cfg80211 doesn't
track authentication attempts, it can't abort them. Therefore the
attempts may be kept running while suspending, which can lead to
all kinds of issues, in at least some cases causing an error in
iwlmvm firmware.
Fix this by aborting the authentication attempt when suspending.
Fixes: 12e7f517029d ("mac80211: cleanup generic suspend/resume procedures")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/mac80211/ieee80211_i.h | 1 +
net/mac80211/mlme.c | 26 ++++++++++++++++++++++++++
net/mac80211/pm.c | 14 +++++++++++---
3 files changed, 38 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 611abfcfb5eb..ab0fbb458c11 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1320,6 +1320,7 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
__le16 fc, bool acked);
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
/* IBSS code */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2af1c38374a4..e41c477c6d9f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3684,6 +3684,32 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
}
#ifdef CONFIG_PM
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+ sdata_lock(sdata);
+
+ if (ifmgd->auth_data) {
+ /*
+ * If we are trying to authenticate while suspending, cfg80211
+ * won't know and won't actually abort those attempts, thus we
+ * need to do that ourselves.
+ */
+ ieee80211_send_deauth_disassoc(sdata,
+ ifmgd->auth_data->bss->bssid,
+ IEEE80211_STYPE_DEAUTH,
+ WLAN_REASON_DEAUTH_LEAVING,
+ false, frame_buf);
+ ieee80211_destroy_auth_data(sdata, false);
+ cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+ IEEE80211_DEAUTH_FRAME_LEN);
+ }
+
+ sdata_unlock(sdata);
+}
+
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 340126204343..efb510e6f206 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -101,10 +101,18 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
/* remove all interfaces that were created in the driver */
list_for_each_entry(sdata, &local->interfaces, list) {
- if (!ieee80211_sdata_running(sdata) ||
- sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
- sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ if (!ieee80211_sdata_running(sdata))
continue;
+ switch (sdata->vif.type) {
+ case NL80211_IFTYPE_AP_VLAN:
+ case NL80211_IFTYPE_MONITOR:
+ continue;
+ case NL80211_IFTYPE_STATION:
+ ieee80211_mgd_quiesce(sdata);
+ break;
+ default:
+ break;
+ }
drv_remove_interface(local, sdata);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 156/182] mac80211: fix software remain-on-channel implementation
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (154 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 155/182] mac80211: fix suspend vs. authentication race Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 157/182] mac80211: exclude AP_VLAN interfaces from tx power calculation Jiri Slaby
` (27 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Johannes Berg, Jiri Slaby
From: Johannes Berg <johannes.berg@intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 115b943a6ea12656088fa1ff6634c0d30815e55b upstream.
Jouni reported that when doing off-channel transmissions mixed
with on-channel transmissions, the on-channel ones ended up on
the off-channel in some cases.
The reason for that is that during the refactoring of the off-
channel code, I lost the part that stopped all activity and as
a consequence the on-channel frames (including data frames)
were no longer queued but would be transmitted on the temporary
channel.
Fix this by simply restoring the lost activity stop call.
Fixes: 2eb278e083549 ("mac80211: unify SW/offload remain-on-channel")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/mac80211/offchannel.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 0c2a29484c07..6fb38558a5e6 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -355,6 +355,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
struct ieee80211_roc_work *dep;
/* start this ROC */
+ ieee80211_offchannel_stop_vifs(local);
/* switch channel etc */
ieee80211_recalc_idle(local);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 157/182] mac80211: exclude AP_VLAN interfaces from tx power calculation
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (155 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 156/182] mac80211: fix software remain-on-channel implementation Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 158/182] ath9k: fix ready time of the multicast buffer queue Jiri Slaby
` (26 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felix Fietkau, Johannes Berg, Jiri Slaby
From: Felix Fietkau <nbd@openwrt.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 764152ff66f4a8be1f9d7981e542ffdaa5bd7aff upstream.
Their power value is initialized to zero. This patch fixes an issue
where the configured power drops to the minimum value when AP_VLAN
interfaces are created/removed.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/mac80211/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index e765f77bb97a..2c5f21c7857f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -148,6 +148,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
list_for_each_entry_rcu(sdata, &local->interfaces, list) {
if (!rcu_access_pointer(sdata->vif.chanctx_conf))
continue;
+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ continue;
power = min(power, sdata->vif.bss_conf.txpower);
}
rcu_read_unlock();
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 158/182] ath9k: fix ready time of the multicast buffer queue
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (156 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 157/182] mac80211: exclude AP_VLAN interfaces from tx power calculation Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 159/182] locks: allow __break_lease to sleep even when break_time is 0 Jiri Slaby
` (25 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Felix Fietkau, John W. Linville, Jiri Slaby
From: Felix Fietkau <nbd@openwrt.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3b3e0efb5c72c4fc940af50b33626b8a78a907dc upstream.
qi->tqi_readyTime is written directly to registers that expect
microseconds as unit instead of TU.
When setting the CABQ ready time, cur_conf->beacon_interval is in TU, so
convert it to microseconds before passing it to ath9k_hw.
This should hopefully fix some Tx DMA issues with buffered multicast
frames in AP mode.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index ba39178a94ab..00e3f49fcf9b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1718,7 +1718,7 @@ int ath_cabq_update(struct ath_softc *sc)
else if (sc->config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
sc->config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;
- qi.tqi_readyTime = (cur_conf->beacon_interval *
+ qi.tqi_readyTime = (TU_TO_USEC(cur_conf->beacon_interval) *
sc->config.cabqReadytime) / 100;
ath_txq_update(sc, qnum, &qi);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 159/182] locks: allow __break_lease to sleep even when break_time is 0
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (157 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 158/182] ath9k: fix ready time of the multicast buffer queue Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 160/182] rtlwifi: rtl8723ae: Fix too long disable of IRQs Jiri Slaby
` (24 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Jeff Layton, J. Bruce Fields, J. Bruce Fields,
Jiri Slaby
From: Jeff Layton <jlayton@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4991a628a789dc5954e98e79476d9808812292ec upstream.
A fl->fl_break_time of 0 has a special meaning to the lease break code
that basically means "never break the lease". knfsd uses this to ensure
that leases don't disappear out from under it.
Unfortunately, the code in __break_lease can end up passing this value
to wait_event_interruptible as a timeout, which prevents it from going
to sleep at all. This causes __break_lease to spin in a tight loop and
causes soft lockups.
Fix this by ensuring that we pass a minimum value of 1 as a timeout
instead.
Cc: J. Bruce Fields <bfields@fieldses.org>
Reported-by: Terry Barnaby <terry1@beam.ltd.uk>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/locks.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/fs/locks.c b/fs/locks.c
index b27a3005d78d..ad95fbd20f8a 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1359,11 +1359,10 @@ int __break_lease(struct inode *inode, unsigned int mode)
restart:
break_time = flock->fl_break_time;
- if (break_time != 0) {
+ if (break_time != 0)
break_time -= jiffies;
- if (break_time == 0)
- break_time++;
- }
+ if (break_time == 0)
+ break_time++;
locks_insert_block(flock, new_fl);
spin_unlock(&inode->i_lock);
error = wait_event_interruptible_timeout(new_fl->fl_wait,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 160/182] rtlwifi: rtl8723ae: Fix too long disable of IRQs
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (158 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 159/182] locks: allow __break_lease to sleep even when break_time is 0 Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 161/182] rtlwifi: rtl8188ee: " Jiri Slaby
` (23 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, John W. Linville, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bfc1010c418a22cbebd8b1bd1e75dad6a527a609 upstream.
In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
<olivier@trillion01.com> fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8723ae.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/rtlwifi/rtl8723ae/hw.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index c333dfd116b8..99f6bc5fa986 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -880,14 +880,25 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw)
bool rtstatus = true;
int err;
u8 tmp_u1b;
+ unsigned long flags;
rtlpriv->rtlhal.being_init_adapter = true;
+ /* As this function can take a very long time (up to 350 ms)
+ * and can be called with irqs disabled, reenable the irqs
+ * to let the other devices continue being serviced.
+ *
+ * It is safe doing so since our own interrupts will only be enabled
+ * in a subsequent step.
+ */
+ local_save_flags(flags);
+ local_irq_enable();
+
rtlpriv->intf_ops->disable_aspm(hw);
rtstatus = _rtl8712e_init_mac(hw);
if (rtstatus != true) {
RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
err = 1;
- return err;
+ goto exit;
}
err = rtl8723ae_download_fw(hw);
@@ -895,8 +906,7 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw)
RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
"Failed to download FW. Init HW without FW now..\n");
err = 1;
- rtlhal->fw_ready = false;
- return err;
+ goto exit;
} else {
rtlhal->fw_ready = true;
}
@@ -971,6 +981,8 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw)
RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n");
}
rtl8723ae_dm_init(hw);
+exit:
+ local_irq_restore(flags);
rtlpriv->rtlhal.being_init_adapter = false;
return err;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 161/182] rtlwifi: rtl8188ee: Fix too long disable of IRQs
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (159 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 160/182] rtlwifi: rtl8723ae: Fix too long disable of IRQs Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 162/182] rtlwifi: rtl8192cu: " Jiri Slaby
` (22 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, John W. Linville, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6b6392715856d563719991e9ce95e773491a8983 upstream.
In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
<olivier@trillion01.com> fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8188ee.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/rtlwifi/rtl8188ee/hw.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
index e06971be7df7..f923d8c9a296 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -1025,9 +1025,20 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw)
bool rtstatus = true;
int err = 0;
u8 tmp_u1b, u1byte;
+ unsigned long flags;
RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Rtl8188EE hw init\n");
rtlpriv->rtlhal.being_init_adapter = true;
+ /* As this function can take a very long time (up to 350 ms)
+ * and can be called with irqs disabled, reenable the irqs
+ * to let the other devices continue being serviced.
+ *
+ * It is safe doing so since our own interrupts will only be enabled
+ * in a subsequent step.
+ */
+ local_save_flags(flags);
+ local_irq_enable();
+
rtlpriv->intf_ops->disable_aspm(hw);
tmp_u1b = rtl_read_byte(rtlpriv, REG_SYS_CLKR+1);
@@ -1043,7 +1054,7 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw)
if (rtstatus != true) {
RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
err = 1;
- return err;
+ goto exit;
}
err = rtl88e_download_fw(hw, false);
@@ -1051,8 +1062,7 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw)
RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
"Failed to download FW. Init HW without FW now..\n");
err = 1;
- rtlhal->fw_ready = false;
- return err;
+ goto exit;
} else {
rtlhal->fw_ready = true;
}
@@ -1135,10 +1145,12 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw)
}
rtl_write_byte(rtlpriv, REG_NAV_CTRL+2, ((30000+127)/128));
rtl88e_dm_init(hw);
+exit:
+ local_irq_restore(flags);
rtlpriv->rtlhal.being_init_adapter = false;
RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "end of Rtl8188EE hw init %x\n",
err);
- return 0;
+ return err;
}
static enum version_8188e _rtl88ee_read_chip_version(struct ieee80211_hw *hw)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 162/182] rtlwifi: rtl8192cu: Fix too long disable of IRQs
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (160 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 161/182] rtlwifi: rtl8188ee: " Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 163/182] rtlwifi: rtl8192se: " Jiri Slaby
` (21 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, John W. Linville, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a53268be0cb9763f11da4f6fe3fb924cbe3a7d4a upstream.
In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
<olivier@trillion01.com> fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8192cu.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 189ba124a8c6..324aa581938e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -985,6 +985,17 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
int err = 0;
static bool iqk_initialized;
+ unsigned long flags;
+
+ /* As this function can take a very long time (up to 350 ms)
+ * and can be called with irqs disabled, reenable the irqs
+ * to let the other devices continue being serviced.
+ *
+ * It is safe doing so since our own interrupts will only be enabled
+ * in a subsequent step.
+ */
+ local_save_flags(flags);
+ local_irq_enable();
rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU;
err = _rtl92cu_init_mac(hw);
@@ -997,7 +1008,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
"Failed to download FW. Init HW without FW now..\n");
err = 1;
- return err;
+ goto exit;
}
rtlhal->last_hmeboxnum = 0; /* h2c */
_rtl92cu_phy_param_tab_init(hw);
@@ -1034,6 +1045,8 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
_InitPABias(hw);
_update_mac_setting(hw);
rtl92c_dm_init(hw);
+exit:
+ local_irq_restore(flags);
return err;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 163/182] rtlwifi: rtl8192se: Fix too long disable of IRQs
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (161 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 162/182] rtlwifi: rtl8192cu: " Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 164/182] rtlwifi: rtl8188ee: initialize packet_beacon Jiri Slaby
` (20 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Larry Finger, John W. Linville, Jiri Slaby
From: Larry Finger <Larry.Finger@lwfinger.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2610decdd0b3808ba20471a999835cfee5275f98 upstream.
In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
<olivier@trillion01.com> fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8192se.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/rtlwifi/rtl8192se/hw.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 4f461786a7eb..c471400fe8f0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -955,7 +955,7 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
u8 tmp_byte = 0;
-
+ unsigned long flags;
bool rtstatus = true;
u8 tmp_u1b;
int err = false;
@@ -967,6 +967,16 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
rtlpci->being_init_adapter = true;
+ /* As this function can take a very long time (up to 350 ms)
+ * and can be called with irqs disabled, reenable the irqs
+ * to let the other devices continue being serviced.
+ *
+ * It is safe doing so since our own interrupts will only be enabled
+ * in a subsequent step.
+ */
+ local_save_flags(flags);
+ local_irq_enable();
+
rtlpriv->intf_ops->disable_aspm(hw);
/* 1. MAC Initialize */
@@ -984,7 +994,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
"Failed to download FW. Init HW without FW now... "
"Please copy FW into /lib/firmware/rtlwifi\n");
- return 1;
+ err = 1;
+ goto exit;
}
/* After FW download, we have to reset MAC register */
@@ -997,7 +1008,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
/* 3. Initialize MAC/PHY Config by MACPHY_reg.txt */
if (!rtl92s_phy_mac_config(hw)) {
RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "MAC Config failed\n");
- return rtstatus;
+ err = rtstatus;
+ goto exit;
}
/* because last function modify RCR, so we update
@@ -1016,7 +1028,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
/* 4. Initialize BB After MAC Config PHY_reg.txt, AGC_Tab.txt */
if (!rtl92s_phy_bb_config(hw)) {
RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG, "BB Config failed\n");
- return rtstatus;
+ err = rtstatus;
+ goto exit;
}
/* 5. Initiailze RF RAIO_A.txt RF RAIO_B.txt */
@@ -1033,7 +1046,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
if (!rtl92s_phy_rf_config(hw)) {
RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n");
- return rtstatus;
+ err = rtstatus;
+ goto exit;
}
/* After read predefined TXT, we must set BB/MAC/RF
@@ -1122,8 +1136,9 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
rtlpriv->cfg->ops->led_control(hw, LED_CTL_POWER_ON);
rtl92s_dm_init(hw);
+exit:
+ local_irq_restore(flags);
rtlpci->being_init_adapter = false;
-
return err;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 164/182] rtlwifi: rtl8188ee: initialize packet_beacon
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (162 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 163/182] rtlwifi: rtl8192se: " Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 165/182] gpio: mxs: Allow for recursive enable_irq_wake() call Jiri Slaby
` (19 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Colin Ian King, John W. Linville, Jiri Slaby
From: Colin Ian King <colin.king@canonical.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 328e203fc35f0b4f6df1c4943f74cf553bcc04f8 upstream.
static code analysis from cppcheck reports:
[drivers/net/wireless/rtlwifi/rtl8188ee/trx.c:322]:
(error) Uninitialized variable: packet_beacon
packet_beacon is not initialized and hence packet_beacon
contains garbage from the stack, so set it to false.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/wireless/rtlwifi/rtl8188ee/trx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 68685a898257..749d41723371 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -293,7 +293,7 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
u8 *psaddr;
__le16 fc;
u16 type, ufc;
- bool match_bssid, packet_toself, packet_beacon, addr;
+ bool match_bssid, packet_toself, packet_beacon = false, addr;
tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 165/182] gpio: mxs: Allow for recursive enable_irq_wake() call
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (163 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 164/182] rtlwifi: rtl8188ee: initialize packet_beacon Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 166/182] tgafb: fix data copying Jiri Slaby
` (18 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Marek Vasut, Linus Walleij, Jiri Slaby
From: Marek Vasut <marex@denx.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a585f87c863e4e1d496459d382b802bf5ebe3717 upstream.
The scenario here is that someone calls enable_irq_wake() from somewhere
in the code. This will result in the lockdep producing a backtrace as can
be seen below. In my case, this problem is triggered when using the wl1271
(TI WlCore) driver found in drivers/net/wireless/ti/ .
The problem cause is rather obvious from the backtrace, but let's outline
the dependency. enable_irq_wake() grabs the IRQ buslock in irq_set_irq_wake(),
which in turns calls mxs_gpio_set_wake_irq() . But mxs_gpio_set_wake_irq()
calls enable_irq_wake() again on the one-level-higher IRQ , thus it tries to
grab the IRQ buslock again in irq_set_irq_wake() . Because the spinlock in
irq_set_irq_wake()->irq_get_desc_buslock()->__irq_get_desc_lock() is not
marked as recursive, lockdep will spew the stuff below.
We know we can safely re-enter the lock, so use IRQ_GC_INIT_NESTED_LOCK to
fix the spew.
=============================================
[ INFO: possible recursive locking detected ]
3.10.33-00012-gf06b763-dirty #61 Not tainted
---------------------------------------------
kworker/0:1/18 is trying to acquire lock:
(&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
but task is already holding lock:
(&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&irq_desc_lock_class);
lock(&irq_desc_lock_class);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/0:1/18:
#0: (events){.+.+.+}, at: [<c0036308>] process_one_work+0x134/0x4a4
#1: ((&fw_work->work)){+.+.+.}, at: [<c0036308>] process_one_work+0x134/0x4a4
#2: (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
stack backtrace:
CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 3.10.33-00012-gf06b763-dirty #61
Workqueue: events request_firmware_work_func
[<c0013eb4>] (unwind_backtrace+0x0/0xf0) from [<c0011c74>] (show_stack+0x10/0x14)
[<c0011c74>] (show_stack+0x10/0x14) from [<c005bb08>] (__lock_acquire+0x140c/0x1a64)
[<c005bb08>] (__lock_acquire+0x140c/0x1a64) from [<c005c6a8>] (lock_acquire+0x9c/0x104)
[<c005c6a8>] (lock_acquire+0x9c/0x104) from [<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58)
[<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c00685f0>] (__irq_get_desc_lock+0x48/0x88)
[<c00685f0>] (__irq_get_desc_lock+0x48/0x88) from [<c0068e78>] (irq_set_irq_wake+0x20/0xf4)
[<c0068e78>] (irq_set_irq_wake+0x20/0xf4) from [<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24)
[<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24) from [<c0068cf4>] (set_irq_wake_real+0x30/0x44)
[<c0068cf4>] (set_irq_wake_real+0x30/0x44) from [<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4)
[<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4) from [<c0310748>] (wlcore_nvs_cb+0x10c/0x97c)
[<c0310748>] (wlcore_nvs_cb+0x10c/0x97c) from [<c02be5e8>] (request_firmware_work_func+0x38/0x58)
[<c02be5e8>] (request_firmware_work_func+0x38/0x58) from [<c0036394>] (process_one_work+0x1c0/0x4a4)
[<c0036394>] (process_one_work+0x1c0/0x4a4) from [<c0036a4c>] (worker_thread+0x138/0x394)
[<c0036a4c>] (worker_thread+0x138/0x394) from [<c003cb74>] (kthread+0xa4/0xb0)
[<c003cb74>] (kthread+0xa4/0xb0) from [<c000ee00>] (ret_from_fork+0x14/0x34)
wlcore: loaded
Signed-off-by: Marek Vasut <marex@denx.de>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpio/gpio-mxs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
index f8e6af20dfbf..d599fc42ae8b 100644
--- a/drivers/gpio/gpio-mxs.c
+++ b/drivers/gpio/gpio-mxs.c
@@ -214,7 +214,8 @@ static void __init mxs_gpio_init_gc(struct mxs_gpio_port *port, int irq_base)
ct->regs.ack = PINCTRL_IRQSTAT(port) + MXS_CLR;
ct->regs.mask = PINCTRL_IRQEN(port);
- irq_setup_generic_chip(gc, IRQ_MSK(32), 0, IRQ_NOREQUEST, 0);
+ irq_setup_generic_chip(gc, IRQ_MSK(32), IRQ_GC_INIT_NESTED_LOCK,
+ IRQ_NOREQUEST, 0);
}
static int mxs_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 166/182] tgafb: fix data copying
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (164 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 165/182] gpio: mxs: Allow for recursive enable_irq_wake() call Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 167/182] mtd: atmel_nand: Disable subpage NAND write when using Atmel PMECC Jiri Slaby
` (17 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mikulas Patocka, Tomi Valkeinen, Jiri Slaby
From: Mikulas Patocka <mpatocka@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6b0df6827bb6fcacb158dff29ad0a62d6418b534 upstream.
The functions for data copying copyarea_foreward_8bpp and
copyarea_backward_8bpp are buggy, they produce screen corruption.
This patch fixes the functions and moves the logic to one function
"copyarea_8bpp". For simplicity, the function only handles copying that
is aligned on 8 pixes. If we copy an unaligned area, generic function
cfb_copyarea is used.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/video/tgafb.c | 264 ++++++++++----------------------------------------
1 file changed, 51 insertions(+), 213 deletions(-)
diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c
index c9c8e5a1fdee..ba77f753649c 100644
--- a/drivers/video/tgafb.c
+++ b/drivers/video/tgafb.c
@@ -1142,222 +1142,57 @@ copyarea_line_32bpp(struct fb_info *info, u32 dy, u32 sy,
__raw_writel(TGA_MODE_SBM_24BPP|TGA_MODE_SIMPLE, tga_regs+TGA_MODE_REG);
}
-/* The general case of forward copy in 8bpp mode. */
+/* The (almost) general case of backward copy in 8bpp mode. */
static inline void
-copyarea_foreward_8bpp(struct fb_info *info, u32 dx, u32 dy, u32 sx, u32 sy,
- u32 height, u32 width, u32 line_length)
+copyarea_8bpp(struct fb_info *info, u32 dx, u32 dy, u32 sx, u32 sy,
+ u32 height, u32 width, u32 line_length,
+ const struct fb_copyarea *area)
{
struct tga_par *par = (struct tga_par *) info->par;
- unsigned long i, copied, left;
- unsigned long dpos, spos, dalign, salign, yincr;
- u32 smask_first, dmask_first, dmask_last;
- int pixel_shift, need_prime, need_second;
- unsigned long n64, n32, xincr_first;
+ unsigned i, yincr;
+ int depos, sepos, backward, last_step, step;
+ u32 mask_last;
+ unsigned n32;
void __iomem *tga_regs;
void __iomem *tga_fb;
- yincr = line_length;
- if (dy > sy) {
- dy += height - 1;
- sy += height - 1;
- yincr = -yincr;
- }
-
- /* Compute the offsets and alignments in the frame buffer.
- More than anything else, these control how we do copies. */
- dpos = dy * line_length + dx;
- spos = sy * line_length + sx;
- dalign = dpos & 7;
- salign = spos & 7;
- dpos &= -8;
- spos &= -8;
-
- /* Compute the value for the PIXELSHIFT register. This controls
- both non-co-aligned source and destination and copy direction. */
- if (dalign >= salign)
- pixel_shift = dalign - salign;
- else
- pixel_shift = 8 - (salign - dalign);
-
- /* Figure out if we need an additional priming step for the
- residue register. */
- need_prime = (salign > dalign);
- if (need_prime)
- dpos -= 8;
-
- /* Begin by copying the leading unaligned destination. Copy enough
- to make the next destination address 32-byte aligned. */
- copied = 32 - (dalign + (dpos & 31));
- if (copied == 32)
- copied = 0;
- xincr_first = (copied + 7) & -8;
- smask_first = dmask_first = (1ul << copied) - 1;
- smask_first <<= salign;
- dmask_first <<= dalign + need_prime*8;
- if (need_prime && copied > 24)
- copied -= 8;
- left = width - copied;
-
- /* Care for small copies. */
- if (copied > width) {
- u32 t;
- t = (1ul << width) - 1;
- t <<= dalign + need_prime*8;
- dmask_first &= t;
- left = 0;
- }
-
- /* Attempt to use 64-byte copies. This is only possible if the
- source and destination are co-aligned at 64 bytes. */
- n64 = need_second = 0;
- if ((dpos & 63) == (spos & 63)
- && (height == 1 || line_length % 64 == 0)) {
- /* We may need a 32-byte copy to ensure 64 byte alignment. */
- need_second = (dpos + xincr_first) & 63;
- if ((need_second & 32) != need_second)
- printk(KERN_ERR "tgafb: need_second wrong\n");
- if (left >= need_second + 64) {
- left -= need_second;
- n64 = left / 64;
- left %= 64;
- } else
- need_second = 0;
- }
-
- /* Copy trailing full 32-byte sections. This will be the main
- loop if the 64 byte loop can't be used. */
- n32 = left / 32;
- left %= 32;
-
- /* Copy the trailing unaligned destination. */
- dmask_last = (1ul << left) - 1;
-
- tga_regs = par->tga_regs_base;
- tga_fb = par->tga_fb_base;
-
- /* Set up the MODE and PIXELSHIFT registers. */
- __raw_writel(TGA_MODE_SBM_8BPP|TGA_MODE_COPY, tga_regs+TGA_MODE_REG);
- __raw_writel(pixel_shift, tga_regs+TGA_PIXELSHIFT_REG);
- wmb();
-
- for (i = 0; i < height; ++i) {
- unsigned long j;
- void __iomem *sfb;
- void __iomem *dfb;
-
- sfb = tga_fb + spos;
- dfb = tga_fb + dpos;
- if (dmask_first) {
- __raw_writel(smask_first, sfb);
- wmb();
- __raw_writel(dmask_first, dfb);
- wmb();
- sfb += xincr_first;
- dfb += xincr_first;
- }
-
- if (need_second) {
- __raw_writel(0xffffffff, sfb);
- wmb();
- __raw_writel(0xffffffff, dfb);
- wmb();
- sfb += 32;
- dfb += 32;
- }
-
- if (n64 && (((unsigned long)sfb | (unsigned long)dfb) & 63))
- printk(KERN_ERR
- "tgafb: misaligned copy64 (s:%p, d:%p)\n",
- sfb, dfb);
-
- for (j = 0; j < n64; ++j) {
- __raw_writel(sfb - tga_fb, tga_regs+TGA_COPY64_SRC);
- wmb();
- __raw_writel(dfb - tga_fb, tga_regs+TGA_COPY64_DST);
- wmb();
- sfb += 64;
- dfb += 64;
- }
-
- for (j = 0; j < n32; ++j) {
- __raw_writel(0xffffffff, sfb);
- wmb();
- __raw_writel(0xffffffff, dfb);
- wmb();
- sfb += 32;
- dfb += 32;
- }
-
- if (dmask_last) {
- __raw_writel(0xffffffff, sfb);
- wmb();
- __raw_writel(dmask_last, dfb);
- wmb();
- }
-
- spos += yincr;
- dpos += yincr;
+ /* Do acceleration only if we are aligned on 8 pixels */
+ if ((dx | sx | width) & 7) {
+ cfb_copyarea(info, area);
+ return;
}
- /* Reset the MODE register to normal. */
- __raw_writel(TGA_MODE_SBM_8BPP|TGA_MODE_SIMPLE, tga_regs+TGA_MODE_REG);
-}
-
-/* The (almost) general case of backward copy in 8bpp mode. */
-static inline void
-copyarea_backward_8bpp(struct fb_info *info, u32 dx, u32 dy, u32 sx, u32 sy,
- u32 height, u32 width, u32 line_length,
- const struct fb_copyarea *area)
-{
- struct tga_par *par = (struct tga_par *) info->par;
- unsigned long i, left, yincr;
- unsigned long depos, sepos, dealign, sealign;
- u32 mask_first, mask_last;
- unsigned long n32;
- void __iomem *tga_regs;
- void __iomem *tga_fb;
-
yincr = line_length;
if (dy > sy) {
dy += height - 1;
sy += height - 1;
yincr = -yincr;
}
+ backward = dy == sy && dx > sx && dx < sx + width;
/* Compute the offsets and alignments in the frame buffer.
More than anything else, these control how we do copies. */
- depos = dy * line_length + dx + width;
- sepos = sy * line_length + sx + width;
- dealign = depos & 7;
- sealign = sepos & 7;
-
- /* ??? The documentation appears to be incorrect (or very
- misleading) wrt how pixel shifting works in backward copy
- mode, i.e. when PIXELSHIFT is negative. I give up for now.
- Do handle the common case of co-aligned backward copies,
- but frob everything else back on generic code. */
- if (dealign != sealign) {
- cfb_copyarea(info, area);
- return;
- }
-
- /* We begin the copy with the trailing pixels of the
- unaligned destination. */
- mask_first = (1ul << dealign) - 1;
- left = width - dealign;
-
- /* Care for small copies. */
- if (dealign > width) {
- mask_first ^= (1ul << (dealign - width)) - 1;
- left = 0;
- }
+ depos = dy * line_length + dx;
+ sepos = sy * line_length + sx;
+ if (backward)
+ depos += width, sepos += width;
/* Next copy full words at a time. */
- n32 = left / 32;
- left %= 32;
+ n32 = width / 32;
+ last_step = width % 32;
/* Finally copy the unaligned head of the span. */
- mask_last = -1 << (32 - left);
+ mask_last = (1ul << last_step) - 1;
+
+ if (!backward) {
+ step = 32;
+ last_step = 32;
+ } else {
+ step = -32;
+ last_step = -last_step;
+ sepos -= 32;
+ depos -= 32;
+ }
tga_regs = par->tga_regs_base;
tga_fb = par->tga_fb_base;
@@ -1374,25 +1209,33 @@ copyarea_backward_8bpp(struct fb_info *info, u32 dx, u32 dy, u32 sx, u32 sy,
sfb = tga_fb + sepos;
dfb = tga_fb + depos;
- if (mask_first) {
- __raw_writel(mask_first, sfb);
- wmb();
- __raw_writel(mask_first, dfb);
- wmb();
- }
- for (j = 0; j < n32; ++j) {
- sfb -= 32;
- dfb -= 32;
+ for (j = 0; j < n32; j++) {
+ if (j < 2 && j + 1 < n32 && !backward &&
+ !(((unsigned long)sfb | (unsigned long)dfb) & 63)) {
+ do {
+ __raw_writel(sfb - tga_fb, tga_regs+TGA_COPY64_SRC);
+ wmb();
+ __raw_writel(dfb - tga_fb, tga_regs+TGA_COPY64_DST);
+ wmb();
+ sfb += 64;
+ dfb += 64;
+ j += 2;
+ } while (j + 1 < n32);
+ j--;
+ continue;
+ }
__raw_writel(0xffffffff, sfb);
wmb();
__raw_writel(0xffffffff, dfb);
wmb();
+ sfb += step;
+ dfb += step;
}
if (mask_last) {
- sfb -= 32;
- dfb -= 32;
+ sfb += last_step - step;
+ dfb += last_step - step;
__raw_writel(mask_last, sfb);
wmb();
__raw_writel(mask_last, dfb);
@@ -1453,14 +1296,9 @@ tgafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
else if (bpp == 32)
cfb_copyarea(info, area);
- /* Detect overlapping source and destination that requires
- a backward copy. */
- else if (dy == sy && dx > sx && dx < sx + width)
- copyarea_backward_8bpp(info, dx, dy, sx, sy, height,
- width, line_length, area);
else
- copyarea_foreward_8bpp(info, dx, dy, sx, sy, height,
- width, line_length);
+ copyarea_8bpp(info, dx, dy, sx, sy, height,
+ width, line_length, area);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 167/182] mtd: atmel_nand: Disable subpage NAND write when using Atmel PMECC
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (165 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 166/182] tgafb: fix data copying Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 168/182] mtd: nuc900_nand: NULL dereference in nuc900_nand_enable() Jiri Slaby
` (16 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Herve Codina, Brian Norris, Jiri Slaby
From: Herve Codina <Herve.CODINA@celad.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 90445ff6241e2a13445310803e2efa606c61f276 upstream.
Crash detected on sam5d35 and its pmecc nand ecc controller.
The problem was a call to chip->ecc.hwctl from nand_write_subpage_hwecc
(nand_base.c) when we write a sub page.
chip->ecc.hwctl function is not set when we are using PMECC controller.
As a workaround, set NAND_NO_SUBPAGE_WRITE for PMECC controller in
order to disable sub page access in nand_write_page.
Signed-off-by: Herve Codina <Herve.CODINA@celad.com>
Acked-by: Josh Wu <josh.wu@atmel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mtd/nand/atmel_nand.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 9be079224761..1de054a0775d 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -1249,6 +1249,7 @@ static int __init atmel_pmecc_nand_init_params(struct platform_device *pdev,
goto err;
}
+ nand_chip->options |= NAND_NO_SUBPAGE_WRITE;
nand_chip->ecc.read_page = atmel_nand_pmecc_read_page;
nand_chip->ecc.write_page = atmel_nand_pmecc_write_page;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 168/182] mtd: nuc900_nand: NULL dereference in nuc900_nand_enable()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (166 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 167/182] mtd: atmel_nand: Disable subpage NAND write when using Atmel PMECC Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 169/182] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes() Jiri Slaby
` (15 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dan Carpenter, Brian Norris, Jiri Slaby
From: Dan Carpenter <dan.carpenter@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c69dbbf3335a21aae74376d7e5db50a486d52439 upstream.
Instead of writing to "nand->reg + REG_FMICSR" we write to "REG_FMICSR"
which is NULL and not a valid register.
Fixes: 8bff82cbc308 ('mtd: add nand support for w90p910 (v2)')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mtd/nand/nuc900_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/nuc900_nand.c b/drivers/mtd/nand/nuc900_nand.c
index 52115151e4a7..2e1d16bf9818 100644
--- a/drivers/mtd/nand/nuc900_nand.c
+++ b/drivers/mtd/nand/nuc900_nand.c
@@ -225,7 +225,7 @@ static void nuc900_nand_enable(struct nuc900_nand *nand)
val = __raw_readl(nand->reg + REG_FMICSR);
if (!(val & NAND_EN))
- __raw_writel(val | NAND_EN, REG_FMICSR);
+ __raw_writel(val | NAND_EN, nand->reg + REG_FMICSR);
val = __raw_readl(nand->reg + REG_SMCSR);
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 169/182] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (167 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 168/182] mtd: nuc900_nand: NULL dereference in nuc900_nand_enable() Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 170/182] Skip intel_crt_init for Dell XPS 8700 Jiri Slaby
` (14 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Dan Carpenter, Brian Norris, Jiri Slaby
From: Dan Carpenter <dan.carpenter@oracle.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b4c233057771581698a13694ab6f33b48ce837dc upstream.
We always put a NUL terminator one space past the end of the "vendor"
buffer. Walter Harms also pointed out that this should just use
kstrndup().
Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mtd/sm_ftl.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 4b8e89583f2a..cf49c22673b9 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -59,15 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
struct attribute_group *attr_group;
struct attribute **attributes;
struct sm_sysfs_attribute *vendor_attribute;
+ char *vendor;
- int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
- SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET);
-
- char *vendor = kmalloc(vendor_len, GFP_KERNEL);
+ vendor = kstrndup(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
+ SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET, GFP_KERNEL);
if (!vendor)
goto error1;
- memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);
- vendor[vendor_len] = 0;
/* Initialize sysfs attributes */
vendor_attribute =
@@ -78,7 +75,7 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
sysfs_attr_init(&vendor_attribute->dev_attr.attr);
vendor_attribute->data = vendor;
- vendor_attribute->len = vendor_len;
+ vendor_attribute->len = strlen(vendor);
vendor_attribute->dev_attr.attr.name = "vendor";
vendor_attribute->dev_attr.attr.mode = S_IRUGO;
vendor_attribute->dev_attr.show = sm_attr_show;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 170/182] Skip intel_crt_init for Dell XPS 8700
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (168 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 169/182] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes() Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 171/182] dm cache: prevent corruption caused by discard_block_size > cache_block_size Jiri Slaby
` (13 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Giacomo Comes, Daniel Vetter, Jiri Slaby
From: Giacomo Comes <comes@naic.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 10b6ee4a87811a110cb01eaca01eb04da6801baf upstream.
The Dell XPS 8700 has a onboard Display port and HDMI port and no VGA port.
The call intel_crt_init freeze the machine, so skip such call.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73559
Signed-off-by: Giacomo Comes <comes at naic.edu>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/i915/intel_crt.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 10d1de5bce6f..e8edbb751e9a 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -758,6 +758,14 @@ static const struct dmi_system_id intel_no_crt[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "ZGB"),
},
},
+ {
+ .callback = intel_no_crt_dmi_callback,
+ .ident = "DELL XPS 8700",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "XPS 8700"),
+ },
+ },
{ }
};
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 171/182] dm cache: prevent corruption caused by discard_block_size > cache_block_size
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (169 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 170/182] Skip intel_crt_init for Dell XPS 8700 Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 172/182] dm transaction manager: fix corruption due to non-atomic transaction commit Jiri Slaby
` (12 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mike Snitzer, Jiri Slaby
From: Mike Snitzer <snitzer@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d132cc6d9e92424bb9d4fd35f5bd0e55d583f4be upstream.
If the discard block size is larger than the cache block size we will
not properly quiesce IO to a region that is about to be discarded. This
results in a race between a cache migration where no copy is needed, and
a write to an adjacent cache block that's within the same large discard
block.
Workaround this by limiting the discard_block_size to cache_block_size.
Also limit the max_discard_sectors to cache_block_size.
A more comprehensive fix that introduces range locking support in the
bio_prison and proper quiescing of a discard range that spans multiple
cache blocks is already in development.
Reported-by: Morgan Mears <Morgan.Mears@netapp.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <ejt@redhat.com>
Acked-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/dm-cache-target.c | 37 +++----------------------------------
1 file changed, 3 insertions(+), 34 deletions(-)
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 6ab68e058a0a..d64bf7d6c8fe 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -162,7 +162,7 @@ struct cache {
*/
dm_dblock_t discard_nr_blocks;
unsigned long *discard_bitset;
- uint32_t discard_block_size; /* a power of 2 times sectors per block */
+ uint32_t discard_block_size;
/*
* Rather than reconstructing the table line for the status we just
@@ -1908,35 +1908,6 @@ static int create_cache_policy(struct cache *cache, struct cache_args *ca,
return 0;
}
-/*
- * We want the discard block size to be a power of two, at least the size
- * of the cache block size, and have no more than 2^14 discard blocks
- * across the origin.
- */
-#define MAX_DISCARD_BLOCKS (1 << 14)
-
-static bool too_many_discard_blocks(sector_t discard_block_size,
- sector_t origin_size)
-{
- (void) sector_div(origin_size, discard_block_size);
-
- return origin_size > MAX_DISCARD_BLOCKS;
-}
-
-static sector_t calculate_discard_block_size(sector_t cache_block_size,
- sector_t origin_size)
-{
- sector_t discard_block_size;
-
- discard_block_size = roundup_pow_of_two(cache_block_size);
-
- if (origin_size)
- while (too_many_discard_blocks(discard_block_size, origin_size))
- discard_block_size *= 2;
-
- return discard_block_size;
-}
-
#define DEFAULT_MIGRATION_THRESHOLD 2048
static int cache_create(struct cache_args *ca, struct cache **result)
@@ -2041,9 +2012,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
}
clear_bitset(cache->dirty_bitset, from_cblock(cache->cache_size));
- cache->discard_block_size =
- calculate_discard_block_size(cache->sectors_per_block,
- cache->origin_sectors);
+ cache->discard_block_size = cache->sectors_per_block;
cache->discard_nr_blocks = oblock_to_dblock(cache, cache->origin_blocks);
cache->discard_bitset = alloc_bitset(from_dblock(cache->discard_nr_blocks));
if (!cache->discard_bitset) {
@@ -2630,7 +2599,7 @@ static void set_discard_limits(struct cache *cache, struct queue_limits *limits)
/*
* FIXME: these limits may be incompatible with the cache device
*/
- limits->max_discard_sectors = cache->discard_block_size * 1024;
+ limits->max_discard_sectors = cache->discard_block_size;
limits->discard_granularity = cache->discard_block_size << SECTOR_SHIFT;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 172/182] dm transaction manager: fix corruption due to non-atomic transaction commit
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (170 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 171/182] dm cache: prevent corruption caused by discard_block_size > cache_block_size Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 173/182] dm: take care to copy the space map roots before locking the superblock Jiri Slaby
` (11 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Joe Thornber, Mike Snitzer, Jiri Slaby
From: Joe Thornber <ejt@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a9d45396f5956d0b615c7ae3b936afd888351a47 upstream.
The persistent-data library used by dm-thin, dm-cache, etc is
transactional. If anything goes wrong, such as an io error when writing
new metadata or a power failure, then we roll back to the last
transaction.
Atomicity when committing a transaction is achieved by:
a) Never overwriting data from the previous transaction.
b) Writing the superblock last, after all other metadata has hit the
disk.
This commit and the following commit ("dm: take care to copy the space
map roots before locking the superblock") fix a bug associated with (b).
When committing it was possible for the superblock to still be written
in spite of an io error occurring during the preceeding metadata flush.
With these commits we're careful not to take the write lock out on the
superblock until after the metadata flush has completed.
Change the transaction manager's semantics for dm_tm_commit() to assume
all data has been flushed _before_ the single superblock that is passed
in.
As a prerequisite, split the block manager's block unlocking and
flushing by simplifying dm_bm_flush_and_unlock() to dm_bm_flush(). Now
the unlocking must be done separately.
This issue was discovered by forcing io errors at the crucial time
using dm-flakey.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/dm-cache-metadata.c | 3 ++-
drivers/md/persistent-data/dm-block-manager.c | 15 ++-------------
drivers/md/persistent-data/dm-block-manager.h | 3 +--
drivers/md/persistent-data/dm-transaction-manager.c | 5 +++--
drivers/md/persistent-data/dm-transaction-manager.h | 17 ++++++++---------
5 files changed, 16 insertions(+), 27 deletions(-)
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 1af7255bbffb..a33e07f4222e 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -511,8 +511,9 @@ static int __begin_transaction_flags(struct dm_cache_metadata *cmd,
disk_super = dm_block_data(sblock);
update_flags(disk_super, mutator);
read_superblock_fields(cmd, disk_super);
+ dm_bm_unlock(sblock);
- return dm_bm_flush_and_unlock(cmd->bm, sblock);
+ return dm_bm_flush(cmd->bm);
}
static int __begin_transaction(struct dm_cache_metadata *cmd)
diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
index 064a3c271baa..30597f389d39 100644
--- a/drivers/md/persistent-data/dm-block-manager.c
+++ b/drivers/md/persistent-data/dm-block-manager.c
@@ -595,25 +595,14 @@ int dm_bm_unlock(struct dm_block *b)
}
EXPORT_SYMBOL_GPL(dm_bm_unlock);
-int dm_bm_flush_and_unlock(struct dm_block_manager *bm,
- struct dm_block *superblock)
+int dm_bm_flush(struct dm_block_manager *bm)
{
- int r;
-
if (bm->read_only)
return -EPERM;
- r = dm_bufio_write_dirty_buffers(bm->bufio);
- if (unlikely(r)) {
- dm_bm_unlock(superblock);
- return r;
- }
-
- dm_bm_unlock(superblock);
-
return dm_bufio_write_dirty_buffers(bm->bufio);
}
-EXPORT_SYMBOL_GPL(dm_bm_flush_and_unlock);
+EXPORT_SYMBOL_GPL(dm_bm_flush);
void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b)
{
diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h
index 13cd58e1fe69..1b95dfc17786 100644
--- a/drivers/md/persistent-data/dm-block-manager.h
+++ b/drivers/md/persistent-data/dm-block-manager.h
@@ -105,8 +105,7 @@ int dm_bm_unlock(struct dm_block *b);
*
* This method always blocks.
*/
-int dm_bm_flush_and_unlock(struct dm_block_manager *bm,
- struct dm_block *superblock);
+int dm_bm_flush(struct dm_block_manager *bm);
/*
* Request data is prefetched into the cache.
diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c
index 81da1a26042e..3bc30a0ae3d6 100644
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -154,7 +154,7 @@ int dm_tm_pre_commit(struct dm_transaction_manager *tm)
if (r < 0)
return r;
- return 0;
+ return dm_bm_flush(tm->bm);
}
EXPORT_SYMBOL_GPL(dm_tm_pre_commit);
@@ -164,8 +164,9 @@ int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *root)
return -EWOULDBLOCK;
wipe_shadow_table(tm);
+ dm_bm_unlock(root);
- return dm_bm_flush_and_unlock(tm->bm, root);
+ return dm_bm_flush(tm->bm);
}
EXPORT_SYMBOL_GPL(dm_tm_commit);
diff --git a/drivers/md/persistent-data/dm-transaction-manager.h b/drivers/md/persistent-data/dm-transaction-manager.h
index b5b139076ca5..2772ed2a781a 100644
--- a/drivers/md/persistent-data/dm-transaction-manager.h
+++ b/drivers/md/persistent-data/dm-transaction-manager.h
@@ -38,18 +38,17 @@ struct dm_transaction_manager *dm_tm_create_non_blocking_clone(struct dm_transac
/*
* We use a 2-phase commit here.
*
- * i) In the first phase the block manager is told to start flushing, and
- * the changes to the space map are written to disk. You should interrogate
- * your particular space map to get detail of its root node etc. to be
- * included in your superblock.
+ * i) Make all changes for the transaction *except* for the superblock.
+ * Then call dm_tm_pre_commit() to flush them to disk.
*
- * ii) @root will be committed last. You shouldn't use more than the
- * first 512 bytes of @root if you wish the transaction to survive a power
- * failure. You *must* have a write lock held on @root for both stage (i)
- * and (ii). The commit will drop the write lock.
+ * ii) Lock your superblock. Update. Then call dm_tm_commit() which will
+ * unlock the superblock and flush it. No other blocks should be updated
+ * during this period. Care should be taken to never unlock a partially
+ * updated superblock; perform any operations that could fail *before* you
+ * take the superblock lock.
*/
int dm_tm_pre_commit(struct dm_transaction_manager *tm);
-int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *root);
+int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *superblock);
/*
* These methods are the only way to get hold of a writeable block.
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 173/182] dm: take care to copy the space map roots before locking the superblock
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (171 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 172/182] dm transaction manager: fix corruption due to non-atomic transaction commit Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 174/182] dm thin: fix dangling bio in process_deferred_bios error path Jiri Slaby
` (10 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Joe Thornber, Mike Snitzer, Jiri Slaby
From: Joe Thornber <ejt@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5a32083d03fb543f63489b2946c4948398579ba0 upstream.
In theory copying the space map root can fail, but in practice it never
does because we're careful to check what size buffer is needed.
But make certain we're able to copy the space map roots before
locking the superblock.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/dm-cache-metadata.c | 60 +++++++++++++++++++------------
drivers/md/dm-thin-metadata.c | 80 +++++++++++++++++++++++++-----------------
2 files changed, 85 insertions(+), 55 deletions(-)
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index a33e07f4222e..1d38019bb022 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -114,6 +114,12 @@ struct dm_cache_metadata {
unsigned policy_version[CACHE_POLICY_VERSION_SIZE];
size_t policy_hint_size;
struct dm_cache_statistics stats;
+
+ /*
+ * Reading the space map root can fail, so we read it into this
+ * buffer before the superblock is locked and updated.
+ */
+ __u8 metadata_space_map_root[SPACE_MAP_ROOT_SIZE];
};
/*-------------------------------------------------------------------
@@ -242,11 +248,31 @@ static void __setup_mapping_info(struct dm_cache_metadata *cmd)
}
}
+static int __save_sm_root(struct dm_cache_metadata *cmd)
+{
+ int r;
+ size_t metadata_len;
+
+ r = dm_sm_root_size(cmd->metadata_sm, &metadata_len);
+ if (r < 0)
+ return r;
+
+ return dm_sm_copy_root(cmd->metadata_sm, &cmd->metadata_space_map_root,
+ metadata_len);
+}
+
+static void __copy_sm_root(struct dm_cache_metadata *cmd,
+ struct cache_disk_superblock *disk_super)
+{
+ memcpy(&disk_super->metadata_space_map_root,
+ &cmd->metadata_space_map_root,
+ sizeof(cmd->metadata_space_map_root));
+}
+
static int __write_initial_superblock(struct dm_cache_metadata *cmd)
{
int r;
struct dm_block *sblock;
- size_t metadata_len;
struct cache_disk_superblock *disk_super;
sector_t bdev_size = i_size_read(cmd->bdev->bd_inode) >> SECTOR_SHIFT;
@@ -254,12 +280,16 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
if (bdev_size > DM_CACHE_METADATA_MAX_SECTORS)
bdev_size = DM_CACHE_METADATA_MAX_SECTORS;
- r = dm_sm_root_size(cmd->metadata_sm, &metadata_len);
+ r = dm_tm_pre_commit(cmd->tm);
if (r < 0)
return r;
- r = dm_tm_pre_commit(cmd->tm);
- if (r < 0)
+ /*
+ * dm_sm_copy_root() can fail. So we need to do it before we start
+ * updating the superblock.
+ */
+ r = __save_sm_root(cmd);
+ if (r)
return r;
r = superblock_lock_zero(cmd, &sblock);
@@ -275,10 +305,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version));
disk_super->policy_hint_size = 0;
- r = dm_sm_copy_root(cmd->metadata_sm, &disk_super->metadata_space_map_root,
- metadata_len);
- if (r < 0)
- goto bad_locked;
+ __copy_sm_root(cmd, disk_super);
disk_super->mapping_root = cpu_to_le64(cmd->root);
disk_super->hint_root = cpu_to_le64(cmd->hint_root);
@@ -295,10 +322,6 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
disk_super->write_misses = cpu_to_le32(0);
return dm_tm_commit(cmd->tm, sblock);
-
-bad_locked:
- dm_bm_unlock(sblock);
- return r;
}
static int __format_metadata(struct dm_cache_metadata *cmd)
@@ -541,7 +564,6 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
flags_mutator mutator)
{
int r;
- size_t metadata_len;
struct cache_disk_superblock *disk_super;
struct dm_block *sblock;
@@ -559,8 +581,8 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
if (r < 0)
return r;
- r = dm_sm_root_size(cmd->metadata_sm, &metadata_len);
- if (r < 0)
+ r = __save_sm_root(cmd);
+ if (r)
return r;
r = superblock_lock(cmd, &sblock);
@@ -587,13 +609,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses);
disk_super->write_hits = cpu_to_le32(cmd->stats.write_hits);
disk_super->write_misses = cpu_to_le32(cmd->stats.write_misses);
-
- r = dm_sm_copy_root(cmd->metadata_sm, &disk_super->metadata_space_map_root,
- metadata_len);
- if (r < 0) {
- dm_bm_unlock(sblock);
- return r;
- }
+ __copy_sm_root(cmd, disk_super);
return dm_tm_commit(cmd->tm, sblock);
}
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 3bb4506582a9..07a6ea3a9820 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -192,6 +192,13 @@ struct dm_pool_metadata {
* operation possible in this state is the closing of the device.
*/
bool fail_io:1;
+
+ /*
+ * Reading the space map roots can fail, so we read it into these
+ * buffers before the superblock is locked and updated.
+ */
+ __u8 data_space_map_root[SPACE_MAP_ROOT_SIZE];
+ __u8 metadata_space_map_root[SPACE_MAP_ROOT_SIZE];
};
struct dm_thin_device {
@@ -431,26 +438,53 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
pmd->details_info.value_type.equal = NULL;
}
+static int save_sm_roots(struct dm_pool_metadata *pmd)
+{
+ int r;
+ size_t len;
+
+ r = dm_sm_root_size(pmd->metadata_sm, &len);
+ if (r < 0)
+ return r;
+
+ r = dm_sm_copy_root(pmd->metadata_sm, &pmd->metadata_space_map_root, len);
+ if (r < 0)
+ return r;
+
+ r = dm_sm_root_size(pmd->data_sm, &len);
+ if (r < 0)
+ return r;
+
+ return dm_sm_copy_root(pmd->data_sm, &pmd->data_space_map_root, len);
+}
+
+static void copy_sm_roots(struct dm_pool_metadata *pmd,
+ struct thin_disk_superblock *disk)
+{
+ memcpy(&disk->metadata_space_map_root,
+ &pmd->metadata_space_map_root,
+ sizeof(pmd->metadata_space_map_root));
+
+ memcpy(&disk->data_space_map_root,
+ &pmd->data_space_map_root,
+ sizeof(pmd->data_space_map_root));
+}
+
static int __write_initial_superblock(struct dm_pool_metadata *pmd)
{
int r;
struct dm_block *sblock;
- size_t metadata_len, data_len;
struct thin_disk_superblock *disk_super;
sector_t bdev_size = i_size_read(pmd->bdev->bd_inode) >> SECTOR_SHIFT;
if (bdev_size > THIN_METADATA_MAX_SECTORS)
bdev_size = THIN_METADATA_MAX_SECTORS;
- r = dm_sm_root_size(pmd->metadata_sm, &metadata_len);
- if (r < 0)
- return r;
-
- r = dm_sm_root_size(pmd->data_sm, &data_len);
+ r = dm_sm_commit(pmd->data_sm);
if (r < 0)
return r;
- r = dm_sm_commit(pmd->data_sm);
+ r = save_sm_roots(pmd);
if (r < 0)
return r;
@@ -471,15 +505,7 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
disk_super->trans_id = 0;
disk_super->held_root = 0;
- r = dm_sm_copy_root(pmd->metadata_sm, &disk_super->metadata_space_map_root,
- metadata_len);
- if (r < 0)
- goto bad_locked;
-
- r = dm_sm_copy_root(pmd->data_sm, &disk_super->data_space_map_root,
- data_len);
- if (r < 0)
- goto bad_locked;
+ copy_sm_roots(pmd, disk_super);
disk_super->data_mapping_root = cpu_to_le64(pmd->root);
disk_super->device_details_root = cpu_to_le64(pmd->details_root);
@@ -488,10 +514,6 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
disk_super->data_block_size = cpu_to_le32(pmd->data_block_size);
return dm_tm_commit(pmd->tm, sblock);
-
-bad_locked:
- dm_bm_unlock(sblock);
- return r;
}
static int __format_metadata(struct dm_pool_metadata *pmd)
@@ -769,6 +791,10 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
if (r < 0)
return r;
+ r = save_sm_roots(pmd);
+ if (r < 0)
+ return r;
+
r = superblock_lock(pmd, &sblock);
if (r)
return r;
@@ -780,21 +806,9 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
disk_super->trans_id = cpu_to_le64(pmd->trans_id);
disk_super->flags = cpu_to_le32(pmd->flags);
- r = dm_sm_copy_root(pmd->metadata_sm, &disk_super->metadata_space_map_root,
- metadata_len);
- if (r < 0)
- goto out_locked;
-
- r = dm_sm_copy_root(pmd->data_sm, &disk_super->data_space_map_root,
- data_len);
- if (r < 0)
- goto out_locked;
+ copy_sm_roots(pmd, disk_super);
return dm_tm_commit(pmd->tm, sblock);
-
-out_locked:
- dm_bm_unlock(sblock);
- return r;
}
struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 174/182] dm thin: fix dangling bio in process_deferred_bios error path
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (172 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 173/182] dm: take care to copy the space map roots before locking the superblock Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 175/182] dma: edma: fix incorrect SG list handling Jiri Slaby
` (9 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Mike Snitzer, Jiri Slaby
From: Mike Snitzer <snitzer@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fe76cd88e654124d1431bb662a0fc6e99ca811a5 upstream.
If unable to ensure_next_mapping() we must add the current bio, which
was removed from the @bios list via bio_list_pop, back to the
deferred_bios list before all the remaining @bios.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/dm-thin.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index e9587101b04f..e4cc196634c1 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1332,9 +1332,9 @@ static void process_deferred_bios(struct pool *pool)
*/
if (ensure_next_mapping(pool)) {
spin_lock_irqsave(&pool->lock, flags);
+ bio_list_add(&pool->deferred_bios, bio);
bio_list_merge(&pool->deferred_bios, &bios);
spin_unlock_irqrestore(&pool->lock, flags);
-
break;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 175/182] dma: edma: fix incorrect SG list handling
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (173 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 174/182] dm thin: fix dangling bio in process_deferred_bios error path Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 176/182] aio: v4 ensure access to ctx->ring_pages is correctly serialised for migration Jiri Slaby
` (8 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Sekhar Nori, Joel Fernandes, Vinod Koul, Jiri Slaby
From: Sekhar Nori <nsekhar@ti.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5fc68a6cad658e45dca3e0a6607df3a8e5df4ef9 upstream.
The code to handle any length SG lists calls edma_resume()
even before edma_start() is called. This is incorrect
because edma_resume() enables edma events on the channel
after which CPU (in edma_start) cannot clear posted
events by writing to ECR (per the EDMA user's guide).
Because of this EDMA transfers fail to start if due
to some reason there is a pending EDMA event registered
even before EDMA transfers are started. This can happen if
an EDMA event is a byproduct of device initialization.
Fix this by calling edma_resume() only if it is not the
first batch of MAX_NR_SG elements.
Without this patch, MMC/SD fails to function on DA850 EVM
with DMA. The behaviour is triggered by specific IP and
this can explain why the issue was not reported before
(example with MMC/SD on AM335x).
Tested on DA850 EVM and AM335x EVM-SK using MMC/SD card.
Cc: Joel Fernandes <joelf@ti.com>
Acked-by: Joel Fernandes <joelf@ti.com>
Tested-by: Jon Ringle <jringle@gridpoint.com>
Tested-by: Alexander Holler <holler@ahsoftware.de>
Reported-by: Jon Ringle <jringle@gridpoint.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/dma/edma.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 10b577fcf48d..0ad40e4a7ae0 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -170,11 +170,13 @@ static void edma_execute(struct edma_chan *echan)
if (edesc->processed == edesc->pset_nr)
edma_link(echan->slot[nslots-1], echan->ecc->dummy_slot);
- edma_resume(echan->ch_num);
-
if (edesc->processed <= MAX_NR_SG) {
dev_dbg(dev, "first transfer starting %d\n", echan->ch_num);
edma_start(echan->ch_num);
+ } else {
+ dev_dbg(dev, "chan: %d: completed %d elements, resuming\n",
+ echan->ch_num, edesc->processed);
+ edma_resume(echan->ch_num);
}
/*
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 176/182] aio: v4 ensure access to ctx->ring_pages is correctly serialised for migration
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (174 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 175/182] dma: edma: fix incorrect SG list handling Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 177/182] lockd: ensure we tear down any live sockets when socket creation fails during lockd_up Jiri Slaby
` (7 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Benjamin LaHaise, Tang Chen, Gu Zheng, Jiri Slaby
From: Benjamin LaHaise <bcrl@kvack.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fa8a53c39f3fdde98c9eace6a9b412143f0f6ed6 upstream.
As reported by Tang Chen, Gu Zheng and Yasuaki Isimatsu, the following issues
exist in the aio ring page migration support.
As a result, for example, we have the following problem:
thread 1 | thread 2
|
aio_migratepage() |
|-> take ctx->completion_lock |
|-> migrate_page_copy(new, old) |
| *NOW*, ctx->ring_pages[idx] == old |
|
| *NOW*, ctx->ring_pages[idx] == old
| aio_read_events_ring()
| |-> ring = kmap_atomic(ctx->ring_pages[0])
| |-> ring->head = head; *HERE, write to the old ring page*
| |-> kunmap_atomic(ring);
|
|-> ctx->ring_pages[idx] = new |
| *BUT NOW*, the content of |
| ring_pages[idx] is old. |
|-> release ctx->completion_lock |
As above, the new ring page will not be updated.
Fix this issue, as well as prevent races in aio_ring_setup() by holding
the ring_lock mutex during kioctx setup and page migration. This avoids
the overhead of taking another spinlock in aio_read_events_ring() as Tang's
and Gu's original fix did, pushing the overhead into the migration code.
Note that to handle the nesting of ring_lock inside of mmap_sem, the
migratepage operation uses mutex_trylock(). Page migration is not a 100%
critical operation in this case, so the ocassional failure can be
tolerated. This issue was reported by Sasha Levin.
Based on feedback from Linus, avoid the extra taking of ctx->completion_lock.
Instead, make page migration fully serialised by mapping->private_lock, and
have aio_free_ring() simply disconnect the kioctx from the mapping by calling
put_aio_ring_file() before touching ctx->ring_pages[]. This simplifies the
error handling logic in aio_migratepage(), and should improve robustness.
v4: always do mutex_unlock() in cases when kioctx setup fails.
Reported-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: Tang Chen <tangchen@cn.fujitsu.com>
Cc: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/aio.c | 120 +++++++++++++++++++++++++++++++++++----------------------------
1 file changed, 67 insertions(+), 53 deletions(-)
diff --git a/fs/aio.c b/fs/aio.c
index 062a5f6a1448..12a3de0ee6da 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -52,7 +52,8 @@
struct aio_ring {
unsigned id; /* kernel internal index number */
unsigned nr; /* number of io_events */
- unsigned head;
+ unsigned head; /* Written to by userland or under ring_lock
+ * mutex by aio_read_events_ring(). */
unsigned tail;
unsigned magic;
@@ -243,6 +244,11 @@ static void aio_free_ring(struct kioctx *ctx)
{
int i;
+ /* Disconnect the kiotx from the ring file. This prevents future
+ * accesses to the kioctx from page migration.
+ */
+ put_aio_ring_file(ctx);
+
for (i = 0; i < ctx->nr_pages; i++) {
struct page *page;
pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
@@ -254,8 +260,6 @@ static void aio_free_ring(struct kioctx *ctx)
put_page(page);
}
- put_aio_ring_file(ctx);
-
if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages) {
kfree(ctx->ring_pages);
ctx->ring_pages = NULL;
@@ -283,29 +287,38 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
{
struct kioctx *ctx;
unsigned long flags;
+ pgoff_t idx;
int rc;
rc = 0;
- /* Make sure the old page hasn't already been changed */
+ /* mapping->private_lock here protects against the kioctx teardown. */
spin_lock(&mapping->private_lock);
ctx = mapping->private_data;
- if (ctx) {
- pgoff_t idx;
- spin_lock_irqsave(&ctx->completion_lock, flags);
- idx = old->index;
- if (idx < (pgoff_t)ctx->nr_pages) {
- if (ctx->ring_pages[idx] != old)
- rc = -EAGAIN;
- } else
- rc = -EINVAL;
- spin_unlock_irqrestore(&ctx->completion_lock, flags);
+ if (!ctx) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+ /* The ring_lock mutex. The prevents aio_read_events() from writing
+ * to the ring's head, and prevents page migration from mucking in
+ * a partially initialized kiotx.
+ */
+ if (!mutex_trylock(&ctx->ring_lock)) {
+ rc = -EAGAIN;
+ goto out;
+ }
+
+ idx = old->index;
+ if (idx < (pgoff_t)ctx->nr_pages) {
+ /* Make sure the old page hasn't already been changed */
+ if (ctx->ring_pages[idx] != old)
+ rc = -EAGAIN;
} else
rc = -EINVAL;
- spin_unlock(&mapping->private_lock);
if (rc != 0)
- return rc;
+ goto out_unlock;
/* Writeback must be complete */
BUG_ON(PageWriteback(old));
@@ -314,38 +327,26 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
rc = migrate_page_move_mapping(mapping, new, old, NULL, mode, 1);
if (rc != MIGRATEPAGE_SUCCESS) {
put_page(new);
- return rc;
+ goto out_unlock;
}
- /* We can potentially race against kioctx teardown here. Use the
- * address_space's private data lock to protect the mapping's
- * private_data.
+ /* Take completion_lock to prevent other writes to the ring buffer
+ * while the old page is copied to the new. This prevents new
+ * events from being lost.
*/
- spin_lock(&mapping->private_lock);
- ctx = mapping->private_data;
- if (ctx) {
- pgoff_t idx;
- spin_lock_irqsave(&ctx->completion_lock, flags);
- migrate_page_copy(new, old);
- idx = old->index;
- if (idx < (pgoff_t)ctx->nr_pages) {
- /* And only do the move if things haven't changed */
- if (ctx->ring_pages[idx] == old)
- ctx->ring_pages[idx] = new;
- else
- rc = -EAGAIN;
- } else
- rc = -EINVAL;
- spin_unlock_irqrestore(&ctx->completion_lock, flags);
- } else
- rc = -EBUSY;
- spin_unlock(&mapping->private_lock);
+ spin_lock_irqsave(&ctx->completion_lock, flags);
+ migrate_page_copy(new, old);
+ BUG_ON(ctx->ring_pages[idx] != old);
+ ctx->ring_pages[idx] = new;
+ spin_unlock_irqrestore(&ctx->completion_lock, flags);
- if (rc == MIGRATEPAGE_SUCCESS)
- put_page(old);
- else
- put_page(new);
+ /* The old page is no longer accessible. */
+ put_page(old);
+out_unlock:
+ mutex_unlock(&ctx->ring_lock);
+out:
+ spin_unlock(&mapping->private_lock);
return rc;
}
#endif
@@ -380,7 +381,7 @@ static int aio_setup_ring(struct kioctx *ctx)
file = aio_private_file(ctx, nr_pages);
if (IS_ERR(file)) {
ctx->aio_ring_file = NULL;
- return -EAGAIN;
+ return -ENOMEM;
}
ctx->aio_ring_file = file;
@@ -415,7 +416,7 @@ static int aio_setup_ring(struct kioctx *ctx)
if (unlikely(i != nr_pages)) {
aio_free_ring(ctx);
- return -EAGAIN;
+ return -ENOMEM;
}
ctx->mmap_size = nr_pages * PAGE_SIZE;
@@ -429,7 +430,7 @@ static int aio_setup_ring(struct kioctx *ctx)
if (IS_ERR((void *)ctx->mmap_base)) {
ctx->mmap_size = 0;
aio_free_ring(ctx);
- return -EAGAIN;
+ return -ENOMEM;
}
pr_debug("mmap address: 0x%08lx\n", ctx->mmap_base);
@@ -556,6 +557,10 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
rcu_read_unlock();
spin_unlock(&mm->ioctx_lock);
+ /* While kioctx setup is in progress,
+ * we are protected from page migration
+ * changes ring_pages by ->ring_lock.
+ */
ring = kmap_atomic(ctx->ring_pages[0]);
ring->id = ctx->id;
kunmap_atomic(ring);
@@ -640,24 +645,28 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
ctx->max_reqs = nr_events;
- if (percpu_ref_init(&ctx->users, free_ioctx_users))
- goto err;
-
- if (percpu_ref_init(&ctx->reqs, free_ioctx_reqs))
- goto err;
-
spin_lock_init(&ctx->ctx_lock);
spin_lock_init(&ctx->completion_lock);
mutex_init(&ctx->ring_lock);
+ /* Protect against page migration throughout kiotx setup by keeping
+ * the ring_lock mutex held until setup is complete. */
+ mutex_lock(&ctx->ring_lock);
init_waitqueue_head(&ctx->wait);
INIT_LIST_HEAD(&ctx->active_reqs);
+ if (percpu_ref_init(&ctx->users, free_ioctx_users))
+ goto err;
+
+ if (percpu_ref_init(&ctx->reqs, free_ioctx_reqs))
+ goto err;
+
ctx->cpu = alloc_percpu(struct kioctx_cpu);
if (!ctx->cpu)
goto err;
- if (aio_setup_ring(ctx) < 0)
+ err = aio_setup_ring(ctx);
+ if (err < 0)
goto err;
atomic_set(&ctx->reqs_available, ctx->nr_events - 1);
@@ -683,6 +692,9 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
if (err)
goto err_cleanup;
+ /* Release the ring_lock mutex now that all setup is complete. */
+ mutex_unlock(&ctx->ring_lock);
+
pr_debug("allocated ioctx %p[%ld]: mm=%p mask=0x%x\n",
ctx, ctx->user_id, mm, ctx->nr_events);
return ctx;
@@ -692,6 +704,7 @@ err_cleanup:
err_ctx:
aio_free_ring(ctx);
err:
+ mutex_unlock(&ctx->ring_lock);
free_percpu(ctx->cpu);
free_percpu(ctx->reqs.pcpu_count);
free_percpu(ctx->users.pcpu_count);
@@ -1024,6 +1037,7 @@ static long aio_read_events_ring(struct kioctx *ctx,
mutex_lock(&ctx->ring_lock);
+ /* Access to ->ring_pages here is protected by ctx->ring_lock. */
ring = kmap_atomic(ctx->ring_pages[0]);
head = ring->head;
tail = ring->tail;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 177/182] lockd: ensure we tear down any live sockets when socket creation fails during lockd_up
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (175 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 176/182] aio: v4 ensure access to ctx->ring_pages is correctly serialised for migration Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 178/182] lib/percpu_counter.c: fix bad percpu counter state during suspend Jiri Slaby
` (6 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jeff Layton, J. Bruce Fields, Jiri Slaby
From: Jeff Layton <jlayton@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 679b033df48422191c4cac52b610d9980e019f9b upstream.
We had a Fedora ABRT report with a stack trace like this:
kernel BUG at net/sunrpc/svc.c:550!
invalid opcode: 0000 [#1] SMP
[...]
CPU: 2 PID: 913 Comm: rpc.nfsd Not tainted 3.13.6-200.fc20.x86_64 #1
Hardware name: Hewlett-Packard HP ProBook 4740s/1846, BIOS 68IRR Ver. F.40 01/29/2013
task: ffff880146b00000 ti: ffff88003f9b8000 task.ti: ffff88003f9b8000
RIP: 0010:[<ffffffffa0305fa8>] [<ffffffffa0305fa8>] svc_destroy+0x128/0x130 [sunrpc]
RSP: 0018:ffff88003f9b9de0 EFLAGS: 00010206
RAX: ffff88003f829628 RBX: ffff88003f829600 RCX: 00000000000041ee
RDX: 0000000000000000 RSI: 0000000000000286 RDI: 0000000000000286
RBP: ffff88003f9b9de8 R08: 0000000000017360 R09: ffff88014fa97360
R10: ffffffff8114ce57 R11: ffffea00051c9c00 R12: ffff88003f829600
R13: 00000000ffffff9e R14: ffffffff81cc7cc0 R15: 0000000000000000
FS: 00007f4fde284840(0000) GS:ffff88014fa80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4fdf5192f8 CR3: 00000000a569a000 CR4: 00000000001407e0
Stack:
ffff88003f792300 ffff88003f9b9e18 ffffffffa02de02a 0000000000000000
ffffffff81cc7cc0 ffff88003f9cb000 0000000000000008 ffff88003f9b9e60
ffffffffa033bb35 ffffffff8131c86c ffff88003f9cb000 ffff8800a5715008
Call Trace:
[<ffffffffa02de02a>] lockd_up+0xaa/0x330 [lockd]
[<ffffffffa033bb35>] nfsd_svc+0x1b5/0x2f0 [nfsd]
[<ffffffff8131c86c>] ? simple_strtoull+0x2c/0x50
[<ffffffffa033c630>] ? write_pool_threads+0x280/0x280 [nfsd]
[<ffffffffa033c6bb>] write_threads+0x8b/0xf0 [nfsd]
[<ffffffff8114efa4>] ? __get_free_pages+0x14/0x50
[<ffffffff8114eff6>] ? get_zeroed_page+0x16/0x20
[<ffffffff811dec51>] ? simple_transaction_get+0xb1/0xd0
[<ffffffffa033c098>] nfsctl_transaction_write+0x48/0x80 [nfsd]
[<ffffffff811b8b34>] vfs_write+0xb4/0x1f0
[<ffffffff811c3f99>] ? putname+0x29/0x40
[<ffffffff811b9569>] SyS_write+0x49/0xa0
[<ffffffff810fc2a6>] ? __audit_syscall_exit+0x1f6/0x2a0
[<ffffffff816962e9>] system_call_fastpath+0x16/0x1b
Code: 31 c0 e8 82 db 37 e1 e9 2a ff ff ff 48 8b 07 8b 57 14 48 c7 c7 d5 c6 31 a0 48 8b 70 20 31 c0 e8 65 db 37 e1 e9 f4 fe ff ff 0f 0b <0f> 0b 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55
RIP [<ffffffffa0305fa8>] svc_destroy+0x128/0x130 [sunrpc]
RSP <ffff88003f9b9de0>
Evidently, we created some lockd sockets and then failed to create
others. make_socks then returned an error and we tried to tear down the
svc, but svc->sv_permsocks was not empty so we ended up tripping over
the BUG() in svc_destroy().
Fix this by ensuring that we tear down any live sockets we created when
socket creation is going to return an error.
Fixes: 786185b5f8abefa (SUNRPC: move per-net operations from...)
Reported-by: Raphos <raphoszap@laposte.net>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/lockd/svc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 10d6c41aecad..6bf06a07f3e0 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -235,6 +235,7 @@ out_err:
if (warned++ == 0)
printk(KERN_WARNING
"lockd_up: makesock failed, error=%d\n", err);
+ svc_shutdown_net(serv, net);
return err;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 178/182] lib/percpu_counter.c: fix bad percpu counter state during suspend
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (176 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 177/182] lockd: ensure we tear down any live sockets when socket creation fails during lockd_up Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 179/182] mmc: sdhci-bcm-kona: fix build errors when built-in Jiri Slaby
` (5 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Jens Axboe, Andrew Morton, Linus Torvalds,
Jiri Slaby
From: Jens Axboe <axboe@fb.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e39435ce68bb4685288f78b1a7e24311f7ef939f upstream.
I got a bug report yesterday from Laszlo Ersek in which he states that
his kvm instance fails to suspend. Laszlo bisected it down to this
commit 1cf7e9c68fe8 ("virtio_blk: blk-mq support") where virtio-blk is
converted to use the blk-mq infrastructure.
After digging a bit, it became clear that the issue was with the queue
drain. blk-mq tracks queue usage in a percpu counter, which is
incremented on request alloc and decremented when the request is freed.
The initial hunt was for an inconsistency in blk-mq, but everything
seemed fine. In fact, the counter only returned crazy values when
suspend was in progress.
When a CPU is unplugged, the percpu counters merges that CPU state with
the general state. blk-mq takes care to register a hotcpu notifier with
the appropriate priority, so we know it runs after the percpu counter
notifier. However, the percpu counter notifier only merges the state
when the CPU is fully gone. This leaves a state transition where the
CPU going away is no longer in the online mask, yet it still holds
private values. This means that in this state, percpu_counter_sum()
returns invalid results, and the suspend then hangs waiting for
abs(dead-cpu-value) requests to complete which of course will never
happen.
Fix this by clearing the state earlier, so we never have a case where
the CPU isn't in online mask but still holds private state. This bug
has been there since forever, I guess we don't have a lot of users where
percpu counters needs to be reliable during the suspend cycle.
Signed-off-by: Jens Axboe <axboe@fb.com>
Reported-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
lib/percpu_counter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index 93c5d5ecff4e..741a4269eb8f 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -166,7 +166,7 @@ static int percpu_counter_hotcpu_callback(struct notifier_block *nb,
struct percpu_counter *fbc;
compute_batch_value();
- if (action != CPU_DEAD)
+ if (action != CPU_DEAD && action != CPU_DEAD_FROZEN)
return NOTIFY_OK;
cpu = (unsigned long)hcpu;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 179/182] mmc: sdhci-bcm-kona: fix build errors when built-in
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (177 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 178/182] lib/percpu_counter.c: fix bad percpu counter state during suspend Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 180/182] Input: synaptics - add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1 Jiri Slaby
` (4 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Russell King, Chris Ball, Jiri Slaby
From: Russell King <rmk+kernel@arm.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4025ce24f326830135341814307c072f6c2a7738 upstream.
`sdhci_bcm_kona_remove' referenced in section `.data' of drivers/built-in.o: defined in discarded section `.exit.text' of drivers/built-in.o
Fixes: 058feb53666f ("mmc: sdhci-bcm-kona: make linker-section warning go away")
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Tested-by: Markus Mayer <markus.mayer@linaro.org>
Acked-by: Matt Porter <mporter@linaro.org>
Signed-off-by: Chris Ball <chris@printf.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/mmc/host/sdhci-bcm-kona.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci-bcm-kona.c b/drivers/mmc/host/sdhci-bcm-kona.c
index 85472d3fd37f..d002eb9e01cd 100644
--- a/drivers/mmc/host/sdhci-bcm-kona.c
+++ b/drivers/mmc/host/sdhci-bcm-kona.c
@@ -314,7 +314,7 @@ err_pltfm_free:
return ret;
}
-static int __exit sdhci_bcm_kona_remove(struct platform_device *pdev)
+static int sdhci_bcm_kona_remove(struct platform_device *pdev)
{
struct sdhci_host *host = platform_get_drvdata(pdev);
int dead;
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 180/182] Input: synaptics - add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (178 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 179/182] mmc: sdhci-bcm-kona: fix build errors when built-in Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 181/182] Input: synaptics - add min/max quirk for ThinkPad Edge E431 Jiri Slaby
` (3 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable
Cc: linux-kernel, Hans de Goede, Benjamin Tissoires, Dmitry Torokhov,
Jiri Slaby
From: Hans de Goede <hdegoede@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 46a2986ebbe18757c2d8c352f8fb6e0f4f0754e3 upstream.
We expect that all the Haswell series will need such quirks, sigh.
The T431s seems to be T430 hardware in a T440s case, using the T440s touchpad,
with the same min/max issue.
The X1 Carbon 3rd generation name says 2nd while it is a 3rd generation.
The X1 and T431s share a PnPID with the T540p, but the reported ranges are
closer to those of the T440s.
HdG: Squashed 5 quirk patches into one. T431s + L440 + L540 are written by me,
S1 Yoga and X1 are written by Benjamin Tissoires.
Hdg: Standardized S1 Yoga and X1 values, Yoga uses the same touchpad as the
X240, X1 uses the same touchpad as the T440.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/input/mouse/synaptics.c | 42 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index d8d49d10f9bb..5048210e798c 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1515,6 +1515,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
.driver_data = (int []){1232, 5710, 1156, 4696},
},
{
+ /* Lenovo ThinkPad T431s */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
+ },
+ .driver_data = (int []){1024, 5112, 2024, 4832},
+ },
+ {
/* Lenovo ThinkPad T440s */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -1523,6 +1531,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
.driver_data = (int []){1024, 5112, 2024, 4832},
},
{
+ /* Lenovo ThinkPad L440 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
+ },
+ .driver_data = (int []){1024, 5112, 2024, 4832},
+ },
+ {
/* Lenovo ThinkPad T540p */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -1530,6 +1546,32 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
},
.driver_data = (int []){1024, 5056, 2058, 4832},
},
+ {
+ /* Lenovo ThinkPad L540 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
+ },
+ .driver_data = (int []){1024, 5112, 2024, 4832},
+ },
+ {
+ /* Lenovo Yoga S1 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
+ "ThinkPad S1 Yoga"),
+ },
+ .driver_data = (int []){1232, 5710, 1156, 4696},
+ },
+ {
+ /* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION,
+ "ThinkPad X1 Carbon 2nd"),
+ },
+ .driver_data = (int []){1024, 5112, 2024, 4832},
+ },
#endif
{ }
};
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 181/182] Input: synaptics - add min/max quirk for ThinkPad Edge E431
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (179 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 180/182] Input: synaptics - add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1 Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 9:28 ` [PATCH 3.12 182/182] drm: cirrus: add power management support Jiri Slaby
` (2 subsequent siblings)
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Hans de Goede, Dmitry Torokhov, Jiri Slaby
From: Hans de Goede <hdegoede@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 27a38856a948c3e8de30dc71647ff9e1778c99fc upstream.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/input/mouse/synaptics.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 5048210e798c..3c511c4adaca 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1515,6 +1515,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
.driver_data = (int []){1232, 5710, 1156, 4696},
},
{
+ /* Lenovo ThinkPad Edge E431 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
+ },
+ .driver_data = (int []){1024, 5022, 2508, 4832},
+ },
+ {
/* Lenovo ThinkPad T431s */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* [PATCH 3.12 182/182] drm: cirrus: add power management support
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (180 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 181/182] Input: synaptics - add min/max quirk for ThinkPad Edge E431 Jiri Slaby
@ 2014-05-13 9:28 ` Jiri Slaby
2014-05-13 12:34 ` [PATCH 3.12 000/182] 3.12.20-stable review Guenter Roeck
2014-05-14 2:09 ` Shuah Khan
183 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-13 9:28 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, Gerd Hoffmann, Dave Airlie, Jiri Slaby
From: Gerd Hoffmann <kraxel@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2f1e800799bf478494cec3573cd63eb34ca89c9d upstream.
cirrus kms driver lacks power management support, thus
the vga display doesn't work any more after S3 resume.
Fix this by adding suspend and resume functions.
Also make the mode_set function unblank the screen.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/cirrus/cirrus_drv.c | 42 ++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/cirrus/cirrus_mode.c | 3 +++
2 files changed, 45 insertions(+)
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index 138364d91782..bfcfd0c202ad 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -11,6 +11,7 @@
#include <linux/module.h>
#include <linux/console.h>
#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
#include "cirrus_drv.h"
@@ -75,6 +76,41 @@ static void cirrus_pci_remove(struct pci_dev *pdev)
drm_put_dev(dev);
}
+static int cirrus_pm_suspend(struct device *dev)
+{
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct drm_device *drm_dev = pci_get_drvdata(pdev);
+ struct cirrus_device *cdev = drm_dev->dev_private;
+
+ drm_kms_helper_poll_disable(drm_dev);
+
+ if (cdev->mode_info.gfbdev) {
+ console_lock();
+ fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 1);
+ console_unlock();
+ }
+
+ return 0;
+}
+
+static int cirrus_pm_resume(struct device *dev)
+{
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct drm_device *drm_dev = pci_get_drvdata(pdev);
+ struct cirrus_device *cdev = drm_dev->dev_private;
+
+ drm_helper_resume_force_mode(drm_dev);
+
+ if (cdev->mode_info.gfbdev) {
+ console_lock();
+ fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 0);
+ console_unlock();
+ }
+
+ drm_kms_helper_poll_enable(drm_dev);
+ return 0;
+}
+
static const struct file_operations cirrus_driver_fops = {
.owner = THIS_MODULE,
.open = drm_open,
@@ -104,11 +140,17 @@ static struct drm_driver driver = {
.dumb_destroy = drm_gem_dumb_destroy,
};
+static const struct dev_pm_ops cirrus_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(cirrus_pm_suspend,
+ cirrus_pm_resume)
+};
+
static struct pci_driver cirrus_pci_driver = {
.name = DRIVER_NAME,
.id_table = pciidlist,
.probe = cirrus_pci_probe,
.remove = cirrus_pci_remove,
+ .driver.pm = &cirrus_pm_ops,
};
static int __init cirrus_init(void)
diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
index 3592616d484b..c6ec012befcd 100644
--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
+++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
@@ -308,6 +308,9 @@ static int cirrus_crtc_mode_set(struct drm_crtc *crtc,
WREG_HDR(hdr);
cirrus_crtc_do_set_base(crtc, old_fb, x, y, 0);
+
+ /* Unblank (needed on S3 resume, vgabios doesn't do it then) */
+ outb(0x20, 0x3c0);
return 0;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [PATCH 3.12 000/182] 3.12.20-stable review
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (181 preceding siblings ...)
2014-05-13 9:28 ` [PATCH 3.12 182/182] drm: cirrus: add power management support Jiri Slaby
@ 2014-05-13 12:34 ` Guenter Roeck
2014-05-19 9:26 ` Jiri Slaby
2014-05-14 2:09 ` Shuah Khan
183 siblings, 1 reply; 186+ messages in thread
From: Guenter Roeck @ 2014-05-13 12:34 UTC (permalink / raw)
To: Jiri Slaby, stable; +Cc: satoru.takeuchi, shuah.kh, linux-kernel
On 05/13/2014 02:26 AM, Jiri Slaby wrote:
> This is the start of the stable review cycle for the 3.12.20 release.
> There are 182 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu May 15 09:25:52 2014
> Anything received after that time might be too late.
>
Build results:
total: 127 pass: 121 skipped: 5 fail: 1
Qemu tests all passed.
Results are as expected. The failing build is unicore32:defconfig;
this is not a concern, it currently fails for all releases.
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [PATCH 3.12 000/182] 3.12.20-stable review
2014-05-13 12:34 ` [PATCH 3.12 000/182] 3.12.20-stable review Guenter Roeck
@ 2014-05-19 9:26 ` Jiri Slaby
0 siblings, 0 replies; 186+ messages in thread
From: Jiri Slaby @ 2014-05-19 9:26 UTC (permalink / raw)
To: Guenter Roeck, stable, shuah.kh; +Cc: satoru.takeuchi, linux-kernel
On 05/13/2014 02:34 PM, Guenter Roeck wrote:
> On 05/13/2014 02:26 AM, Jiri Slaby wrote:
>> This is the start of the stable review cycle for the 3.12.20 release.
>> There are 182 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Thu May 15 09:25:52 2014
>> Anything received after that time might be too late.
>>
>
> Build results:
> total: 127 pass: 121 skipped: 5 fail: 1
>
> Qemu tests all passed.
>
> Results are as expected. The failing build is unicore32:defconfig;
> this is not a concern, it currently fails for all releases.
>
> Details are available at http://server.roeck-us.net:8010/builders.
On 05/14/2014 04:09 AM, Shuah Khan wrote:
> Compiled and booted on my test system. No dmesg regressions.
Thank you both!
--
js
suse labs
^ permalink raw reply [flat|nested] 186+ messages in thread
* Re: [PATCH 3.12 000/182] 3.12.20-stable review
2014-05-13 9:26 [PATCH 3.12 000/182] 3.12.20-stable review Jiri Slaby
` (182 preceding siblings ...)
2014-05-13 12:34 ` [PATCH 3.12 000/182] 3.12.20-stable review Guenter Roeck
@ 2014-05-14 2:09 ` Shuah Khan
183 siblings, 0 replies; 186+ messages in thread
From: Shuah Khan @ 2014-05-14 2:09 UTC (permalink / raw)
To: Jiri Slaby, stable; +Cc: linux, satoru.takeuchi, linux-kernel, Shuah Khan
On 05/13/2014 03:26 AM, Jiri Slaby wrote:
> This is the start of the stable review cycle for the 3.12.20 release.
> There are 182 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu May 15 09:25:52 2014
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.20-rc1.xz
> and the diffstat can be found below.
>
> thanks,
> js
>
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 186+ messages in thread