2.6.34.2-rc1 stable review
Subsystems (93)
cover 2.6.34.2-rc1 stable review
This is the start of the stable review cycle for the 2.6.34.2 release. There are 205 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.
Responses should be made by August 1, 2010, 18:00:00 UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.34.2-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
Documentation/kernel-parameters.txt | 4 +- Makefile | 2 +- arch/arm/include/asm/atomic.h | 132 ++++---- arch/arm/kernel/kprobes-decode.c | 5 +- arch/arm/kernel/perf_event.c | 2 +- arch/arm/mach-omap2/board-rx51-peripherals.c | 17 +- arch/arm/mach-realview/Kconfig | 2 + arch/arm/mach-realview/include/mach/barriers.h | 8 + arch/ia64/mm/tlb.c | 2 +- arch/mips/alchemy/mtx-1/board_setup.c | 8 +- arch/powerpc/include/asm/cpm.h | 24 ++ arch/powerpc/kernel/irq.c | 5 +- arch/powerpc/sysdev/micropatch.c | 12 +- arch/um/os-Linux/mem.c | 1 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/suspend_32.h | 2 + arch/x86/include/asm/suspend_64.h | 2 + arch/x86/include/asm/system.h | 2 +- arch/x86/kernel/acpi/cstate.c | 9 + arch/x86/kernel/acpi/sleep.c | 2 - arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/cpu/perf_event_amd.c | 4 +- arch/x86/kernel/cpu/perf_event_intel.c | 1 + arch/x86/kernel/hpet.c | 2 +- arch/x86/kernel/i8259.c | 25 +- arch/x86/kernel/kprobes.c | 2 +- arch/x86/kernel/pci-calgary_64.c | 17 +- arch/x86/kernel/traps.c | 11 +- arch/x86/kvm/mmu.c | 5 + arch/x86/kvm/svm.c | 96 +++++- arch/x86/pci/mrst.c | 7 +- arch/x86/power/cpu.c | 4 + block/blk-core.c | 2 +- block/cfq-iosched.c | 13 +- drivers/acpi/acpica/acevents.h | 4 - drivers/acpi/acpica/achware.h | 6 +- drivers/acpi/acpica/evgpe.c | 85 +----- drivers/acpi/acpica/evgpeblk.c | 14 +- drivers/acpi/acpica/evxfevnt.c | 66 +++- drivers/acpi/acpica/hwgpe.c | 94 ++++-- drivers/acpi/button.c | 4 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/sleep.c | 157 +-------- drivers/acpi/system.c | 6 +- drivers/acpi/wakeup.c | 20 +- drivers/ata/ahci.c | 10 + drivers/ata/ata_generic.c | 30 ++- drivers/base/firmware_class.c | 26 +- drivers/char/agp/amd64-agp.c | 27 +- drivers/char/ipmi/ipmi_si_intf.c | 2 +- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm_tis.c | 9 +- drivers/cpufreq/cpufreq.c | 11 +- drivers/edac/Kconfig | 2 +- drivers/edac/amd64_edac.c | 24 +- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- drivers/gpu/drm/i915/i915_dma.c | 4 + drivers/gpu/drm/i915/i915_drv.c | 1 + drivers/gpu/drm/i915/i915_drv.h | 1 + drivers/gpu/drm/i915/i915_gem.c | 13 +- drivers/gpu/drm/i915/i915_irq.c | 16 +- drivers/gpu/drm/i915/i915_reg.h | 69 ++++ drivers/gpu/drm/i915/intel_display.c | 88 ++++-- drivers/gpu/drm/i915/intel_dp.c | 53 +++- drivers/gpu/drm/i915/intel_drv.h | 1 + drivers/gpu/drm/radeon/r100.c | 61 ++-- drivers/gpu/drm/radeon/r200.c | 5 + drivers/gpu/drm/radeon/r300.c | 5 + drivers/gpu/drm/radeon/radeon_atombios.c | 20 +- drivers/gpu/drm/radeon/radeon_connectors.c | 27 +- drivers/gpu/drm/radeon/radeon_encoders.c | 4 +- drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 + drivers/gpu/drm/radeon/radeon_legacy_tv.c | 4 +- drivers/hid/usbhid/hid-core.c | 7 +- drivers/hid/usbhid/usbkbd.c | 1 + drivers/hwmon/coretemp.c | 32 ++- drivers/hwmon/i5k_amb.c | 6 + drivers/hwmon/it87.c | 22 ++ drivers/hwmon/k10temp.c | 14 +- drivers/hwmon/k8temp.c | 12 +- drivers/ide/cmd640.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 +- drivers/input/joystick/gamecon.c | 5 +- drivers/input/keyboard/twl4030_keypad.c | 17 +- drivers/input/serio/i8042-x86ia64io.h | 7 + drivers/isdn/capi/kcapi.c | 6 + drivers/isdn/gigaset/asyncdata.c | 44 +-- drivers/isdn/gigaset/capi.c | 433 +++++++++++++++-------- drivers/isdn/gigaset/common.c | 36 +-- drivers/isdn/gigaset/ev-layer.c | 4 +- drivers/isdn/gigaset/gigaset.h | 38 ++- drivers/isdn/gigaset/i4l.c | 21 ++ drivers/isdn/gigaset/isocdata.c | 72 ++--- drivers/md/raid10.c | 12 +- drivers/media/dvb/dvb-core/dvb_net.c | 12 +- drivers/media/dvb/ttpci/Kconfig | 5 +- drivers/media/video/cx23885/cx23885-i2c.c | 12 +- drivers/media/video/cx88/cx88-i2c.c | 16 +- drivers/media/video/uvc/uvc_driver.c | 25 ++- drivers/media/video/uvc/uvcvideo.h | 4 +- drivers/mfd/88pm860x-i2c.c | 1 - drivers/mfd/max8925-i2c.c | 2 - drivers/mmc/host/sdhci-s3c.c | 20 + drivers/net/3c503.c | 42 ++- drivers/net/bnx2.c | 14 +- drivers/net/cpmac.c | 3 +- drivers/net/dm9000.c | 38 ++- drivers/net/r8169.c | 11 + drivers/net/sky2.c | 20 +- drivers/net/usb/pegasus.h | 2 +- drivers/net/usb/usbnet.c | 5 +- drivers/net/virtio_net.c | 28 +- drivers/net/wireless/ath/ath5k/attach.c | 1 + drivers/net/wireless/ath/ath9k/initvals.h | 8 +- drivers/net/wireless/hostap/hostap_cs.c | 15 +- drivers/net/wireless/hostap/hostap_hw.c | 13 + drivers/net/wireless/hostap/hostap_wlan.h | 2 +- drivers/net/wireless/iwlwifi/iwl-1000.c | 3 + drivers/net/wireless/iwlwifi/iwl-3945.c | 3 + drivers/net/wireless/iwlwifi/iwl-4965.c | 1 + drivers/net/wireless/iwlwifi/iwl-5000.c | 9 + drivers/net/wireless/iwlwifi/iwl-6000.c | 8 + drivers/net/wireless/iwlwifi/iwl-agn.c | 16 + drivers/net/wireless/iwlwifi/iwl-core.c | 93 +++++ drivers/net/wireless/iwlwifi/iwl-core.h | 7 + drivers/net/wireless/iwlwifi/iwl-dev.h | 10 + drivers/net/wireless/iwlwifi/iwl-scan.c | 1 + drivers/net/wireless/iwlwifi/iwl-tx.c | 7 + drivers/net/wireless/iwlwifi/iwl3945-base.c | 16 + drivers/net/wireless/libertas/if_sdio.c | 22 ++ drivers/net/wireless/p54/p54pci.c | 2 + drivers/pci/pci.c | 1 + drivers/pci/pcie/pme/pcie_pme.c | 19 +- drivers/pcmcia/ds.c | 3 +- drivers/rtc/rtc-ds1307.c | 4 +- drivers/scsi/aacraid/commctrl.c | 4 +- drivers/serial/cpm_uart/cpm_uart_core.c | 143 ++++---- drivers/spi/spi_mpc8xxx.c | 22 -- drivers/ssb/driver_chipcommon.c | 3 + drivers/ssb/driver_chipcommon_pmu.c | 17 +- drivers/ssb/pci.c | 46 ++- drivers/ssb/sprom.c | 15 + drivers/usb/core/driver.c | 13 +- drivers/usb/core/hub.c | 3 +- drivers/usb/core/quirks.c | 7 + drivers/usb/gadget/u_serial.c | 16 +- drivers/usb/host/ehci-mxc.c | 13 +- drivers/usb/host/xhci-mem.c | 5 +- drivers/usb/misc/sisusbvga/sisusb.c | 5 +- drivers/usb/musb/musb_core.c | 9 +- drivers/usb/musb/musb_core.h | 6 +- drivers/usb/musb/tusb6010.c | 13 - drivers/usb/serial/ftdi_sio.c | 9 + drivers/usb/serial/ftdi_sio_ids.h | 15 + drivers/usb/serial/option.c | 4 + drivers/usb/serial/sierra.c | 1 + drivers/virtio/virtio_pci.c | 3 + drivers/virtio/virtio_ring.c | 7 +- fs/btrfs/ioctl.c | 4 +- fs/cifs/cifsfs.c | 6 +- fs/cifs/dns_resolve.c | 69 ++++ fs/cifs/dns_resolve.h | 4 +- fs/cifs/inode.c | 4 + fs/cifs/sess.c | 10 +- fs/ecryptfs/messaging.c | 17 +- fs/nfs/nfs4xdr.c | 4 +- fs/nfs/super.c | 22 +- fs/ocfs2/aops.c | 52 +-- fs/ocfs2/file.c | 118 +++++-- fs/ocfs2/xattr.c | 84 +++-- fs/splice.c | 9 +- fs/sysv/ialloc.c | 6 +- fs/xfs/xfs_dfrag.c | 5 +- include/acpi/acexcep.h | 2 +- include/acpi/actypes.h | 1 + include/acpi/processor.h | 3 +- include/linux/acpi.h | 1 - include/linux/compiler-gcc.h | 10 +- include/linux/compiler-gcc4.h | 4 + include/linux/ethtool.h | 2 + include/linux/fb.h | 4 +- include/linux/firmware.h | 1 + include/linux/mmc/sdio.h | 2 + include/linux/pci_ids.h | 1 + include/linux/ssb/ssb.h | 1 + include/linux/ssb/ssb_driver_chipcommon.h | 2 + include/linux/ssb/ssb_regs.h | 3 +- include/math-emu/op-common.h | 2 +- include/net/sock.h | 7 +- kernel/early_res.c | 6 + kernel/futex.c | 17 +- kernel/irq/manage.c | 3 + kernel/module.c | 4 +- kernel/perf_event.c | 18 +- kernel/sched.c | 9 +- mm/bootmem.c | 24 +- mm/page_alloc.c | 8 + net/bridge/br_fdb.c | 6 +- net/core/dev.c | 7 +- net/core/ethtool.c | 43 ++- net/core/neighbour.c | 5 +- net/core/skbuff.c | 1 + net/dccp/input.c | 6 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_output.c | 12 +- net/ipv6/addrconf.c | 7 +- net/ipv6/ndisc.c | 2 +- net/ipv6/netfilter/ip6t_REJECT.c | 6 +- net/ipv6/route.c | 2 +- net/mac80211/scan.c | 21 +- net/mac80211/work.c | 28 +- net/netfilter/ipvs/ip_vs_conn.c | 4 + net/sunrpc/xprtsock.c | 38 ++- scripts/mod/modpost.c | 2 +- sound/pci/hda/hda_codec.c | 27 ++ sound/pci/hda/hda_codec.h | 5 +- sound/pci/hda/patch_hdmi.c | 13 + sound/pci/hda/patch_nvhdmi.c | 3 + sound/pci/hda/patch_realtek.c | 23 +- sound/soc/codecs/wm8776.c | 1 - sound/soc/fsl/mpc5200_dma.h | 2 +- tools/perf/util/callchain.h | 3 + virt/kvm/ioapic.c | 3 +- 224 files changed, 2595 insertions(+), 1338 deletions(-)
PATCH 1/205 virtio-pci: disable msi at startup
2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit b03214d559471359e2a85ae256686381d0672f29 upstream.
virtio-pci resets the device at startup by writing to the status register, but this does not clear the pci config space, specifically msi enable status which affects register layout.
This breaks things like kdump when they try to use e.g. virtio-blk.
Fix by forcing msi off at startup. Since pci.c already has
a routine to do this, we export and use it instead of duplicating code.
--- drivers/pci/pci.c | 1 + drivers/virtio/virtio_pci.c | 3 +++ 2 files changed, 4 insertions(+)
drivers/pci/pci.c +1 -0
@@ -2294,6 +2294,7 @@ void pci_msi_off(struct pci_dev *dev)pci_write_config_word (dev, pos +PCI_MSIX_FLAGS , control); } } +EXPORT_SYMBOL_GPL (pci_msi_off);#ifndef HAVE_ARCH_PCI_SET_DMA_MAX_SEGMENT_SIZE int pci_set_dma_max_seg_size (struct pci_dev *dev,unsigned int size)
drivers/virtio/virtio_pci.c +3 -0
@@ -636,6 +636,9 @@ static int __devinit virtio_pci_probe(stINIT_LIST_HEAD (&vp_dev->virtqueues);spin_lock_init (&vp_dev->lock); +/* Disable MSI/MSIX to bring device to a known good state. */ +pci_msi_off (pci_dev); +/* enable the device */ err =pci_enable_device (pci_dev);if (err)
PATCH 2/205 virtio: return ENOMEM on out of memory
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 686d363786a53ed28ee875b84ef24e6d5126ef6f upstream.
add_buf returns ring size on out of memory, this is not what devices expect.
--- drivers/virtio/virtio_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/virtio/virtio_ring.c +1 -1
@@ -118,7 +118,7 @@ static int vring_add_indirect(struct vri desc =kmalloc ((out + in) *sizeof (struct vring_desc ),GFP_ATOMIC );if (!desc) -return vq->vring.num; +return -ENOMEM ;/* Transfer entries from the sg list into the indirect page */ for (i =0 ; i < out; i++) {
PATCH 3/205 virtio_net: do not reschedule rx refill forever
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 1788f49548860fa1c861ee3454d47b466c877e43 upstream.
We currently fill all of RX ring, then add_buf returns ENOSPC, which gets mis-detected as an out of memory condition and causes us to reschedule the work, and so on forever. Fix this by oom = err == -ENOMEM;
--- drivers/net/virtio_net.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/virtio_net.c +3 -4
@@ -417,7 +417,7 @@ static int add_recvbuf_mergeable(structstatic bool try_fill_recv (struct virtnet_info *vi,gfp_t gfp) {int err; -bool oom = false; +bool oom; do { if (vi->mergeable_rx_bufs)
@@ -427,10 +427,9 @@ static bool try_fill_recv(struct virtnetelse err =add_recvbuf_small (vi, gfp); -if (err <0 ) { - oom = true; + oom = err == -ENOMEM ; +if (err <0 )break ; - } ++vi->num; }while (err >0 );if (unlikely (vi->num > vi->max))
PATCH 4/205 bridge: fdb cleanup runs too often
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: stephen hemminger <[email protected]>
[ Upstream commit 25442e06d20aaba7d7b16438078a562b3e4cf19b ]
It is common in end-node, non STP bridges to set forwarding delay to zero; which causes the forwarding database cleanup to run every clock tick. Change to run only as soon as needed or at next ageing timer interval which ever is sooner.
Use round_jiffies_up macro rather than attempting round up by changing value.
--- net/bridge/br_fdb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/bridge/br_fdb.c +2 -4
@@ -128,7 +128,7 @@ void br_fdb_cleanup(unsigned long _data) {struct net_bridge *br = (struct net_bridge *)_data;unsigned long delay =hold_time (br); -unsigned long next_timer = jiffies + br->forward_delay; +unsigned long next_timer = jiffies + br->ageing_time;int i;spin_lock_bh (&br->hash_lock);
@@ -149,9 +149,7 @@ void br_fdb_cleanup(unsigned long _data) }spin_unlock_bh (&br->hash_lock); -/* Add HZ/4 to ensure we round the jiffies upwards to be after the next -* timer, otherwise we might round down and will have no-op run. */ -mod_timer (&br->gc_timer,round_jiffies (next_timer +HZ /4 )); +mod_timer (&br->gc_timer,round_jiffies_up (next_timer)); }/* Completely flush all dynamic entries in forwarding database.*/
PATCH 5/205 net/dccp: expansion of error code size
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yoichi Yuasa <[email protected]>
[ Upstream commit d9b52dc6fd1fbb2bad645cbc86a60f984c1cb179 ]
Because MIPS's EDQUOT value is 1133(0x46d). It's larger than u8.
--- net/dccp/input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/dccp/input.c +3 -3
@@ -124,9 +124,9 @@ static int dccp_rcv_closereq(struct sockreturn queued; } -static u8 dccp_reset_code_convert (const u8 code) +static u16 dccp_reset_code_convert (const u8 code) { -const u8 error_code[] = { +const u16 error_code[] = { [DCCP_RESET_CODE_CLOSED ] =0 ,/* normal termination */ [DCCP_RESET_CODE_UNSPECIFIED ] =0 ,/* nothing known */ [DCCP_RESET_CODE_ABORTED ] =ECONNRESET ,
@@ -148,7 +148,7 @@ static u8 dccp_reset_code_convert(conststatic void dccp_rcv_reset (struct sock *sk,struct sk_buff *skb) { -u8 err =dccp_reset_code_convert (dccp_hdr_reset (skb)->dccph_reset_code); +u16 err =dccp_reset_code_convert (dccp_hdr_reset (skb)->dccph_reset_code); sk->sk_err = err;
PATCH 6/205 gro: Fix bogus gso_size on the first fraglist entry
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 622e0ca1cd4d459f5af4f2c65f4dc0dd823cb4c3 ]
When GRO produces fraglist entries, and the resulting skb hits an interface that is incapable of TSO but capable of FRAGLIST, we end up producing a bogus packet with gso_size non-zero.
This was reported in the field with older versions of KVM that did not set the TSO bits on tuntap.
This patch fixes that.
--- net/core/skbuff.c | 1 + 1 file changed, 1 insertion(+)
net/core/skbuff.c +1 -0
@@ -2729,6 +2729,7 @@ int skb_gro_receive(struct sk_buff **hea *NAPI_GRO_CB (nskb) = *NAPI_GRO_CB (p);skb_shinfo (nskb)->frag_list = p;skb_shinfo (nskb)->gso_size = pinfo->gso_size; + pinfo->gso_size =0 ;skb_header_release (p); nskb->prev = p;
PATCH 7/205 IPv6: fix Mobile IPv6 regression
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Brian Haley <[email protected]>
[ Upstream commit 6057fd78a8dcce6269f029b967051d5a2e9b0895 ]
Commit f4f914b5 (net: ipv6 bind to device issue) caused a regression with Mobile IPv6 when it changed the meaning of fl->oif to become a strict requirement of the route lookup. Instead, only force strict mode when sk->sk_bound_dev_if is set on the calling socket, getting the intended behavior and fixing the regression.
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -815,7 +815,7 @@ struct dst_entry * ip6_route_output(stru {int flags =0 ; -if (fl->oif ||rt6_need_strict (&fl->fl6_dst)) +if ((sk && sk->sk_bound_dev_if) ||rt6_need_strict (&fl->fl6_dst)) flags |=RT6_LOOKUP_F_IFACE ;if (!ipv6_addr_any (&fl->fl6_src))
PATCH 8/205 pegasus: fix USB device ID for ETX-US2
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tadashi Abe <[email protected]>
[ Upstream commit 95718c1c25370b2c85061a4d8dfab2831b3ad280 ]
USB device ID definition for I-O Data ETX-US2 is wrong. Correct ID is 0x093a. Here's snippet from /proc/bus/usb/devices;
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=04bb ProdID=093a Rev= 1.01 S: Manufacturer=I-O DATA DEVICE,INC. S: Product=I-O DATA ETX2-US2 S: SerialNumber=A26427 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=224mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=pegasus E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=125us
This patch enables pegasus driver to work fine with ETX-US2.
--- drivers/net/usb/pegasus.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/pegasus.h +1 -1
@@ -256,7 +256,7 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR DEFAULT_GPIO_RESET ) PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913, DEFAULT_GPIO_RESET | PEGASUS_II ) -PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a, +PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x093a, DEFAULT_GPIO_RESET | PEGASUS_II )PEGASUS_DEV ("Kingston KNU101TX Ethernet" ,VENDOR_KINGSTON ,0x000a ,DEFAULT_GPIO_RESET )
PATCH 9/205 r8169: fix random mdio_write failures
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Timo Teräs <[email protected]>
[ Upstream commit 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e ]
Some configurations need delay between the "write completed" indication and new write to work reliably.
Realtek driver seems to use longer delay when polling the "write complete" bit, so it waits long enough between writes with high probability (but could probably break too). This patch adds a new udelay to make sure we wait unconditionally some time after the write complete indication.
This caused a regression with XID 18000000 boards when the board specific phy configuration writing many mdio registers was added in commit 2e955856ff (r8169: phy init for the 8169scd). Some of the configration mdio writes would almost always fail, and depending on failure might leave the PHY in non-working state.
--- drivers/net/r8169.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/r8169.c +5 -0
@@ -557,6 +557,11 @@ static void mdio_write(void __iomem *ioabreak ;udelay (25 ); } +/* +* Some configurations require a small delay even after the write +* completed indication or the next write might fail. +*/ +udelay (25 ); }static int mdio_read (void __iomem *ioaddr,int reg_addr)
PATCH 10/205 r8169: fix mdio_read and update mdio_write according to hw specs
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Timo Teräs <[email protected]>
[ Upstream commit 81a95f049962ec20a9aed888e676208b206f0f2e ]
Realtek confirmed that a 20us delay is needed after mdio_read and mdio_write operations. Reduce the delay in mdio_write, and add it to mdio_read too. Also add a comment that the 20us is from hw specs.
--- drivers/net/r8169.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/r8169.c +9 -3
@@ -558,10 +558,10 @@ static void mdio_write(void __iomem *ioaudelay (25 ); }/* -* Some configurations require a small delay even after the write -* completed indication or the next write might fail. +* According to hardware specs a 20us delay is required after write +* complete indication, but before sending next command. */ -udelay (25 ); +udelay (20 ); }static int mdio_read (void __iomem *ioaddr,int reg_addr)
@@ -581,6 +581,12 @@ static int mdio_read(void __iomem *ioadd }udelay (25 ); } +/* +* According to hardware specs a 20us delay is required after read +* complete indication, but before sending next command. +*/ +udelay (20 ); +return value; }
PATCH 11/205 tcp: tcp_synack_options() fix
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit de213e5eedecdfb1b1eea7e6be28bc64cac5c078 ]
Commit 33ad798c924b4a (tcp: options clean up) introduced a problem if MD5+SACK+timestamps were used in initial SYN message.
Some stacks (old linux for example) try to negotiate MD5+SACK+TSTAMP sessions, but since 40 bytes of tcp options space are not enough to store all the bits needed, we chose to disable timestamps in this case.
We send a SYN-ACK _without_ timestamp option, but socket has timestamps enabled and all further outgoing messages contain a TS block, all with the initial timestamp of the remote peer.
Fix is to really disable timestamps option for the whole session.
--- net/ipv4/tcp_output.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/ipv4/tcp_output.c +4 -5
@@ -667,7 +667,6 @@ static unsigned tcp_synack_options(strucu8 cookie_plus = (xvp !=NULL && !xvp->cookie_out_never) ? xvp->cookie_plus :0 ; -bool doing_ts = ireq->tstamp_ok;#ifdef CONFIG_TCP_MD5SIG *md5 =tcp_rsk (req)->af_specific->md5_lookup (sk, req);
@@ -680,7 +679,7 @@ static unsigned tcp_synack_options(struc* rather than TS in order to fit in better with old, * buggy kernels, but that was deemed to be unnecessary. */ - doing_ts &= !ireq->sack_ok; + ireq->tstamp_ok &= !ireq->sack_ok; }#else *md5 =NULL ;
@@ -695,7 +694,7 @@ static unsigned tcp_synack_options(struc opts->options |=OPTION_WSCALE ; remaining -=TCPOLEN_WSCALE_ALIGNED ; } -if (likely (doing_ts)) { +if (likely (ireq->tstamp_ok)) { opts->options |=OPTION_TS ; opts->tsval =TCP_SKB_CB (skb)->when; opts->tsecr = req->ts_recent;
@@ -703,7 +702,7 @@ static unsigned tcp_synack_options(struc }if (likely (ireq->sack_ok)) { opts->options |=OPTION_SACK_ADVERTISE ; -if (unlikely (!doing_ts)) +if (unlikely (!ireq->tstamp_ok)) remaining -=TCPOLEN_SACKPERM_ALIGNED ; }
@@ -711,7 +710,7 @@ static unsigned tcp_synack_options(struc* If the <SYN> options fit, the same options should fit now! */ if (*md5 ==NULL && - doing_ts && + ireq->tstamp_ok && cookie_plus >TCPOLEN_COOKIE_BASE ) {int need = cookie_plus;/* has TCPOLEN_COOKIE_BASE */
PATCH 12/205 tcp: use correct net ns in cookie_v4_check()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c44649216522cd607a4027d2ebf4a8147d3fa94c ]
Its better to make a route lookup in appropriate namespace.
--- net/ipv4/syncookies.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/syncookies.c +1 -1
@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock { .sport = th->dest, .dport = th->source } } };security_req_classify_flow (req, &fl); -if (ip_route_output_key (&init_net, &rt, &fl)) { +if (ip_route_output_key (sock_net (sk), &rt, &fl)) {reqsk_free (req); goto out; }
PATCH 13/205 usbnet: Set parent device early for netdev_printk()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ben Hutchings <[email protected]>
[ Upsteam commit 0dacca73a3ddefa6cb8a7e0282f938e01faa1a64 ]
netdev_printk() follows the net_device's parent device pointer, so we must set that earlier than we previously did.
--- drivers/net/usb/usbnet.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/usb/usbnet.c +3 -2
@@ -1290,6 +1290,9 @@ usbnet_probe (struct usb_interface *udev goto out; } +/* netdev_printk() needs this so do it as early as possible */ +SET_NETDEV_DEV (net, &udev->dev); + dev =netdev_priv (net); dev->udev = xdev; dev->intf = udev;
@@ -1374,8 +1377,6 @@ usbnet_probe (struct usb_interface *udev dev->rx_urb_size = dev->hard_mtu; dev->maxpacket =usb_maxpacket (dev->udev, dev->out,1 ); -SET_NETDEV_DEV (net, &udev->dev); -if ((dev->driver_info->flags &FLAG_WLAN ) !=0 )SET_NETDEV_DEVTYPE (net, &wlan_type);if ((dev->driver_info->flags &FLAG_WWAN ) !=0 )
PATCH 14/205 fix mis-applied upstream commit ac9721f3f54b27a16c7e1afb2481e7ee95a70318
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jan Beulich <[email protected]>
For some reason one of the changes to sys_perf_event_open() got mis-applied, thus breaking (at least) error handling paths (pointed out by means of a compiler warning).
--- kernel/perf_event.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
kernel/perf_event.c +9 -9
@@ -4870,6 +4870,15 @@ SYSCALL_DEFINE5(perf_event_open,if (event_fd <0 )return event_fd; +/* +* Get the target context (task or percpu): +*/ + ctx =find_get_context (pid, cpu); +if (IS_ERR (ctx)) { + err =PTR_ERR (ctx); + goto err_fd; + } +if (group_fd !=-1 ) { group_leader =perf_fget_light (group_fd, &fput_needed);if (IS_ERR (group_leader)) {
@@ -4884,15 +4893,6 @@ SYSCALL_DEFINE5(perf_event_open, }/* -* Get the target context (task or percpu): -*/ - ctx =find_get_context (pid, cpu); -if (IS_ERR (ctx)) { - err =PTR_ERR (ctx); - goto err_fd; - } - -/* * Look up the group leader (we will attach this event to it): */ if (group_leader) {
PATCH 15/205 ssb: Handle Netbook devices where the SPROM address is changed
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Christoph Fritz <[email protected]>
For some Netbook computers with Broadcom BCM4312 wireless interfaces, the SPROM has been moved to a new location. When the ssb driver tries to read the old location, the systems hangs when trying to read a non-existent location. Such freezes are particularly bad as they do not log the failure.
This patch is modified from commit da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other mainline changes so that it can be applied to stable 2.6.34.Y.
--- drivers/ssb/driver_chipcommon.c | 3 + drivers/ssb/driver_chipcommon_pmu.c | 17 ++++------- drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++---- drivers/ssb/sprom.c | 15 +++++++++ include/linux/ssb/ssb.h | 1 include/linux/ssb/ssb_driver_chipcommon.h | 2 + include/linux/ssb/ssb_regs.h | 3 + 7 files changed, 70 insertions(+), 17 deletions(-)
drivers/ssb/driver_chipcommon.c +3 -0
@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip {if (!cc->dev)return ;/* We don't have a ChipCommon */ +if (cc->dev->id.revision >=11 ) + cc->status =chipco_read32 (cc,SSB_CHIPCO_CHIPSTAT ); + ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);ssb_pmu_init (cc);chipco_powercontrol_init (cc);ssb_chipco_set_clockmode (cc,SSB_CLKMODE_FAST );
drivers/ssb/driver_chipcommon_pmu.c +7 -10
@@ -502,9 +502,9 @@ static void ssb_pmu_resources_init(strucchipco_write32 (cc,SSB_CHIPCO_PMU_MAXRES_MSK , max_msk); } +/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */ void ssb_pmu_init (struct ssb_chipcommon *cc) { -struct ssb_bus *bus = cc->dev->bus;u32 pmucap;if (!(cc->capabilities &SSB_CHIPCO_CAP_PMU ))
@@ -516,15 +516,12 @@ void ssb_pmu_init(struct ssb_chipcommon ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev, pmucap); -if (cc->pmu.rev >=1 ) { -if ((bus->chip_id ==0x4325 ) && (bus->chip_rev <2 )) { -chipco_mask32 (cc,SSB_CHIPCO_PMU_CTL , - ~SSB_CHIPCO_PMU_CTL_NOILPONW ); - }else { -chipco_set32 (cc,SSB_CHIPCO_PMU_CTL , -SSB_CHIPCO_PMU_CTL_NOILPONW ); - } - } +if (cc->pmu.rev ==1 ) +chipco_mask32 (cc,SSB_CHIPCO_PMU_CTL , + ~SSB_CHIPCO_PMU_CTL_NOILPONW ); +else +chipco_set32 (cc,SSB_CHIPCO_PMU_CTL , +SSB_CHIPCO_PMU_CTL_NOILPONW );ssb_pmu_pll_init (cc);ssb_pmu_resources_init (cc); }
drivers/ssb/pci.c +40 -6
89 lines not on this page · raw message
drivers/ssb/sprom.c +15 -0
@@ -176,3 +176,18 @@ const struct ssb_sprom *ssb_get_fallback {return fallback_sprom; } + +/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */ +bool ssb_is_sprom_available (struct ssb_bus *bus) +{ +/* status register only exists on chipcomon rev >= 11 and we need check +for >= 31 only */ +/* this routine differs from specs as we do not access SPROM directly +on PCMCIA */ +if (bus->bustype ==SSB_BUSTYPE_PCI && + bus->chipco.dev &&/* can be unavailible! */ + bus->chipco.dev->id.revision >=31 ) +return bus->chipco.capabilities &SSB_CHIPCO_CAP_SPROM ; + +return true; +}
include/linux/ssb/ssb.h +1 -0
@@ -306,6 +306,7 @@ struct ssb_bus {u16 chip_id;u16 chip_rev;u16 sprom_size;/* number of words in sprom */ +u16 sprom_offset;u8 chip_package;/* List of devices (cores) on the backplane. */
include/linux/ssb/ssb_driver_chipcommon.h +2 -0
@@ -46,6 +46,7 @@#define SSB_PLLTYPE_7 0x00038000/* 25Mhz, 4 dividers */ #define SSB_CHIPCO_CAP_PCTL 0x00040000/* Power Control */ #define SSB_CHIPCO_CAP_OTPS 0x00380000/* OTP size */ +#define SSB_CHIPCO_CAP_SPROM 0x40000000/* SPROM present */ #define SSB_CHIPCO_CAP_OTPS_SHIFT 19#define SSB_CHIPCO_CAP_OTPS_BASE 5#define SSB_CHIPCO_CAP_JTAGM 0x00400000/* JTAG master present */
@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu {struct ssb_chipcommon {struct ssb_device *dev;u32 capabilities; +u32 status;/* Fast Powerup Delay constant */ u16 fast_pwrup_delay;struct ssb_chipcommon_pmu pmu;
include/linux/ssb/ssb_regs.h +2 -1
@@ -170,7 +170,8 @@#define SSB_SPROMSIZE_WORDS_R4 220#define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))#define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16)) -#define SSB_SPROM_BASE 0x1000 +#define SSB_SPROM_BASE1 0x1000 +#define SSB_SPROM_BASE31 0x0800#define SSB_SPROM_REVISION 0x107E#define SSB_SPROM_REVISION_REV 0x00FF/* SPROM Revision number */ #define SSB_SPROM_REVISION_CRC 0xFF00/* SPROM CRC8 value */
PATCH 16/205 hwmon: (k8temp) Bypass core swapping on single-core processors
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit cd4de21f7e65a8cd04860f5661b3c18648ee52a1 upstream.
Commit a2e066bba2aad6583e3ff648bf28339d6c9f0898 introduced core swapping for CPU models 64 and later. I recently had a report about a Sempron 3200+, model 95, for which this patch broke temperature reading. It happens that this is a single-core processor, so the effect of the swapping was to read a temperature value for a core that didn't exist, leading to an incorrect value (-49 degrees C.)
Disabling core swapping on singe-core processors should fix this.
Additional comment from Andreas:
The BKDG says
Thermal Sensor Core Select (ThermSenseCoreSel)-Bit 2. This bit selects the CPU whose temperature is reported in the CurTemp field. This bit only applies to dual core processors. For single core processors CPU0 Thermal Sensor is always selected.
k8temp_probe() correctly detected that SEL_CORE can't be used on single core CPU. Thus k8temp did never update the temperature values stored in temp[1][x] and -49 degrees was reported. For single core CPUs we must use the values read into temp[0][x].
--- drivers/hwmon/k8temp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/k8temp.c +1 -1
@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device *int temp;struct k8temp_data *data =k8temp_update_device (dev); -if (data->swap_core_select) +if (data->swap_core_select && (data->sensorsp &SEL_CORE )) core = core ?0 :1 ; temp =TEMP_FROM_REG (data->temp[core][place]) + data->temp_offset;
PATCH 17/205 hwmon: (k8temp) Fix temperature reporting for ASB1 processor revisions
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andreas Herrmann <[email protected]>
commit d535bad90dad4eb42ec6528043fcfb53627d4f89 upstream.
Reported temperature for ASB1 CPUs is too high.
Add ASB1 CPU revisions (these are also non-desktop variants) to the list of CPUs for which the temperature fixup is not required.
Example: (from LENOVO ThinkPad Edge 13, 01972NG, system was idle)
Current kernel reports
$ sensors k8temp-pci-00c3 Adapter: PCI adapter Core0 Temp: +74.0 C Core0 Temp: +70.0 C Core1 Temp: +69.0 C Core1 Temp: +70.0 C
With this patch I have
$ sensors k8temp-pci-00c3 Adapter: PCI adapter Core0 Temp: +54.0 C Core0 Temp: +51.0 C Core1 Temp: +48.0 C Core1 Temp: +49.0 C
--- drivers/hwmon/k8temp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/hwmon/k8temp.c +6 -4
@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct }if ((model >=0x69 ) && - !(model ==0xc1 || model ==0x6c || model ==0x7c )) { + !(model ==0xc1 || model ==0x6c || model ==0x7c || + model ==0x6b || model ==0x6f || model ==0x7f )) {/* -* RevG desktop CPUs (i.e. no socket S1G1 parts) -* need additional offset, otherwise reported -* temperature is below ambient temperature +* RevG desktop CPUs (i.e. no socket S1G1 or +* ASB1 parts) need additional offset, +* otherwise reported temperature is below +* ambient temperature */ data->temp_offset =21000 ; }
PATCH 18/205 hwmon: (i5k_amb) Fix sysfs attribute for lockdep
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: KAMEZAWA Hiroyuki <[email protected]>
commit 0e6c7870856c7fb4ee054d28ac253b2d3d0c7e36 upstream.
i5k_amb.ko uses dynamically allocated memory (by kmalloc) for attributes passed to sysfs. So, sysfs_attr_init() should be called for working happy with lockdep.
--- drivers/hwmon/i5k_amb.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwmon/i5k_amb.c +6 -0
@@ -289,6 +289,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.attr.mode =S_IRUGO ; iattr->s_attr.dev_attr.show = show_label; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
@@ -303,6 +304,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.attr.mode =S_IRUGO ; iattr->s_attr.dev_attr.show = show_amb_temp; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
@@ -318,6 +320,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.show = show_amb_min; iattr->s_attr.dev_attr.store = store_amb_min; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
@@ -333,6 +336,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.show = show_amb_mid; iattr->s_attr.dev_attr.store = store_amb_mid; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
@@ -348,6 +352,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.show = show_amb_max; iattr->s_attr.dev_attr.store = store_amb_max; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
@@ -362,6 +367,7 @@ static int __devinit i5k_amb_hwmon_init( iattr->s_attr.dev_attr.attr.mode =S_IRUGO ; iattr->s_attr.dev_attr.show = show_amb_alarm; iattr->s_attr.index = k; +sysfs_attr_init (&iattr->s_attr.dev_attr.attr); res =device_create_file (&pdev->dev, &iattr->s_attr.dev_attr);if (res)
PATCH 19/205 hwmon: (k10temp) Do not blacklist known working CPU models
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 upstream.
When detecting AM2+ or AM3 socket with DDR2, only blacklist cores which are known to exist in AM2+ format.
--- drivers/hwmon/k10temp.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/hwmon/k10temp.c +12 -2
@@ -112,11 +112,21 @@ static bool __devinit has_erratum_319(stif (pkg_type !=CPUID_PKGTYPE_AM2R2_AM3 )return false; -/* Differentiate between AM2+ (bad) and AM3 (good) */ +/* DDR3 memory implies socket AM3, which is good */ pci_bus_read_config_dword (pdev->bus,PCI_DEVFN (PCI_SLOT (pdev->devfn),2 ),REG_DCT0_CONFIG_HIGH , ®_dram_cfg); -return !(reg_dram_cfg &DDR3_MODE ); +if (reg_dram_cfg &DDR3_MODE ) +return false; + +/* +* Unfortunately it is possible to run a socket AM3 CPU with DDR2 +* memory. We blacklist all the cores which do exist in socket AM2+ +* format. It still isn't perfect, as RB-C2 cores exist in both AM2+ +* and AM3 formats, but that's the best we can do. +*/ +return boot_cpu_data.x86_model <4 || + (boot_cpu_data.x86_model ==4 && boot_cpu_data.x86_mask <=2 ); } static int __devinit k10temp_probe(struct pci_dev *pdev,
PATCH 20/205 hwmon: (coretemp) Properly label the sensors
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c upstream.
Don't assume that CPU entry number and core ID always match. It worked in the simple cases (single CPU, no HT) but fails on multi-CPU systems.
--- drivers/hwmon/coretemp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hwmon/coretemp.c +5 -1
@@ -53,6 +53,7 @@ struct coretemp_data {struct mutex update_lock;const char *name;u32 id; +u16 core_id;char valid;/* zero until following fields are valid */ unsigned long last_updated;/* in jiffies */ int temp;
@@ -75,7 +76,7 @@ static ssize_t show_name(struct device *if (attr->index ==SHOW_NAME ) ret =sprintf (buf,"%s\n" , data->name);else /* show label */ - ret =sprintf (buf,"Core %d\n" , data->id); + ret =sprintf (buf,"Core %d\n" , data->core_id);return ret; }
@@ -255,6 +256,9 @@ static int __devinit coretemp_probe(stru } data->id = pdev->id; +#ifdef CONFIG_SMP + data->core_id = c->cpu_core_id; +#endif data->name ="coretemp" ;mutex_init (&data->update_lock);
PATCH 21/205 hwmon: (coretemp) Skip duplicate CPU entries
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit d883b9f0977269d519469da72faec6a7f72cb489 upstream.
On hyper-threaded CPUs, each core appears twice in the CPU list. Skip the second entry to avoid duplicate sensors.
--- drivers/hwmon/coretemp.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-)
drivers/hwmon/coretemp.c +25 -1
@@ -356,6 +356,10 @@ struct pdev_entry {struct list_head list;struct platform_device *pdev;unsigned int cpu; +#ifdef CONFIG_SMP +u16 phys_proc_id; +u16 cpu_core_id; +#endif };static LIST_HEAD (pdev_list);
@@ -366,6 +370,22 @@ static int __cpuinit coretemp_device_addint err;struct platform_device *pdev;struct pdev_entry *pdev_entry; +#ifdef CONFIG_SMP +struct cpuinfo_x86 *c = &cpu_data (cpu); +#endif + +mutex_lock (&pdev_list_mutex); + +#ifdef CONFIG_SMP +/* Skip second HT entry of each core */ +list_for_each_entry (pdev_entry, &pdev_list, list) { +if (c->phys_proc_id == pdev_entry->phys_proc_id && + c->cpu_core_id == pdev_entry->cpu_core_id) { + err =0 ;/* Not an error */ + goto exit; + } + } +#endif pdev =platform_device_alloc (DRVNAME , cpu);if (!pdev) {
@@ -389,7 +409,10 @@ static int __cpuinit coretemp_device_add pdev_entry->pdev = pdev; pdev_entry->cpu = cpu; -mutex_lock (&pdev_list_mutex); +#ifdef CONFIG_SMP + pdev_entry->phys_proc_id = c->phys_proc_id; + pdev_entry->cpu_core_id = c->cpu_core_id; +#endif list_add_tail (&pdev_entry->list, &pdev_list);mutex_unlock (&pdev_list_mutex);
@@ -400,6 +423,7 @@ exit_device_free: exit_device_put:platform_device_put (pdev); exit: +mutex_unlock (&pdev_list_mutex);return err; }
PATCH 22/205 hwmon: (it87) Fix in7 on IT8720F
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b upstream.
The IT8720F has no VIN7 pin, so VCCH should always be routed internally to VIN7 with an internal divider. Curiously, there still is a configuration bit to control this, which means it can be set incorrectly. And even more curiously, many boards out there are improperly configured, even though the IT8720F datasheet claims that the internal routing of VCCH to VIN7 is the default setting. So we force the internal routing in this case.
It turns out that all boards with the wrong setting are from Gigabyte, so I suspect a BIOS bug. But it's easy enough to workaround in the driver, so let's do it.
--- drivers/hwmon/it87.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/hwmon/it87.c +22 -0
@@ -80,6 +80,13 @@ superio_inb(int reg)return inb (VAL ); } +static inline void +superio_outb (int reg,int val) +{ +outb (reg,REG ); +outb (val,VAL ); +} +static int superio_inw (int reg) {int val;
@@ -1517,6 +1524,21 @@ static int __init it87_find(unsigned sho sio_data->vid_value =superio_inb (IT87_SIO_VID_REG ); reg =superio_inb (IT87_SIO_PINX2_REG ); +/* +* The IT8720F has no VIN7 pin, so VCCH should always be +* routed internally to VIN7 with an internal divider. +* Curiously, there still is a configuration bit to control +* this, which means it can be set incorrectly. And even +* more curiously, many boards out there are improperly +* configured, even though the IT8720F datasheet claims +* that the internal routing of VCCH to VIN7 is the default +* setting. So we force the internal routing in this case. +*/ +if (sio_data->type == it8720 && !(reg & (1 <<1 ))) { + reg |= (1 <<1 ); +superio_outb (IT87_SIO_PINX2_REG , reg); +pr_notice ("it87: Routing internal VCCH to in7\n" ); + }if (reg & (1 <<0 ))pr_info ("it87: in3 is VCC (+5V)\n" );if (reg & (1 <<1 ))
PATCH 23/205 cifs: remove bogus first_time check in NTLMv2 session setup code
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeff Layton <[email protected]>
commit 8a224d489454b7457105848610cfebebdec5638d upstream.
This bug appears to be the result of a cut-and-paste mistake from the NTLMv1 code. The function to generate the MAC key was commented out, but not the conditional above it. The conditional then ended up causing the session setup key not to be copied to the buffer unless this was the first session on the socket, and that made all but the first NTLMv2 session setup fail.
Fix this by removing the conditional and all of the commented clutter that made it difficult to see.
--- fs/cifs/sess.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
fs/cifs/sess.c +1 -9
@@ -723,15 +723,7 @@ ssetup_ntlmssp_authenticate:/* calculate session key */ setup_ntlmv2_rsp (ses, v2_sess_key, nls_cp); -if (first_time)/* should this be moved into common code -with similar ntlmv2 path? */ -/* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key, -response BB FIXME, v2_sess_key); */ - -/* copy session key */ - -/* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE); -bcc_ptr += LM2_SESS_KEY_SIZE; */ +/* FIXME: calculate MAC key */ memcpy (bcc_ptr, (char *)v2_sess_key,sizeof (struct ntlmv2_resp )); bcc_ptr +=sizeof (struct ntlmv2_resp );
PATCH 24/205 cifs: dont attempt busy-file rename unless its in same directory
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeff Layton <[email protected]>
commit ed0e3ace576d297a5c7015401db1060bbf677b94 upstream.
Busy-file renames don't actually work across directories, so we need to limit this code to renames within the same dir.
This fixes the bug detailed here:
https://bugzilla.redhat.com/show_bug.cgi?id=591938
--- fs/cifs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/cifs/inode.c +4 -0
@@ -1389,6 +1389,10 @@ cifs_do_rename(int xid, struct dentry *fif (rc ==0 || rc != -ETXTBSY )return rc; +/* open-file renames don't work across directories */ +if (to_dentry->d_parent != from_dentry->d_parent) +return rc; +/* open the file to be renamed -- we need DELETE perms */ rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE, CREATE_NOT_DIR, &srcfid, &oplock, NULL,
PATCH 25/205 CIFS: Fix a malicious redirect problem in the DNS lookup code
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Howells <[email protected]>
commit 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 upstream.
Fix the security problem in the CIFS filesystem DNS lookup code in which a malicious redirect could be installed by a random user by simply adding a result record into one of their keyrings with add_key() and then invoking a CIFS CFS lookup [CVE-2010-2524].
This is done by creating an internal keyring specifically for the caching of DNS lookups. To enforce the use of this keyring, the module init routine creates a set of override credentials with the keyring installed as the thread keyring and instructs request_key() to only install lookup result keys in that keyring.
The override is then applied around the call to request_key().
This has some additional benefits when a kernel service uses this module to request a key:
(1) The result keys are owned by root, not the user that caused the lookup.
(2) The result keys don't pop up in the user's keyrings.
(3) The result keys don't come out of the quota of the user that caused the lookup.
The keyring can be viewed as root by doing cat /proc/keys:
2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4
It can then be listed with 'keyctl list' by root.
# keyctl list 0x2a0ca6c3 1 key in keyring: 726766307: --alswrv 0 0 dns_resolver: foo.bar.com
--- fs/cifs/cifsfs.c | 6 ++-- fs/cifs/dns_resolve.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++ fs/cifs/dns_resolve.h | 4 +- 3 files changed, 74 insertions(+), 5 deletions(-)
fs/cifs/cifsfs.c +3 -3
@@ -1046,7 +1046,7 @@ init_cifs(void) goto out_unregister_filesystem;#endif #ifdef CONFIG_CIFS_DFS_UPCALL - rc =register_key_type (&key_type_dns_resolver); + rc =cifs_init_dns_resolver ();if (rc) goto out_unregister_key_type;#endif
@@ -1058,7 +1058,7 @@ init_cifs(void) out_unregister_resolver_key: #ifdef CONFIG_CIFS_DFS_UPCALL -unregister_key_type (&key_type_dns_resolver); +cifs_exit_dns_resolver (); out_unregister_key_type:#endif #ifdef CONFIG_CIFS_UPCALL
@@ -1084,7 +1084,7 @@ exit_cifs(void)cifs_proc_clean ();#ifdef CONFIG_CIFS_DFS_UPCALL cifs_dfs_release_automount_timer (); -unregister_key_type (&key_type_dns_resolver); +cifs_exit_dns_resolver ();#endif #ifdef CONFIG_CIFS_UPCALL unregister_key_type (&cifs_spnego_key_type);
fs/cifs/dns_resolve.c +69 -0
99 lines not on this page · raw message
fs/cifs/dns_resolve.h +2 -2
@@ -24,8 +24,8 @@#define _DNS_RESOLVE_H#ifdef __KERNEL__ -#include <linux/key-type.h> -extern struct key_type key_type_dns_resolver; +extern int __init cifs_init_dns_resolver (void ); +extern void __exit cifs_exit_dns_resolver(void);extern int dns_resolve_server_name_to_ip (const char *unc,char **ip_addr);#endif /* KERNEL */
PATCH 26/205 ALSA: hda - Dont check capture source mixer if no ADC is available
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <[email protected]>
commit fbe618f216830f47b183858c3380d4767b1ad02f upstream.
With multiple codec configurations, some codec might have no ADC, thus it keeps spec->adc_nids = NULL. This causes an Oops in alc_build_controls().
Reference: kernel bug #16156
https://bugzilla.kernel.org/show_bug.cgi?id=16156
--- sound/pci/hda/patch_realtek.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
sound/pci/hda/patch_realtek.c +12 -10
@@ -2550,16 +2550,18 @@ static int alc_build_controls(struct hda }/* assign Capture Source enums to NID */ - kctl =snd_hda_find_mixer_ctl (codec,"Capture Source" ); -if (!kctl) - kctl =snd_hda_find_mixer_ctl (codec,"Input Source" ); -for (i =0 ; kctl && i < kctl->count; i++) { -hda_nid_t *nids = spec->capsrc_nids; -if (!nids) - nids = spec->adc_nids; - err =snd_hda_add_nid (codec, kctl, i, nids[i]); -if (err <0 ) -return err; +if (spec->capsrc_nids || spec->adc_nids) { + kctl =snd_hda_find_mixer_ctl (codec,"Capture Source" ); +if (!kctl) + kctl =snd_hda_find_mixer_ctl (codec,"Input Source" ); +for (i =0 ; kctl && i < kctl->count; i++) { +hda_nid_t *nids = spec->capsrc_nids; +if (!nids) + nids = spec->adc_nids; + err =snd_hda_add_nid (codec, kctl, i, nids[i]); +if (err <0 ) +return err; + } }if (spec->cap_mixer) {const char *kname = kctl ? kctl->id.name :NULL ;
PATCH 27/205 ALSA: hda - Add Macbook 5,2 quirk
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luke Yelavich <[email protected]>
commit 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 upstream.
Set Macbook 5,2 (106b:4a00) hardware to use ALC885_MB5
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9400,6 +9400,7 @@ static struct snd_pci_quirk alc882_ssid_SND_PCI_QUIRK (0x106b ,0x3e00 ,"iMac 24 Aluminum" ,ALC885_IMAC24 ),SND_PCI_QUIRK (0x106b ,0x4900 ,"iMac 9,1 Aluminum" ,ALC885_IMAC91 ),SND_PCI_QUIRK (0x106b ,0x3f00 ,"Macbook 5,1" ,ALC885_MB5 ), + SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5),/* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2, * so apparently no perfect solution yet */
PATCH 28/205 ALSA: hda - Restore cleared pin controls on resume
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <[email protected]>
commit ac0547dc62e67a3e0b0c1628b6e49efba8f517db upstream.
Many codecs now clear the pin controls at suspend via snd_hda_shutup_pins() for reducing the click noise at power-off. But this leaves some pins uninitialized, and they'll be never recovered after resume.
This patch adds the proper recovery of cleared pin controls on resume. Also it adds a check of bus->shutdown so that pins won't be cleared at module unloading.
Reference: Kernel bug 16339
http://bugzilla.kernel.org/show_bug.cgi?id=16339
--- sound/pci/hda/hda_codec.c | 27 +++++++++++++++++++++++++++ sound/pci/hda/hda_codec.h | 5 ++++- 2 files changed, 31 insertions(+), 1 deletion(-)
sound/pci/hda/hda_codec.c +27 -0
@@ -784,6 +784,9 @@ static int read_pin_defaults(struct hda_ pin->nid = nid; pin->cfg =snd_hda_codec_read (codec, nid,0 ,AC_VERB_GET_CONFIG_DEFAULT ,0 ); + pin->ctrl =snd_hda_codec_read (codec, nid,0 , +AC_VERB_GET_PIN_WIDGET_CONTROL , +0 ); }return 0 ; }
@@ -912,15 +915,38 @@ static void restore_pincfgs(struct hda_cvoid snd_hda_shutup_pins (struct hda_codec *codec) {int i; +/* don't shut up pins when unloading the driver; otherwise it breaks +* the default pin setup at the next load of the driver +*/ +if (codec->bus->shutdown) +return ;for (i =0 ; i < codec->init_pins.used; i++) {struct hda_pincfg *pin =snd_array_elem (&codec->init_pins, i);/* use read here for syncing after issuing each verb */ snd_hda_codec_read (codec, pin->nid,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0 ); } + codec->pins_shutup =1 ; }EXPORT_SYMBOL_HDA (snd_hda_shutup_pins); +/* Restore the pin controls cleared previously via snd_hda_shutup_pins() */ +static void restore_shutup_pins (struct hda_codec *codec) +{ +int i; +if (!codec->pins_shutup) +return ; +if (codec->bus->shutdown) +return ; +for (i =0 ; i < codec->init_pins.used; i++) { +struct hda_pincfg *pin =snd_array_elem (&codec->init_pins, i); +snd_hda_codec_write (codec, pin->nid,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL , + pin->ctrl); + } + codec->pins_shutup =0 ; +} +static void init_hda_cache (struct hda_cache_rec *cache,unsigned int record_size);static void free_hda_cache (struct hda_cache_rec *cache);
@@ -2858,6 +2884,7 @@ static void hda_call_codec_resume(struct codec->afg ? codec->afg : codec->mfg, AC_PWRST_D0);restore_pincfgs (codec);/* restore all current pin configs */ +restore_shutup_pins (codec);hda_exec_init_verbs (codec);if (codec->patch_ops.resume) codec->patch_ops.resume (codec);
sound/pci/hda/hda_codec.h +4 -1
@@ -821,6 +821,7 @@ struct hda_codec { unsigned int pin_amp_workaround:1; /* pin out-amp takes index* (e.g. Conexant codecs) */ + unsigned int pins_shutup:1; /* pins are shut up */ unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */#ifdef CONFIG_SND_HDA_POWER_SAVE unsigned int power_on :1; /* current (global) power-state */
@@ -894,7 +895,9 @@ void snd_hda_codec_resume_cache(struct h/* the struct for codec->pin_configs */ struct hda_pincfg {hda_nid_t nid; -unsigned int cfg; +unsigned char ctrl;/* current pin control value */ +unsigned char pad;/* reserved */ +unsigned int cfg;/* default configuration */ };unsigned int snd_hda_codec_get_pincfg (struct hda_codec *codec,hda_nid_t nid);
PATCH 29/205 cpmac: do not leak struct net_device on phy_connect errors
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Florian Fainelli <[email protected]>
commit ed770f01360b392564650bf1553ce723fa46afec upstream.
If the call to phy_connect fails, we will return directly instead of freeing the previously allocated struct net_device.
--- drivers/net/cpmac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/cpmac.c +2 -1
@@ -1182,7 +1182,8 @@ static int __devinit cpmac_probe(structif (netif_msg_drv (priv))printk (KERN_ERR "%s: Could not attach to PHY\n" , dev->name); -return PTR_ERR (priv->phy); + rc =PTR_ERR (priv->phy); + goto fail; }if ((rc =register_netdev (dev))) {
PATCH 30/205 sky2: Restore multicast after restart
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike McCormack <[email protected]>
commit 37652522faa0877dc6d0dbb6b999bdccc07f0e89 upstream.
Multicast settings will be lost on reset, so restore them.
--- drivers/net/sky2.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/sky2.c +1 -0
@@ -3293,6 +3293,7 @@ static void sky2_restart(struct work_strcontinue ;sky2_hw_up (sky2); +sky2_set_multicast (dev);netif_wake_queue (dev); }
PATCH 31/205 sky2: enable rx/tx in sky2_phy_reinit()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Brandon Philips <[email protected]>
commit 38000a94a902e94ca8b5498f7871c6316de8957a upstream.
sky2_phy_reinit is called by the ethtool helpers sky2_set_settings, sky2_nway_reset and sky2_set_pauseparam when netif_running.
However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to stop working:
$ ethtool -r eth0 $ ethtool -A eth0 autoneg off
Fix this issue by enabling Rx/Tx after running sky2_phy_init in sky2_phy_reinit.
--- drivers/net/sky2.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/net/sky2.c +14 -5
@@ -720,11 +720,24 @@ static void sky2_phy_power_down(struct ssky2_write8 (hw,B2_TST_CTRL1 ,TST_CFG_WRITE_OFF ); } +/* Enable Rx/Tx */ +static void sky2_enable_rx_tx (struct sky2_port *sky2) +{ +struct sky2_hw *hw = sky2->hw; +unsigned port = sky2->port; +u16 reg; + + reg =gma_read16 (hw, port,GM_GP_CTRL ); + reg |=GM_GPCR_RX_ENA |GM_GPCR_TX_ENA ; +gma_write16 (hw, port,GM_GP_CTRL , reg); +} +/* Force a renegotiation */ static void sky2_phy_reinit (struct sky2_port *sky2) {spin_lock_bh (&sky2->phy_lock);sky2_phy_init (sky2->hw, sky2->port); +sky2_enable_rx_tx (sky2);spin_unlock_bh (&sky2->phy_lock); }
@@ -2002,7 +2015,6 @@ static void sky2_link_up(struct sky2_por {struct sky2_hw *hw = sky2->hw;unsigned port = sky2->port; -u16 reg;static const char *fc_name[] = { [FC_NONE ] ="none" , [FC_TX ] ="tx" ,
@@ -2010,10 +2022,7 @@ static void sky2_link_up(struct sky2_por [FC_BOTH ] ="both" , }; -/* enable Rx/Tx */ - reg =gma_read16 (hw, port,GM_GP_CTRL ); - reg |=GM_GPCR_RX_ENA |GM_GPCR_TX_ENA ; -gma_write16 (hw, port,GM_GP_CTRL , reg); +sky2_enable_rx_tx (sky2);gm_phy_write (hw, port,PHY_MARV_INT_MASK ,PHY_M_DEF_MSK );
PATCH 32/205 net: fix problem in reading sock TX queue
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tom Herbert <[email protected]>
commit b0f77d0eae0c58a5a9691a067ada112ceeae2d00 upstream.
Fix problem in reading the tx_queue recorded in a socket. In dev_pick_tx, the TX queue is read by doing a check with sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. The problem is that there is not mutual exclusion across these calls in the socket so it it is possible that the queue in the sock can be invalidated after sk_tx_queue_recorded is called so that sk_tx_queue get returns -1, which sets 65535 in queue_index and thus dev_pick_tx returns 65536 which is a bogus queue and can cause crash in dev_queue_xmit.
We fix this by only calling sk_tx_queue_get which does the proper checks. The interface is that sk_tx_queue_get returns the TX queue if the sock argument is non-NULL and TX queue is recorded, else it returns -1. sk_tx_queue_recorded is no longer used so it can be completely removed.
--- include/net/sock.h | 7 +------ net/core/dev.c | 7 +++---- 2 files changed, 4 insertions(+), 10 deletions(-)
include/net/sock.h +1 -6
@@ -1146,12 +1146,7 @@ static inline void sk_tx_queue_clear(strstatic inline int sk_tx_queue_get (const struct sock *sk) { -return sk->sk_tx_queue_mapping; -} - -static inline bool sk_tx_queue_recorded (const struct sock *sk) -{ -return (sk && sk->sk_tx_queue_mapping >=0 ); +return sk ? sk->sk_tx_queue_mapping :-1 ; }static inline void sk_set_socket (struct sock *sk,struct socket *sock)
net/core/dev.c +3 -4
@@ -1972,12 +1972,11 @@ static inline u16 dev_cap_txqueue(structstatic struct netdev_queue *dev_pick_tx (struct net_device *dev,struct sk_buff *skb) { -u16 queue_index; +int queue_index;struct sock *sk = skb->sk; -if (sk_tx_queue_recorded (sk)) { - queue_index =sk_tx_queue_get (sk); - }else { + queue_index =sk_tx_queue_get (sk); +if (queue_index <0 ) {const struct net_device_ops *ops = dev->netdev_ops;if (ops->ndo_select_queue) {
PATCH 33/205 tcp: fix crash in tcp_xmit_retransmit_queue
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ilpo Järvinen <[email protected]>
commit 45e77d314585869dfe43c82679f7e08c9b35b898 upstream.
It can happen that there are no packets in queue while calling tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns NULL and that gets deref'ed to get sacked into a local var.
There is no work to do if no packets are outstanding so we just exit early.
This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out guard to make joining diff nicer).
--- net/ipv4/tcp_output.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/tcp_output.c +3 -0
@@ -2206,6 +2206,9 @@ void tcp_xmit_retransmit_queue(struct soint mib_idx;int fwd_rexmitting =0 ; +if (!tp->packets_out) +return ; +if (!tp->lost_out) tp->retransmit_high = tp->snd_una;
PATCH 34/205 net/core: neighbour update Oops
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Doug Kehn <[email protected]>
commit 91a72a70594e5212c97705ca6a694bd307f7a26b upstream.
When configuring DMVPN (GRE + openNHRP) and a GRE remote address is configured a kernel Oops is observed. The obserseved Oops is caused by a NULL header_ops pointer (neigh->dev->header_ops) in neigh_update_hhs() when
void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) = neigh->dev->header_ops->cache_update;
is executed. The dev associated with the NULL header_ops is the GRE interface. This patch guards against the possibility that header_ops is NULL.
This Oops was first observed in kernel version 2.6.26.8.
--- net/core/neighbour.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/neighbour.c +4 -1
@@ -948,7 +948,10 @@ static void neigh_update_hhs(struct neig {struct hh_cache *hh;void (*update)(struct hh_cache *,const struct net_device *,const unsigned char *) - = neigh->dev->header_ops->cache_update; + =NULL ; + +if (neigh->dev->header_ops) + update = neigh->dev->header_ops->cache_update;if (update) {for (hh = neigh->hh; hh; hh = hh->hh_next) {
PATCH 35/205 math-emu: correct test for downshifting fraction in _FP_FROM_INT()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mikael Pettersson <[email protected]>
commit f8324e20f8289dffc646d64366332e05eaacab25 upstream.
The kernel's math-emu code contains a macro _FP_FROM_INT() which is used to convert an integer to a raw normalized floating-point value. It does this basically in three steps:
1. Compute the exponent from the number of leading zero bits.
2. Downshift large fractions to put the MSB in the right position for normalized fractions.
3. Upshift small fractions to put the MSB in the right position.
There is an boundary error in step 2, causing a fraction with its MSB exactly one bit above the normalized MSB position to not be downshifted. This results in a non-normalized raw float, which when packed becomes a massively inaccurate representation for that input.
The impact of this depends on a number of arch-specific factors, but it is known to have broken emulation of FXTOD instructions on UltraSPARC III, which was originally reported as GCC bug 44631
<http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44631>.
Any arch which uses math-emu to emulate conversions from integers to same-size floats may be affected.
The fix is simple: the exponent comparison used to determine if the fraction should be downshifted must be "<=" not "<".
I'm sending a kernel module to test this as a reply to this message. There are also SPARC user-space test cases in the GCC bug entry.
--- include/math-emu/op-common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/math-emu/op-common.h +1 -1
@@ -799,7 +799,7 @@ do { \ X##_e -= (_FP_W_TYPE_SIZE - rsize); \ X##_e = rsize - X##_e - 1; \ \ - if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \ + if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \ __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\ _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \ if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \
PATCH 36/205 cmd640: fix kernel oops in test_irq() method
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sergei Shtylyov <[email protected]>
commit a9ddabc52ce3757a4331d6c1e8bf4065333cc51b upstream.
When implementing the test_iqr() method, I forgot that this driver is not an ordinary PCI driver and also needs to support VLB variant of the chip. Moreover, 'hwif->dev' should be NULL, potentially causing oops in pci_read_config_byte().
--- drivers/ide/cmd640.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/ide/cmd640.c +2 -4
@@ -633,12 +633,10 @@ static void __init cmd640_init_dev(ide_dstatic int cmd640_test_irq (ide_hwif_t *hwif) { -struct pci_dev *dev =to_pci_dev (hwif->dev);int irq_reg = hwif->channel ?ARTTIM23 :CFR ; -u8 irq_stat, irq_mask = hwif->channel ?ARTTIM23_IDE23INTR : +u8 irq_mask = hwif->channel ?ARTTIM23_IDE23INTR :CFR_IDE01INTR ; - -pci_read_config_byte (dev, irq_reg, &irq_stat); +u8 irq_stat =get_cmd640_reg (irq_reg);return (irq_stat & irq_mask) ?1 :0 ; }
PATCH 37/205 NFSv4: Fix an embarassing typo in encode_attrs()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Trond Myklebust <[email protected]>
commit d3f6baaa34c54040b3ef30950e59b54ac0624b21 upstream.
Apparently, we have never been able to set the atime correctly from the NFSv4 client.
--- fs/nfs/nfs4xdr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/nfs4xdr.c +2 -2
@@ -862,8 +862,8 @@ static void encode_attrs(struct xdr_stre bmval1 |=FATTR4_WORD1_TIME_ACCESS_SET ; *p++ =cpu_to_be32 (NFS4_SET_TO_CLIENT_TIME ); *p++ =cpu_to_be32 (0 ); - *p++ =cpu_to_be32 (iap->ia_mtime.tv_sec); - *p++ =cpu_to_be32 (iap->ia_mtime.tv_nsec); + *p++ =cpu_to_be32 (iap->ia_atime.tv_sec); + *p++ =cpu_to_be32 (iap->ia_atime.tv_nsec); }else if (iap->ia_valid &ATTR_ATIME ) { bmval1 |=FATTR4_WORD1_TIME_ACCESS_SET ;
PATCH 38/205 NFSv4: Ensure that /proc/self/mountinfo displays the minor version number
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Trond Myklebust <[email protected]>
commit 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 upstream.
Currently, we do not display the minor version mount parameter in the /proc mount info.
--- fs/nfs/super.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
fs/nfs/super.c +18 -4
@@ -566,6 +566,22 @@ static void nfs_show_mountd_options(strunfs_show_mountd_netid (m, nfss, showdefaults); } +#ifdef CONFIG_NFS_V4 +static void nfs_show_nfsv4_options (struct seq_file *m,struct nfs_server *nfss, +int showdefaults) +{ +struct nfs_client *clp = nfss->nfs_client; + +seq_printf (m,",clientaddr=%s" , clp->cl_ipaddr); +seq_printf (m,",minorversion=%u" , clp->cl_minorversion); +} +#else +static void nfs_show_nfsv4_options (struct seq_file *m,struct nfs_server *nfss, +int showdefaults) +{ +} +#endif +/* * Describe the mount options in force on this server representation */
@@ -627,11 +643,9 @@ static void nfs_show_mount_options(strucif (version !=4 )nfs_show_mountd_options (m, nfss, showdefaults); +else +nfs_show_nfsv4_options (m, nfss, showdefaults); -#ifdef CONFIG_NFS_V4 -if (clp->rpc_ops->version ==4 ) -seq_printf (m,",clientaddr=%s" , clp->cl_ipaddr); -#endif if (nfss->options &NFS_OPTION_FSCACHE )seq_printf (m,",fsc" ); }
PATCH 39/205 SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Trond Myklebust <[email protected]>
commit b76ce56192bcf618013fb9aecd83488cffd645cc upstream.
If the attempt to read the calldir fails, then instead of storing the read bytes, we currently discard them. This leads to a garbage final result when upon re-entry to the same routine, we read the remaining bytes.
Fixes the regression in bugzilla number 16213. Please see
https://bugzilla.kernel.org/show_bug.cgi?id=16213
--- net/sunrpc/xprtsock.c | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-)
net/sunrpc/xprtsock.c +22 -16
@@ -224,7 +224,8 @@ struct sock_xprt {* State of TCP reply receive */ __be32 tcp_fraghdr, - tcp_xid; + tcp_xid, + tcp_calldir;u32 tcp_offset, tcp_reclen;
@@ -942,7 +943,7 @@ static inline void xs_tcp_read_calldir(s {size_t len, used;u32 offset; -__be32 calldir; +char *p;/* * We want transport->tcp_offset to be 8 at the end of this routine
@@ -951,26 +952,33 @@ static inline void xs_tcp_read_calldir(s* transport->tcp_offset is 4 (after having already read the xid). */ offset = transport->tcp_offset -sizeof (transport->tcp_xid); - len =sizeof (calldir) - offset; + len =sizeof (transport->tcp_calldir) - offset;dprintk ("RPC: reading CALL/REPLY flag (%Zu bytes)\n" , len); - used =xdr_skb_read_bits (desc, &calldir, len); + p = ((char *) &transport->tcp_calldir) + offset; + used =xdr_skb_read_bits (desc, p, len); transport->tcp_offset += used;if (used != len)return ; transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR ; - transport->tcp_flags |=TCP_RCV_COPY_CALLDIR ; - transport->tcp_flags |=TCP_RCV_COPY_DATA ;/* * We don't yet have the XDR buffer, so we will write the calldir * out after we get the buffer from the 'struct rpc_rqst' */ -if (ntohl (calldir) ==RPC_REPLY ) +switch (ntohl (transport->tcp_calldir)) { +case RPC_REPLY : + transport->tcp_flags |=TCP_RCV_COPY_CALLDIR ; + transport->tcp_flags |=TCP_RCV_COPY_DATA ; transport->tcp_flags |=TCP_RPC_REPLY ; -else +break ; +case RPC_CALL : + transport->tcp_flags |=TCP_RCV_COPY_CALLDIR ; + transport->tcp_flags |=TCP_RCV_COPY_DATA ; transport->tcp_flags &= ~TCP_RPC_REPLY ; -dprintk ("RPC: reading %s CALL/REPLY flag %08x\n" , - (transport->tcp_flags &TCP_RPC_REPLY ) ? -"reply for" :"request with" , calldir); +break ; +default : +dprintk ("RPC: invalid request message type\n" ); +xprt_force_disconnect (&transport->xprt); + }xs_tcp_check_fraghdr (transport); }
@@ -990,12 +998,10 @@ static inline void xs_tcp_read_common(st/* * Save the RPC direction in the XDR buffer */ -__be32 calldir = transport->tcp_flags &TCP_RPC_REPLY ? -htonl (RPC_REPLY ) :0 ; -memcpy (rcvbuf->head[0 ].iov_base + transport->tcp_copied, - &calldir,sizeof (calldir)); - transport->tcp_copied +=sizeof (calldir); + &transport->tcp_calldir, +sizeof (transport->tcp_calldir)); + transport->tcp_copied +=sizeof (transport->tcp_calldir); transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR ; }
PATCH 40/205 powerpc/5200: Fix build error in sound code.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Grant Likely <[email protected]>
commit f487537c2b6b23332bbea7ecb1fe793b6c74d5b2 upstream.
Compiling in the MPC5200 sound drivers results in the following build error:
sound/soc/fsl/mpc5200_psc_ac97.o: In function `to_psc_dma_stream':
mpc5200_psc_ac97.c:(.text+0x0): multiple definition of to_psc_dma_stream' sound/soc/fsl/mpc5200_dma.o:mpc5200_dma.c:(.text+0x0): first defined here sound/soc/fsl/efika-audio-fabric.o: In function to_psc_dma_stream':
efika-audio-fabric.c:(.text+0x0): multiple definition of `to_psc_dma_stream' sound/soc/fsl/mpc5200_dma.o:mpc5200_dma.c:(.text+0x0): first defined here make[3]: *** [sound/soc/fsl/built-in.o] Error 1
make[2]: *** [sound/soc/fsl] Error 2
make[1]: *** [sound/soc] Error 2
make: *** [sound] Error 2
This patch fixes it by declaring the inline function in the header file to also be a static.
--- sound/soc/fsl/mpc5200_dma.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/mpc5200_dma.h +1 -1
@@ -73,7 +73,7 @@ struct psc_dma { };/* Utility for retrieving psc_dma_stream structure from a substream */ -inline struct psc_dma_stream * +static inline struct psc_dma_stream *to_psc_dma_stream (struct snd_pcm_substream *substream,struct psc_dma *psc_dma) {if (substream->pstr->stream ==SNDRV_PCM_STREAM_CAPTURE )
PATCH 41/205 ath9k: Avoid corrupt frames being forwarded to mac80211.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vivek Natarajan <[email protected]>
commit 3a37495268ab45507b4cab9d4cb18c5496ab7a10 upstream.
If bit 29 is set, MAC H/W can attempt to decrypt the received aggregate with WEP or TKIP, eventhough the received frame may be a CRC failed corrupted frame. If this bit is set, H/W obeys key type in keycache. If it is not set and if the key type in keycache is neither open nor AES, H/W forces key type to be open. But bit 29 should be set to 1 for AsyncFIFO feature to encrypt/decrypt the aggregate with WEP or TKIP.
--- drivers/net/wireless/ath/ath9k/initvals.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/initvals.h +4 -4
@@ -246,7 +246,7 @@ static const u32 ar5416Common[][2] = { { 0x00008258, 0x00000000 }, { 0x0000825c, 0x400000ff }, { 0x00008260, 0x00080922 }, - { 0x00008264, 0xa8000010 }, + { 0x00008264, 0x88000010 }, { 0x00008270, 0x00000000 }, { 0x00008274, 0x40000000 }, { 0x00008278, 0x003e4180 },
@@ -2766,7 +2766,7 @@ static const u32 ar9280Common_9280_2[][2 { 0x00008258, 0x00000000 }, { 0x0000825c, 0x400000ff }, { 0x00008260, 0x00080922 }, - { 0x00008264, 0xa8a00010 }, + { 0x00008264, 0x88a00010 }, { 0x00008270, 0x00000000 }, { 0x00008274, 0x40000000 }, { 0x00008278, 0x003e4180 },
@@ -3936,7 +3936,7 @@ static const u_int32_t ar9285Common_9285 { 0x00008258, 0x00000000 }, { 0x0000825c, 0x400000ff }, { 0x00008260, 0x00080922 }, - { 0x00008264, 0xa8a00010 }, + { 0x00008264, 0x88a00010 }, { 0x00008270, 0x00000000 }, { 0x00008274, 0x40000000 }, { 0x00008278, 0x003e4180 },
@@ -5073,7 +5073,7 @@ static const u_int32_t ar9287Common_9287 { 0x00008258, 0x00000000 }, { 0x0000825c, 0x400000ff }, { 0x00008260, 0x00080922 }, - { 0x00008264, 0xa8a00010 }, + { 0x00008264, 0x88a00010 }, { 0x00008270, 0x00000000 }, { 0x00008274, 0x40000000 }, { 0x00008278, 0x003e4180 },
PATCH 42/205 hostap: Protect against initialization interrupt
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tim Gardner <[email protected]>
commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream.
Use an irq spinlock to hold off the IRQ handler until enough early card init is complete such that the handler can run without faulting.
--- drivers/net/wireless/hostap/hostap_cs.c | 15 +++++++++++++-- drivers/net/wireless/hostap/hostap_hw.c | 13 +++++++++++++ drivers/net/wireless/hostap/hostap_wlan.h | 2 +- 3 files changed, 27 insertions(+), 3 deletions(-)
drivers/net/wireless/hostap/hostap_cs.c +13 -2
@@ -603,6 +603,7 @@ static int prism2_config(struct pcmcia_dlocal_info_t *local;int ret =1 ;struct hostap_cs_priv *hw_priv; +unsigned long flags;PDEBUG (DEBUG_FLOW ,"prism2_config()\n" );
@@ -637,6 +638,12 @@ static int prism2_config(struct pcmcia_d link->dev_node = &hw_priv->node;/* +* Make sure the IRQ handler cannot proceed until at least +* dev->base_addr is initialized. +*/ +spin_lock_irqsave (&local->irq_init_lock, flags); + +/* * Allocate an interrupt line. Note that this does not assign a * handler to the interrupt, unless the 'Handler' member of the * irq structure is initialized.
@@ -646,7 +653,7 @@ static int prism2_config(struct pcmcia_d link->irq.Handler = prism2_interrupt; ret =pcmcia_request_irq (link, &link->irq);if (ret) - goto failed; + goto failed_unlock; }/*
@@ -656,11 +663,13 @@ static int prism2_config(struct pcmcia_d*/ ret =pcmcia_request_configuration (link, &link->conf);if (ret) - goto failed; + goto failed_unlock; dev->irq = link->irq.AssignedIRQ; dev->base_addr = link->io.BasePort1; +spin_unlock_irqrestore (&local->irq_init_lock, flags); +/* Finally, report what we've done */ printk (KERN_INFO "%s: index 0x%02x: " , dev_info, link->conf.ConfigIndex);
@@ -689,6 +698,8 @@ static int prism2_config(struct pcmcia_d }return ret; + failed_unlock: +spin_unlock_irqrestore (&local->irq_init_lock, flags); failed:kfree (hw_priv);prism2_release ((u_long )link);
drivers/net/wireless/hostap/hostap_hw.c +13 -0
@@ -2630,6 +2630,18 @@ static irqreturn_t prism2_interrupt(int iface =netdev_priv (dev); local = iface->local; +/* Detect early interrupt before driver is fully configued */ +spin_lock (&local->irq_init_lock); +if (!dev->base_addr) { +if (net_ratelimit ()) { +printk (KERN_DEBUG "%s: Interrupt, but dev not configured\n" , + dev->name); + } +spin_unlock (&local->irq_init_lock); +return IRQ_HANDLED ; + } +spin_unlock (&local->irq_init_lock); +prism2_io_debug_add (dev,PRISM2_IO_DEBUG_CMD_INTERRUPT ,0 ,0 );if (local->func->card_present && !local->func->card_present (local)) {
@@ -3147,6 +3159,7 @@ prism2_init_local_data(struct prism2_helspin_lock_init (&local->cmdlock);spin_lock_init (&local->baplock);spin_lock_init (&local->lock); +spin_lock_init (&local->irq_init_lock);mutex_init (&local->rid_bap_mtx);if (card_idx <0 || card_idx >=MAX_PARM_DEVICES )
drivers/net/wireless/hostap/hostap_wlan.h +1 -1
@@ -654,7 +654,7 @@ struct local_info {rwlock_t iface_lock;/* hostap_interfaces read lock; use write lock * when removing entries from the list. * TX and RX paths can use read lock. */ -spinlock_t cmdlock, baplock, lock; +spinlock_t cmdlock, baplock, lock, irq_init_lock;struct mutex rid_bap_mtx;u16 infofid;/* MAC buffer id for info frame */ /* txfid, intransmitfid, next_txtid, and next_alloc are protected by
PATCH 43/205 TPM: ReadPubEK output struct fix
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajiv Andrade <[email protected]>
commit 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 upstream.
This patch adds a missing element of the ReadPubEK command output, that prevents future overflow of this buffer when copying the TPM output result into it.
Prevents a kernel panic in case the user tries to read the pubek from sysfs.
--- drivers/char/tpm/tpm.h | 1 + 1 file changed, 1 insertion(+)
drivers/char/tpm/tpm.h +1 -0
@@ -224,6 +224,7 @@ struct tpm_readpubek_params_out {u8 algorithm[4 ];u8 encscheme[2 ];u8 sigscheme[2 ]; +__be32 paramsize;u8 parameters[12 ];/*assuming RSA*/ __be32 keysize;u8 modulus[256 ];
PATCH 44/205 fb: fix colliding defines for fb flags.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dave Airlie <[email protected]>
commit b26c949755c06ec79e55a75817210083bd78fc9a upstream.
When I added the flags I must have been using a 25 line terminal and missed the following flags.
The collided with flag has one user in staging despite being in-tree for 5 years.
I'm happy to push this via my drm tree unless someone really wants to do it.
--- include/linux/fb.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/fb.h +2 -2
@@ -787,8 +787,6 @@ struct fb_tile_ops {#define FBINFO_MISC_USEREVENT 0x10000/* event request from userspace */ #define FBINFO_MISC_TILEBLITTING 0x20000/* use tile blitting */ -#define FBINFO_MISC_FIRMWARE 0x40000/* a replaceable firmware -inited framebuffer */ /* A driver may set this flag to indicate that it does want a set_par to be * called every time when fbcon_switch is executed. The advantage is that with
@@ -802,6 +800,8 @@ struct fb_tile_ops {*/ #define FBINFO_MISC_ALWAYS_SETPAR 0x40000 +/* where the fb is a firmware driver, and can be replaced with a proper one */ +#define FBINFO_MISC_FIRMWARE 0x80000/* * Host and GPU endianness differ. */
PATCH 45/205 iwlwifi: cancel scan watchdog in iwl_bg_abort_scan
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: John W. Linville <[email protected]>
commit a69b03e941abae00380fc6bc1877fb797a1b31e6 upstream.
Avoids this:
WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1 [mac80211]() Hardware name: Latitude E5400 Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat
nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1
Call Trace: [<ffffffff8104b558>] warn_slowpath_common+0x77/0x8f [<ffffffff8104b57f>] warn_slowpath_null+0xf/0x11 [<ffffffffa01bb7d9>] ieee80211_scan_completed+0x5f/0x1f1 [mac80211] [<ffffffffa02a23f0>] iwl_bg_scan_completed+0xbb/0x17a [iwlcore] [<ffffffff81060d3d>] worker_thread+0x1a4/0x232 [<ffffffffa02a2335>] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore] [<ffffffff81064817>] ? autoremove_wake_function+0x0/0x34 [<ffffffff81060b99>] ? worker_thread+0x0/0x232 [<ffffffff810643c7>] kthread+0x7a/0x82 [<ffffffff8100a924>] kernel_thread_helper+0x4/0x10 [<ffffffff8106434d>] ? kthread+0x0/0x82 [<ffffffff8100a920>] ? kernel_thread_helper+0x0/0x10
Reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=590436
--- drivers/net/wireless/iwlwifi/iwl-scan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/iwlwifi/iwl-scan.c +1 -0
@@ -952,6 +952,7 @@ void iwl_bg_abort_scan(struct work_strucmutex_lock (&priv->mutex); +cancel_delayed_work_sync (&priv->scan_check);set_bit (STATUS_SCAN_ABORTING , &priv->status);iwl_send_scan_abort (priv);
PATCH 46/205 mac80211: do not wip out old supported rates
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream.
Use old supported rates, if AP do not provide supported rates information element in a new managment frame.
--- net/mac80211/scan.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
net/mac80211/scan.c +11 -10
@@ -83,7 +83,7 @@ ieee80211_bss_info_update(struct ieee802 {struct cfg80211_bss *cbss;struct ieee80211_bss *bss; -int clen; +int clen, srlen;s32 signal =0 ;if (local->hw.flags &IEEE80211_HW_SIGNAL_DBM )
@@ -112,23 +112,24 @@ ieee80211_bss_info_update(struct ieee802 bss->dtim_period = tim_ie->dtim_period; } - bss->supp_rates_len =0 ; +/* replace old supported rates if we get new values */ + srlen =0 ;if (elems->supp_rates) { - clen =IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; + clen =IEEE80211_MAX_SUPP_RATES ;if (clen > elems->supp_rates_len) clen = elems->supp_rates_len; -memcpy (&bss->supp_rates[bss->supp_rates_len], elems->supp_rates, - clen); - bss->supp_rates_len += clen; +memcpy (bss->supp_rates, elems->supp_rates, clen); + srlen += clen; }if (elems->ext_supp_rates) { - clen =IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; + clen =IEEE80211_MAX_SUPP_RATES - srlen;if (clen > elems->ext_supp_rates_len) clen = elems->ext_supp_rates_len; -memcpy (&bss->supp_rates[bss->supp_rates_len], - elems->ext_supp_rates, clen); - bss->supp_rates_len += clen; +memcpy (bss->supp_rates + srlen, elems->ext_supp_rates, clen); + srlen += clen; } +if (srlen) + bss->supp_rates_len = srlen; bss->wmm_used = elems->wmm_param || elems->wmm_info; bss->uapsd_supported =is_uapsd_supported (elems);
PATCH 47/205 Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Rosenberg <[email protected]>
commit 2ebc3464781ad24474abcbd2274e6254689853b5 upstream.
1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check whether the donor file is append-only before writing to it.
2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around). I haven't been able to successfully exploit this, but I'd imagine that a clever attacker could use this to read things he shouldn't. Even if it's not exploitable, it couldn't hurt to be safe.
--- fs/btrfs/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/ioctl.c +2 -2
@@ -1469,7 +1469,7 @@ static noinline long btrfs_ioctl_clone(s*/ /* the destination must be opened for writing */ -if (!(file->f_mode &FMODE_WRITE )) +if (!(file->f_mode &FMODE_WRITE ) || (file->f_flags &O_APPEND ))return -EINVAL ; ret =mnt_want_write (file->f_path.mnt);
@@ -1522,7 +1522,7 @@ static noinline long btrfs_ioctl_clone(s/* determine range to clone */ ret = -EINVAL ; -if (off >= src->i_size || off + len > src->i_size) +if (off + len > src->i_size || off + len < off) goto out_unlock;if (len ==0 ) olen = len = src->i_size - off;
PATCH 48/205 ocfs2: No need to zero pages past i_size.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joel Becker <[email protected]>
commit 693c241a5f6aa01417f5f4caf9f82e60e316398d upstream.
When ocfs2 fills a hole, it does so by allocating clusters. When a cluster is larger than the write, ocfs2 must zero the portions of the cluster outside of the write. If the clustersize is smaller than a pagecache page, this is handled by the normal pagecache mechanisms, but when the clustersize is larger than a page, ocfs2's write code will zero the pages adjacent to the write. This makes sure the entire cluster is zeroed correctly.
Currently ocfs2 behaves exactly the same when writing past i_size. However, this means ocfs2 is writing zeroed pages for portions of a new cluster that are beyond i_size. The page writeback code isn't expecting this. It treats all pages past the one containing i_size as left behind due to a previous truncate operation.
Thankfully, ocfs2 calculates the number of pages it will be working on up front. The rest of the write code merely honors the original calculation. We can simply trim the number of pages to only cover the actual file data.
--- fs/ocfs2/aops.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
fs/ocfs2/aops.c +18 -4
@@ -1131,23 +1131,37 @@ out:*/ static int ocfs2_grab_pages_for_write (struct address_space *mapping,struct ocfs2_write_ctxt *wc, -u32 cpos,loff_t user_pos,int new, +u32 cpos,loff_t user_pos, +unsigned user_len,int new,struct page *mmap_page) {int ret =0 , i; -unsigned long start, target_index, index; +unsigned long start, target_index, end_index, index;struct inode *inode = mapping->host; +loff_t last_byte; target_index = user_pos >>PAGE_CACHE_SHIFT ;/* * Figure out how many pages we'll be manipulating here. For * non allocating write, we just change the one -* page. Otherwise, we'll need a whole clusters worth. +* page. Otherwise, we'll need a whole clusters worth. If we're +* writing past i_size, we only need enough pages to cover the +* last page of the write. */ if (new) { wc->w_num_pages =ocfs2_pages_per_cluster (inode->i_sb); start =ocfs2_align_clusters_to_page_index (inode->i_sb, cpos); +/* +* We need the index *past* the last page we could possibly +* touch. This is the page past the end of the write or +* i_size, whichever is greater. +*/ + last_byte =max (user_pos + user_len,i_size_read (inode)); +BUG_ON (last_byte <1 ); + end_index = ((last_byte -1 ) >>PAGE_CACHE_SHIFT ) +1 ; +if ((start + wc->w_num_pages) > end_index) + wc->w_num_pages = end_index - start; }else { wc->w_num_pages =1 ; start = target_index;
@@ -1786,7 +1800,7 @@ int ocfs2_write_begin_nolock(struct addr* that we can zero and flush if we error after adding the * extent. */ - ret =ocfs2_grab_pages_for_write (mapping, wc, wc->w_cpos, pos, + ret =ocfs2_grab_pages_for_write (mapping, wc, wc->w_cpos, pos, len, cluster_of_pages, mmap_page);if (ret) {mlog_errno (ret);
PATCH 49/205 ocfs2: When zero extending, do it by page.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joel Becker <[email protected]>
commit a4bfb4cf11fd2211b788af59dc8a8b4394bca227 upstream.
ocfs2_zero_extend() does its zeroing block by block, but it calls a function named ocfs2_write_zero_page(). Let's have ocfs2_write_zero_page() handle the page level. From ocfs2_zero_extend()'s perspective, it is now page-at-a-time.
--- fs/ocfs2/aops.c | 30 -------------- fs/ocfs2/file.c | 118 +++++++++++++++++++++++++++++++++++++++----------------- 2 files changed, 84 insertions(+), 64 deletions(-)
fs/ocfs2/aops.c +0 -30
@@ -459,36 +459,6 @@ int walk_page_buffers( handle_t *handle,return ret; } -handle_t *ocfs2_start_walk_page_trans (struct inode *inode, -struct page *page, -unsigned from, -unsigned to) -{ -struct ocfs2_super *osb =OCFS2_SB (inode->i_sb); -handle_t *handle; -int ret =0 ; - - handle =ocfs2_start_trans (osb,OCFS2_INODE_UPDATE_CREDITS ); -if (IS_ERR (handle)) { - ret = -ENOMEM ; -mlog_errno (ret); - goto out; - } - -if (ocfs2_should_order_data (inode)) { - ret =ocfs2_jbd2_file_inode (handle, inode); -if (ret <0 ) -mlog_errno (ret); - } -out: -if (ret) { -if (!IS_ERR (handle)) -ocfs2_commit_trans (osb, handle); - handle =ERR_PTR (ret); - } -return handle; -} -static sector_t ocfs2_bmap (struct address_space *mapping,sector_t block) {sector_t status;
fs/ocfs2/file.c +84 -34
161 lines not on this page · raw message
PATCH 50/205 p54pci: add Symbol AP-300 minipci adapters pciid
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joerg Albert <[email protected]>
commit 50900f1698f68127e54c67fdfe829e4a97b1be2b upstream.
--- drivers/net/wireless/p54/p54pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/p54/p54pci.c +2 -0
@@ -41,6 +41,8 @@ static DEFINE_PCI_DEVICE_TABLE(p54p_tabl { PCI_DEVICE(0x1260, 0x3877) },/* Intersil PRISM Javelin/Xbow Wireless LAN adapter */ { PCI_DEVICE(0x1260, 0x3886) }, +/* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */ + { PCI_DEVICE(0x1260, 0xffff) }, { }, };
PATCH 51/205 perf_events: Fix Intel Westmere event constraints
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stephane Eranian <[email protected]>
commit d11007703c31db534674ebeeb9eb047bbbe758bd upstream.
Based on Intel Vol3b (March 2010), the event SNOOPQ_REQUEST_OUTSTANDING is restricted to counters 0,1 so update the event table for Intel Westmere accordingly.
LKML-Reference: <[email protected]>
--- arch/x86/kernel/cpu/perf_event_intel.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/perf_event_intel.c +1 -0
@@ -72,6 +72,7 @@ static struct event_constraint intel_wesINTEL_EVENT_CONSTRAINT (0x51 ,0x3 ),/* L1D */ INTEL_EVENT_CONSTRAINT (0x60 ,0x1 ),/* OFFCORE_REQUESTS_OUTSTANDING */ INTEL_EVENT_CONSTRAINT (0x63 ,0x3 ),/* CACHE_LOCK_CYCLES */ +INTEL_EVENT_CONSTRAINT (0xb3 ,0x1 ),/* SNOOPQ_REQUEST_OUTSTANDING */ EVENT_CONSTRAINT_END };
PATCH 52/205 dynamic debug: move ddebug_remove_module() down into free_module()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jason Baron <[email protected]>
commit b82bab4bbe9efa7bc7177fc20620fff19bd95484 upstream.
The command
echo "file ec.c +p" >/sys/kernel/debug/dynamic_debug/control
causes an oops.
Move the call to ddebug_remove_module() down into free_module(). In this way it should be called from all error paths. Currently, we are missing the remove if the module init routine fails.
--- kernel/module.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/module.c +3 -1
@@ -787,7 +787,6 @@ SYSCALL_DEFINE2(delete_module, const chamutex_lock (&module_mutex);/* Store the name of the last unloaded module for diagnostic purposes */ strlcpy (last_unloaded_module, mod->name,sizeof (last_unloaded_module)); -ddebug_remove_module (mod->name);free_module (mod); out:
@@ -1455,6 +1454,9 @@ static void free_module(struct module *mremove_sect_attrs (mod);mod_kobject_remove (mod); +/* Remove dynamic debug info */ +ddebug_remove_module (mod->name); +/* Arch-specific cleanup. */ module_arch_cleanup (mod);
PATCH 53/205 drm/i915: fix hibernation since i915 self-reclaim fixes
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Linus Torvalds <[email protected]>
commit 985b823b919273fe1327d56d2196b4f92e5d0fae upstream.
Since commit 4bdadb9785696439c6e2b3efe34aa76df1149c83 ("drm/i915:
Selectively enable self-reclaim"), we've been passing GFP_MOVABLE to the i915 page allocator where we weren't before due to some over-eager removal of the page mapping gfp_flags games the code used to play.
This caused hibernate on Intel hardware to result in a lot of memory corruptions on resume. See for example
http://bugzilla.kernel.org/show_bug.cgi?id=13811
--- drivers/gpu/drm/i915/i915_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_gem.c +1 -1
@@ -2312,7 +2312,7 @@ i915_gem_object_get_pages(struct drm_gem mapping = inode->i_mapping;for (i =0 ; i < page_count; i++) { page =read_cache_page_gfp (mapping, i, -mapping_gfp_mask (mapping) | +GFP_HIGHUSER | __GFP_COLD | gfpmask);if (IS_ERR (page))
PATCH 54/205 drm/i915: dont access FW_BLC_SELF on 965G
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesse Barnes <[email protected]>
commit adcdbc6651a7086b99827cf50623a02d941261f1 upstream.
The register offset for FW_BLC_SELF is a totally different set of bits on Broadwater (it's actually MI_RDRET_STATE), so don't treat it like FW_BLC_SELF on 965G chips.
Fixes bug https://bugs.freedesktop.org/show_bug.cgi?id=26874.
--- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- drivers/gpu/drm/i915/intel_display.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/i915_debugfs.c +1 -1
@@ -618,7 +618,7 @@ static int i915_sr_status(struct seq_fildrm_i915_private_t *dev_priv = dev->dev_private;bool sr_enabled = false; -if (IS_I965G (dev) ||IS_I945G (dev) ||IS_I945GM (dev)) +if (IS_I965GM (dev) ||IS_I945G (dev) ||IS_I945GM (dev)) sr_enabled =I915_READ (FW_BLC_SELF ) &FW_BLC_SELF_EN ;else if (IS_I915GM (dev)) sr_enabled =I915_READ (INSTPM ) &INSTPM_SELF_EN ;
drivers/gpu/drm/i915/intel_display.c +5 -3
@@ -2691,11 +2691,13 @@ static void i965_update_wm(struct drm_deif (srwm <0 ) srwm =1 ; srwm &=0x3f ; -I915_WRITE (FW_BLC_SELF ,FW_BLC_SELF_EN ); +if (IS_I965GM (dev)) +I915_WRITE (FW_BLC_SELF ,FW_BLC_SELF_EN ); }else {/* Turn off self refresh if both pipes are enabled */ -I915_WRITE (FW_BLC_SELF ,I915_READ (FW_BLC_SELF ) - & ~FW_BLC_SELF_EN ); +if (IS_I965GM (dev)) +I915_WRITE (FW_BLC_SELF ,I915_READ (FW_BLC_SELF ) + & ~FW_BLC_SELF_EN ); } DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
PATCH 55/205 drm/i915: add reclaimable to i915 self-reclaimable page allocations
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Linus Torvalds <[email protected]>
commit cd9f040df6ce46573760a507cb88192d05d27d86 upstream.
The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915:
fix hibernation since i915 self-reclaim fixes") turn out to have been incomplete. Vefa Bicakci tested lots of hibernate cycles, and without the __GFP_RECLAIMABLE flag the system eventually fails to resume.
With the flag added, Vefa can apparently hibernate forever (or until he gets bored running his automated scripts, whichever comes first).
The reclaimable flag was there originally, and was one of the flags that were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915:
Selectively enable self-reclaim") that introduced all these problems, but I didn't want to just blindly add back all the flags in commit 985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It clearly was.
I still suspect that there is some subtle reason we're missing that causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use in this context, and is what the code historically used. And we have no idea what the causes the corruption without it.
--- drivers/gpu/drm/i915/i915_gem.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/i915_gem.c +1 -0
@@ -2314,6 +2314,7 @@ i915_gem_object_get_pages(struct drm_gem page =read_cache_page_gfp (mapping, i,GFP_HIGHUSER | __GFP_COLD | + __GFP_RECLAIMABLE | gfpmask);if (IS_ERR (page)) goto err_pages;
PATCH 56/205 i915: fix lock imbalance on error path...
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel J Blueman <[email protected]>
commit f953c9353f5fe6e98fa7f32f51060a74d845b5f8 upstream.
While investigating Intel i5 Arrandale GPU lockups with -rc4, I noticed a lock imbalance.
--- drivers/gpu/drm/i915/i915_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/i915_drv.c +1 -0
@@ -341,6 +341,7 @@ int i965_reset(struct drm_device *dev, u } }else {DRM_ERROR ("Error occurred. Don't know how to reset this chip.\n" ); +mutex_unlock (&dev->struct_mutex);return -ENODEV ; }
PATCH 57/205 drm/i915: Define MI_ARB_STATE bits
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Keith Packard <[email protected]>
commit 45503ded966c98e604c9667c0b458d40666b9ef3 upstream.
The i915 memory arbiter has a register full of configuration bits which are currently not defined in the driver header file.
--- drivers/gpu/drm/i915/i915_reg.h | 64 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+)
drivers/gpu/drm/i915/i915_reg.h +64 -0
@@ -357,6 +357,70 @@#define LM_BURST_LENGTH 0x00000700#define LM_FIFO_WATERMARK 0x0000001F#define MI_ARB_STATE 0x020e4/* 915+ only */ +#define MI_ARB_MASK_SHIFT 16/* shift for enable bits */ + +/* Make render/texture TLB fetches lower priorty than associated data +* fetches. This is not turned on by default +*/ +#define MI_ARB_RENDER_TLB_LOW_PRIORITY (1 << 15) + +/* Isoch request wait on GTT enable (Display A/B/C streams). +* Make isoch requests stall on the TLB update. May cause +* display underruns (test mode only) +*/ +#define MI_ARB_ISOCH_WAIT_GTT (1 << 14) + +/* Block grant count for isoch requests when block count is +* set to a finite value. +*/ +#define MI_ARB_BLOCK_GRANT_MASK (3 << 12) +#define MI_ARB_BLOCK_GRANT_8 (0 << 12)/* for 3 display planes */ +#define MI_ARB_BLOCK_GRANT_4 (1 << 12)/* for 2 display planes */ +#define MI_ARB_BLOCK_GRANT_2 (2 << 12)/* for 1 display plane */ +#define MI_ARB_BLOCK_GRANT_0 (3 << 12)/* don't use */ + +/* Enable render writes to complete in C2/C3/C4 power states. +* If this isn't enabled, render writes are prevented in low +* power states. That seems bad to me. +*/ +#define MI_ARB_C3_LP_WRITE_ENABLE (1 << 11) + +/* This acknowledges an async flip immediately instead +* of waiting for 2TLB fetches. +*/ +#define MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE (1 << 10) + +/* Enables non-sequential data reads through arbiter +*/ +#define MI_ARB_DUAL_DATA_PHASE_DISABLE (1 << 9) + +/* Disable FSB snooping of cacheable write cycles from binner/render +* command stream +*/ +#define MI_ARB_CACHE_SNOOP_DISABLE (1 << 8) + +/* Arbiter time slice for non-isoch streams */ +#define MI_ARB_TIME_SLICE_MASK (7 << 5) +#define MI_ARB_TIME_SLICE_1 (0 << 5) +#define MI_ARB_TIME_SLICE_2 (1 << 5) +#define MI_ARB_TIME_SLICE_4 (2 << 5) +#define MI_ARB_TIME_SLICE_6 (3 << 5) +#define MI_ARB_TIME_SLICE_8 (4 << 5) +#define MI_ARB_TIME_SLICE_10 (5 << 5) +#define MI_ARB_TIME_SLICE_14 (6 << 5) +#define MI_ARB_TIME_SLICE_16 (7 << 5) + +/* Low priority grace period page size */ +#define MI_ARB_LOW_PRIORITY_GRACE_4KB (0 << 4)/* default */ +#define MI_ARB_LOW_PRIORITY_GRACE_8KB (1 << 4) + +/* Disable display A/B trickle feed */ +#define MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE (1 << 2) + +/* Set display plane priority */ +#define MI_ARB_DISPLAY_PRIORITY_A_B (0 << 0)/* display A > display B */ +#define MI_ARB_DISPLAY_PRIORITY_B_A (1 << 0)/* display B > display A */ +#define CACHE_MODE_0 0x02120/* 915+ only */ #define CM0_MASK_SHIFT 16#define CM0_IZ_OPT_DISABLE (1<<6)
PATCH 58/205 drm/i915: enable low power render writes on GEN3 hardware.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dave Airlie <[email protected]>
commit 944001201ca0196bcdb088129e5866a9f379d08c upstream.
A lot of 945GMs have had stability issues for a long time, this manifested as X hangs, blitter engine hangs, and lots of crashes.
one such report is at:
https://bugs.freedesktop.org/show_bug.cgi?id=20560
along with numerous distro bugzillas.
This only took a week of digging and hair ripping to figure out.
Tracked down and tested on a 945GM Lenovo T60,
previously running
x11perf -copypixwin500
or
x11perf -copywinpix500
repeatedly would cause the GPU to wedge within 4 or 5 tries, with random busy bits set.
After this patch no hangs were observed.
--- drivers/gpu/drm/i915/i915_gem.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/i915/i915_gem.c +10 -0
@@ -4985,6 +4985,16 @@ i915_gem_load(struct drm_device *dev)list_add (&dev_priv->mm.shrink_list, &shrink_list);spin_unlock (&shrink_list_lock); +/* On GEN3 we really need to make sure the ARB C3 LP bit is set */ +if (IS_GEN3 (dev)) { +u32 tmp =I915_READ (MI_ARB_STATE ); +if (!(tmp &MI_ARB_C3_LP_WRITE_ENABLE )) { +/* arb state is a masked write, so set bit + bit in mask */ + tmp =MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE <<MI_ARB_MASK_SHIFT ); +I915_WRITE (MI_ARB_STATE , tmp); + } + } +/* Old X drivers will take 0-2 for front, back, depth buffers */ if (!drm_core_check_feature (dev,DRIVER_MODESET )) dev_priv->fence_reg_start =3 ;
PATCH 59/205 drm/i915: Make G4X-style PLL search more permissive
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Adam Jackson <[email protected]>
commit 6ba770dc5c334aff1c055c8728d34656e0f091e2 upstream.
Fixes an Ironlake laptop with a 68.940MHz 1280x800 panel and 120MHz SSC reference clock.
More generally, the 0.488% tolerance used before is just too tight to reliably find a PLL setting. I extracted the search algorithm and modified it to find the dot clocks with maximum error over the valid range for the given output type:
http://people.freedesktop.org/~ajax/intel_g4x_find_best_pll.c
This gave:
Worst dotclock for Ironlake DAC refclk is 350000kHz (error 0.00571) Worst dotclock for Ironlake SL-LVDS refclk is 102321kHz (error 0.00524) Worst dotclock for Ironlake DL-LVDS refclk is 219642kHz (error 0.00488) Worst dotclock for Ironlake SL-LVDS SSC refclk is 84374kHz (error 0.00529) Worst dotclock for Ironlake DL-LVDS SSC refclk is 183035kHz (error 0.00488) Worst dotclock for G4X SDVO refclk is 267600kHz (error 0.00448) Worst dotclock for G4X HDMI refclk is 334400kHz (error 0.00478) Worst dotclock for G4X SL-LVDS refclk is 95571kHz (error 0.00449) Worst dotclock for G4X DL-LVDS refclk is 224000kHz (error 0.00510)
--- drivers/gpu/drm/i915/intel_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_display.c +2 -2
@@ -880,8 +880,8 @@ intel_g4x_find_best_PLL(const intel_limiintel_clock_t clock;int max_n;bool found; -/* approximately equals target * 0.00488 */ -int err_most = (target >>8 ) + (target >>10 ); +/* approximately equals target * 0.00585 */ +int err_most = (target >>8 ) + (target >>9 ); found = false;if (intel_pipe_has_type (crtc,INTEL_OUTPUT_LVDS )) {
PATCH 60/205 drm/radeon/r200: handle more hw tex coord types
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Roland Scheidegger <[email protected]>
commit 688acaa2897462e4c5e2482496e2868db0760809 upstream.
Code did not handle projected 2d and depth coordinates, meaning potentially set 3d or cube special handling might stick.
(Not sure what depth coord actually does, but I guess handling it like a normal coordinate is the right thing to do.)
Might be related to https://bugs.freedesktop.org/show_bug.cgi?id=26428
--- drivers/gpu/drm/radeon/r200.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/radeon/r200.c +2 -0
@@ -415,6 +415,8 @@ int r200_packet0_check(struct radeon_cs_/* 2D, 3D, CUBE */ switch (tmp) {case 0 : +case 3 : +case 4 :case 5 :case 6 :case 7 :
PATCH 61/205 drm/radeon/r100/r200: fix calculation of compressed cube maps
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Roland Scheidegger <[email protected]>
commit 37cf6b03f9f28c62dafb0b9ce5f1ba29c8baffa9 upstream.
This needs similar handling to other compressed textures. Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=26428
--- drivers/gpu/drm/radeon/r100.c | 58 ++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 27 deletions(-)
drivers/gpu/drm/radeon/r100.c +31 -27
@@ -2829,33 +2829,6 @@ static inline void r100_cs_track_textureDRM_ERROR ("compress format %d\n" , t->compress_format); } -static int r100_cs_track_cube (struct radeon_device *rdev, -struct r100_cs_track *track,unsigned idx) -{ -unsigned face, w, h; -struct radeon_bo *cube_robj; -unsigned long size; - -for (face =0 ; face <5 ; face++) { - cube_robj = track->textures[idx].cube_info[face].robj; - w = track->textures[idx].cube_info[face].width; - h = track->textures[idx].cube_info[face].height; - - size = w * h; - size *= track->textures[idx].cpp; - - size += track->textures[idx].cube_info[face].offset; - -if (size >radeon_bo_size (cube_robj)) { -DRM_ERROR ("Cube texture offset greater than object size %lu %lu\n" , - size,radeon_bo_size (cube_robj)); -r100_cs_track_texture_print (&track->textures[idx]); -return -1 ; - } - } -return 0 ; -} -static int r100_track_compress_size (int compress_format,int w,int h) {int block_width, block_height, block_bytes;
@@ -2886,6 +2859,37 @@ static int r100_track_compress_size(intreturn sz; } +static int r100_cs_track_cube (struct radeon_device *rdev, +struct r100_cs_track *track,unsigned idx) +{ +unsigned face, w, h; +struct radeon_bo *cube_robj; +unsigned long size; +unsigned compress_format = track->textures[idx].compress_format; + +for (face =0 ; face <5 ; face++) { + cube_robj = track->textures[idx].cube_info[face].robj; + w = track->textures[idx].cube_info[face].width; + h = track->textures[idx].cube_info[face].height; + +if (compress_format) { + size =r100_track_compress_size (compress_format, w, h); + }else + size = w * h; + size *= track->textures[idx].cpp; + + size += track->textures[idx].cube_info[face].offset; + +if (size >radeon_bo_size (cube_robj)) { +DRM_ERROR ("Cube texture offset greater than object size %lu %lu\n" , + size,radeon_bo_size (cube_robj)); +r100_cs_track_texture_print (&track->textures[idx]); +return -1 ; + } + } +return 0 ; +} +static int r100_cs_track_texture_check (struct radeon_device *rdev,struct r100_cs_track *track) {
PATCH 62/205 drm/radeon/kms: fix DP after DPMS cycle
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit a5f798ce2b9de4b14c46cb68d58c488dc1b8e215 upstream.
The transmitter needs to be enabled before the link is trained.
--- drivers/gpu/drm/radeon/radeon_encoders.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_encoders.c +2 -2
@@ -1075,6 +1075,8 @@ radeon_atom_encoder_dpms(struct drm_encoif (is_dig) {switch (mode) {case DRM_MODE_DPMS_ON : +if (!ASIC_IS_DCE4 (rdev)) +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT ,0 ,0 );if (atombios_get_encoder_mode (encoder) ==ATOM_ENCODER_MODE_DP ) {struct drm_connector *connector =radeon_get_connector_for_encoder (encoder);
@@ -1082,8 +1084,6 @@ radeon_atom_encoder_dpms(struct drm_encoif (ASIC_IS_DCE4 (rdev))atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_DP_VIDEO_ON ); } -if (!ASIC_IS_DCE4 (rdev)) -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT ,0 ,0 );break ;case DRM_MODE_DPMS_STANDBY :case DRM_MODE_DPMS_SUSPEND :
PATCH 63/205 drm/radeon/kms: CS checker texture fixes for r1xx/r2xx/r3xx
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Roland Scheidegger <[email protected]>
commit f9da52d54eb0e8822b5e7f32ab1cfa6522533d6e upstream.
fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=28459
agd5f: apply to r1xx/r2xx as well.
--- drivers/gpu/drm/radeon/r100.c | 3 +++ drivers/gpu/drm/radeon/r200.c | 3 +++ drivers/gpu/drm/radeon/r300.c | 5 +++++ 3 files changed, 11 insertions(+)
drivers/gpu/drm/radeon/r100.c +3 -0
@@ -1392,6 +1392,7 @@ static int r100_packet0_check(struct radcase RADEON_TXFORMAT_RGB332 :case RADEON_TXFORMAT_Y8 : track->textures[i].cpp =1 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case RADEON_TXFORMAT_AI88 :case RADEON_TXFORMAT_ARGB1555 :
@@ -1403,12 +1404,14 @@ static int r100_packet0_check(struct radcase RADEON_TXFORMAT_LDUDV655 :case RADEON_TXFORMAT_DUDV88 : track->textures[i].cpp =2 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case RADEON_TXFORMAT_ARGB8888 :case RADEON_TXFORMAT_RGBA8888 :case RADEON_TXFORMAT_SHADOW32 :case RADEON_TXFORMAT_LDUDUV8888 : track->textures[i].cpp =4 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case RADEON_TXFORMAT_DXT1 : track->textures[i].cpp =1 ;
drivers/gpu/drm/radeon/r200.c +3 -0
@@ -452,6 +452,7 @@ int r200_packet0_check(struct radeon_cs_case R200_TXFORMAT_RGB332 :case R200_TXFORMAT_Y8 : track->textures[i].cpp =1 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R200_TXFORMAT_AI88 :case R200_TXFORMAT_ARGB1555 :
@@ -463,6 +464,7 @@ int r200_packet0_check(struct radeon_cs_case R200_TXFORMAT_DVDU88 :case R200_TXFORMAT_AVYU4444 : track->textures[i].cpp =2 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R200_TXFORMAT_ARGB8888 :case R200_TXFORMAT_RGBA8888 :
@@ -470,6 +472,7 @@ int r200_packet0_check(struct radeon_cs_case R200_TXFORMAT_BGR111110 :case R200_TXFORMAT_LDVDU8888 : track->textures[i].cpp =4 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R200_TXFORMAT_DXT1 : track->textures[i].cpp =1 ;
drivers/gpu/drm/radeon/r300.c +5 -0
@@ -881,6 +881,7 @@ static int r300_packet0_check(struct radcase R300_TX_FORMAT_Y4X4 :case R300_TX_FORMAT_Z3Y3X2 : track->textures[i].cpp =1 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R300_TX_FORMAT_X16 :case R300_TX_FORMAT_Y8X8 :
@@ -892,6 +893,7 @@ static int r300_packet0_check(struct radcase R300_TX_FORMAT_B8G8_B8G8 :case R300_TX_FORMAT_G8R8_G8B8 : track->textures[i].cpp =2 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R300_TX_FORMAT_Y16X16 :case R300_TX_FORMAT_Z11Y11X10 :
@@ -902,14 +904,17 @@ static int r300_packet0_check(struct radcase R300_TX_FORMAT_FL_I32 :case 0x1e : track->textures[i].cpp =4 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R300_TX_FORMAT_W16Z16Y16X16 :case R300_TX_FORMAT_FL_R16G16B16A16 :case R300_TX_FORMAT_FL_I32A32 : track->textures[i].cpp =8 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R300_TX_FORMAT_FL_R32G32B32A32 : track->textures[i].cpp =16 ; + track->textures[i].compress_format =R100_TRACK_COMP_NONE ;break ;case R300_TX_FORMAT_DXT1 : track->textures[i].cpp =1 ;
PATCH 64/205 drm/radeon/kms: fix shared ddc handling
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit b2ea4aa67bfd084834edd070e0a4a47857d6db59 upstream.
Connectors with a shared ddc line can be connected to different encoders.
Reported by Pasi Kärkkäinen <[email protected]> on dri-devel
--- drivers/gpu/drm/radeon/radeon_connectors.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_connectors.c +3 -1
@@ -785,7 +785,9 @@ static enum drm_connector_status radeon_if (connector == list_connector)continue ; list_radeon_connector =to_radeon_connector (list_connector); -if (radeon_connector->devices == list_radeon_connector->devices) { +if (list_radeon_connector->shared_ddc && + (list_radeon_connector->ddc_bus->rec.i2c_id == + radeon_connector->ddc_bus->rec.i2c_id)) {if (drm_detect_hdmi_monitor (radeon_connector->edid)) {if (connector->connector_type ==DRM_MODE_CONNECTOR_DVID ) {kfree (radeon_connector->edid);
PATCH 65/205 drm/radeon/kms: fix shared ddc harder
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 42f14c4b454946650cf0bf66e0b631d02e328f61 upstream.
This fixes a regression caused by b2ea4aa67bfd084834edd070e0a4a47857d6db59 due to the way shared ddc with multiple digital connectors was handled.
You generally have two cases where DDC lines are shared:
- HDMI + VGA
- HDMI + DVI-D
HDMI + VGA is easy to deal with because you can check the EDID for the to see if the attached monitor is digital. A shared DDC line with two digital connectors is more complex. You can't use the hdmi bits in the EDID since they may not be there with DVI<->HDMI adapters. In this case all we can do is check the HPD pins to see which is connected as we have no way of knowing using the EDID.
--- drivers/gpu/drm/radeon/radeon_connectors.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-)
drivers/gpu/drm/radeon/radeon_connectors.c +9 -14
@@ -771,14 +771,14 @@ static enum drm_connector_status radeon_ }else ret = connector_status_connected; -/* multiple connectors on the same encoder with the same ddc line -* This tends to be HDMI and DVI on the same encoder with the -* same ddc line. If the edid says HDMI, consider the HDMI port -* connected and the DVI port disconnected. If the edid doesn't -* say HDMI, vice versa. +/* This gets complicated. We have boards with VGA + HDMI with a +* shared DDC line and we have boards with DVI-D + HDMI with a shared +* DDC line. The latter is more complex because with DVI<->HDMI adapters +* you don't really know what's connected to which port as both are digital. */ if (radeon_connector->shared_ddc && (ret == connector_status_connected)) {struct drm_device *dev = connector->dev; +struct radeon_device *rdev = dev->dev_private;struct drm_connector *list_connector;struct radeon_connector *list_radeon_connector;list_for_each_entry (list_connector, &dev->mode_config.connector_list, head) {
@@ -788,15 +788,10 @@ static enum drm_connector_status radeon_if (list_radeon_connector->shared_ddc && (list_radeon_connector->ddc_bus->rec.i2c_id == radeon_connector->ddc_bus->rec.i2c_id)) { -if (drm_detect_hdmi_monitor (radeon_connector->edid)) { -if (connector->connector_type ==DRM_MODE_CONNECTOR_DVID ) { -kfree (radeon_connector->edid); - radeon_connector->edid =NULL ; - ret = connector_status_disconnected; - } - }else { -if ((connector->connector_type ==DRM_MODE_CONNECTOR_HDMIA ) || - (connector->connector_type ==DRM_MODE_CONNECTOR_HDMIB )) { +/* cases where both connectors are digital */ +if (list_connector->connector_type !=DRM_MODE_CONNECTOR_VGA ) { +/* hpd is our only option in this case */ +if (!radeon_hpd_sense (rdev, radeon_connector->hpd.hpd)) {kfree (radeon_connector->edid); radeon_connector->edid =NULL ; ret = connector_status_disconnected;
PATCH 66/205 drm/radeon/kms: add quirk for ASUS HD 3600 board
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit e153b70b89770968a704eda0b55707c6066b2d44 upstream.
Connector is actually DVI rather than HDMI.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/radeon/radeon_atombios.c +9 -0
@@ -280,6 +280,15 @@ static bool radeon_atom_apply_quirks(str } } +/* ASUS HD 3600 board lists the DVI port as HDMI */ +if ((dev->pdev->device ==0x9598 ) && + (dev->pdev->subsystem_vendor ==0x1043 ) && + (dev->pdev->subsystem_device ==0x01e4 )) { +if (*connector_type ==DRM_MODE_CONNECTOR_HDMIA ) { + *connector_type =DRM_MODE_CONNECTOR_DVII ; + } + } +/* ASUS HD 3450 board lists the DVI port as HDMI */ if ((dev->pdev->device == 0x95C5) && (dev->pdev->subsystem_vendor == 0x1043) &&
PATCH 67/205 drm/radeon/kms: fix possible mis-detection of sideport on rs690/rs740
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 5099fa7f23d3711538cbe9fe072b4ce1ba814035 upstream.
Check ulBootUpMemoryClock on AMD IGPs.
Fix regression noticed by Torsten Kaiser <[email protected]>
--- drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +9 -2
@@ -1030,8 +1030,15 @@ bool radeon_atombios_sideport_present(st data_offset);switch (crev) {case 1 : -if (igp_info->info.ucMemoryType &0xf0 ) -return true; +/* AMD IGPS */ +if ((rdev->family ==CHIP_RS690 ) || + (rdev->family ==CHIP_RS740 )) { +if (igp_info->info.ulBootUpMemoryClock) +return true; + }else { +if (igp_info->info.ucMemoryType &0xf0 ) +return true; + }break ;case 2 :if (igp_info->info_2.ucMemoryType &0x0f )
PATCH 68/205 drm/radeon/kms: fix legacy LVDS dpms sequence
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 15cb02c0a0338ee724bf23e31c7c410ecbffeeba upstream.
Add delay after turning off the LVDS encoder.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=16389
--- drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/radeon_legacy_encoders.c +1 -0
@@ -108,6 +108,7 @@ static void radeon_legacy_lvds_dpms(struudelay (panel_pwr_delay *1000 );WREG32 (RADEON_LVDS_GEN_CNTL , lvds_gen_cntl);WREG32_PLL (RADEON_PIXCLKS_CNTL , pixclks_cntl); +udelay (panel_pwr_delay *1000 );break ; }
PATCH 69/205 drm/radeon/kms: fix legacy tv-out pal mode
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit ff3f011cd859072b5d6e64c0b968cff9bfdc0b37 upstream.
fixes fdo bug 26915
--- drivers/gpu/drm/radeon/radeon_legacy_tv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_legacy_tv.c +2 -2
@@ -642,8 +642,8 @@ void radeon_legacy_tv_mode_set(struct dr } flicker_removal = (tmp +500 ) /1000 ; -if (flicker_removal <2 ) - flicker_removal =2 ; +if (flicker_removal <3 ) + flicker_removal =3 ;for (i =0 ; i <ARRAY_SIZE (SLOPE_limit); ++i) {if (flicker_removal == SLOPE_limit[i])break ;
PATCH 70/205 tpm_tis: fix subsequent suspend failures
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajiv Andrade <[email protected]>
commit 59f6fbe4291fcc078ba26ce4edf8373a7620a13a upstream.
Fix subsequent suspends by issuing tpm_continue_selftest during resume. Otherwise, the tpm chip seems to be not fully initialized and will reject the save state command during suspend, thus preventing the whole system to suspend.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16256
--- drivers/char/tpm/tpm_tis.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/char/tpm/tpm_tis.c +8 -1
@@ -623,7 +623,14 @@ static int tpm_tis_pnp_suspend(struct pnstatic int tpm_tis_pnp_resume (struct pnp_dev *dev) { -return tpm_pm_resume (&dev->dev); +struct tpm_chip *chip =pnp_get_drvdata (dev); +int ret; + + ret =tpm_pm_resume (&dev->dev); +if (!ret) +tpm_continue_selftest (chip); + +return ret; }static struct pnp_device_id tpm_pnp_tbl[]__devinitdata = {
PATCH 71/205 IPv6: keep route for tentative address
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stephen Hemminger <[email protected]>
(cherry picked from commit 93fa159abe50d3c55c7f83622d3f5c09b6e06f4b)
Recent changes preserve IPv6 address when link goes down (good). But would cause address to point to dead dst entry (bad). The simplest fix is to just not delete route if address is being held for later use.
--- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +2 -1
@@ -4047,7 +4047,8 @@ static void __ipv6_ifa_notify(int event,addrconf_leave_anycast (ifp);addrconf_leave_solict (ifp->idev, &ifp->addr);dst_hold (&ifp->rt->u.dst); -if (ip6_del_rt (ifp->rt)) + +if (ifp->dead &&ip6_del_rt (ifp->rt))dst_free (&ifp->rt->u.dst);break ; }
PATCH 72/205 IPv6: only notify protocols if address is completely gone
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stephen Hemminger <[email protected]>
(cherry picked from commit 8595805aafc8b077e01804c9a3668e9aa3510e89)
The notifier for address down should only be called if address is completely gone, not just being marked as tentative on link transition. The code in net-next would case bonding/sctp/s390 to see address disappear on link down, but they would never see it reappear on link up.
--- net/ipv6/addrconf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +3 -1
@@ -2729,7 +2729,9 @@ static int addrconf_ifdown(struct net_dewrite_unlock_bh (&idev->lock);__ipv6_ifa_notify (RTM_DELADDR , ifa); -atomic_notifier_call_chain (&inet6addr_chain,NETDEV_DOWN , ifa); +if (ifa->dead) +atomic_notifier_call_chain (&inet6addr_chain, +NETDEV_DOWN , ifa);in6_ifa_put (ifa);write_lock_bh (&idev->lock);
PATCH 73/205 ipvs: Add missing locking during connection table hashing and unhashing
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sven Wegener <[email protected]>
commit aea9d711f3d68c656ad31ab578ecfb0bb5cd7f97 upstream.
The code that hashes and unhashes connections from the connection table is missing locking of the connection being modified, which opens up a race condition and results in memory corruption when this race condition is hit.
Here is what happens in pretty verbose form:
CPU 0 CPU 1
------------ ------------
An active connection is terminated and
we schedule ip_vs_conn_expire() on this
CPU to expire this connection.
IRQ assignment is changed to this CPU, but the expire timer stays scheduled on the other CPU.
New connection from same ip:port comes in right before the timer expires, we find the inactive connection in our connection table and get a reference to it. We proper lock the connection in tcp_state_transition() and read the connection flags in set_tcp_state().
ip_vs_conn_expire() gets called, we
unhash the connection from our
connection table and remove the hashed
flag in ip_vs_conn_unhash(), without
proper locking!
While still holding proper locks we write the connection flags in set_tcp_state() and this sets the hashed flag again.
ip_vs_conn_expire() fails to expire the
connection, because the other CPU has
incremented the reference count. We try
to re-insert the connection into our
connection table, but this fails inip_vs_conn_hash(), because the hashed
flag has been set by the other CPU. We
re-schedule execution ofip_vs_conn_expire(). Now this connection
has the hashed flag set, but isn't
actually hashed in our connection table
and has a dangling list_head.
We drop the reference we held on the connection and schedule the expire timer for timeouting the connection on this CPU. Further packets won't be able to find this connection in our connection table.
ip_vs_conn_expire() gets called again, we think it's already hashed, but the list_head is dangling and while removing the connection from our connection table we write to the memory location where this list_head points to.
The result will probably be a kernel oops at some other point in time.
This race condition is pretty subtle, but it can be triggered remotely. It needs the IRQ assignment change or another circumstance where packets coming from the same ip:port for the same service are being processed on different CPUs. And it involves hitting the exact time at which ip_vs_conn_expire() gets called. It can be avoided by making sure that all packets from one connection are always processed on the same CPU and can be made harder to exploit by changing the connection timeouts to some custom values.
--- net/netfilter/ipvs/ip_vs_conn.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_conn.c +4 -0
@@ -162,6 +162,7 @@ static inline int ip_vs_conn_hash(struct hash =ip_vs_conn_hashkey (cp->af, cp->protocol, &cp->caddr, cp->cport);ct_write_lock (hash); +spin_lock (&cp->lock);if (!(cp->flags &IP_VS_CONN_F_HASHED )) {list_add (&cp->c_list, &ip_vs_conn_tab[hash]);
@@ -174,6 +175,7 @@ static inline int ip_vs_conn_hash(struct ret =0 ; } +spin_unlock (&cp->lock);ct_write_unlock (hash);return ret;
@@ -193,6 +195,7 @@ static inline int ip_vs_conn_unhash(stru hash =ip_vs_conn_hashkey (cp->af, cp->protocol, &cp->caddr, cp->cport);ct_write_lock (hash); +spin_lock (&cp->lock);if (cp->flags &IP_VS_CONN_F_HASHED ) {list_del (&cp->c_list);
@@ -202,6 +205,7 @@ static inline int ip_vs_conn_unhash(stru }else ret =0 ; +spin_unlock (&cp->lock);ct_write_unlock (hash);return ret;
PATCH 74/205 ipv6: fix NULL reference in proxy neighbor discovery
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: stephen hemminger <[email protected]>
commit 9f888160bdcccf0565dd2774956b8d9456e610be upstream.
The addition of TLLAO option created a kernel OOPS regression for the case where neighbor advertisement is being sent via proxy path. When using proxy, ipv6_get_ifaddr() returns NULL causing the NULL dereference.
Change causing the bug was:
commit f7734fdf61ec6bb848e0bafc1fb8bad2c124bb50
Author: Octavian Purdila <[email protected]> Date: Fri Oct 2 11:39:15 2009 +0000
make TLLAO option for NA packets configurable
--- net/ipv6/ndisc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ndisc.c +1 -1
@@ -586,6 +586,7 @@ static void ndisc_send_na(struct net_dev src_addr = solicited_addr;if (ifp->flags &IFA_F_OPTIMISTIC ) override =0 ; + inc_opt |= ifp->idev->cnf.force_tllao;in6_ifa_put (ifp); }else { if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
@@ -599,7 +600,6 @@ static void ndisc_send_na(struct net_dev icmp6h.icmp6_solicited = solicited; icmp6h.icmp6_override = override; - inc_opt |= ifp->idev->cnf.force_tllao;__ndisc_send (dev, neigh, daddr, src_addr, &icmp6h, solicited_addr, inc_opt ?ND_OPT_TARGET_LL_ADDR :0 );
PATCH 75/205 netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Dumazet <[email protected]>
commit 499031ac8a3df6738f6186ded9da853e8ea18253 upstream.
We should release dst if dst->error is set.
Bug introduced in 2.6.14 by commit e104411b82f5c ([XFRM]: Always release dst_entry on error in xfrm_lookup)
--- net/ipv6/netfilter/ip6t_REJECT.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv6/netfilter/ip6t_REJECT.c +4 -2
@@ -96,9 +96,11 @@ static void send_reset(struct net *net, fl.fl_ip_dport = otcph.source;security_skb_classify_flow (oldskb, &fl); dst =ip6_route_output (net,NULL , &fl); -if (dst ==NULL ) +if (dst ==NULL || dst->error) { +dst_release (dst);return ; -if (dst->error ||xfrm_lookup (net, &dst, &fl,NULL ,0 )) + } +if (xfrm_lookup (net, &dst, &fl,NULL ,0 ))return ; hh_len = (dst->dev->hard_header_len +15 )&~15 ;
PATCH 76/205 SCSI: aacraid: Eliminate use after free
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Julia Lawall <[email protected]>
commit 8a52da632ceb9d8b776494563df579e87b7b586b upstream.
The debugging code using the freed structure is moved before the kfree.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@free@
expression E;
position p;
@@
kfree@p(E)
@@
expression free.E, subE<=free.E, E1;
position free.p;
@@
kfree@p(E)
...
(
subE = E1
|
* E
)
// </smpl>
--- drivers/scsi/aacraid/commctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/aacraid/commctrl.c +2 -2
@@ -655,9 +655,9 @@ static int aac_send_raw_srb(struct aac_d/* Does this really need to be GFP_DMA? */ p =kmalloc (usg->sg[i].count,GFP_KERNEL |__GFP_DMA);if (!p) { -kfree (usg); -dprintk ((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n" , +dprintk ((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n" , usg->sg[i].count,i,usg->count)); +kfree (usg); rcode = -ENOMEM ; goto cleanup; }
PATCH 77/205 md: raid10: Fix null pointer dereference in fix_read_error()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Prasanna S. Panchamukhi <[email protected]>
commit 0544a21db02c1d8883158fd6f323364f830a120a upstream.
Such NULL pointer dereference can occur when the driver was fixing the read errors/bad blocks and the disk was physically removed causing a system crash. This patch check if thercu_dereference() returns valid rdev before accessing it in fix_read_error().
--- drivers/md/raid10.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/md/raid10.c +6 -6
@@ -1487,14 +1487,14 @@ static void fix_read_error(conf_t *conf,int sectors = r10_bio->sectors;mdk_rdev_t *rdev;int max_read_errors =atomic_read (&mddev->max_corr_read_errors); +int d = r10_bio->devs[r10_bio->read_slot].devnum;rcu_read_lock (); - { -int d = r10_bio->devs[r10_bio->read_slot].devnum; + rdev =rcu_dereference (conf->mirrors[d].rdev); +if (rdev) {/* If rdev is not NULL */ char b[BDEVNAME_SIZE ];int cur_read_error_count =0 ; - rdev =rcu_dereference (conf->mirrors[d].rdev);bdevname (rdev->bdev, b);if (test_bit (Faulty, &rdev->flags)) {
@@ -1534,7 +1534,7 @@ static void fix_read_error(conf_t *conf,rcu_read_lock (); do { - int d = r10_bio->devs[sl].devnum; + d = r10_bio->devs[sl].devnum; rdev = rcu_dereference(conf->mirrors[d].rdev); if (rdev && test_bit(In_sync, &rdev->flags)) {
@@ -1568,7 +1568,7 @@ static void fix_read_error(conf_t *conf,rcu_read_lock ();while (sl != r10_bio->read_slot) {char b[BDEVNAME_SIZE ]; -int d; +if (sl==0 ) sl = conf->copies; sl--;
@@ -1604,7 +1604,7 @@ static void fix_read_error(conf_t *conf, } sl = start;while (sl != r10_bio->read_slot) { -int d; +if (sl==0 ) sl = conf->copies; sl--;
PATCH 78/205 amd64-agp: Probe unknown AGP devices the right way
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ben Hutchings <[email protected]>
commit 6fd024893911dcb51b4a0aa71971db5ba38f7071 upstream.
The current initialisation code probes 'unsupported' AGP devices simply by calling its own probe function. It does not lock these devices or even check whether another driver is already bound to them.
We must use the device core to manage this. So if the specific device id table didn't match anything and agp_try_unsupported=1, switch the device id table and call driver_attach() again.
--- drivers/char/agp/amd64-agp.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/char/agp/amd64-agp.c +15 -12
@@ -499,6 +499,10 @@ static int __devinit agp_amd64_probe(stru8 cap_ptr;int err; +/* The Highlander principle */ +if (agp_bridges_found) +return -ENODEV ; + cap_ptr =pci_find_capability (pdev,PCI_CAP_ID_AGP );if (!cap_ptr)return -ENODEV ;
@@ -562,6 +566,8 @@ static void __devexit agp_amd64_remove(s amd64_aperture_sizes[bridge->aperture_size_idx].size);agp_remove_bridge (bridge);agp_put_bridge (bridge); + + agp_bridges_found--; }#ifdef CONFIG_PM
@@ -709,6 +715,11 @@ static struct pci_device_id agp_amd64_pcMODULE_DEVICE_TABLE (pci, agp_amd64_pci_table); +static DEFINE_PCI_DEVICE_TABLE (agp_amd64_pci_promisc_table) = { + {PCI_DEVICE_CLASS (0 ,0 ) }, + { } +}; +static struct pci_driver agp_amd64_pci_driver = { .name ="agpgart-amd64" , .id_table = agp_amd64_pci_table,
@@ -734,7 +745,6 @@ int __init agp_amd64_init(void)return err;if (agp_bridges_found ==0 ) { -struct pci_dev *dev;if (!agp_try_unsupported && !agp_try_unsupported_boot) { printk(KERN_INFO PFX "No supported AGP bridge found.\n");#ifdef MODULE
@@ -750,17 +760,10 @@ int __init agp_amd64_init(void)return -ENODEV ;/* Look for any AGP bridge */ - dev =NULL ; - err = -ENODEV ; -for_each_pci_dev (dev) { -if (!pci_find_capability (dev,PCI_CAP_ID_AGP )) -continue ; -/* Only one bridge supported right now */ -if (agp_amd64_probe (dev,NULL ) ==0 ) { - err =0 ; -break ; - } - } + agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table; + err =driver_attach (&agp_amd64_pci_driver.driver); +if (err ==0 && agp_bridges_found ==0 ) + err = -ENODEV ; }return err; }
PATCH 79/205 amd64_edac: Fix syndrome calculation on K8
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Borislav Petkov <[email protected]>
commit 41c310447fe06bcedc22b75752c18b60e0b9521b upstream.
When calculating the DCT channel from the syndrome we need to know the syndrome type (x4 vs x8). On F10h, this is read out from extended PCI cfg space register F3x180 while on K8 we only support x4 syndromes and don't have extended PCI config space anyway.
Make the code accessing F3x180 F10h only and fall back to x4 syndromes on everything else.
--- drivers/edac/amd64_edac.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/edac/amd64_edac.c +12 -12
@@ -1958,20 +1958,20 @@ static int get_channel_from_ecc_syndromeu32 value =0 ;int err_sym =0 ; -amd64_read_pci_cfg (pvt->misc_f3_ctl,0x180 , &value); +if (boot_cpu_data.x86 ==0x10 ) { -/* F3x180[EccSymbolSize]=1, x8 symbols */ -if (boot_cpu_data.x86 ==0x10 && - boot_cpu_data.x86_model >7 && - value &BIT (25 )) { - err_sym =decode_syndrome (syndrome, x8_vectors, -ARRAY_SIZE (x8_vectors),8 ); -return map_err_sym_to_channel (err_sym,8 ); - }else { - err_sym =decode_syndrome (syndrome, x4_vectors, -ARRAY_SIZE (x4_vectors),4 ); -return map_err_sym_to_channel (err_sym,4 ); +amd64_read_pci_cfg (pvt->misc_f3_ctl,0x180 , &value); + +/* F3x180[EccSymbolSize]=1 => x8 symbols */ +if (boot_cpu_data.x86_model >7 && + value &BIT (25 )) { + err_sym =decode_syndrome (syndrome, x8_vectors, +ARRAY_SIZE (x8_vectors),8 ); +return map_err_sym_to_channel (err_sym,8 ); + } } + err_sym =decode_syndrome (syndrome, x4_vectors,ARRAY_SIZE (x4_vectors),4 ); +return map_err_sym_to_channel (err_sym,4 ); }/*
PATCH 80/205 perf, x86: Fix incorrect branches event on AMD CPUs
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vince Weaver <[email protected]>
commit f287d332ce835f77a4f5077d2c0ef1e3f9ea42d2 upstream.
While doing some performance counter validation tests on some assembly language programs I noticed that the "branches:u" count was very wrong on AMD machines.
It looks like the wrong event was selected.
LKML-Reference: <[email protected]>
--- arch/x86/kernel/cpu/perf_event_amd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/perf_event_amd.c +2 -2
@@ -102,8 +102,8 @@ static const u64 amd_perfmon_event_map[] [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0, [PERF_COUNT_HW_CACHE_REFERENCES] = 0x0080, [PERF_COUNT_HW_CACHE_MISSES] = 0x0081, - [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c4, - [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c5, + [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2, + [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3, };static u64 amd_pmu_event_map (int hw_event)
PATCH 81/205 ARM: 6205/1: perf: ensure counter delta is treated as unsigned
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Will Deacon <[email protected]>
commit 446a5a8b1eb91a6990e5c8fe29f14e7a95b69132 upstream.
Hardware performance counters on ARM are 32-bits wide but atomic64_t variables are used to represent counter data in the hw_perf_event structure.
The armpmu_event_update function right-shifts a signed 64-bit delta variable and adds the result to the event count. This can lead to shifting in sign-bits if the MSB of the 32-bit counter value is set. This results in perf output such as:
Performance counter stats for 'sleep 20':
18446744073460670464 cycles <-- 0xFFFFFFFFF12A6000
7783773 instructions # 0.000 IPC
465 context-switches
161 page-faults
1172393 branches20.154242147 seconds time elapsed
This patch ensures that the delta value is treated as unsigned so that the right shift sets the upper bits to zero.
--- arch/arm/kernel/perf_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/perf_event.c +1 -1
@@ -165,7 +165,7 @@ armpmu_event_update(struct perf_event *e {int shift =64 -32 ;s64 prev_raw_count, new_raw_count; -s64 delta; +u64 delta; again: prev_raw_count =atomic64_read (&hwc->prev_count);
PATCH 82/205 perf: Resurrect flat callchains
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Frederic Weisbecker <[email protected]>
commit 97aa1052739c6a06cb6b0467dbf410613d20bc97 upstream.
Initialize the callchain radix tree root correctly.
When we walk through the parents, we must stop after the root, but since it wasn't well initialized, its parent pointer was random.
Also the number of hits was random because uninitialized, hence it was part of the callchain while the root doesn't contain anything.
This fixes segfaults and percentages followed by empty callchains while running:
perf report -g flat
--- tools/perf/util/callchain.h | 3 +++ 1 file changed, 3 insertions(+)
tools/perf/util/callchain.h +3 -0
@@ -48,6 +48,9 @@ static inline void callchain_init(structINIT_LIST_HEAD (&node->brothers);INIT_LIST_HEAD (&node->children);INIT_LIST_HEAD (&node->val); + + node->parent =NULL ; + node->hit =0 ; }static inline u64 cumul_hits (struct callchain_node *node)
PATCH 83/205 x86: Send a SIGTRAP for user icebp traps
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Frederic Weisbecker <[email protected]>
commit a1e80fafc9f0742a1776a0490258cb64912411b0 upstream.
Before we had a generic breakpoint layer, x86 used to send a sigtrap for any debug event that happened in userspace, except if it was caused by lazy dr7 switches.
Currently we only send such signal for single step or breakpoint events.
However, there are three other kind of debug exceptions:
- debug register access detected: trigger an exception if the next instruction touches the debug registers. We don't use it.
- task switch, but we don't use tss.
- icebp/int01 trap. This instruction (0xf1) is undocumented and generates an int 1 exception. Unlike single step through TF flag, it doesn't set the single step origin of the exception in dr6.
icebp then used to be reported in userspace using trap signals but this have been incidentally broken with the new breakpoint code. Reenable this. Since this is the only debug event that doesn't set anything in dr6, this is all we have to check.
This fixes a regression in Wine where World Of Warcraft got broken as it uses this for software protection checks purposes. And probably other apps do.
--- arch/x86/kernel/traps.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/x86/kernel/traps.c +10 -1
@@ -529,6 +529,7 @@ asmlinkage __kprobes struct pt_regs *syn dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) {struct task_struct *tsk = current; +int user_icebp =0 ;unsigned long dr6;int si_code;
@@ -537,6 +538,14 @@ dotraplinkage void __kprobes do_debug(st/* Filter out all the reserved bits which are preset to 1 */ dr6 &= ~DR6_RESERVED ; +/* +* If dr6 has no reason to give us about the origin of this trap, +* then it's very likely the result of an icebp/int01 trap. +* User wants a sigtrap for that. +*/ +if (!dr6 &&user_mode (regs)) + user_icebp =1 ; +/* Catch kmemcheck conditions first of all! */ if ((dr6 &DR_STEP ) &&kmemcheck_trap (regs))return ;
@@ -578,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st regs->flags &= ~X86_EFLAGS_TF ; } si_code =get_si_code (tsk->thread.debugreg6); -if (tsk->thread.debugreg6 & (DR_STEP |DR_TRAP_BITS )) +if (tsk->thread.debugreg6 & (DR_STEP |DR_TRAP_BITS ) || user_icebp)send_sigtrap (tsk, regs, error_code, si_code);preempt_conditional_cli (regs);
PATCH 84/205 x86: Fix vsyscall on gcc 4.5 with -Os
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andi Kleen <[email protected]>
commit 124482935fb7fb9303c8a8ab930149c6a93d9910 upstream.
This fixes the -Os breaks with gcc 4.5 bug. rdtsc_barrier needs to be force inlined, otherwise user space will jump into kernel space and kill init.
This also addresses http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44129
I believe.
LKML-Reference: <[email protected]>
--- arch/x86/include/asm/system.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/system.h +1 -1
@@ -451,7 +451,7 @@ void stop_this_cpu(void *dummy);* * (Could use an alternative three way for this if there was one.) */ -static inline void rdtsc_barrier (void ) +static __always_inline void rdtsc_barrier(void) {alternative (ASM_NOP3 ,"mfence" ,X86_FEATURE_MFENCE_RDTSC );alternative (ASM_NOP3 ,"lfence" ,X86_FEATURE_LFENCE_RDTSC );
PATCH 85/205 x86, Calgary: Increase max PHB number
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Darrick J. Wong <[email protected]>
commit 499a00e92dd9a75395081f595e681629eb1eebad upstream.
Newer systems (x3950M2) can have 48 PHBs per chassis and 8 chassis, so bump the limits up and provide an explanation of the requirements for each class.
LKML-Reference: <[email protected]>
--- arch/x86/kernel/pci-calgary_64.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/kernel/pci-calgary_64.c +10 -5
@@ -103,11 +103,16 @@ int use_calgary __read_mostly = 0;#define PMR_SOFTSTOPFAULT 0x40000000#define PMR_HARDSTOP 0x20000000 -#define MAX_NUM_OF_PHBS 8/* how many PHBs in total? */ -#define MAX_NUM_CHASSIS 8/* max number of chassis */ -/* MAX_PHB_BUS_NUM is the maximal possible dev->bus->number */ -#define MAX_PHB_BUS_NUM (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2) -#define PHBS_PER_CALGARY 4 +/* +* The maximum PHB bus number. +* x3950M2 (rare): 8 chassis, 48 PHBs per chassis = 384 +* x3950M2: 4 chassis, 48 PHBs per chassis = 192 +* x3950 (PCIE): 8 chassis, 32 PHBs per chassis = 256 +* x3950 (PCIX): 8 chassis, 16 PHBs per chassis = 128 +*/ +#define MAX_PHB_BUS_NUM 384 + +#define PHBS_PER_CALGARY 4/* register offsets in Calgary's internal register space */ static const unsigned long tar_offsets[] = {
PATCH 86/205 x86, Calgary: Limit the max PHB number to 256
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Darrick J. Wong <[email protected]>
commit d596043d71ff0d7b3d0bead19b1d68c55f003093 upstream.
The x3950 family can have as many as 256 PCI buses in a single system, so change the limits to the maximum. Since there can only be 256 PCI buses in one domain, we no longer need the BUG_ON check.
LKML-Reference: <[email protected]>
--- arch/x86/kernel/pci-calgary_64.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/x86/kernel/pci-calgary_64.c +1 -3
@@ -110,7 +110,7 @@ int use_calgary __read_mostly = 0;* x3950 (PCIE): 8 chassis, 32 PHBs per chassis = 256 * x3950 (PCIX): 8 chassis, 16 PHBs per chassis = 128 */ -#define MAX_PHB_BUS_NUM 384 +#define MAX_PHB_BUS_NUM 256#define PHBS_PER_CALGARY 4
@@ -1056,8 +1056,6 @@ static int __init calgary_init_one(strucstruct iommu_table *tbl;int ret; -BUG_ON (dev->bus->number >=MAX_PHB_BUS_NUM ); - bbar =busno_to_bbar (dev->bus->number); ret =calgary_setup_tar (dev, bbar);if (ret)
PATCH 87/205 sched: Prevent compiler from optimising the sched_avg_update() loop
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Will Deacon <[email protected]>
commit 0d98bb2656e9bd2dfda2d089db1fe1dbdab41504 upstream.
GCC 4.4.1 on ARM has been observed to replace the while loop in sched_avg_update with a call to uldivmod, resulting in the following build failure at link-time:
kernel/built-in.o: In function `sched_avg_update':
kernel/sched.c:1261: undefined reference to __aeabi_uldivmod' kernel/sched.c:1261: undefined reference to __aeabi_uldivmod'
make: *** [.tmp_vmlinux1] Error 1
This patch introduces a fake data hazard to the loop body to prevent the compiler optimising the loop away.
--- kernel/sched.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/sched.c +6 -0
@@ -1251,6 +1251,12 @@ static void sched_avg_update(struct rq *s64 period =sched_avg_period ();while ((s64)(rq->clock - rq->age_stamp) > period) { +/* +* Inline assembly required to prevent the compiler +* optimising this loop into a divmod call. +* See __iter_div_u64_rem() for another example of this. +*/ + asm("" :"+rm" (rq->age_stamp)); rq->age_stamp += period; rq->rt_avg /=2 ; }
PATCH 88/205 ipmi: set schedule_timeout_wait() value back to one
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Martin Wilck <[email protected]>
commit 8d1f66dc9b4f80a1441bc1c33efa98aca99e8813 upstream.
Fix a regression introduced by ae74e823cb7d ("ipmi: add parameter to limit CPU usage in kipmid").
Some systems were seeing CPU usage go up dramatically with the recent changes to try to reduce timer usage in the IPMI driver. This was traced down to schedule_timeout_interruptible(1) being changed to schedule_timeout_interruptbile(0). Revert that part of the change.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16147
--- drivers/char/ipmi/ipmi_si_intf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/ipmi/ipmi_si_intf.c +1 -1
@@ -1003,7 +1003,7 @@ static int ipmi_thread(void *data)else if (smi_result ==SI_SM_CALL_WITH_DELAY && busy_wait)schedule ();else -schedule_timeout_interruptible (0 ); +schedule_timeout_interruptible (1 ); }return 0 ; }
PATCH 89/205 sched: Fix over-scheduling bug
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex,Shi <[email protected]>
commit 3c93717cfa51316e4dbb471e7c0f9d243359d5f8 upstream.
Commit e70971591 ("sched: Optimize unused cgroup configuration") introduced an imbalanced scheduling bug.
If we do not use CGROUP, function update_h_load won't update h_load. When the system has a large number of tasks far more than logical CPU number, the incorrect cfs_rq[cpu]->h_load value will cause load_balance() to pull too many tasks to the local CPU from the busiest CPU. So the busiest CPU keeps going in a round robin. That will hurt performance.
The issue was found originally by a scientific calculation workload that developed by Yanmin. With that commit, the workload performance drops about 40%.
CPU before after
00 : 2 : 7 01 : 1 : 7 02 : 11 : 6 03 : 12 : 7 04 : 6 : 6 05 : 11 : 7 06 : 10 : 6 07 : 12 : 7 08 : 11 : 6 09 : 12 : 6 10 : 1 : 6 11 : 1 : 6 12 : 6 : 6 13 : 2 : 6 14 : 2 : 6 15 : 1 : 6
LKML-Reference: <1276754893.9452.5442.camel@debian>
--- kernel/sched.c | 3 --- 1 file changed, 3 deletions(-)
kernel/sched.c +0 -3
@@ -1675,9 +1675,6 @@ static void update_shares(struct sched_dstatic void update_h_load (long cpu) { -if (root_task_group_empty ()) -return ; -walk_tg_tree (tg_load_down, tg_nop, (void *)cpu); }
PATCH 90/205 genirq: Deal with desc->set_type() changing desc->chip
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Gleixner <[email protected]>
commit 4673247562e39a17e09440fa1400819522ccd446 upstream.
The set_type() function can change the chip implementation when the trigger mode changes. That might result in using an non-initialized irq chip when called from __setup_irq() or when called via set_irq_type() on an already enabled irq.
The set_irq_type() function should not be called on an enabled irq, but because we forgot to put a check into it, we have a bunch of users which grew the habit of doing that and it never blew up as the function is serialized via desc->lock against all users of desc->chip and they never hit the non-initialized irq chip issue.
The easy fix for the __setup_irq() issue would be to move the irq_chip_set_defaults(desc->chip) call after the trigger setting to make sure that a chip change is covered.
But as we have already users, which do the type setting after request_irq(), the safe fix for now is to call irq_chip_set_defaults() from __irq_set_trigger() when desc->set_type() changed the irq chip.
It needs a deeper analysis whether we should refuse to change the chip on an already enabled irq, but that'd be a large scale change to fix all the existing users. So that's neither stable nor 2.6.35 material.
--- kernel/irq/manage.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/irq/manage.c +3 -0
@@ -440,6 +440,9 @@ int __irq_set_trigger(struct irq_desc *d/* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */ desc->status &= ~(IRQ_LEVEL |IRQ_TYPE_SENSE_MASK ); desc->status |= flags; + +if (chip != desc->chip) +irq_chip_set_defaults (desc->chip); }return ret;
PATCH 91/205 cfq: Dont allow queue merges for queues that have no process references
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeff Moyer <[email protected]>
commit c10b61f0910466b4b99c266a7d76ac4390743fb5 upstream.
Hi,
A user reported a kernel bug when running a particular program that did the following:
created 32 threads
- each thread took a mutex, grabbed a global offset, added a buffer size to that offset, released the lock
- read from the given offset in the file
- created a new thread to do the same
- exited
The result is that cfq's close cooperator logic would trigger, as the threads were issuing I/O within the mean seek distance of one another. This workload managed to routinely trigger a use after free bug when walking the list of merge candidates for a particular cfqq (cfqq->new_cfqq). The logic used for merging queues looks like this:
static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq)
{
int process_refs, new_process_refs;
struct cfq_queue *__cfqq;
/* Avoid a circular list and skip interim queue merges */
while ((__cfqq = new_cfqq->new_cfqq)) {
if (__cfqq == cfqq)
return;
new_cfqq = __cfqq;
}
process_refs = cfqq_process_refs(cfqq);
/*
* If the process for the cfqq has gone away, there is no
* sense in merging the queues.
*/
if (process_refs == 0)
return;
/*
* Merge in the direction of the lesser amount of work.
*/
new_process_refs = cfqq_process_refs(new_cfqq);
if (new_process_refs >= process_refs) {
cfqq->new_cfqq = new_cfqq;
atomic_add(process_refs, &new_cfqq->ref);
} else {
new_cfqq->new_cfqq = cfqq;
atomic_add(new_process_refs, &cfqq->ref);
}
}When a merge candidate is found, we add the process references for the queue with less references to the queue with more. The actual merging of queues happens when a new request is issued for a given cfqq. In the case of the test program, it only does a single pread call to read in 1MB, so the actual merge never happens.
Normally, this is fine, as when the queue exits, we simply drop the references we took on the other cfqqs in the merge chain:
/*
* If this queue was scheduled to merge with another queue, be
* sure to drop the reference taken on that queue (and others in
* the merge chain). See cfq_setup_merge and cfq_merge_cfqqs.
*/
__cfqq = cfqq->new_cfqq;
while (__cfqq) {
if (__cfqq == cfqq) {
WARN(1, "cfqq->new_cfqq loop detected\n");
break;
}
next = __cfqq->new_cfqq;
cfq_put_queue(__cfqq);
__cfqq = next;
}However, there is a hole in this logic. Consider the following (and keep in mind that each I/O keeps a reference to the cfqq):
q1->new_cfqq = q2 // q2 now has 2 process referencesq3->new_cfqq = q2 // q2 now has 3 process references
// the process associated with q2 exits
// q2 now has 2 process references
// queue 1 exits, drops its reference on q2
// q2 now has 1 process reference
// q3 exits, so has 0 process references, and hence drops its references // to q2, which leaves q2 also with 0 process references
q4 comes along and wants to merge with q3
q3->new_cfqq still points at q2! We follow that link and end up at an already freed cfqq.
So, the fix is to not follow a merge chain if the top-most queue does not have a process reference, otherwise any queue in the chain could be already freed. I also changed the logic to disallow merging with a queue that does not have any process references. Previously, we did this check for one of the merge candidates, but not the other. That doesn't really make sense.
Without the attached patch, my system would BUG within a couple of seconds of running the reproducer program. With the patch applied, my system ran the program for over an hour without issues.
This addresses the following bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=16217
Thanks a ton to Phil Carns for providing the bug report and an excellent reproducer.
[ Note for stable: this applies to 2.6.32/33/34 ].
--- block/cfq-iosched.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
block/cfq-iosched.c +11 -2
@@ -1930,6 +1930,15 @@ static void cfq_setup_merge(struct cfq_qint process_refs, new_process_refs;struct cfq_queue *__cfqq; +/* +* If there are no process references on the new_cfqq, then it is +* unsafe to follow the ->new_cfqq chain as other cfqq's in the +* chain may have dropped their last reference (not just their +* last process reference). +*/ +if (!cfqq_process_refs (new_cfqq)) +return ; +/* Avoid a circular list and skip interim queue merges */ while ((__cfqq = new_cfqq->new_cfqq)) {if (__cfqq == cfqq)
@@ -1938,17 +1947,17 @@ static void cfq_setup_merge(struct cfq_q } process_refs =cfqq_process_refs (cfqq); + new_process_refs =cfqq_process_refs (new_cfqq);/* * If the process for the cfqq has gone away, there is no * sense in merging the queues. */ -if (process_refs ==0 ) +if (process_refs ==0 || new_process_refs ==0 )return ;/* * Merge in the direction of the lesser amount of work. */ - new_process_refs =cfqq_process_refs (new_cfqq);if (new_process_refs >= process_refs) { cfqq->new_cfqq = new_cfqq;atomic_add (process_refs, &new_cfqq->ref);
PATCH 92/205 sysvfs: fix NULL deref. when allocating new inode
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Lubomir Rintel <[email protected]>
commit 46c23d7f520e315dde86881b38ba92ebdf34ced5 upstream.
A call to sysv_write_inode() in sysv_new_inode() to its new interface that replaced wait flag with writeback structure. This was broken by a9185b41a4f84971b930c519f0c63bd450c4810d ("pass writeback_control to ->write_inode").
--- fs/sysv/ialloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/sysv/ialloc.c +5 -1
@@ -25,6 +25,7 @@#include <linux/stat.h> #include <linux/string.h> #include <linux/buffer_head.h> +#include <linux/writeback.h> #include "sysv.h" /* We don't trust the value of
@@ -139,6 +140,9 @@ struct inode * sysv_new_inode(const strustruct inode *inode;sysv_ino_t ino;unsigned count; +struct writeback_control wbc = { + .sync_mode =WB_SYNC_NONE + }; inode =new_inode (sb);if (!inode)
@@ -177,7 +181,7 @@ struct inode * sysv_new_inode(const strumark_inode_dirty (inode); inode->i_mode = mode;/* for sysv_write_inode() */ -sysv_write_inode (inode,0 );/* ensure inode not allocated again */ +sysv_write_inode (inode, &wbc);/* ensure inode not allocated again */ mark_inode_dirty (inode);/* cleared by sysv_write_inode() */ /* That's it. */ unlock_super (sb);
PATCH 93/205 serial: cpm_uart: implement the cpm_uart_early_write() function for console poll
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dongdong Deng <[email protected]>
commit 8cd774ad30c22b9d89823f1f05d845f4cdaba9e8 upstream.
The cpm_uart_early_write() function which was used for console poll isn't implemented in the cpm uart driver.
Implementing this function both fixes the build when CONFIG_CONSOLE_POLL is set and allows kgdboc to work via the cpm uart.
--- drivers/serial/cpm_uart/cpm_uart_core.c | 143 +++++++++++++++++--------------- 1 file changed, 79 insertions(+), 64 deletions(-)
drivers/serial/cpm_uart/cpm_uart_core.c +79 -64
@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct } } +#if defined(CONFIG_CONSOLE_POLL ) || defined(CONFIG_SERIAL_CPM_CONSOLE ) +/* +* Write a string to the serial port +* Note that this is called with interrupts already disabled +*/ +static void cpm_uart_early_write (struct uart_cpm_port *pinfo, +const char *string,u_int count) +{ +unsigned int i; +cbd_t __iomem *bdp, *bdbase; +unsigned char *cpm_outp_addr; + +/* Get the address of the host memory buffer. +*/ + bdp = pinfo->tx_cur; + bdbase = pinfo->tx_bd_base; + +/* +* Now, do each character. This is not as bad as it looks +* since this is a holding FIFO and not a transmitting FIFO. +* We could add the complexity of filling the entire transmit +* buffer, but we would just wait longer between accesses...... +*/ +for (i =0 ; i < count; i++, string++) { +/* Wait for transmitter fifo to empty. +* Ready indicates output is ready, and xmt is doing +* that, not that it is ready for us to send. +*/ +while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) + ; + +/* Send the character out. +* If the buffer address is in the CPM DPRAM, don't +* convert it. +*/ + cpm_outp_addr =cpm2cpu_addr (in_be32 (&bdp->cbd_bufaddr), + pinfo); + *cpm_outp_addr = *string; + +out_be16 (&bdp->cbd_datlen,1 ); +setbits16 (&bdp->cbd_sc,BD_SC_READY ); + +if (in_be16 (&bdp->cbd_sc) &BD_SC_WRAP ) + bdp = bdbase; +else + bdp++; + +/* if a LF, also do CR... */ +if (*string ==10 ) { +while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) + ; + + cpm_outp_addr =cpm2cpu_addr (in_be32 (&bdp->cbd_bufaddr), + pinfo); + *cpm_outp_addr =13 ; + +out_be16 (&bdp->cbd_datlen,1 ); +setbits16 (&bdp->cbd_sc,BD_SC_READY ); + +if (in_be16 (&bdp->cbd_sc) &BD_SC_WRAP ) + bdp = bdbase; +else + bdp++; + } + } + +/* +* Finally, Wait for transmitter & holding register to empty +* and restore the IER +*/ +while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) + ; + + pinfo->tx_cur = bdp; +} +#endif +#ifdef CONFIG_CONSOLE_POLL /* Serial polling routines for writing and reading from the uart while * in an interrupt or debug context.
@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uarstatic char ch[2 ]; ch[0 ] = (char )c; - cpm_uart_early_write(pinfo->port.line, ch, 1); + cpm_uart_early_write(pinfo, ch, 1); }#endif /* CONFIG_CONSOLE_POLL */
@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struc u_int count) {struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index]; -unsigned int i; -cbd_t __iomem *bdp, *bdbase; -unsigned char *cp;unsigned long flags;int nolock = oops_in_progress;
@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(strucspin_lock_irqsave (&pinfo->port.lock, flags); } -/* Get the address of the host memory buffer. -*/ - bdp = pinfo->tx_cur; - bdbase = pinfo->tx_bd_base; - -/* -* Now, do each character. This is not as bad as it looks -* since this is a holding FIFO and not a transmitting FIFO. -* We could add the complexity of filling the entire transmit -* buffer, but we would just wait longer between accesses...... -*/ -for (i =0 ; i < count; i++, s++) { -/* Wait for transmitter fifo to empty. -* Ready indicates output is ready, and xmt is doing -* that, not that it is ready for us to send. -*/ -while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) - ; - -/* Send the character out. -* If the buffer address is in the CPM DPRAM, don't -* convert it. -*/ - cp =cpm2cpu_addr (in_be32 (&bdp->cbd_bufaddr), pinfo); - *cp = *s; - -out_be16 (&bdp->cbd_datlen,1 ); -setbits16 (&bdp->cbd_sc,BD_SC_READY ); - -if (in_be16 (&bdp->cbd_sc) &BD_SC_WRAP ) - bdp = bdbase; -else - bdp++; - -/* if a LF, also do CR... */ -if (*s ==10 ) { -while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) - ; - - cp =cpm2cpu_addr (in_be32 (&bdp->cbd_bufaddr), pinfo); - *cp =13 ; - -out_be16 (&bdp->cbd_datlen,1 ); -setbits16 (&bdp->cbd_sc,BD_SC_READY ); - -if (in_be16 (&bdp->cbd_sc) &BD_SC_WRAP ) - bdp = bdbase; -else - bdp++; - } - } - -/* -* Finally, Wait for transmitter & holding register to empty -* and restore the IER -*/ -while ((in_be16 (&bdp->cbd_sc) &BD_SC_READY ) !=0 ) - ; - - pinfo->tx_cur = bdp; +cpm_uart_early_write (pinfo, s, count);if (unlikely (nolock)) {local_irq_restore (flags);
PATCH 94/205 um: os-linux/mem.c needs sys/stat.h
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Liu Aleaxander <[email protected]>
commit fb967ecc584c20c74a007de749ca597068b0fcac upstream.
The os-linux/mem.c file calls fchmod function, which is declared in sys/stat.h header file, so include it. Fixes build breakage under FC13.
--- arch/um/os-Linux/mem.c | 1 + 1 file changed, 1 insertion(+)
arch/um/os-Linux/mem.c +1 -0
@@ -10,6 +10,7 @@#include <errno.h> #include <fcntl.h> #include <string.h> +#include <sys/stat.h> #include <sys/mman.h> #include <sys/param.h> #include "init.h"
PATCH 95/205 compiler-gcc.h: gcc-4.5 needs noclone and noinline on __naked functions
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mikael Pettersson <[email protected]>
commit 9c695203a7ddbe49dba5f22f4c941d24f47475df upstream.
A __naked function is defined in C but with a body completely implemented by asm(), including any prologue and epilogue. These asm() bodies expect standard calling conventions for parameter passing. Older GCCs implement that correctly, but 4.[56] currently do not, see GCC PR44290. In the Linux kernel this breaks ARM, causing most arch/arm/mm/copypage-*.c modules to get miscompiled, resulting in kernel crashes during bootup.
Part of the kernel fix is to augment the __naked function attribute to also imply noinline and noclone. This patch implements that, and has been verified to fix boot failures with gcc-4.5 compiled 2.6.34 and 2.6.35-rc1 kernels. The patch is a no-op with older GCCs.
--- include/linux/compiler-gcc.h | 10 +++++++++- include/linux/compiler-gcc4.h | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-)
include/linux/compiler-gcc.h +9 -1
@@ -58,8 +58,12 @@* naked functions because then mcount is called without stack and frame pointer * being set up and there is no chance to restore the lr register to the value * before mcount was called. +* +* The asm() bodies of naked functions often depend on standard calling conventions, +* therefore they must be noinline and noclone. GCC 4.[56] currently fail to enforce +* this, so we must do so ourselves. See GCC PR44290. */ -#define __naked __attribute__((naked)) notrace +#define __naked __attribute__((naked)) noinline __noclone notrace#define __noreturn __attribute__((noreturn))
@@ -85,3 +89,7 @@#define _gcc_header (x) __gcc_header(linux/compiler-gcc##x.h)#define gcc_header (x) _gcc_header(x)#include gcc_header (__GNUC__) + +#if !defined(__noclone) +#define __noclone/* not needed */ +#endif
include/linux/compiler-gcc4.h +4 -0
@@ -48,6 +48,10 @@* unreleased. Really, we need to have autoconf for the kernel. */ #define unreachable () __builtin_unreachable() + +/* Mark a function definition as prohibited from being cloned. */ +#define __noclone __attribute__((__noclone__)) +#endif #endif
PATCH 96/205 rtc: fix ds1388 time corruption
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joakim Tjernlund <[email protected]>
commit 96fc3a45ea073136566f3c2676cad52f8b39a7df upstream.
The ds1307 driver misreads the ds1388 registers when checking for 12 or 24 hour mode. Instead of checking the hour register it reads the minute register. Therefore the driver thinks minutes >= 40 has the 12HR bit set and resets the minute register by zeroing the high bits. This results in minutes are reset to 0-9, jumping back in time 40 or 50 minutes. The time jump is also written back to the RTC.
--- drivers/rtc/rtc-ds1307.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/rtc/rtc-ds1307.c +2 -2
@@ -775,7 +775,7 @@ static int __devinit ds1307_probe(struct read_rtc:/* read RTC registers */ - tmp = ds1307->read_block_data (ds1307->client,0 ,8 , buf); + tmp = ds1307->read_block_data (ds1307->client, ds1307->offset,8 , buf);if (tmp !=8 ) {pr_debug ("read error %d\n" , tmp); err = -EIO ;
@@ -860,7 +860,7 @@ read_rtc:if (ds1307->regs[DS1307_REG_HOUR ] &DS1307_BIT_PM ) tmp +=12 ;i2c_smbus_write_byte_data (client, -DS1307_REG_HOUR , + ds1307->offset +DS1307_REG_HOUR ,bin2bcd (tmp)); }
PATCH 97/205 ahci,ata_generic: let ata_generic handle new MBP w/ MCP89
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit c6353b4520788e34098bbf61c73fb9618ca7fdd6 upstream.
For yet unknown reason, MCP89 on MBP 7,1 doesn't work w/ ahci under linux but the controller doesn't require explicit mode setting and works fine with ata_generic. Make ahci ignore the controller on MBP 7,1 and let ata_generic take it for now.
Reported in bko#15923.
https://bugzilla.kernel.org/show_bug.cgi?id=15923
NVIDIA is investigating why ahci mode doesn't work.
--- drivers/ata/ahci.c | 10 ++++++++++ drivers/ata/ata_generic.c | 6 ++++++ include/linux/pci_ids.h | 1 + 3 files changed, 17 insertions(+)
drivers/ata/ahci.c +10 -0
@@ -3249,6 +3249,16 @@ static int ahci_init_one(struct pci_devif (pdev->vendor ==PCI_VENDOR_ID_MARVELL && !marvell_enable)return -ENODEV ; +/* +* For some reason, MCP89 on MacBook 7,1 doesn't work with +* ahci, use ata_generic instead. +*/ +if (pdev->vendor ==PCI_VENDOR_ID_NVIDIA && + pdev->device ==PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA && + pdev->subsystem_vendor ==PCI_VENDOR_ID_APPLE && + pdev->subsystem_device ==0xcb89 ) +return -ENODEV ; +/* Promise's PDC42819 is a SAS/SATA controller that has an AHCI mode. * At the moment, we can only use the AHCI mode. Let the users know * that for SAS drives they're out of luck.
drivers/ata/ata_generic.c +6 -0
@@ -168,6 +168,12 @@ static struct pci_device_id ata_generic[ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), }, { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), }, { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), }, + /* + * For some reason, MCP89 on MacBook 7,1 doesn't work with + * ahci, use ata_generic instead. + */ + { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA, + PCI_VENDOR_ID_APPLE, 0xcb89, }, #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE) { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), }, { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), },
include/linux/pci_ids.h +1 -0
@@ -1261,6 +1261,7 @@#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS 0x07D8#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS 0x0AA2 +#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA 0x0D85#define PCI_VENDOR_ID_IMS 0x10e0#define PCI_DEVICE_ID_IMS_TT128 0x9128
PATCH 98/205 ata_generic: implement ATA_GEN_* flags and force enable DMA on MBP 7,1
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit 1529c69adce1e95f7ae72f0441590c226bbac7fc upstream.
IDE mode of MCP89 on MBP 7,1 doesn't set DMA enable bits in the BMDMA status register. Make the following changes to work around the problem.
* Instead of using hard coded 1 in id->driver_data as class code match, use ATA_GEN_CLASS_MATCH and carry the matched id in host->private_data.
* Instead of matching PCI_VENDOR_ID_CENATEK, use ATA_GEN_FORCE_DMA flag in id instead.
* Add ATA_GEN_FORCE_DMA to the id entry of MBP 7,1.
--- drivers/ata/ata_generic.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/ata/ata_generic.c +19 -7
@@ -32,6 +32,11 @@* A generic parallel ATA driver using libata */ +enum { +ATA_GEN_CLASS_MATCH = (1 <<0 ), +ATA_GEN_FORCE_DMA = (1 <<1 ), +}; +/** * generic_set_mode - mode setting * @link: link to set up
@@ -46,13 +51,17 @@static int generic_set_mode (struct ata_link *link,struct ata_device **unused) {struct ata_port *ap = link->ap; +const struct pci_device_id *id = ap->host->private_data;int dma_enabled =0 ;struct ata_device *dev;struct pci_dev *pdev =to_pci_dev (ap->host->dev); -/* Bits 5 and 6 indicate if DMA is active on master/slave */ -if (ap->ioaddr.bmdma_addr) +if (id->driver_data &ATA_GEN_FORCE_DMA ) { + dma_enabled =0xff ; + }else if (ap->ioaddr.bmdma_addr) { +/* Bits 5 and 6 indicate if DMA is active on master/slave */ dma_enabled =ioread8 (ap->ioaddr.bmdma_addr +ATA_DMA_STATUS ); + }if (pdev->vendor ==PCI_VENDOR_ID_CENATEK ) dma_enabled =0xFF ;
@@ -126,7 +135,7 @@ static int ata_generic_init_one(struct pconst struct ata_port_info *ppi[] = { &info,NULL };/* Don't use the generic entry unless instructed to do so */ -if (id->driver_data ==1 && all_generic_ide ==0 ) +if ((id->driver_data &ATA_GEN_CLASS_MATCH ) && all_generic_ide ==0 )return -ENODEV ;/* Devices that need care */
@@ -155,7 +164,7 @@ static int ata_generic_init_one(struct preturn rc;pcim_pin_device (dev); } -return ata_pci_sff_init_one (dev, ppi, &generic_sht,NULL ,0 ); +return ata_pci_sff_init_one (dev, ppi, &generic_sht, (void *)id,0 ); }static struct pci_device_id ata_generic[] = {
@@ -167,13 +176,15 @@ static struct pci_device_id ata_generic[ { PCI_DEVICE(PCI_VENDOR_ID_HINT, PCI_DEVICE_ID_HINT_VXPROII_IDE), }, { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), }, { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), }, - { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), }, + { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), + .driver_data = ATA_GEN_FORCE_DMA },/* * For some reason, MCP89 on MacBook 7,1 doesn't work with * ahci, use ata_generic instead. */ { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA, - PCI_VENDOR_ID_APPLE, 0xcb89, }, +PCI_VENDOR_ID_APPLE ,0xcb89 , + .driver_data = ATA_GEN_FORCE_DMA }, #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE) { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), }, { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), },
@@ -181,7 +192,8 @@ static struct pci_device_id ata_generic[ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_5), },#endif /* Must come last. If you add entries adjust this table appropriately */ - { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 1}, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL), + .driver_data = ATA_GEN_CLASS_MATCH }, { 0, }, };
PATCH 99/205 ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ben Hutchings <[email protected]>
commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream.
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service.
--- net/core/ethtool.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/core/ethtool.c +3 -2
@@ -328,8 +328,9 @@ static noinline_for_stack int ethtool_geif (info.cmd ==ETHTOOL_GRXCLSRLALL ) {if (info.rule_cnt >0 ) { - rule_buf =kmalloc (info.rule_cnt *sizeof (u32), -GFP_USER ); +if (info.rule_cnt <=KMALLOC_MAX_SIZE /sizeof (u32)) + rule_buf =kmalloc (info.rule_cnt *sizeof (u32), +GFP_USER );if (!rule_buf)return -ENOMEM ; }
PATCH 100/205 powerpc: Fix logic error in fixup_irqs
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johannes Berg <[email protected]>
commit 3cd8519248e9e17d982c6fab0f1a89bca6feb49a upstream.
When SPARSE_IRQ is set, irq_to_desc() can
return NULL. While the code here has a
check for NULL, it's not really correct.
Fix it by separating the check for it.
This fixes CPU hot unplug for me.
--- arch/powerpc/kernel/irq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/powerpc/kernel/irq.c +4 -1
@@ -294,7 +294,10 @@ void fixup_irqs(cpumask_t map)cpumask_t mask; desc =irq_to_desc (irq); -if (desc && desc->status &IRQ_PER_CPU ) +if (!desc) +continue ; + +if (desc->status &IRQ_PER_CPU )continue ;cpumask_and (&mask, desc->affinity, &map);
PATCH 101/205 powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue)
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Vorontsov <[email protected]>
commit 56825c88ff438f4dbb51a44591cc29e707fe783a upstream.
spi_t was removed in commit 644b2a680ccc51a9ec4d6beb12e9d47d2dee98e2 ("powerpc/cpm: Remove SPI defines and spi structs"), the commit assumed that spi_t isn't used anywhere outside of the spi_mpc8xxx driver. But it appears that the struct is needed for micropatch code. So, let's reintroduce the struct.
Fixes the following build issue:
CC arch/powerpc/sysdev/micropatch.o
micropatch.c: In function 'cpm_load_patch':
micropatch.c:629: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token micropatch.c:629: error: 'spp' undeclared (first use in this function) micropatch.c:629: error: (Each undeclared identifier is reported only once micropatch.c:629: error: for each function it appears in.)
--- arch/powerpc/include/asm/cpm.h | 24 ++++++++++++++++++++++++ arch/powerpc/sysdev/micropatch.c | 7 ++++--- drivers/spi/spi_mpc8xxx.c | 22 ---------------------- 3 files changed, 28 insertions(+), 25 deletions(-)
arch/powerpc/include/asm/cpm.h +24 -0
@@ -7,6 +7,30 @@#include <linux/of.h> /* +* SPI Parameter RAM common to QE and CPM. +*/ +struct spi_pram { +__be16 rbase;/* Rx Buffer descriptor base address */ +__be16 tbase;/* Tx Buffer descriptor base address */ +u8 rfcr;/* Rx function code */ +u8 tfcr;/* Tx function code */ +__be16 mrblr;/* Max receive buffer length */ +__be32 rstate;/* Internal */ +__be32 rdp;/* Internal */ +__be16 rbptr;/* Internal */ +__be16 rbc;/* Internal */ +__be32 rxtmp;/* Internal */ +__be32 tstate;/* Internal */ +__be32 tdp;/* Internal */ +__be16 tbptr;/* Internal */ +__be16 tbc;/* Internal */ +__be32 txtmp;/* Internal */ +__be32 res;/* Tx temp. */ +__be16 rpbase;/* Relocation pointer (CPM1 only) */ +__be16 res1;/* Reserved */ +}; + +/* * USB Controller pram common to QE and CPM. */ struct usb_ctlr {
arch/powerpc/sysdev/micropatch.c +4 -3
@@ -16,6 +16,7 @@#include <asm/page.h> #include <asm/pgtable.h> #include <asm/8xx_immap.h> +#include <asm/cpm.h> #include <asm/cpm1.h> /*
@@ -626,7 +627,7 @@ cpm_load_patch(cpm8xx_t *cp)volatile uint *dp;/* Dual-ported RAM. */ volatile cpm8xx_t *commproc;volatile iic_t *iip; -volatile spi_t *spp; +volatile struct spi_pram *spp;volatile smc_uart_t *smp;int i;
@@ -668,8 +669,8 @@ cpm_load_patch(cpm8xx_t *cp)/* Put SPI above the IIC, also 32-byte aligned. */ i = (RPBASE +sizeof (iic_t) +31 ) & ~31 ; - spp = (spi_t *)&commproc->cp_dparam[PROFF_SPI ]; - spp->spi_rpbase = i; + spp = (struct spi_pram *)&commproc->cp_dparam[PROFF_SPI ]; + spp->rpbase = i;# if defined(CONFIG_I2C_SPI_UCODE_PATCH ) commproc->cp_cpmcr1 =0x802a ;
drivers/spi/spi_mpc8xxx.c +0 -22
@@ -66,28 +66,6 @@ struct mpc8xxx_spi_reg {__be32 receive; }; -/* SPI Parameter RAM */ -struct spi_pram { -__be16 rbase;/* Rx Buffer descriptor base address */ -__be16 tbase;/* Tx Buffer descriptor base address */ -u8 rfcr;/* Rx function code */ -u8 tfcr;/* Tx function code */ -__be16 mrblr;/* Max receive buffer length */ -__be32 rstate;/* Internal */ -__be32 rdp;/* Internal */ -__be16 rbptr;/* Internal */ -__be16 rbc;/* Internal */ -__be32 rxtmp;/* Internal */ -__be32 tstate;/* Internal */ -__be32 tdp;/* Internal */ -__be16 tbptr;/* Internal */ -__be16 tbc;/* Internal */ -__be32 txtmp;/* Internal */ -__be32 res;/* Tx temp. */ -__be16 rpbase;/* Relocation pointer (CPM1 only) */ -__be16 res1;/* Reserved */ -}; -/* SPI Controller mode register definitions */ #define SPMODE_LOOP (1 << 30)#define SPMODE_CI_INACTIVEHIGH (1 << 29)
PATCH 102/205 powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Vorontsov <[email protected]>
commit 2069a6ae19a34d96cc9cb284eb645b165138e03f upstream.
Warnings are treated as errors for arch/powerpc code, so build fails with CONFIG_I2C_SPI_UCODE_PATCH=y:
CC arch/powerpc/sysdev/micropatch.o
cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch':
arch/powerpc/sysdev/micropatch.c:630: warning: unused variable 'smp' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1
And with CONFIG_USB_SOF_UCODE_PATCH=y:
CC arch/powerpc/sysdev/micropatch.o
cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch':
arch/powerpc/sysdev/micropatch.c:629: warning: unused variable 'spp' arch/powerpc/sysdev/micropatch.c:628: warning: unused variable 'iip' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1
This patch fixes these issues by introducing proper #ifdefs.
--- arch/powerpc/sysdev/micropatch.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/sysdev/micropatch.c +5 -0
@@ -626,9 +626,14 @@ cpm_load_patch(cpm8xx_t *cp) {volatile uint *dp;/* Dual-ported RAM. */ volatile cpm8xx_t *commproc; +#if defined(CONFIG_I2C_SPI_UCODE_PATCH ) || \ + defined(CONFIG_I2C_SPI_SMC1_UCODE_PATCH )volatile iic_t *iip;volatile struct spi_pram *spp; +#ifdef CONFIG_I2C_SPI_SMC1_UCODE_PATCH volatile smc_uart_t *smp; +#endif +#endif int i; commproc = cp;
PATCH 103/205 kmemleak: Add support for NO_BOOTMEM configurations
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Catalin Marinas <[email protected]>
commit 9078370c0d2cfe4a905aa34f398bbb0d65921a2b upstream.
With commits 08677214 and 59be5a8e, alloc_bootmem()/free_bootmem() and friends use the early_res functions for memory management when NO_BOOTMEM is enabled. This patch adds the kmemleak calls in the corresponding code paths for bootmem allocations.
--- kernel/early_res.c | 6 ++++++ mm/page_alloc.c | 5 +++++ 2 files changed, 11 insertions(+)
kernel/early_res.c +6 -0
@@ -7,6 +7,8 @@#include <linux/bootmem.h> #include <linux/mm.h> #include <linux/early_res.h> +#include <linux/slab.h> +#include <linux/kmemleak.h> /* * Early reserved memory areas.
@@ -319,6 +321,8 @@ void __init free_early(u64 start, u64 enstruct early_res *r;int i; +kmemleak_free_part (__va (start), end - start); + i =find_overlapped_early (start, end); r = &early_res[i];if (i >= max_early_res || r->end != end || r->start != start)
@@ -333,6 +337,8 @@ void __init free_early_partial(u64 startstruct early_res *r;int i; +kmemleak_free_part (__va (start), end - start); +if (start == end)return ;
mm/page_alloc.c +5 -0
@@ -3440,6 +3440,11 @@ void * __init __alloc_memory_core_early( ptr =phys_to_virt (addr);memset (ptr,0 , size);reserve_early_without_check (addr, addr + size,"BOOTMEM" ); +/* +* The min_count is set to 0 so that bootmem allocated blocks +* are never reported as leaks. +*/ +kmemleak_alloc (ptr, size,0 ,0 );return ptr; }
PATCH 104/205 sdhci-s3c: add missing remove function
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Marek Szyprowski <[email protected]>
commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 upstream.
System will crash sooner or later once the memory with the code of the s3c-sdhci.ko module is reused for something else. I really have no idea how the lack of remove function went unnoticed into the mainline code.
--- drivers/mmc/host/sdhci-s3c.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/mmc/host/sdhci-s3c.c +20 -0
@@ -373,6 +373,26 @@ static int __devinit sdhci_s3c_probe(str static int __devexit sdhci_s3c_remove(struct platform_device *pdev) { +struct sdhci_host *host =platform_get_drvdata (pdev); +struct sdhci_s3c *sc =sdhci_priv (host); +int ptr; + +sdhci_remove_host (host,1 ); + +for (ptr =0 ; ptr <3 ; ptr++) { +clk_disable (sc->clk_bus[ptr]); +clk_put (sc->clk_bus[ptr]); + } +clk_disable (sc->clk_io); +clk_put (sc->clk_io); + +iounmap (host->ioaddr); +release_resource (sc->ioarea); +kfree (sc->ioarea); + +sdhci_free_host (host); +platform_set_drvdata (pdev,NULL ); +return 0 ; }
PATCH 105/205 virtio_net: fix oom handling on tx
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rusty Russell <[email protected]>
commit 58eba97d0774c69b1cf3e5a8ac74419409d1abbf upstream.
virtio net will never try to overflow the TX ring, so the only reason add_buf may fail is out of memory. Thus, we can not stop the device until some request completes - there's no guarantee anything at all is outstanding.
Make the error message clearer as well: error here does not indicate queue full.
--- drivers/net/virtio_net.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
drivers/net/virtio_net.c +13 -8
@@ -566,7 +566,6 @@ static netdev_tx_t start_xmit(struct sk_struct virtnet_info *vi =netdev_priv (dev);int capacity; -again:/* Free up any pending old buffers before queueing new ones. */ free_old_xmit_skbs (vi);
@@ -575,14 +574,20 @@ again:/* This can happen with OOM and indirect buffers. */ if (unlikely (capacity <0 )) { -netif_stop_queue (dev); -dev_warn (&dev->dev,"Unexpected full queue\n" ); -if (unlikely (!vi->svq->vq_ops->enable_cb (vi->svq))) { - vi->svq->vq_ops->disable_cb (vi->svq); -netif_start_queue (dev); - goto again; +if (net_ratelimit ()) { +if (likely (capacity == -ENOMEM )) { +dev_warn (&dev->dev, +"TX queue failure: out of memory\n" ); + }else { + dev->stats.tx_fifo_errors++; +dev_warn (&dev->dev, +"Unexpected TX queue failure: %d\n" , + capacity); + } } -return NETDEV_TX_BUSY ; + dev->stats.tx_dropped++; +kfree_skb (skb); +return NETDEV_TX_OK ; } vi->svq->vq_ops->kick (vi->svq);
PATCH 106/205 virtio: fix oops on OOM
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 1fe9b6fef11771461e69ecd1bc8935a1c7c90cb5 upstream.
virtio ring was changed to return an error code on OOM, but one caller was missed and still checks for vq->vring.num. The fix is just to check for <0 error code.
Long term it might make sense to change goto add_head to just return an error on oom instead, but let's apply a minimal fix for 2.6.35.
--- drivers/virtio/virtio_ring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/virtio/virtio_ring.c +3 -2
@@ -162,7 +162,8 @@ static int vring_add_buf(struct virtqueu void *data) {struct vring_virtqueue *vq =to_vvq (_vq); -unsigned int i, avail, head,uninitialized_var (prev ); +unsigned int i, avail,uninitialized_var (prev ); +int head;START_USE (vq);
@@ -172,7 +173,7 @@ static int vring_add_buf(struct virtqueu* buffers, then go indirect. FIXME: tune this threshold */ if (vq->indirect && (out + in) >1 && vq->num_free) { head =vring_add_indirect (vq, sg, out, in); -if (head != vq->vring.num) +if (likely (head >=0 )) goto add_head; }
PATCH 107/205 edac: mpc85xx: fix MPC85xx dependency
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Vorontsov <[email protected]>
commit 1cd8521e7d77def75fdb1cb35ecd135385e4be4f upstream.
Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx:Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the driver became non-selectable.
This patch fixes the issue by switching to PPC_85xx symbol.
--- drivers/edac/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/Kconfig +1 -1
@@ -196,7 +196,7 @@ config EDAC_I5100 config EDAC_MPC85XX tristate "Freescale MPC83xx / MPC85xx" - depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || MPC85xx) + depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || PPC_85xx) help Support for error detection and correction on the Freescale MPC8349, MPC8560, MPC8540, MPC8548
PATCH 108/205 ASoC: Remove duplicate AUX definition from WM8776
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 3c0709396df0869786f83e4b2d2d687c70ee886d upstream.
--- sound/soc/codecs/wm8776.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/wm8776.c +0 -1
@@ -94,7 +94,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = {SND_SOC_DAPM_INPUT ("AUX" ), -SND_SOC_DAPM_INPUT ("AUX" ),SND_SOC_DAPM_INPUT ("AIN1" ),SND_SOC_DAPM_INPUT ("AIN2" ),
PATCH 109/205 x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yinghai Lu <[email protected]>
commit b8ab9f82025adea77864115da73e70026fa4f540 upstream.
Borislav Petkov reported his 32bit numa system has problem:
[ 0.000000] Reserving total of 4c00 pages for numa KVA remap [ 0.000000] kva_start_pfn ~ 32800 max_low_pfn ~ 375fe [ 0.000000] max_pfn = 238000 [ 0.000000] 8202MB HIGHMEM available. [ 0.000000] 885MB LOWMEM available. [ 0.000000] mapped low ram: 0 - 375fe000 [ 0.000000] low ram: 0 - 375fe000 [ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 1000 1000 => 34e7000 [ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 200 40 => 34c9d80 [ 0.000000] alloc (nid=0 100000 - 7ee00000) (1000000 - ffffffffffffffff) 180 40 => 34e6140 [ 0.000000] alloc (nid=1 80000000 - c7e60000) (1000000 - ffffffffffffffff) 240 40 => 80000000 [ 0.000000] BUG: unable to handle kernel paging request at 40000000 [ 0.000000] IP: [<c2c8cff1>] __alloc_memory_core_early+0x147/0x1d6 [ 0.000000] *pdpt = 0000000000000000 *pde = f000ff53f000ff00 ... [ 0.000000] Call Trace: [ 0.000000] [<c2c8b4f8>] ? __alloc_bootmem_node+0x216/0x22f [ 0.000000] [<c2c90c9b>] ? sparse_early_usemaps_alloc_node+0x5a/0x10b [ 0.000000] [<c2c9149e>] ? sparse_init+0x1dc/0x499 [ 0.000000] [<c2c79118>] ? paging_init+0x168/0x1df [ 0.000000] [<c2c780ff>] ? native_pagetable_setup_start+0xef/0x1bb
looks like it allocates too much high address for bootmem.
Try to cut limit with get_max_mapped()
--- mm/bootmem.c | 24 ++++++++++++++++++++---- mm/page_alloc.c | 3 +++ 2 files changed, 23 insertions(+), 4 deletions(-)
mm/bootmem.c +20 -4
@@ -833,15 +833,24 @@ static void * __init ___alloc_bootmem_novoid *__init __alloc_bootmem_node (pg_data_t *pgdat,unsigned long size,unsigned long align,unsigned long goal) { +void *ptr; +if (WARN_ON_ONCE (slab_is_available ()))return kzalloc_node (size,GFP_NOWAIT , pgdat->node_id);#ifdef CONFIG_NO_BOOTMEM -return __alloc_memory_core_early (pgdat->node_id, size, align, + ptr =__alloc_memory_core_early (pgdat->node_id, size, align, + goal,-1ULL ); +if (ptr) +return ptr; + + ptr =__alloc_memory_core_early (MAX_NUMNODES , size, align, goal,-1ULL );#else -return ___alloc_bootmem_node (pgdat->bdata, size, align, goal,0 ); + ptr =___alloc_bootmem_node (pgdat->bdata, size, align, goal,0 );#endif + +return ptr; } void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size,
@@ -977,14 +986,21 @@ void * __init __alloc_bootmem_low(unsignvoid *__init __alloc_bootmem_low_node (pg_data_t *pgdat,unsigned long size,unsigned long align,unsigned long goal) { +void *ptr; +if (WARN_ON_ONCE (slab_is_available ()))return kzalloc_node (size,GFP_NOWAIT , pgdat->node_id);#ifdef CONFIG_NO_BOOTMEM -return __alloc_memory_core_early (pgdat->node_id, size, align, + ptr =__alloc_memory_core_early (pgdat->node_id, size, align, + goal,ARCH_LOW_ADDRESS_LIMIT ); +if (ptr) +return ptr; + ptr =__alloc_memory_core_early (MAX_NUMNODES , size, align, goal,ARCH_LOW_ADDRESS_LIMIT );#else -return ___alloc_bootmem_node (pgdat->bdata, size, align, + ptr =___alloc_bootmem_node (pgdat->bdata, size, align, goal,ARCH_LOW_ADDRESS_LIMIT );#endif +return ptr; }
mm/page_alloc.c +3 -0
@@ -3415,6 +3415,9 @@ void * __init __alloc_memory_core_early(int i;void *ptr; +if (limit >get_max_mapped ()) + limit =get_max_mapped (); +/* need to go over early_node_map to find out good range for node */ for_each_active_range_index_in_nid (i, nid) {u64 addr;
PATCH 110/205 Input: gamecon - reference correct input device in NES mode
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 7b5d3312fbfbb21d2fc7de94e0db66cfdf8b0055 upstream.
We moved input devices from 'struct gc' to individial pads (struct gc-pad), but gc_nes_process_packet() was still trying to use old ones and crashing.
--- drivers/input/joystick/gamecon.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/input/joystick/gamecon.c +1 -2
@@ -89,7 +89,6 @@ struct gc_pad {struct gc {struct pardevice *pd;struct gc_pad pads[GC_MAX_DEVICES ]; -struct input_dev *dev[GC_MAX_DEVICES ];struct timer_list timer;int pad_count[GC_MAX ];int used;
@@ -387,7 +386,7 @@ static void gc_nes_process_packet(structfor (i =0 ; i <GC_MAX_DEVICES ; i++) { pad = &gc->pads[i]; - dev = gc->dev[i]; + dev = pad->dev; s = gc_status_bit[i];switch (pad->type) {
PATCH 111/205 Input: gamecon - reference correct pad in gc_psx_command()
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dmitry Torokhov <[email protected]>
commit c25f7b763cc35a249232ce612a36a811b0e263f9 upstream.
Otherwise we won't see any events from the gamepad. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16408
--- drivers/input/joystick/gamecon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/joystick/gamecon.c +1 -1
@@ -578,7 +578,7 @@ static void gc_psx_command(struct gc *gc read =parport_read_status (port) ^0x80 ;for (j =0 ; j <GC_MAX_DEVICES ; j++) { -struct gc_pad *pad = &gc->pads[i]; +struct gc_pad *pad = &gc->pads[j];if (pad->type ==GC_PSX || pad->type ==GC_DDR ) data[j] |= (read & gc_status_bit[j]) ? (1 << i) :0 ;
PATCH 112/205 x86: Fix x2apic preenabled system with kexec
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yinghai Lu <[email protected]>
commit fd19dce7ac07973f700b0f13fb7f94b951414a4c upstream.
Found one x2apic system kexec loop test failed
when CONFIG_NMI_WATCHDOG=y (old) or CONFIG_LOCKUP_DETECTOR=y (current tip)
first kernel can kexec second kernel, but second kernel can not kexec third one.
it can be duplicated on another system with BIOS preenabled x2apic. First kernel can not kexec second kernel.
It turns out, when kernel boot with pre-enabled x2apic, it will not execute disable_local_APIC on shutdown path.
when init_apic_mappings() is called in setup_arch, it will skip setting of apic_phys when x2apic_mode is set. ( x2apic_mode is much early check_x2apic()) Then later, disable_local_APIC() will bail out early because !apic_phys.
So check !x2apic_mode in x2apic_mode in disable_local_APIC with !apic_phys.
another solution could be updating init_apic_mappings() to set apic_phys even for preenabled x2apic system. Actually even for x2apic system, that lapic address is mapped already in early stage.
BTW: is there any x2apic preenabled system with apicid of boot cpu > 255?
LKML-Reference: <[email protected]>
--- arch/x86/kernel/apic/apic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/apic/apic.c +1 -1
@@ -920,7 +920,7 @@ void disable_local_APIC(void)unsigned int value;/* APIC hasn't been mapped yet */ -if (!apic_phys) +if (!x2apic_mode && !apic_phys)return ;clear_local_APIC ();
PATCH 113/205 IPoIB: Fix world-writable child interface control sysfs attributes
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Or Gerlitz <[email protected]>
commit 7a52b34b07122ff5f45258d47f260f8a525518f0 upstream.
Sumeet Lahorani <[email protected]> reported that the IPoIB child entries are world-writable; however we don't want ordinary users to be able to create and destroy child interfaces, so fix them to be writable only by root.
--- drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_main.c +2 -2
@@ -1163,7 +1163,7 @@ static ssize_t create_child(struct devicreturn ret ? ret : count; } -static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child); +static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child); static ssize_t delete_child(struct device *dev, struct device_attribute *attr,
@@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct devicreturn ret ? ret : count; } -static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child); +static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child);int ipoib_add_pkey_attr (struct net_device *dev) {
PATCH 114/205 Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kamal Mostafa <[email protected]>
commit 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 upstream.
Gigabyte "Spring Peak" notebook indicates wrong chassis-type, tripping up i8042 and breaking the touchpad. Add this model to i8042_dmi_noloop_table[] to resolve.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -166,6 +166,13 @@ static const struct dmi_system_id __init }, }, { +/* Gigabyte Spring Peak - defines wrong chassis type */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"), + }, + }, + { .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
PATCH 115/205 Input: twl40300-keypad - fix handling of "all ground" rows
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 upstream.
The Nokia RX51 board code (arch/arm/mach-omap2/board-rx51-peripherals.c) defines a key map for the matrix keypad keyboard. The hardware seems to use all of the 8 rows and 8 columns of the keypad, although not all possible locations are used.
The TWL4030 supports keypads with at most 8 rows and 8 columns. Most keys are defined with a row and column number between 0 and 7, except
KEY(0xff, 2, KEY_F9),
KEY(0xff, 4, KEY_F10),
KEY(0xff, 5, KEY_F11),which represent keycodes that should be emitted when entire row is connected to the ground. since the driver handles this case as if we had an extra column in the key matrix. Unfortunately we do not allocate enough space and end up owerwriting some random memory.
--- arch/arm/mach-omap2/board-rx51-peripherals.c | 17 ++++++++++++++--- drivers/input/keyboard/twl4030_keypad.c | 17 +++++++++++------ 2 files changed, 25 insertions(+), 9 deletions(-)
arch/arm/mach-omap2/board-rx51-peripherals.c +14 -3
@@ -147,6 +147,10 @@ static void __init rx51_add_gpio_keys(vo#endif /* CONFIG_KEYBOARD_GPIO || CONFIG_KEYBOARD_GPIO_MODULE */ static int board_keymap[] = { +/* +* Note that KEY(x, 8, KEY_XXX) entries represent "entrire row +* connected to the ground" matrix state. +*/ KEY (0 ,0 ,KEY_Q ),KEY (0 ,1 ,KEY_O ),KEY (0 ,2 ,KEY_P ),
@@ -154,6 +158,7 @@ static int board_keymap[] = {KEY (0 ,4 ,KEY_BACKSPACE ),KEY (0 ,6 ,KEY_A ),KEY (0 ,7 ,KEY_S ), +KEY (1 ,0 ,KEY_W ),KEY (1 ,1 ,KEY_D ), KEY(1, 2, KEY_F),
@@ -162,6 +167,7 @@ static int board_keymap[] = {KEY (1 ,5 ,KEY_J ),KEY (1 ,6 ,KEY_K ),KEY (1 ,7 ,KEY_L ), +KEY (2 ,0 ,KEY_E ),KEY (2 ,1 ,KEY_DOT ), KEY(2, 2, KEY_UP),
@@ -169,6 +175,8 @@ static int board_keymap[] = {KEY (2 ,5 ,KEY_Z ),KEY (2 ,6 ,KEY_X ),KEY (2 ,7 ,KEY_C ), +KEY (2 ,8 ,KEY_F9 ), +KEY (3 ,0 ,KEY_R ),KEY (3 ,1 ,KEY_V ), KEY(3, 2, KEY_B),
@@ -177,20 +185,23 @@ static int board_keymap[] = {KEY (3 ,5 ,KEY_SPACE ),KEY (3 ,6 ,KEY_SPACE ),KEY (3 ,7 ,KEY_LEFT ), +KEY (4 ,0 ,KEY_T ),KEY (4 ,1 ,KEY_DOWN ),KEY (4 ,2 ,KEY_RIGHT ),KEY (4 ,4 ,KEY_LEFTCTRL ),KEY (4 ,5 ,KEY_RIGHTALT ),KEY (4 ,6 ,KEY_LEFTSHIFT ), +KEY (4 ,8 ,KEY_10 ), +KEY (5 ,0 ,KEY_Y ), +KEY (5 ,8 ,KEY_11 ), +KEY (6 ,0 ,KEY_U ), +KEY (7 ,0 ,KEY_I ),KEY (7 ,1 ,KEY_F7 ), KEY(7, 2, KEY_F8), -KEY (0xff ,2 ,KEY_F9 ), -KEY (0xff ,4 ,KEY_F10 ), - KEY(0xff, 5, KEY_F11), }; static struct matrix_keymap_data board_map_data = {
drivers/input/keyboard/twl4030_keypad.c +11 -6
@@ -51,8 +51,12 @@*/ #define TWL4030_MAX_ROWS 8/* TWL4030 hard limit */ #define TWL4030_MAX_COLS 8 -#define TWL4030_ROW_SHIFT 3 -#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS * TWL4030_MAX_COLS) +/* +* Note that we add space for an extra column so that we can handle +* row lines connected to the gnd (see twl4030_col_xlate()). +*/ +#define TWL4030_ROW_SHIFT 4 +#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT)struct twl4030_keypad {unsigned short keymap[TWL4030_KEYMAP_SIZE ];
@@ -182,7 +186,7 @@ static int twl4030_read_kp_matrix_state(return ret; } -static int twl4030_is_in_ghost_state (struct twl4030_keypad *kp,u16 *key_state) +static bool twl4030_is_in_ghost_state (struct twl4030_keypad *kp,u16 *key_state) {int i;u16 check =0 ;
@@ -191,12 +195,12 @@ static int twl4030_is_in_ghost_state(stru16 col = key_state[i];if ((col & check) &&hweight16 (col) >1 ) -return 1 ; +return true; check |= col; } -return 0 ; +return false; }static void twl4030_kp_scan (struct twl4030_keypad *kp,bool release_all)
@@ -225,7 +229,8 @@ static void twl4030_kp_scan(struct twl40if (!changed)continue ; -for (col =0 ; col < kp->n_cols; col++) { +/* Extra column handles "all gnd" rows */ +for (col =0 ; col < kp->n_cols +1 ; col++) {int code;if (!(changed & (1 << col)))
PATCH 116/205 ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Catalin Marinas <[email protected]>
commit 2503a5ecd86c002506001eba432c524ea009fe7f upstream.
RealView boards with certain revisions of the L220 cache controller (ARM11* processors only) may have issues (hardware deadlock) with the recent changes to the mb() barrier implementation (DSB followed by an L2 cache sync). The patch redefines the RealView ARM11MPCore mandatory barriers without the outer_sync() call.
--- arch/arm/mach-realview/Kconfig | 2 ++ arch/arm/mach-realview/include/mach/barriers.h | 8 ++++++++ 2 files changed, 10 insertions(+)
arch/arm/mach-realview/Kconfig +2 -0
@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP bool "Support ARM11MPCore tile" depends on MACH_REALVIEW_EB select CPU_V6 + select ARCH_HAS_BARRIERS if SMP help Enable support for the ARM11MPCore tile on the Realview platform.
@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP select CPU_V6 select ARM_GIC select HAVE_PATA_PLATFORM + select ARCH_HAS_BARRIERS if SMP help Include support for the ARM(R) RealView MPCore Platform Baseboard. PB11MPCore is a platform with an on-board ARM11MPCore and has
arch/arm/mach-realview/include/mach/barriers.h new file +8 -0
@@ -0,0 +1,8 @@ +/* +* Barriers redefined for RealView ARM11MPCore platforms with L220 cache +* controller to work around hardware errata causing the outer_sync() +* operation to deadlock the system. +*/ +#define mb () dsb() +#define rmb () dmb() +#define wmb () mb()
PATCH 117/205 ARM: 6211/1: atomic ops: fix register constraints for atomic64_add_unless
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Will Deacon <[email protected]>
commit 068de8d1be48a04b92fd97f76bb7e113b7be82a8 upstream.
The atomic64_add_unless function compares an atomic variable with a given value and, if they are not equal, adds another given value to the atomic variable. The function returns zero if the addition did not occur and non-zero otherwise.
On ARM, the return value is initialised to 1 in C code. Inline assembly code then performs the atomic64_add_unless operation, setting the return value to 0 iff the addition does not occur. This means that when the addition *does* occur, the value of ret must be preserved across the inline assembly and therefore requires a "+r" constraint rather than the current one of "=&r".
Thanks to Nicolas Pitre for helping to spot this.
--- arch/arm/include/asm/atomic.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/include/asm/atomic.h +1 -1
@@ -440,7 +440,7 @@ static inline int atomic64_add_unless(at" teq %2, #0\n" " bne 1b\n" "2:" - : "=&r" (val), "=&r" (ret), "=&r" (tmp) + : "=&r" (val), "+r" (ret), "=&r" (tmp) : "r" (&v->counter), "r" (u), "r" (a) : "cc");
PATCH 118/205 ARM: 6212/1: atomic ops: add memory constraints to inline asm
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Will Deacon <[email protected]>
commit 398aa66827155ef52bab58bebd24597d90968929 upstream.
Currently, the 32-bit and 64-bit atomic operations on ARM do not include memory constraints in the inline assembly blocks. In the case of barrier-less operations [for example, atomic_add], this means that the compiler may constant fold values which have actually been modified by a call to an atomic operation.
This issue can be observed in the atomic64_test routine in <kernel root>/lib/atomic64_test.c:
00000000 <test_atomic64>:
0: e1a0c00d mov ip, sp
4: e92dd830 push {r4, r5, fp, ip, lr, pc}
8: e24cb004 sub fp, ip, #4
c: e24dd008 sub sp, sp, #8
10: e24b3014 sub r3, fp, #20
14: e30d000d movw r0, #53261 ; 0xd00d
18: e3011337 movw r1, #4919 ; 0x1337
1c: e34c0001 movt r0, #49153 ; 0xc001
20: e34a1aa3 movt r1, #43683 ; 0xaaa3
24: e16300f8 strd r0, [r3, #-8]!
28: e30c0afe movw r0, #51966 ; 0xcafe
2c: e30b1eef movw r1, #48879 ; 0xbeef
30: e34d0eaf movt r0, #57007 ; 0xdeaf
34: e34d1ead movt r1, #57005 ; 0xdead
38: e1b34f9f ldrexd r4, [r3]
3c: e1a34f90 strexd r4, r0, [r3]
40: e3340000 teq r4, #0
44: 1afffffb bne 38 <test_atomic64+0x38>
48: e59f0004 ldr r0, [pc, #4] ; 54 <test_atomic64+0x54>
4c: e3a0101e mov r1, #30
50: ebfffffe bl 0 <__bug>
54: 00000000 .word 0x00000000
The atomic64_set (0x38-0x44) writes to the atomic64_t, but the compiler doesn't see this, assumes the test condition is always false and generates an unconditional branch to __bug. The rest of the test is optimised away.
This patch adds suitable memory constraints to the atomic operations on ARM to ensure that the compiler is informed of the correct data hazards. We have to use the "Qo" constraints to avoid hitting the GCC anomaly described at
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44492 , where the compiler makes assumptions about the writeback in the addressing mode used by the inline assembly. These constraints forbid the use of auto{inc,dec} addressing modes, so it doesn't matter if we don't use the operand exactly once.
--- arch/arm/include/asm/atomic.h | 132 +++++++++++++++++++++--------------------- 1 file changed, 66 insertions(+), 66 deletions(-)
arch/arm/include/asm/atomic.h +66 -66
@@ -40,12 +40,12 @@ static inline void atomic_add(int i, atoint result; __asm__ __volatile__("@ atomic_add\n" -"1: ldrex %0, [%2]\n" -" add %0, %0, %3\n" -" strex %1, %0, [%2]\n" +"1: ldrex %0, [%3]\n" +" add %0, %0, %4\n" +" strex %1, %0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"Ir" (i) :"cc" ); }
@@ -58,12 +58,12 @@ static inline int atomic_add_return(intsmp_mb (); __asm__ __volatile__("@ atomic_add_return\n" -"1: ldrex %0, [%2]\n" -" add %0, %0, %3\n" -" strex %1, %0, [%2]\n" +"1: ldrex %0, [%3]\n" +" add %0, %0, %4\n" +" strex %1, %0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"Ir" (i) :"cc" );
@@ -78,12 +78,12 @@ static inline void atomic_sub(int i, atoint result; __asm__ __volatile__("@ atomic_sub\n" -"1: ldrex %0, [%2]\n" -" sub %0, %0, %3\n" -" strex %1, %0, [%2]\n" +"1: ldrex %0, [%3]\n" +" sub %0, %0, %4\n" +" strex %1, %0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"Ir" (i) :"cc" ); }
@@ -96,12 +96,12 @@ static inline int atomic_sub_return(intsmp_mb (); __asm__ __volatile__("@ atomic_sub_return\n" -"1: ldrex %0, [%2]\n" -" sub %0, %0, %3\n" -" strex %1, %0, [%2]\n" +"1: ldrex %0, [%3]\n" +" sub %0, %0, %4\n" +" strex %1, %0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"Ir" (i) :"cc" );
@@ -118,11 +118,11 @@ static inline int atomic_cmpxchg(atomic_do { __asm__ __volatile__("@ atomic_cmpxchg\n" -"ldrex %1, [%2]\n" +"ldrex %1, [%3]\n" "mov %0, #0\n" -"teq %1, %3\n" -"strexeq %0, %4, [%2]\n" - :"=&r" (res),"=&r" (oldval) +"teq %1, %4\n" +"strexeq %0, %5, [%3]\n" + :"=&r" (res),"=&r" (oldval),"+Qo" (ptr->counter) :"r" (&ptr->counter),"Ir" (old),"r" (new) :"cc" ); }while (res);
@@ -137,12 +137,12 @@ static inline void atomic_clear_mask(unsunsigned long tmp, tmp2; __asm__ __volatile__("@ atomic_clear_mask\n" -"1: ldrex %0, [%2]\n" -" bic %0, %0, %3\n" -" strex %1, %0, [%2]\n" +"1: ldrex %0, [%3]\n" +" bic %0, %0, %4\n" +" strex %1, %0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (tmp),"=&r" (tmp2) + :"=&r" (tmp),"=&r" (tmp2),"+Qo" (*addr) :"r" (addr),"Ir" (mask) :"cc" ); }
@@ -249,7 +249,7 @@ static inline u64 atomic64_read(atomic64 __asm__ __volatile__("@ atomic64_read\n" " ldrexd %0, %H0, [%1]" :"=&r" (result) - :"r" (&v->counter) + :"r" (&v->counter),"Qo" (v->counter) );return result;
@@ -260,11 +260,11 @@ static inline void atomic64_set(atomic64u64 tmp; __asm__ __volatile__("@ atomic64_set\n" -"1: ldrexd %0, %H0, [%1]\n" -" strexd %0, %2, %H2, [%1]\n" +"1: ldrexd %0, %H0, [%2]\n" +" strexd %0, %3, %H3, [%2]\n" " teq %0, #0\n" " bne 1b" - :"=&r" (tmp) + :"=&r" (tmp),"=Qo" (v->counter) :"r" (&v->counter),"r" (i) :"cc" ); }
@@ -275,13 +275,13 @@ static inline void atomic64_add(u64 i, aunsigned long tmp; __asm__ __volatile__("@ atomic64_add\n" -"1: ldrexd %0, %H0, [%2]\n" -" adds %0, %0, %3\n" -" adc %H0, %H0, %H3\n" -" strexd %1, %0, %H0, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" +" adds %0, %0, %4\n" +" adc %H0, %H0, %H4\n" +" strexd %1, %0, %H0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"r" (i) :"cc" ); }
@@ -294,13 +294,13 @@ static inline u64 atomic64_add_return(u6smp_mb (); __asm__ __volatile__("@ atomic64_add_return\n" -"1: ldrexd %0, %H0, [%2]\n" -" adds %0, %0, %3\n" -" adc %H0, %H0, %H3\n" -" strexd %1, %0, %H0, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" +" adds %0, %0, %4\n" +" adc %H0, %H0, %H4\n" +" strexd %1, %0, %H0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"r" (i) :"cc" );
@@ -315,13 +315,13 @@ static inline void atomic64_sub(u64 i, aunsigned long tmp; __asm__ __volatile__("@ atomic64_sub\n" -"1: ldrexd %0, %H0, [%2]\n" -" subs %0, %0, %3\n" -" sbc %H0, %H0, %H3\n" -" strexd %1, %0, %H0, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" +" subs %0, %0, %4\n" +" sbc %H0, %H0, %H4\n" +" strexd %1, %0, %H0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"r" (i) :"cc" ); }
@@ -334,13 +334,13 @@ static inline u64 atomic64_sub_return(u6smp_mb (); __asm__ __volatile__("@ atomic64_sub_return\n" -"1: ldrexd %0, %H0, [%2]\n" -" subs %0, %0, %3\n" -" sbc %H0, %H0, %H3\n" -" strexd %1, %0, %H0, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" +" subs %0, %0, %4\n" +" sbc %H0, %H0, %H4\n" +" strexd %1, %0, %H0, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"r" (i) :"cc" );
@@ -358,12 +358,12 @@ static inline u64 atomic64_cmpxchg(atomido { __asm__ __volatile__("@ atomic64_cmpxchg\n" -"ldrexd %1, %H1, [%2]\n" +"ldrexd %1, %H1, [%3]\n" "mov %0, #0\n" -"teq %1, %3\n" -"teqeq %H1, %H3\n" -"strexdeq %0, %4, %H4, [%2]" - :"=&r" (res),"=&r" (oldval) +"teq %1, %4\n" +"teqeq %H1, %H4\n" +"strexdeq %0, %5, %H5, [%3]" + :"=&r" (res),"=&r" (oldval),"+Qo" (ptr->counter) :"r" (&ptr->counter),"r" (old),"r" (new) :"cc" ); }while (res);
@@ -381,11 +381,11 @@ static inline u64 atomic64_xchg(atomic64smp_mb (); __asm__ __volatile__("@ atomic64_xchg\n" -"1: ldrexd %0, %H0, [%2]\n" -" strexd %1, %3, %H3, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" +" strexd %1, %4, %H4, [%3]\n" " teq %1, #0\n" " bne 1b" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (ptr->counter) :"r" (&ptr->counter),"r" (new) :"cc" );
@@ -402,16 +402,16 @@ static inline u64 atomic64_dec_if_positismp_mb (); __asm__ __volatile__("@ atomic64_dec_if_positive\n" -"1: ldrexd %0, %H0, [%2]\n" +"1: ldrexd %0, %H0, [%3]\n" " subs %0, %0, #1\n" " sbc %H0, %H0, #0\n" " teq %H0, #0\n" " bmi 2f\n" -" strexd %1, %0, %H0, [%2]\n" +" strexd %1, %0, %H0, [%3]\n" " teq %1, #0\n" " bne 1b\n" "2:" - :"=&r" (result),"=&r" (tmp) + :"=&r" (result),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter) :"cc" );
@@ -429,18 +429,18 @@ static inline int atomic64_add_unless(atsmp_mb (); __asm__ __volatile__("@ atomic64_add_unless\n" -"1: ldrexd %0, %H0, [%3]\n" -" teq %0, %4\n" -" teqeq %H0, %H4\n" +"1: ldrexd %0, %H0, [%4]\n" +" teq %0, %5\n" +" teqeq %H0, %H5\n" " moveq %1, #0\n" " beq 2f\n" -" adds %0, %0, %5\n" -" adc %H0, %H0, %H5\n" -" strexd %2, %0, %H0, [%3]\n" +" adds %0, %0, %6\n" +" adc %H0, %H0, %H6\n" +" strexd %2, %0, %H0, [%4]\n" " teq %2, #0\n" " bne 1b\n" "2:" - :"=&r" (val),"+r" (ret),"=&r" (tmp) + :"=&r" (val),"+r" (ret),"=&r" (tmp),"+Qo" (v->counter) :"r" (&v->counter),"r" (u),"r" (a) :"cc" );
PATCH 119/205 ARM: 6226/1: fix kprobe bug in ldr instruction emulation
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nicolas Pitre <[email protected]>
commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream.
From: Bin Yang <[email protected]>
--- arch/arm/kernel/kprobes-decode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm/kernel/kprobes-decode.c +3 -2
@@ -583,13 +583,14 @@ static void __kprobes emulate_ldr(struct {insn_llret_3arg_fn_t *i_fn = (insn_llret_3arg_fn_t *)&p->ainsn.insn[0 ];kprobe_opcode_t insn = p->opcode; +long ppc = (long )p->addr +8 ;union reg_pair fnr;int rd = (insn >>12 ) &0xf ;int rn = (insn >>16 ) &0xf ;int rm = insn &0xf ;long rdv; -long rnv = regs->uregs[rn]; -long rmv = regs->uregs[rm];/* rm/rmv may be invalid, don't care. */ +long rnv = (rn ==15 ) ? ppc : regs->uregs[rn]; +long rmv = (rm ==15 ) ? ppc : regs->uregs[rm];long cpsr = regs->ARM_cpsr; fnr.dr =insnslot_llret_3arg_rflags (rnv,0 , rmv, cpsr, i_fn);
PATCH 120/205 x86: Do not try to disable hpet if it hasnt been initialized before
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stefano Stabellini <[email protected]>
commit ff4878089e1eaeac79d57878ad4ea32910fb4037 upstream.
hpet_disable is called unconditionally on machine reboot if hpet support is compiled in the kernel.hpet_disable only checks if the machine is hpet capable but doesn't make sure that hpet has been initialized.
[ tglx: Made it a one liner and removed the redundant hpet_address check ]
LKML-Reference: <alpine.DEB.2.00.1007211726240.22235@kaball-desktop>
--- arch/x86/kernel/hpet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/hpet.c +1 -1
@@ -959,7 +959,7 @@ fs_initcall(hpet_late_init);void hpet_disable (void ) { -if (is_hpet_capable ()) { +if (is_hpet_capable () && hpet_virt_address) {unsigned int cfg =hpet_readl (HPET_CFG );if (hpet_legacy_int_enabled) {
PATCH 121/205 x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jacob Pan <[email protected]>
commit f82c3d71d6fd2e6a3e3416f09099e29087e39abf upstream.
The fixed bar capability structure is searched in PCI extended configuration space. We need to make sure there is a valid capability ID to begin with otherwise, the search code may stuck in a infinite loop which results in boot hang. This patch adds additional check for cap ID 0, which is also invalid, and indicates end of chain.
End of chain is supposed to have all fields zero, but that doesn't seem to always be the case in the field.
LKML-Reference: <[email protected]>
--- arch/x86/pci/mrst.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/pci/mrst.c +4 -3
@@ -66,8 +66,9 @@ static int fixed_bar_cap(struct pci_bus devfn, pos, 4, &pcie_cap))return 0 ; -if (pcie_cap ==0xffffffff ) -return 0 ; +if (PCI_EXT_CAP_ID (pcie_cap) ==0x0000 || +PCI_EXT_CAP_ID (pcie_cap) ==0xffff ) +break ;if (PCI_EXT_CAP_ID (pcie_cap) ==PCI_EXT_CAP_ID_VNDR ) { raw_pci_ext_ops->read(pci_domain_nr(bus), bus->number,
@@ -76,7 +77,7 @@ static int fixed_bar_cap(struct pci_busreturn pos; } - pos = pcie_cap >>20 ; + pos =PCI_EXT_CAP_NEXT (pcie_cap); }return 0 ;
PATCH 122/205 x86: kprobes: fix swapped segment registers in kretprobe
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Roland McGrath <[email protected]>
commit a197479848a2f1a2a5c07cffa6c31ab5e8c82797 upstream.
In commit f007ea26, the order of the %es and %ds segment registers got accidentally swapped, so synthesized 'struct pt_regs' frames have the two values inverted. It's almost sure that these values never matter, and that they also never differ. But wrong is wrong.
--- arch/x86/kernel/kprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/kprobes.c +1 -1
@@ -632,8 +632,8 @@ static int __kprobes kprobe_handler(stru/* Skip cs, ip, orig_ax and gs. */ \" subl $16, %esp\n" \" pushl %fs\n" \ -" pushl %ds\n" \" pushl %es\n" \ +" pushl %ds\n" \" pushl %eax\n" \" pushl %ebp\n" \" pushl %edi\n" \
PATCH 123/205 x86, i8259: Only register sysdev if we have a real 8259 PIC
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Adam Lackorzynski <[email protected]>
commit 087b255a2b43f417af83cb44e0bb02507f36b7fe upstream.
My platform makes use of the null_legacy_pic choice and oopses when doing a shutdown as the shutdown code goes through all the registered sysdevs and calls their shutdown method which in my case poke on a non-existing i8259. Imho the i8259 specific sysdev should only be registered if the i8259 is actually there.
Do not register the sysdev function when the null_legacy_pic is used so that the i8259 resume, suspend and shutdown functions are not called.
LKML-Reference: <[email protected]>
--- arch/x86/kernel/i8259.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
arch/x86/kernel/i8259.c +15 -10
@@ -276,16 +276,6 @@ static struct sys_device device_i8259A = .cls = &i8259_sysdev_class, }; -static int __init i8259A_init_sysfs (void ) -{ -int error =sysdev_class_register (&i8259_sysdev_class); -if (!error) - error =sysdev_register (&device_i8259A); -return error; -} - -device_initcall (i8259A_init_sysfs); -static void mask_8259A (void ) {unsigned long flags;
@@ -407,3 +397,18 @@ struct legacy_pic default_legacy_pic = { };struct legacy_pic *legacy_pic = &default_legacy_pic; + +static int __init i8259A_init_sysfs (void ) +{ +int error; + +if (legacy_pic != &default_legacy_pic) +return 0 ; + + error =sysdev_class_register (&i8259_sysdev_class); +if (!error) + error =sysdev_register (&device_i8259A); +return error; +} + +device_initcall (i8259A_init_sysfs);
PATCH 124/205 USB: dont enable remote wakeup by default
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit 7aba8d014341341590ecb64050b7a026642a62eb upstream.
This patch (as1364) avoids enabling remote wakeup by default on all non-root-hub USB devices. Individual drivers or userspace will have to enable it wherever it is needed, such as for keyboards or network interfaces. Note: This affects only system sleep, not autosuspend.
External hubs will continue to relay wakeup requests received from downstream through their upstream port, even when remote wakeup is not enabled for the hub itself. Disabling remote wakeup on a hub merely prevents it from generating wakeup requests in response to connect, disconnect, and overcurrent events.
--- drivers/usb/core/hub.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/core/hub.c +0 -1
@@ -1784,7 +1784,6 @@ int usb_new_device(struct usb_device *ud* sysfs power/wakeup controls wakeup enabled/disabled */ device_init_wakeup (&udev->dev,0 ); -device_set_wakeup_enable (&udev->dev,1 ); }/* Tell the runtime-PM framework the device is active */
PATCH 125/205 USB: g_serial: dont set low_latency flag
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jon Povey <[email protected]>
commit 44a0c0190b500ee6bcfc0976fe540f65dee2cd67 upstream.
No longer set low_latency flag as it causes this warning backtrace:
WARNING: at kernel/mutex.c:207 __mutex_lock_slowpath+0x6c/0x288()
Fix associated locking and wakeups.
--- drivers/usb/gadget/u_serial.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
drivers/usb/gadget/u_serial.c +2 -13
@@ -536,17 +536,11 @@ recycle:list_move (&req->list, &port->read_pool); } -/* Push from tty to ldisc; this is immediate with low_latency, and -* may trigger callbacks to this driver ... so drop the spinlock. +/* Push from tty to ldisc; without low_latency set this is handled by +* a workqueue, so we won't get callbacks and can hold port_lock */ if (tty && do_push) { -spin_unlock_irq (&port->port_lock);tty_flip_buffer_push (tty); -wake_up_interruptible (&tty->read_wait); -spin_lock_irq (&port->port_lock); - -/* tty may have been closed */ - tty = port->port_tty; }
@@ -784,11 +778,6 @@ static int gs_open(struct tty_struct *tt port->open_count =1 ; port->openclose = false; -/* low_latency means ldiscs work in tasklet context, without -* needing a workqueue schedule ... easier to keep up. -*/ - tty->low_latency =1 ; -/* if connected, start the I/O stream */ if (port->port_usb) {struct gserial *gser = port->port_usb;
PATCH 126/205 USB: g_serial: fix tty cleanup on unload
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jon Povey <[email protected]>
commit b23097b793081358a6d943263c91bae4c955c4e3 upstream.
Call put_tty_driver() in cleanup function, to fix Oops when trying to open gadget serial char device after module unload.
--- drivers/usb/gadget/u_serial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/u_serial.c +1 -0
@@ -1184,6 +1184,7 @@ void gserial_cleanup(void) n_ports =0 ;tty_unregister_driver (gs_tty_driver); +put_tty_driver (gs_tty_driver); gs_tty_driver =NULL ;pr_debug ("%s: cleaned up ttyGS* support\n" , __func__);
PATCH 127/205 usb: musb: Fix a bug by making suspend interrupt available in device mode
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Maulik Mankad <[email protected]>
commit 2bb14cbf04ded4b9e394a6ba9e4f06b82fbac8b2 upstream.
As a part of aligning the ISR code for MUSB with the specs, the ISR code was re-written.
See Commit 1c25fda4a09e8229800979986ef399401053b46e (usb: musb: handle irqs in the order dictated by programming guide)
With this the suspend interrupt came accidently under CONFIG_USB_MUSB_HDRC_HCD.
The fix brings suspend interrupt handling outsideCONFIG_USB_MUSB_HDRC_HCD.
--- drivers/usb/musb/musb_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/musb/musb_core.c +2 -1
@@ -562,7 +562,7 @@ static irqreturn_t musb_stage0_irq(struc handled = IRQ_HANDLED; } - +#endif if (int_usb &MUSB_INTR_SUSPEND ) {DBG (1 ,"SUSPEND (%s) devctl %02x power %02x\n" ,otg_state_string (musb), devctl, power);
@@ -625,6 +625,7 @@ static irqreturn_t musb_stage0_irq(struc } } +#ifdef CONFIG_USB_MUSB_HDRC_HCD if (int_usb &MUSB_INTR_CONNECT ) {struct usb_hcd *hcd =musb_to_hcd (musb);void __iomem *mbase = musb->mregs;
PATCH 128/205 USB: ehci-mxc: bail out on transceiver problems
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Wolfram Sang <[email protected]>
commit 4c9715de52b9b6256bf1e9510917111a47b0c176 upstream.
The old code registered the hcd even if there were no transceivers detected, leading to oopses like this if we try to probe a non-existant ULPI:
[ 2.730000] mxc-ehci mxc-ehci.0: unable to init transceiver [ 2.740000] timeout polling for ULPI device [ 2.740000] timeout polling for ULPI device [ 2.750000] mxc-ehci mxc-ehci.0: unable to enable vbus on transceiver [ 2.750000] mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller [ 2.760000] mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 2 [ 2.770000] Unhandled fault: external abort on non-linefetch (0x808) at 0xc4876184 [ 2.770000] Internal error: : 808 [#1] PREEMPT [ 2.770000] last sysfs file: [ 2.770000] Modules linked in: [ 2.770000] CPU: 0 Not tainted (2.6.33.5 #5) [ 2.770000] PC is at ehci_hub_control+0x4d4/0x8f8 [ 2.770000] LR is at ehci_mxc_setup+0xbc/0xdc [ 2.770000] pc : [<c0196dfc>] lr : [<c019bc8c>] psr: 00000093 [ 2.770000] sp : c3815e40 ip : 00000001 fp : 60000013 [ 2.770000] r10: c4876184 r9 : 00000000 r8 : c3814000 [ 2.770000] r7 : c391d2cc r6 : 00000001 r5 : 00000001 r4 : 00000000 [ 2.770000] r3 : 80000000 r2 : 00000007 r1 : 80000000 r0 : c4876184 [ 2.770000] Flags: nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel [ 2.770000] Control: 0005317f Table: a0004000 DAC: 00000017 [ 2.770000] Process swapper (pid: 1, stack limit = 0xc3814270)
...
--- drivers/usb/host/ehci-mxc.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/usb/host/ehci-mxc.c +10 -3
@@ -207,10 +207,17 @@ static int ehci_mxc_drv_probe(struct pla/* Initialize the transceiver */ if (pdata->otg) { pdata->otg->io_priv = hcd->regs +ULPI_VIEWPORT_OFFSET ; -if (otg_init (pdata->otg) !=0 ) -dev_err (dev,"unable to init transceiver\n" ); -else if (otg_set_vbus (pdata->otg,1 ) !=0 ) + ret =otg_init (pdata->otg); +if (ret) { +dev_err (dev,"unable to init transceiver, probably missing\n" ); + ret = -ENODEV ; + goto err_add; + } + ret =otg_set_vbus (pdata->otg,1 ); +if (ret) {dev_err (dev,"unable to enable vbus on transceiver\n" ); + goto err_add; + } } priv->hcd = hcd;
PATCH 129/205 USB: obey the sysfs power/wakeup setting
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit 48826626263d4a61d06fd8c5805da31f925aefa0 upstream.
This patch (as1403) is a partial reversion of an earlier change (commit 5f677f1d45b2bf08085bbba7394392dfa586fa8e "USB: fix remote wakeup settings during system sleep"). After hearing from a user, I realized that remote wakeup should be enabled during system sleep whenever userspace allows it, and not only if a driver requests it too.
Indeed, there could be a device with no driver, that does nothing but generate a wakeup request when the user presses a button. Such a device should be allowed to do its job.
The problem fixed by the earlier patch -- device generating a wakeup request for no reason, causing system suspend to abort -- was also addressed by a later patch ("USB: don't enable remote wakeup by default", accepted but not yet merged into mainline). The device won't be able to generate the bogus wakeup requests because it will be disabled for remote wakeup by default. Hence this reversion will not re-introduce any old problems.
--- drivers/usb/core/driver.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/usb/core/driver.c +3 -10
@@ -1266,8 +1266,7 @@ static int usb_resume_both(struct usb_destatic void choose_wakeup (struct usb_device *udev,pm_message_t msg) { -int w, i; -struct usb_interface *intf; +int w;/* Remote wakeup is needed only when we actually go to sleep. * For things like FREEZE and QUIESCE, if the device is already
@@ -1279,16 +1278,10 @@ static void choose_wakeup(struct usb_devreturn ; } -/* If remote wakeup is permitted, see whether any interface drivers +/* Enable remote wakeup if it is allowed, even if no interface drivers * actually want it. */ - w =0 ; -if (device_may_wakeup (&udev->dev) && udev->actconfig) { -for (i =0 ; i < udev->actconfig->desc.bNumInterfaces; i++) { - intf = udev->actconfig->interface[i]; - w |= intf->needs_remote_wakeup; - } - } + w =device_may_wakeup (&udev->dev);/* If the device is autosuspended with the wrong wakeup setting, * autoresume now so the setting can be changed.
PATCH 130/205 USB: musb_core: make disconnect and suspend interrupts work again
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 7d9645fdca444d53907b22a4b73e3967efe09781 upstream.
Commit 1c25fda4a09e8229800979986ef399401053b46e (usb: musb: handle irqs in the order dictated by programming guide) forgot to get rid of the old 'STAGE0_MASK' filter for calling musb_stage0_irq(), so now disconnect and suspend interrupts are effectively ignored...
--- drivers/usb/musb/musb_core.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/musb/musb_core.c +1 -5
@@ -371,10 +371,6 @@ void musb_hnp_stop(struct musb *musb)* @param power */ -#define STAGE0_MASK (MUSB_INTR_RESUME | MUSB_INTR_SESSREQ \ - | MUSB_INTR_VBUSERROR | MUSB_INTR_CONNECT \ - | MUSB_INTR_RESET) -static irqreturn_t musb_stage0_irq (struct musb *musb,u8 int_usb,u8 devctl,u8 power) {
@@ -1520,7 +1516,7 @@ irqreturn_t musb_interrupt(struct musb */* the core can interrupt us for multiple reasons; docs have * a generic interrupt flowchart to follow */ -if (musb->int_usb &STAGE0_MASK ) +if (musb->int_usb) retval |=musb_stage0_irq (musb, musb->int_usb, devctl, power);
PATCH 131/205 USB: MUSB: make non-OMAP platforms build with CONFIG_PM=y
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 9297688a9257d73956d4bba484d9dd331ca72c25 upstream.
Attempt to build MUSB driver with CONFIG_PM=y (e.g. in the OTG mode) on DaVinci results in these link errors:
drivers/built-in.o: In function `musb_restore_context':
led-triggers.c:(.text+0x714d8): undefined reference to musb_platform_restore_context' drivers/built-in.o: In function musb_save_context':
led-triggers.c:(.text+0x71788): undefined reference to `musb_platform_save_context'
This turned out to be caused by commit 9957dd97ec5e98dd334f87ade1d9a0b24d1f86eb (usb: musb: Fix compile error for omaps for musb_hdrc). Revert it, taking into account the rename of CONFIG_ARCH_OMAP34XX into CONFIG_ARCH_OMAP3 (which that commit fixed in a completely inappropriate way) and the recent addition of OMAP4 support.
--- drivers/usb/musb/musb_core.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/musb/musb_core.h +4 -2
@@ -469,7 +469,8 @@ struct musb_csr_regs {struct musb_context_registers { -#ifdef CONFIG_PM +#if defined(CONFIG_ARCH_OMAP2430 ) || defined(CONFIG_ARCH_OMAP3 ) || \ + defined(CONFIG_ARCH_OMAP4 )u32 otg_sysconfig, otg_forcestandby;#endif u8 power;
@@ -483,7 +484,8 @@ struct musb_context_registers {struct musb_csr_regs index_regs[MUSB_C_NUM_EPS ]; }; -#ifdef CONFIG_PM +#if defined(CONFIG_ARCH_OMAP2430 ) || defined(CONFIG_ARCH_OMAP3 ) || \ + defined(CONFIG_ARCH_OMAP4 )extern void musb_platform_save_context (struct musb *musb,struct musb_context_registers *musb_context); extern void musb_platform_restore_context(struct musb *musb,
PATCH 132/205 USB: option: add support for 1da5:4518
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: =?UTF-8?q?=C3=96mer=20Sezgin=20Ugurlu?= <[email protected]>
commit 646d90e2b925578abef5c45853e0b166b6a450bf upstream.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -323,6 +323,7 @@ static int option_resume(struct usb_ser#define QISDA_PRODUCT_H21_4512 0x4512#define QISDA_PRODUCT_H21_4523 0x4523#define QISDA_PRODUCT_H20_4515 0x4515 +#define QISDA_PRODUCT_H20_4518 0x4518#define QISDA_PRODUCT_H20_4519 0x4519/* TLAYTECH PRODUCTS */
@@ -873,6 +874,7 @@ static const struct usb_device_id option { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) }, { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) }, { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4518) }, { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) }, { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
PATCH 133/205 USB: Add PID for Sierra 250U to drivers/usb/serial/sierra.c
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: august huber <[email protected]>
commit 9d72c81d657340e54a260a3b621f4a9f5b33829c upstream.
Add VID/PID for Sierra Wireless 250U USB dongle to sierra.c Allows use of 3G radio only
--- drivers/usb/serial/sierra.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/sierra.c +1 -0
@@ -245,6 +245,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */ { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */ { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */ + { USB_DEVICE(0x1199, 0x0301) }, /* Sierra Wireless USB Dongle 250U *//* Sierra Wireless C597 */ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0023, 0xFF, 0xFF, 0xFF) },/* Sierra Wireless T598 */
PATCH 134/205 USB: ftdi_sio: support for Signalyzer tools based on FTDI chips
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Colin Leitner <[email protected]>
commit 77dbd74e16b566e9d5eeb4be18ae3ee7d5902bd3 upstream.
ftdi_sio: support for Signalyzer tools based on FTDI chips
This patch adds support for the Xverve Signalyzers.
--- drivers/usb/serial/ftdi_sio.c | 8 ++++++++ drivers/usb/serial/ftdi_sio_ids.h | 9 +++++++++ 2 files changed, 17 insertions(+)
drivers/usb/serial/ftdi_sio.c +8 -0
@@ -743,6 +743,14 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { }, /* Optional parameter entry */ { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +9 -0
@@ -1024,3 +1024,12 @@#define MJSG_SR_RADIO_PID 0x9379#define MJSG_XM_RADIO_PID 0x937A#define MJSG_HD_RADIO_PID 0x937C + +/* +* Xverve Signalyzer tools (http://www.signalyzer.com/) +*/ +#define XVERVE_SIGNALYZER_ST_PID 0xBCA0 +#define XVERVE_SIGNALYZER_SLITE_PID 0xBCA1 +#define XVERVE_SIGNALYZER_SH2_PID 0xBCA2 +#define XVERVE_SIGNALYZER_SH4_PID 0xBCA4 +
PATCH 135/205 USB: option: Add support for AMOI Skypephone S2
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dennis Jansen <[email protected]>
commit 7595931c986f50b1e197ce7b881563e36a7d041e upstream.
usbserial: Add AMOI Skypephone S2 support.
This patch adds support for the AMOI Skypephone S2 to the usbserial module.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -227,6 +227,7 @@ static int option_resume(struct usb_ser#define AMOI_PRODUCT_H01 0x0800#define AMOI_PRODUCT_H01A 0x7002#define AMOI_PRODUCT_H02 0x0802 +#define AMOI_PRODUCT_SKYPEPHONE_S2 0x0407#define DELL_VENDOR_ID 0x413C
@@ -538,6 +539,7 @@ static const struct usb_device_id option { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_SKYPEPHONE_S2) }, { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
PATCH 136/205 USB: Fix USB3.0 Port Speed Downgrade after port reset
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit 809cd1cb80d7dffe75dc94bc94ef2aab3dadc86a upstream.
Without this fix, a USB 3.0 port is downgraded to full speed after a port reset of a configured device. The USB 3.0 terminations will be disabled permanently, and USB 3.0 devices will always enumerate as full speed devices, until the host controller is unplugged (if it is an ExpressCard) or the computer is rebooted.
Fajun Chen traced this traced the speed downgrade issue to the port reset and the interpretation of port status in USB hub driver code. The hub code was not testing for the port being a SuperSpeed port, and it fell through to the else case of Full Speed.
The following patch adds SuperSpeed mapping from the port status, and fixes the speed downgrade issue.
--- drivers/usb/core/hub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/core/hub.c +2 -0
@@ -1971,6 +1971,8 @@ static int hub_port_wait_reset(struct us (portstatus & USB_PORT_STAT_ENABLE)) {if (hub_is_wusb (hub)) udev->speed =USB_SPEED_WIRELESS ; +else if (portstatus & (1 <<USB_PORT_FEAT_SUPERSPEED )) + udev->speed =USB_SPEED_SUPER ;else if (portstatus &USB_PORT_STAT_HIGH_SPEED ) udev->speed =USB_SPEED_HIGH ;else if (portstatus &USB_PORT_STAT_LOW_SPEED )
PATCH 137/205 USB: adds Artisman USB dongle to list of quirky devices
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Paul Mortier <[email protected]>
commit 47f19c0eedb377ad1ee8114f464d001ec5f96a69 upstream.
When an attempt is made to read the interface strings of the Artisman Watchdog USB dongle (idVendor:idProduct 04b4:0526) an error is written to the dmesg log (uhci_result_common: failed with status 440000) and the dongle resets itself, resulting in a disconnect/reconnect loop.
Adding the dongle to the list of devices in quirks.c, with the same quirk Alan Stern's previous patch for the Saitek Cyborg Gold 3D joystick, stops the device from resetting and allows it to be used with no problems.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -41,6 +41,10 @@ static const struct usb_device_id usb_qu/* Philips PSC805 audio device */ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Artisman Watchdog Dongle */ + { USB_DEVICE(0x04b4, 0x0526), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Roland SC-8820 */ { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
PATCH 138/205 USB: sisusbvga: Fix for USB 3.0
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Oliver Neukum <[email protected]>
commit 20a12f007feee1cfa761b431047271d1141d8031 upstream.
Super speed is also fast enough to let sisusbvga operate. Therefor expand the checks.
--- drivers/usb/misc/sisusbvga/sisusb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/misc/sisusbvga/sisusb.c +3 -2
@@ -2442,7 +2442,8 @@ sisusb_open(struct inode *inode, struct }if (!sisusb->devinit) { -if (sisusb->sisusb_dev->speed ==USB_SPEED_HIGH ) { +if (sisusb->sisusb_dev->speed ==USB_SPEED_HIGH || + sisusb->sisusb_dev->speed ==USB_SPEED_SUPER ) {if (sisusb_init_gfxdevice (sisusb,0 )) {mutex_unlock (&sisusb->lock);dev_err (&sisusb->sisusb_dev->dev,"Failed to initialize device\n" );
@@ -3177,7 +3178,7 @@ static int sisusb_probe(struct usb_inter sisusb->present =1 ; -if (dev->speed ==USB_SPEED_HIGH ) { +if (dev->speed ==USB_SPEED_HIGH || dev->speed ==USB_SPEED_SUPER ) {int initscreen =1 ;#ifdef INCL_SISUSB_CON if (sisusb_first_vc > 0 &&
PATCH 139/205 USB: xhci: Set Mult field in endpoint context correctly.
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit c30c791c946a14a03e87819eced562ed28711961 upstream.
The bmAttributes field of the SuperSpeed Endpoint Companion Descriptor has different meanings, depending on the endpoint type. If the endpoint is isochronous, the bmAttributes field is the maximum number of packets within a service interval that this endpoint supports. If the endpoint is bulk, it's the number of stream IDs this endpoint supports.
Only set the Mult field of the xHCI endpoint context using the bmAttributes field if the endpoint is isochronous, and the device is a SuperSpeed device.
--- drivers/usb/host/xhci-mem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-mem.c +3 -2
@@ -582,7 +582,7 @@ static inline unsigned int xhci_get_endpreturn EP_INTERVAL (interval); } -/* The "Mult" field in the endpoint context is only set for SuperSpeed devices. +/* The "Mult" field in the endpoint context is only set for SuperSpeed isoc eps. * High speed endpoint descriptors can define "the number of additional * transaction opportunities per microframe", but that goes in the Max Burst * endpoint context field.
@@ -590,7 +590,8 @@ static inline unsigned int xhci_get_endpstatic inline u32 xhci_get_endpoint_mult (struct usb_device *udev,struct usb_host_endpoint *ep) { -if (udev->speed !=USB_SPEED_SUPER || !ep->ss_ep_comp) +if (udev->speed !=USB_SPEED_SUPER || !ep->ss_ep_comp || + !usb_endpoint_xfer_isoc (&ep->desc))return 0 ;return ep->ss_ep_comp->desc.bmAttributes; }
PATCH 140/205 USB: add quirk for Broadcom BT dongle
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Oliver Neukum <[email protected]>
commit 63ab71deae67b031045bb28bf8cff45180089f8f upstream.
This device needs to be reset when resuming
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -68,6 +68,9 @@ static const struct usb_device_id usb_qu/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + /* Broadcom BCM92035DGROM BT dongle */ + { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 },
PATCH 141/205 USB: FTDI: Add support for the RT System VX-7 radio programming cable
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Corey Minyard <[email protected]>
commit fcc6cb789c77ffee31710eec64efeb25f2124f7a upstream.
RT Systems has put out bunch of ham radio cables based on the FT232RL chip. Each cable type has a unique PID, this adds one for the Yaesu VX-7 radios.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -697,6 +697,7 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) }, { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) }, { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -703,6 +703,12 @@#define TELLDUS_TELLSTICK_PID 0x0C30/* RF control dongle 433 MHz using FT232RL */ /* +* RT Systems programming cables for various ham radios +*/ +#define RTSYSTEMS_VID 0x2100/* Vendor ID */ +#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52/* Serial converter for VX-7 Radios using FT232RL */ + +/* * Bayer Ascensia Contour blood glucose meter USB-converter cable. * http://winglucofacts.com/cables/ */
PATCH 142/205 USB: musb: tusb6010: fix compile error with n8x0_defconfig
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Felipe Balbi <[email protected]>
commit 2b795ea00c2bbb077a1199a4d729c8ac03a6bded upstream.
Drop the unnecessary empty stubs in tusb6010.c and avoid a compile error when building kernel for n8x0.
--- drivers/usb/musb/tusb6010.c | 13 ------------- 1 file changed, 13 deletions(-)
drivers/usb/musb/tusb6010.c +0 -13
@@ -29,19 +29,6 @@ static void tusb_source_power(struct mus#define TUSB_REV_MAJOR (reg_val) ((reg_val >> 4) & 0xf)#define TUSB_REV_MINOR (reg_val) (reg_val & 0xf) -#ifdef CONFIG_PM -/* REVISIT: These should be only needed if somebody implements off idle */ -void musb_platform_save_context (struct musb *musb, -struct musb_context_registers *musb_context) -{ -} - -void musb_platform_restore_context (struct musb *musb, -struct musb_context_registers *musb_context) -{ -} -#endif -/* * Checks the revision. We need to use the DMA register as 3.0 does not * have correct versions for TUSB_PRCM_REV or TUSB_INT_CTRL_REV.
PATCH 143/205 drm/i915: gen3 page flipping fixes
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesse Barnes <[email protected]>
commit 1afe3e9d4335bf3bc5615e37243dc8fef65dac8f upstream.
Gen3 chips have slightly different flip commands, and also contain a bit that indicates whether a "flip pending" interrupt means the flip has been queued or has been completed.
So implement support for the gen3 flip command, and make sure we use the flip pending interrupt correctly depending on the value of ECOSKPD bit 0.
--- drivers/gpu/drm/i915/i915_dma.c | 4 ++++ drivers/gpu/drm/i915/i915_drv.h | 1 + drivers/gpu/drm/i915/i915_irq.c | 16 ++++++++++++---- drivers/gpu/drm/i915/i915_reg.h | 4 ++++ drivers/gpu/drm/i915/intel_display.c | 29 ++++++++++++++++++++++++----- drivers/gpu/drm/i915/intel_drv.h | 1 + 6 files changed, 46 insertions(+), 9 deletions(-)
drivers/gpu/drm/i915/i915_dma.c +4 -0
@@ -1488,6 +1488,10 @@ static int i915_load_modeset_init(structif (ret) goto destroy_ringbuffer; +/* IIR "flip pending" bit means done if this bit is set */ +if (IS_GEN3 (dev) && (I915_READ (ECOSKPD ) &ECO_FLIP_DONE )) + dev_priv->flip_pending_is_done = true; +intel_modeset_init (dev); ret =drm_irq_install (dev);
drivers/gpu/drm/i915/i915_drv.h +1 -0
@@ -611,6 +611,7 @@ typedef struct drm_i915_private {struct drm_crtc *plane_to_crtc_mapping[2 ];struct drm_crtc *pipe_to_crtc_mapping[2 ];wait_queue_head_t pending_flip_queue; +bool flip_pending_is_done;/* Reclocking support */ bool render_reclock_avail;
drivers/gpu/drm/i915/i915_irq.c +12 -4
@@ -932,22 +932,30 @@ irqreturn_t i915_driver_irq_handler(DRM_mod_timer (&dev_priv->hangcheck_timer, jiffies +DRM_I915_HANGCHECK_PERIOD ); } -if (iir &I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT ) +if (iir &I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT ) {intel_prepare_page_flip (dev,0 ); +if (dev_priv->flip_pending_is_done) +intel_finish_page_flip_plane (dev,0 ); + } -if (iir &I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT ) +if (iir &I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT ) { +if (dev_priv->flip_pending_is_done) +intel_finish_page_flip_plane (dev,1 );intel_prepare_page_flip (dev,1 ); + }if (pipea_stats & vblank_status) { vblank++;drm_handle_vblank (dev,0 ); -intel_finish_page_flip (dev,0 ); +if (!dev_priv->flip_pending_is_done) +intel_finish_page_flip (dev,0 ); }if (pipeb_stats & vblank_status) { vblank++;drm_handle_vblank (dev,1 ); -intel_finish_page_flip (dev,1 ); +if (!dev_priv->flip_pending_is_done) +intel_finish_page_flip (dev,1 ); } if ((pipeb_stats & I915_LEGACY_BLC_EVENT_STATUS) ||
drivers/gpu/drm/i915/i915_reg.h +4 -0
@@ -178,6 +178,7 @@#define MI_OVERLAY_OFF (0x2<<21)#define MI_LOAD_SCAN_LINES_INCL MI_INSTR(0x12, 0)#define MI_DISPLAY_FLIP MI_INSTR(0x14, 2) +#define MI_DISPLAY_FLIP_I915 MI_INSTR(0x14, 1)#define MI_DISPLAY_FLIP_PLANE (n) ((n) << 20)#define MI_STORE_DWORD_IMM MI_INSTR(0x20, 1)#define MI_MEM_VIRTUAL (1 << 22)/* 965+ only */
@@ -431,6 +432,9 @@#define CM0_RC_OP_FLUSH_DISABLE (1<<0)#define BB_ADDR 0x02140/* 8 bytes */ #define GFX_FLSH_CNTL 0x02170/* 915+ only */ +#define ECOSKPD 0x021d0 +#define ECO_GATING_CX_ONLY (1<<3) +#define ECO_FLIP_DONE (1<<0)/*
drivers/gpu/drm/i915/intel_display.c +24 -5
@@ -4139,10 +4139,10 @@ static void intel_unpin_work_fn(struct wkfree (work); } -void intel_finish_page_flip (struct drm_device *dev,int pipe) +static void do_intel_finish_page_flip (struct drm_device *dev, +struct drm_crtc *crtc) {drm_i915_private_t *dev_priv = dev->dev_private; -struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];struct intel_crtc *intel_crtc =to_intel_crtc (crtc);struct intel_unpin_work *work;struct drm_i915_gem_object *obj_priv;
@@ -4186,6 +4186,22 @@ void intel_finish_page_flip(struct drm_dschedule_work (&work->work); } +void intel_finish_page_flip (struct drm_device *dev,int pipe) +{ +drm_i915_private_t *dev_priv = dev->dev_private; +struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe]; + +do_intel_finish_page_flip (dev, crtc); +} + +void intel_finish_page_flip_plane (struct drm_device *dev,int plane) +{ +drm_i915_private_t *dev_priv = dev->dev_private; +struct drm_crtc *crtc = dev_priv->plane_to_crtc_mapping[plane]; + +do_intel_finish_page_flip (dev, crtc); +} +void intel_prepare_page_flip (struct drm_device *dev,int plane) {drm_i915_private_t *dev_priv = dev->dev_private;
@@ -4267,14 +4283,17 @@ static int intel_crtc_page_flip(struct d work->pending_flip_obj = obj;BEGIN_LP_RING (4 ); -OUT_RING (MI_DISPLAY_FLIP | -MI_DISPLAY_FLIP_PLANE (intel_crtc->plane)); -OUT_RING (fb->pitch);if (IS_I965G (dev)) { +OUT_RING (MI_DISPLAY_FLIP | +MI_DISPLAY_FLIP_PLANE (intel_crtc->plane)); +OUT_RING (fb->pitch);OUT_RING (obj_priv->gtt_offset | obj_priv->tiling_mode); pipesrc =I915_READ (pipesrc_reg);OUT_RING (pipesrc &0x0fff0fff ); }else { +OUT_RING (MI_DISPLAY_FLIP_I915 | +MI_DISPLAY_FLIP_PLANE (intel_crtc->plane)); +OUT_RING (fb->pitch);OUT_RING (obj_priv->gtt_offset);OUT_RING (MI_NOOP ); }
drivers/gpu/drm/i915/intel_drv.h +1 -0
@@ -219,6 +219,7 @@ extern int intel_framebuffer_create(struextern void intel_prepare_page_flip (struct drm_device *dev,int plane);extern void intel_finish_page_flip (struct drm_device *dev,int pipe); +extern void intel_finish_page_flip_plane (struct drm_device *dev,int plane);extern void intel_setup_overlay (struct drm_device *dev);extern void intel_cleanup_overlay (struct drm_device *dev);
PATCH 144/205 drm/i915: dont queue flips during a flip pending event
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesse Barnes <[email protected]>
commit 83f7fd055eb3f1e843803cd906179d309553967b upstream.
Hardware will set the flip pending ISR bit as soon as it receives the flip instruction, and (supposedly) clear it once the flip completes (e.g. at the next vblank). If we try to send down a flip instruction while the ISR bit is set, the hardware can become very confused, and we may never receive the corresponding flip pending interrupt, effectively hanging the chip.
--- drivers/gpu/drm/i915/intel_display.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/i915/intel_display.c +11 -0
@@ -4232,6 +4232,7 @@ static int intel_crtc_page_flip(struct dunsigned long flags;int pipesrc_reg = (intel_crtc->pipe ==0 ) ?PIPEASRC :PIPEBSRC ;int ret, pipesrc; +u32 flip_mask;RING_LOCALS ; work =kzalloc (sizeof *work,GFP_KERNEL );
@@ -4282,6 +4283,16 @@ static int intel_crtc_page_flip(struct datomic_inc (&obj_priv->pending_flip); work->pending_flip_obj = obj; +if (intel_crtc->plane) + flip_mask =I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT ; +else + flip_mask =I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT ; + +/* Wait for any previous flip to finish */ +if (IS_GEN3 (dev)) +while (I915_READ (ISR ) & flip_mask) + ; +BEGIN_LP_RING (4 );if (IS_I965G (dev)) { OUT_RING(MI_DISPLAY_FLIP |
PATCH 145/205 drm/i915: Hold the spinlock whilst resetting unpin_work along error path
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <[email protected]>
commit 468f0b44ce4b002ca7d9260f802a341854752c02 upstream.
Delay taking the mutex until we need to and ensure that we hold the spinlock when resetting unpin_work on the error path. Also defer the debugging print messages until after we have released the spinlock.
--- drivers/gpu/drm/i915/intel_display.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/intel_display.c +12 -8
@@ -4239,8 +4239,6 @@ static int intel_crtc_page_flip(struct dif (work ==NULL )return -ENOMEM ; -mutex_lock (&dev->struct_mutex); - work->event = event; work->dev = crtc->dev; intel_fb =to_intel_framebuffer (crtc->fb);
@@ -4250,10 +4248,10 @@ static int intel_crtc_page_flip(struct d/* We borrow the event spin lock for protecting unpin_work */ spin_lock_irqsave (&dev->event_lock, flags);if (intel_crtc->unpin_work) { -DRM_DEBUG_DRIVER ("flip queue: crtc already busy\n" );spin_unlock_irqrestore (&dev->event_lock, flags);kfree (work); -mutex_unlock (&dev->struct_mutex); + +DRM_DEBUG_DRIVER ("flip queue: crtc already busy\n" );return -EBUSY ; } intel_crtc->unpin_work = work;
@@ -4262,13 +4260,19 @@ static int intel_crtc_page_flip(struct d intel_fb =to_intel_framebuffer (fb); obj = intel_fb->obj; +mutex_lock (&dev->struct_mutex); ret =intel_pin_and_fence_fb_obj (dev, obj);if (ret !=0 ) { -DRM_DEBUG_DRIVER ("flip queue: %p pin & fence failed\n" , -to_intel_bo (obj)); -kfree (work); - intel_crtc->unpin_work =NULL ;mutex_unlock (&dev->struct_mutex); + +spin_lock_irqsave (&dev->event_lock, flags); + intel_crtc->unpin_work =NULL ; +spin_unlock_irqrestore (&dev->event_lock, flags); + +kfree (work); + +DRM_DEBUG_DRIVER ("flip queue: %p pin & fence failed\n" , +to_intel_bo (obj));return ret; }
PATCH 146/205 drm/i915: handle shared framebuffers when flipping
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesse Barnes <[email protected]>
commit be9a3dbf65a69933b06011f049b1e2fdfa6bc8b9 upstream.
If a framebuffer is shared across CRTCs, the x,y position of one of them is likely to be something other than the origin (e.g. for extended desktop configs). So calculate the offset at flip time so such configurations can work.
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=28518.
--- drivers/gpu/drm/i915/intel_display.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_display.c +7 -3
@@ -4229,7 +4229,7 @@ static int intel_crtc_page_flip(struct dstruct drm_gem_object *obj;struct intel_crtc *intel_crtc =to_intel_crtc (crtc);struct intel_unpin_work *work; -unsigned long flags; +unsigned long flags, offset;int pipesrc_reg = (intel_crtc->pipe ==0 ) ?PIPEASRC :PIPEBSRC ;int ret, pipesrc;u32 flip_mask;
@@ -4297,19 +4297,23 @@ static int intel_crtc_page_flip(struct dwhile (I915_READ (ISR ) & flip_mask) ; +/* Offset into the new buffer for cases of shared fbs between CRTCs */ + offset = obj_priv->gtt_offset; + offset += (crtc->y * fb->pitch) + (crtc->x * (fb->bits_per_pixel) /8 ); +BEGIN_LP_RING (4 );if (IS_I965G (dev)) {OUT_RING (MI_DISPLAY_FLIP |MI_DISPLAY_FLIP_PLANE (intel_crtc->plane));OUT_RING (fb->pitch); -OUT_RING (obj_priv->gtt_offset | obj_priv->tiling_mode); +OUT_RING (offset | obj_priv->tiling_mode); pipesrc =I915_READ (pipesrc_reg);OUT_RING (pipesrc &0x0fff0fff ); }else {OUT_RING (MI_DISPLAY_FLIP_I915 |MI_DISPLAY_FLIP_PLANE (intel_crtc->plane));OUT_RING (fb->pitch); -OUT_RING (obj_priv->gtt_offset); +OUT_RING (offset);OUT_RING (MI_NOOP ); }ADVANCE_LP_RING ();
PATCH 147/205 ethtool: Fix potential user buffer overflow for ETHTOOL_{G, S}RXFH
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
commit bf988435bd5b53529f4408a8efb1f433f6ddfda9 upstream.
struct ethtool_rxnfc was originally defined in 2.6.27 for the ETHTOOL_{G,S}RXFH command with only the cmd, flow_type and data fields. It was then extended in 2.6.30 to support various additional commands. These commands should have been defined to use a new structure, but it is too late to change that now.
Since user-space may still be using the old structure definition for the ETHTOOL_{G,S}RXFH commands, and since they do not need the additional fields, only copy the originally defined fields to and from user-space.
--- include/linux/ethtool.h | 2 ++ net/core/ethtool.c | 38 +++++++++++++++++++++++++++++--------- 2 files changed, 31 insertions(+), 9 deletions(-)
include/linux/ethtool.h +2 -0
@@ -378,6 +378,8 @@ struct ethtool_rxnfc {__u32 flow_type;/* The rx flow hash value or the rule DB size */ __u64 data; +/* The following fields are not valid and must not be used for +* the ETHTOOL_{G,X}RXFH commands. */ struct ethtool_rx_flow_spec fs;__u32 rule_cnt;__u32 rule_locs[0 ];
net/core/ethtool.c +29 -9
@@ -300,22 +300,34 @@ out:return ret; } -static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr) +static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, +u32 cmd,void __user *useraddr) { -struct ethtool_rxnfc cmd; +struct ethtool_rxnfc info; +size_t info_size =sizeof (info);if (!dev->ethtool_ops->set_rxnfc)return -EOPNOTSUPP ; -if (copy_from_user (&cmd, useraddr,sizeof (cmd))) +/* struct ethtool_rxnfc was originally defined for +* ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data +* members. User-space might still be using that +* definition. */ +if (cmd ==ETHTOOL_SRXFH ) + info_size = (offsetof(struct ethtool_rxnfc , data) + +sizeof (info.data)); + +if (copy_from_user (&info, useraddr, info_size))return -EFAULT ; -return dev->ethtool_ops->set_rxnfc (dev, &cmd); +return dev->ethtool_ops->set_rxnfc (dev, &info); } -static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr) +static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, +u32 cmd,void __user *useraddr) {struct ethtool_rxnfc info; +size_t info_size =sizeof (info);const struct ethtool_ops *ops = dev->ethtool_ops;int ret;void *rule_buf =NULL ;
@@ -323,7 +335,15 @@ static noinline_for_stack int ethtool_geif (!ops->get_rxnfc)return -EOPNOTSUPP ; -if (copy_from_user (&info, useraddr,sizeof (info))) +/* struct ethtool_rxnfc was originally defined for +* ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data +* members. User-space might still be using that +* definition. */ +if (cmd ==ETHTOOL_GRXFH ) + info_size = (offsetof(struct ethtool_rxnfc , data) + +sizeof (info.data)); + +if (copy_from_user (&info, useraddr, info_size))return -EFAULT ;if (info.cmd ==ETHTOOL_GRXCLSRLALL ) {
@@ -341,7 +361,7 @@ static noinline_for_stack int ethtool_ge goto err_out; ret = -EFAULT ; -if (copy_to_user (useraddr, &info,sizeof (info))) +if (copy_to_user (useraddr, &info, info_size)) goto err_out;if (rule_buf) {
@@ -1492,12 +1512,12 @@ int dev_ethtool(struct net *net, structcase ETHTOOL_GRXCLSRLCNT :case ETHTOOL_GRXCLSRULE :case ETHTOOL_GRXCLSRLALL : - rc =ethtool_get_rxnfc (dev, useraddr); + rc =ethtool_get_rxnfc (dev, ethcmd, useraddr);break ;case ETHTOOL_SRXFH :case ETHTOOL_SRXCLSRLDEL :case ETHTOOL_SRXCLSRLINS : - rc =ethtool_set_rxnfc (dev, useraddr); + rc =ethtool_set_rxnfc (dev, ethcmd, useraddr);break ;case ETHTOOL_GGRO : rc =ethtool_get_gro (dev, useraddr);
PATCH 148/205 KVM: MMU: Remove user access when allowing kernel access to gpte.w=0 page
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
If cr0.wp=0, we have to allow the guest kernel access to a page with pte.w=0. We do that by setting spte.w=1, since the host cr0.wp must remain set so the host can write protect pages. Once we allow write access, we must remove user access otherwise we mistakenly allow the user to write the page.
--- arch/x86/kvm/mmu.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/mmu.c +3 -0
@@ -1837,6 +1837,9 @@ static int set_spte(struct kvm_vcpu *vcp spte |=PT_WRITABLE_MASK ; +if (!tdp_enabled && !(pte_access &ACC_WRITE_MASK )) + spte &= ~PT_USER_MASK ; +/* * Optimization: for pte sync, if spte was writable the hash * lookup is unnecessary (and expensive). Write protection
PATCH 149/205 KVM: SVM: Handle MCEs early in the vmexit process
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
This patch moves handling of the MC vmexits to an earlier point in the vmexit. The handle_exit function is too late because the vcpu might alreadry have changed its physical cpu.
--- arch/x86/kvm/svm.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
arch/x86/kvm/svm.c +14 -1
@@ -1280,7 +1280,7 @@ static int nm_interception(struct vcpu_sreturn 1 ; } -static int mc_interception (struct vcpu_svm *svm) +static void svm_handle_mce (struct vcpu_svm *svm) {/* * On an #MC intercept the MCE handler is not called automatically in
@@ -1290,6 +1290,11 @@ static int mc_interception(struct vcpu_s "int $0x12\n");/* not sure if we ever come back to this point */ +return ; +} + +static int mc_interception (struct vcpu_svm *svm) +{return 1 ; }
@@ -2842,6 +2847,14 @@ static void svm_vcpu_run(struct kvm_vcpu vcpu->arch.regs_avail &= ~(1 <<VCPU_EXREG_PDPTR ); vcpu->arch.regs_dirty &= ~(1 <<VCPU_EXREG_PDPTR ); } + +/* +* We need to handle MC intercepts here before the vcpu has a chance to +* change the physical cpu +*/ +if (unlikely (svm->vmcb->control.exit_code == +SVM_EXIT_EXCP_BASE +MC_VECTOR )) +svm_handle_mce (svm); }#undef R
PATCH 150/205 KVM: SVM: Implement workaround for Erratum 383
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
This patch implements a workaround for AMD erratum 383 into KVM. Without this erratum fix it is possible for a guest to kill the host machine. This patch implements the suggested workaround for hypervisors which will be published by the next revision guide update.
[jan: fix overflow warning on i386]
[xiao: fix unused variable warning]
--- arch/x86/include/asm/msr-index.h | 1 arch/x86/kvm/svm.c | 81 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -107,6 +107,7 @@#define MSR_AMD64_PATCH_LOADER 0xc0010020#define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140#define MSR_AMD64_OSVW_STATUS 0xc0010141 +#define MSR_AMD64_DC_CFG 0xc0011022#define MSR_AMD64_IBSFETCHCTL 0xc0011030#define MSR_AMD64_IBSFETCHLINAD 0xc0011031#define MSR_AMD64_IBSFETCHPHYSAD 0xc0011032
arch/x86/kvm/svm.c +81 -0
113 lines not on this page · raw message
PATCH 151/205 KVM: MMU: invalidate and flush on spte small->large page size change
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
Always invalidate spte and flush TLBs when changing page size, to make sure different sized translations for the same address are never cached in a CPU's TLB.
Currently the only case where this occurs is when a non-leaf spte pointer is overwritten by a leaf, large spte entry. This can happen after dirty logging is disabled on a memslot, for example.
Noticed by Andrea.
KVM-Stable-Tag
--- arch/x86/kvm/mmu.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/mmu.c +2 -0
@@ -1895,6 +1895,8 @@ static void mmu_set_spte(struct kvm_vcpu child =page_header (pte &PT64_BASE_ADDR_MASK );mmu_page_remove_parent_pte (child, sptep); +__set_spte (sptep, shadow_trap_nonpresent_pte); +kvm_flush_remote_tlbs (vcpu->kvm); }else if (pfn !=spte_to_pfn (*sptep)) {pgprintk ("hfn old %lx new %lx\n" ,spte_to_pfn (*sptep), pfn);
PATCH 152/205 KVM: read apic->irr with ioapic lock held
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
Read ioapic->irr inside ioapic->lock protected section.
KVM-Stable-Tag
--- virt/kvm/ioapic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
virt/kvm/ioapic.c +2 -1
@@ -192,12 +192,13 @@ static int ioapic_deliver(struct kvm_ioaint kvm_ioapic_set_irq (struct kvm_ioapic *ioapic,int irq,int level) { -u32 old_irr = ioapic->irr; +u32 old_irr;u32 mask =1 << irq;union kvm_ioapic_redirect_entry entry;int ret =1 ;spin_lock (&ioapic->lock); + old_irr = ioapic->irr;if (irq >=0 && irq <IOAPIC_NUM_PINS ) { entry = ioapic->redirtbl[irq]; level ^= entry.fields.polarity;
PATCH 153/205 splice: direct_splice_actor() should not use pos in sd
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Changli Gao <[email protected]>
commit 2cb4b05e7647891b46b91c07c9a60304803d1688 upstream.
direct_splice_actor() shouldn't use sd->pos, as sd->pos is for file reading, file->f_pos should be used instead.
--- fs/splice.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/splice.c +2 -1
@@ -1232,7 +1232,8 @@ static int direct_splice_actor(struct pi {struct file *file = sd->u.file; -return do_splice_from (pipe, file, &sd->pos, sd->total_len, sd->flags); +return do_splice_from (pipe, file, &file->f_pos, sd->total_len, + sd->flags); }/**
PATCH 154/205 splice: check f_mode for seekable file
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Changli Gao <[email protected]>
commit 19c9a49b432f245c6293508d164a4350f1f2c601 upstream.
check f_mode for seekable file
As a seekable file is allowed without a llseek function, so the old way isn't work any more.
--- fs/splice.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/splice.c +2 -4
@@ -1322,8 +1322,7 @@ static long do_splice(struct file *in, lif (off_in)return -ESPIPE ;if (off_out) { -if (!out->f_op || !out->f_op->llseek || - out->f_op->llseek == no_llseek) +if (!(out->f_mode &FMODE_PWRITE ))return -EINVAL ;if (copy_from_user (&offset, off_out,sizeof (loff_t)))return -EFAULT ;
@@ -1343,8 +1342,7 @@ static long do_splice(struct file *in, lif (off_out)return -ESPIPE ;if (off_in) { -if (!in->f_op || !in->f_op->llseek || - in->f_op->llseek == no_llseek) +if (!(in->f_mode &FMODE_PREAD ))return -EINVAL ;if (copy_from_user (&offset, off_in,sizeof (loff_t)))return -EFAULT ;
PATCH 155/205 futex: futex_find_get_task remove credentails check
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michal Hocko <[email protected]>
commit 7a0ea09ad5352efce8fe79ed853150449903b9f5 upstream.
futex_find_get_task is currently used (through lookup_pi_state) from two contexts, futex_requeue and futex_lock_pi_atomic. None of the paths looks it needs the credentials check, though. Different (e)uids shouldn't matter at all because the only thing that is important for shared futex is the accessibility of the shared memory.
The credentail check results in glibc assert failure or process hang (if glibc is compiled without assert support) for shared robust pthread mutex with priority inheritance if a process tries to lock already held lock owned by a process with a different euid:
pthread_mutex_lock.c:312: __pthread_mutex_lock_full: Assertion `(-(e)) != 3 || !robust' failed.
The problem is that futex_lock_pi_atomic which is called when we try to lock already held lock checks the current holder (tid is stored in the futex value) to get the PI state. It uses lookup_pi_state which in turn gets task struct from futex_find_get_task. ESRCH is returned either when the task is not found or if credentials check fails.
futex_lock_pi_atomic simply returns if it gets ESRCH. glibc code, however, doesn't expect that robust lock returns with ESRCH because it should get either success or owner died.
--- kernel/futex.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-)
kernel/futex.c +4 -13
@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pstatic struct task_struct *futex_find_get_task (pid_t pid) {struct task_struct *p; -const struct cred *cred =current_cred (), *pcred;rcu_read_lock (); p =find_task_by_vpid (pid); -if (!p) { - p =ERR_PTR (-ESRCH ); - }else { - pcred =__task_cred (p); -if (cred->euid != pcred->euid && - cred->euid != pcred->uid) - p =ERR_PTR (-ESRCH ); -else -get_task_struct (p); - } +if (p) +get_task_struct (p);rcu_read_unlock ();
@@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hif (!pid)return -ESRCH ; p =futex_find_get_task (pid); -if (IS_ERR (p)) -return PTR_ERR (p); +if (!p) +return -ESRCH ;/* * We need to look at the task state flags to figure out,
PATCH 156/205 PM / x86: Save/restore MISC_ENABLE register
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ondrej Zary <[email protected]>
commit 85a0e7539781dad4bfcffd98e72fa9f130f4e40d upstream.
Save/restore MISC_ENABLE register on suspend/resume.
This fixes OOPS (invalid opcode) on resume from STR on Asus P4P800-VM, which wakes up with MWAIT disabled.
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15385
--- arch/x86/include/asm/suspend_32.h | 2 ++ arch/x86/include/asm/suspend_64.h | 2 ++ arch/x86/power/cpu.c | 4 ++++ 3 files changed, 8 insertions(+)
arch/x86/include/asm/suspend_32.h +2 -0
@@ -15,6 +15,8 @@ static inline int arch_prepare_suspend(vstruct saved_context {u16 es, fs, gs, ss;unsigned long cr0, cr2, cr3, cr4; +u64 misc_enable; +bool misc_enable_saved;struct desc_ptr gdt;struct desc_ptr idt;u16 ldt;
arch/x86/include/asm/suspend_64.h +2 -0
@@ -27,6 +27,8 @@ struct saved_context {u16 ds, es, fs, gs, ss;unsigned long gs_base, gs_kernel_base, fs_base;unsigned long cr0, cr2, cr3, cr4, cr8; +u64 misc_enable; +bool misc_enable_saved;unsigned long efer;u16 gdt_pad;u16 gdt_limit;
arch/x86/power/cpu.c +4 -0
@@ -105,6 +105,8 @@ static void __save_processor_state(struc ctxt->cr4 =read_cr4 (); ctxt->cr8 =read_cr8 ();#endif + ctxt->misc_enable_saved = !rdmsrl_safe (MSR_IA32_MISC_ENABLE , + &ctxt->misc_enable); }/* Needed by apm.c */
@@ -152,6 +154,8 @@ static void fix_processor_context(void)*/ static void __restore_processor_state (struct saved_context *ctxt) { +if (ctxt->misc_enable_saved) +wrmsrl (MSR_IA32_MISC_ENABLE , ctxt->misc_enable);/* * control registers */
PATCH 157/205 PCI/PM: Do not use native PCIe PME by default
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit b27759f880018b0cd43543dc94c921341b64b5ec upstream.
Commit c7f486567c1d0acd2e4166c47069835b9f75e77b
(PCI PM: PCIe PME root port service driver) causes the native PCIe PME signaling to be used by default, if the BIOS allows the kernel to control the standard configuration registers of PCIe root ports. However, the native PCIe PME is coupled to the native PCIe hotplug and calling pcie_pme_acpi_setup() makes some BIOSes expect that the native PCIe hotplug will be used as well. That, in turn, causes problems to appear on systems where the PCIe hotplug driver is not loaded. The usual symptom, as reported by Jaroslav Kameník and others, is that the ACPI GPE associated with PCIe hotplug keeps firing continuously causing kacpid to take substantial percentage of CPU time.
To work around this issue, change the default so that the native PCIe PME signaling is only used if directly requested with the help of the pcie_pme= command line switch.
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15924 , which is a listed regression from 2.6.33.
--- Documentation/kernel-parameters.txt | 4 +++- drivers/pci/pcie/pme/pcie_pme.c | 19 +++++++++++++------ 2 files changed, 16 insertions(+), 7 deletions(-)
Documentation/kernel-parameters.txt +3 -1
@@ -2013,7 +2013,9 @@ and is between 256 and 4096 characters. WARNING: Forcing ASPM on may cause system lockups. pcie_pme= [PCIE,PM] Native PCIe PME signaling options: - off Do not use native PCIe PME signaling. + Format: {auto|force}[,nomsi] + auto Use native PCIe PME signaling if the BIOS allows the + kernel to control PCIe config registers of root ports. force Use native PCIe PME signaling even if the BIOS refuses to allow the kernel to control the relevant PCIe config registers.
drivers/pci/pcie/pme/pcie_pme.c +13 -6
@@ -34,7 +34,7 @@* being registered. Consequently, the interrupt-based PCIe PME signaling will * not be used by any PCIe root ports in that case. */ -static bool pcie_pme_disabled; +static bool pcie_pme_disabled = true;/* * The PCI Express Base Specification 2.0, Section 6.1.8, states the following:
@@ -64,12 +64,19 @@ bool pcie_pme_msi_disabled;static int __init pcie_pme_setup (char *str) { -if (!strcmp (str,"off" )) - pcie_pme_disabled = true; -else if (!strcmp (str,"force" )) +if (!strncmp (str,"auto" ,4 )) + pcie_pme_disabled = false; +else if (!strncmp (str,"force" ,5 )) pcie_pme_force_enable = true; -else if (!strcmp (str,"nomsi" )) - pcie_pme_msi_disabled = true; + + str =strchr (str,',' ); +if (str) { + str++; + str +=strspn (str," \t" ); +if (*str && !strcmp (str,"nomsi" )) + pcie_pme_msi_disabled = true; + } +return 1 ; }__setup ("pcie_pme=" , pcie_pme_setup);
PATCH 158/205 isdn/capi: make reset_ctr op truly optional
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit 85a83560afa69862639fb2d6f670b4440a003335 upstream.
The CAPI controller operation reset_ctr is marked as optional, and not all drivers do implement it. Add a check to the kernel CAPI whether it exists before trying to call it.
--- drivers/isdn/capi/kcapi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/isdn/capi/kcapi.c +6 -0
@@ -1147,6 +1147,12 @@ load_unlock_out:if (ctr->state ==CAPI_CTR_DETECTED ) goto reset_unlock_out; +if (ctr->reset_ctr ==NULL ) { +printk (KERN_DEBUG "kcapi: reset: no reset function\n" ); + retval = -ESRCH ; + goto reset_unlock_out; + } + ctr->reset_ctr (ctr); retval =wait_on_ctr_state (ctr,CAPI_CTR_DETECTED );
PATCH 159/205 isdn/gigaset: remove dummy CAPI method implementations
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit e487639dc8ca6bd6c19a4140f45ebc88da56ddd5 upstream.
Dummy implementations for the optional CAPI controller operations load_firmware and reset_ctr can cause userspace callers to hang indefinitely. It's better not to implement them at all.
--- drivers/isdn/gigaset/capi.c | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-)
drivers/isdn/gigaset/capi.c +2 -26
@@ -933,30 +933,6 @@ void gigaset_isdn_stop(struct cardstate*/ /* -* load firmware -*/ -static int gigaset_load_firmware (struct capi_ctr *ctr,capiloaddata *data) -{ -struct cardstate *cs = ctr->driverdata; - -/* AVM specific operation, not needed for Gigaset -- ignore */ -dev_notice (cs->dev,"load_firmware ignored\n" ); - -return 0 ; -} - -/* -* reset (deactivate) controller -*/ -static void gigaset_reset_ctr (struct capi_ctr *ctr) -{ -struct cardstate *cs = ctr->driverdata; - -/* AVM specific operation, not needed for Gigaset -- ignore */ -dev_notice (cs->dev,"reset_ctr ignored\n" ); -} - -/* * register CAPI application */ static void gigaset_register_appl(struct capi_ctr *ctr, u16 appl,
@@ -2213,8 +2189,8 @@ int gigaset_isdn_regdev(struct cardstate iif->ctr.driverdata = cs;strncpy (iif->ctr.name, isdnid,sizeof (iif->ctr.name)); iif->ctr.driver_name ="gigaset" ; - iif->ctr.load_firmware = gigaset_load_firmware; - iif->ctr.reset_ctr = gigaset_reset_ctr; + iif->ctr.load_firmware =NULL ; + iif->ctr.reset_ctr =NULL ; iif->ctr.register_appl = gigaset_register_appl; iif->ctr.release_appl = gigaset_release_appl; iif->ctr.send_message = gigaset_send_message;
PATCH 160/205 isdn/gigaset: honor CAPI applications buffer size request
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit e7752ee280608a24e27f163641121bdc2c68d6af upstream.
Fix the Gigaset CAPI driver to limit the length of a connection's payload data receive buffers to the corresponding CAPI application's data buffer size, as some real-life CAPI applications tend to be rather unhappy if they receive bigger data blocks than requested.
Impact: bugfix
--- drivers/isdn/gigaset/asyncdata.c | 44 +++++------------------ drivers/isdn/gigaset/capi.c | 8 ++++ drivers/isdn/gigaset/common.c | 32 ++++------------- drivers/isdn/gigaset/gigaset.h | 29 +++++++++++---- drivers/isdn/gigaset/i4l.c | 21 +++++++++++ drivers/isdn/gigaset/isocdata.c | 72 +++++++++++++-------------------------- 6 files changed, 94 insertions(+), 112 deletions(-)
drivers/isdn/gigaset/asyncdata.c +11 -33
@@ -126,26 +126,6 @@ static unsigned lock_loop(unsigned numbyreturn numbytes; } -/* set up next receive skb for data mode -*/ -static void new_rcv_skb (struct bc_state *bcs) -{ -struct cardstate *cs = bcs->cs; -unsigned short hw_hdr_len = cs->hw_hdr_len; - -if (bcs->ignore) { - bcs->skb =NULL ; -return ; - } - - bcs->skb =dev_alloc_skb (SBUFSIZE + hw_hdr_len); -if (bcs->skb ==NULL ) { -dev_warn (cs->dev,"could not allocate new skb\n" ); -return ; - } -skb_reserve (bcs->skb, hw_hdr_len); -} -/* process a block of received bytes in HDLC data mode * (mstate != MS_LOCKED && !(inputstate & INS_command) && proto2 == L2_HDLC) * Collect HDLC frames, undoing byte stuffing and watching for DLE escapes.
@@ -159,8 +139,8 @@ static unsigned hdlc_loop(unsigned numbystruct cardstate *cs = inbuf->cs;struct bc_state *bcs = cs->bcs;int inputstate = bcs->inputstate; -__u16 fcs = bcs->fcs; -struct sk_buff *skb = bcs->skb; +__u16 fcs = bcs->rx_fcs; +struct sk_buff *skb = bcs->rx_skb;unsigned char *src = inbuf->data + inbuf->head;unsigned procbytes =0 ;unsigned char c;
@@ -245,8 +225,7 @@ byte_stuff:/* prepare reception of next frame */ inputstate &= ~INS_have_data; -new_rcv_skb (bcs); - skb = bcs->skb; + skb =gigaset_new_rx_skb (bcs); }else {/* empty frame (7E 7E) */ #ifdef CONFIG_GIGASET_DEBUG
@@ -255,8 +234,7 @@ byte_stuff:if (!skb) {/* skipped (?) */ gigaset_isdn_rcv_err (bcs); -new_rcv_skb (bcs); - skb = bcs->skb; + skb =gigaset_new_rx_skb (bcs); } }
@@ -279,11 +257,11 @@ byte_stuff:#endif inputstate |= INS_have_data;if (skb) { -if (skb->len ==SBUFSIZE ) { +if (skb->len >= bcs->rx_bufsize) {dev_warn (cs->dev,"received packet too long\n" );dev_kfree_skb_any (skb);/* skip remainder of packet */ - bcs->skb = skb =NULL ; + bcs->rx_skb = skb =NULL ; }else { *__skb_put (skb,1 ) = c; fcs =crc_ccitt_byte (fcs, c);
@@ -292,7 +270,7 @@ byte_stuff: } bcs->inputstate = inputstate; - bcs->fcs = fcs; + bcs->rx_fcs = fcs;return procbytes; }
@@ -308,18 +286,18 @@ static unsigned iraw_loop(unsigned numbystruct cardstate *cs = inbuf->cs;struct bc_state *bcs = cs->bcs;int inputstate = bcs->inputstate; -struct sk_buff *skb = bcs->skb; +struct sk_buff *skb = bcs->rx_skb;unsigned char *src = inbuf->data + inbuf->head;unsigned procbytes =0 ;unsigned char c;if (!skb) {/* skip this block */ -new_rcv_skb (bcs); +gigaset_new_rx_skb (bcs);return numbytes; } -while (procbytes < numbytes && skb->len <SBUFSIZE ) { +while (procbytes < numbytes && skb->len < bcs->rx_bufsize) { c = *src++; procbytes++;
@@ -343,7 +321,7 @@ static unsigned iraw_loop(unsigned numbyif (inputstate & INS_have_data) {gigaset_skb_rcvd (bcs, skb); inputstate &= ~INS_have_data; -new_rcv_skb (bcs); +gigaset_new_rx_skb (bcs); } bcs->inputstate = inputstate;
drivers/isdn/gigaset/capi.c +8 -0
@@ -80,6 +80,7 @@ struct gigaset_capi_appl {struct list_head ctrlist;struct gigaset_capi_appl *bcnext;u16 id; +struct capi_register_params rp;u16 nextMessageNumber;u32 listenInfoMask;u32 listenCIPmask;
@@ -956,6 +957,7 @@ static void gigaset_register_appl(structreturn ; } ap->id = appl; + ap->rp = *rp;list_add (&ap->ctrlist, &iif->appls); }
@@ -1177,6 +1179,9 @@ static void do_connect_req(struct gigase } ap->bcnext =NULL ; bcs->ap = ap; + bcs->rx_bufsize = ap->rp.datablklen; +dev_kfree_skb (bcs->rx_skb); +gigaset_new_rx_skb (bcs); cmsg->adr.adrPLCI |= (bcs->channel +1 ) <<8 ;/* build command table */
@@ -1446,6 +1451,9 @@ static void do_connect_resp(struct gigas CapiCallGivenToOtherApplication); ap->bcnext =NULL ; bcs->ap = ap; + bcs->rx_bufsize = ap->rp.datablklen; +dev_kfree_skb (bcs->rx_skb); +gigaset_new_rx_skb (bcs); bcs->chstate |=CHS_NOTIFY_LL ;/* check/encode B channel protocol */
drivers/isdn/gigaset/common.c +8 -24
@@ -399,8 +399,8 @@ static void gigaset_freebcs(struct bc_stgig_dbg (DEBUG_INIT ,"clearing bcs[%d]->at_state" , bcs->channel);clear_at_state (&bcs->at_state);gig_dbg (DEBUG_INIT ,"freeing bcs[%d]->skb" , bcs->channel); -dev_kfree_skb (bcs->skb); - bcs->skb =NULL ; +dev_kfree_skb (bcs->rx_skb); + bcs->rx_skb =NULL ;for (i =0 ; i <AT_NUM ; ++i) {kfree (bcs->commands[i]);
@@ -634,19 +634,10 @@ static struct bc_state *gigaset_initbcs( bcs->emptycount =0 ;#endif -gig_dbg (DEBUG_INIT ,"allocating bcs[%d]->skb" , channel); - bcs->fcs =PPP_INITFCS ; + bcs->rx_bufsize =0 ; + bcs->rx_skb =NULL ; + bcs->rx_fcs =PPP_INITFCS ; bcs->inputstate =0 ; -if (cs->ignoreframes) { - bcs->skb =NULL ; - }else { - bcs->skb =dev_alloc_skb (SBUFSIZE + cs->hw_hdr_len); -if (bcs->skb !=NULL ) -skb_reserve (bcs->skb, cs->hw_hdr_len); -else -pr_err ("out of memory\n" ); - } - bcs->channel = channel; bcs->cs = cs;
@@ -663,11 +654,6 @@ static struct bc_state *gigaset_initbcs(return bcs;gig_dbg (DEBUG_INIT ," failed" ); - -gig_dbg (DEBUG_INIT ," freeing bcs[%d]->skb" , channel); -dev_kfree_skb (bcs->skb); - bcs->skb =NULL ; -return NULL ; }
@@ -839,14 +825,12 @@ void gigaset_bcs_reinit(struct bc_state bcs->emptycount =0 ;#endif - bcs->fcs =PPP_INITFCS ; + bcs->rx_fcs =PPP_INITFCS ; bcs->chstate =0 ; bcs->ignore = cs->ignoreframes; -if (bcs->ignore) { -dev_kfree_skb (bcs->skb); - bcs->skb =NULL ; - } +dev_kfree_skb (bcs->rx_skb); + bcs->rx_skb =NULL ; cs->ops->reinitbcshw (bcs); }
drivers/isdn/gigaset/gigaset.h +21 -8
@@ -45,10 +45,6 @@#define MAX_EVENTS 64/* size of event queue */ #define RBUFSIZE 8192 -#define SBUFSIZE 4096/* sk_buff payload size */ - -#define TRANSBUFSIZE 768/* bytes per skb for transparent receive */ -#define MAX_BUF_SIZE (SBUFSIZE - 2)/* Max. size of a data packet from LL */ /* compile time options */ #define GIG_MAJOR 0
@@ -380,8 +376,10 @@ struct bc_state {struct at_state_t at_state; -__u16 fcs; -struct sk_buff *skb; +/* receive buffer */ +unsigned rx_bufsize;/* max size accepted by application */ +struct sk_buff *rx_skb; +__u16 rx_fcs;int inputstate;/* see INS_XXXX */ int channel;
@@ -801,8 +799,23 @@ static inline void gigaset_bchannel_up(sgigaset_schedule_event (bcs->cs); } -/* handling routines for sk_buff */ -/* ============================= */ +/* set up next receive skb for data mode */ +static inline struct sk_buff *gigaset_new_rx_skb (struct bc_state *bcs) +{ +struct cardstate *cs = bcs->cs; +unsigned short hw_hdr_len = cs->hw_hdr_len; + +if (bcs->ignore) { + bcs->rx_skb =NULL ; + }else { + bcs->rx_skb =dev_alloc_skb (bcs->rx_bufsize + hw_hdr_len); +if (bcs->rx_skb ==NULL ) +dev_warn (cs->dev,"could not allocate skb\n" ); +else +skb_reserve (bcs->rx_skb, hw_hdr_len); + } +return bcs->rx_skb; +}/* append received bytes to inbuf */ int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
drivers/isdn/gigaset/i4l.c +21 -0
@@ -16,7 +16,10 @@#include "gigaset.h" #include <linux/isdnif.h> +#define SBUFSIZE 4096/* sk_buff payload size */ +#define TRANSBUFSIZE 768/* bytes per skb for transparent receive */ #define HW_HDR_LEN 2/* Header size used to store ack info */ +#define MAX_BUF_SIZE (SBUFSIZE - HW_HDR_LEN)/* max data packet from LL */ /* == Handling of I4L IO =====================================================*/
@@ -231,6 +234,15 @@ static int command_from_LL(isdn_ctrl *cndev_err (cs->dev,"ISDN_CMD_DIAL: channel not free\n" );return -EBUSY ; } +switch (bcs->proto2) { +case L2_HDLC : + bcs->rx_bufsize =SBUFSIZE ; +break ; +default :/* assume transparent */ + bcs->rx_bufsize =TRANSBUFSIZE ; + } +dev_kfree_skb (bcs->rx_skb); +gigaset_new_rx_skb (bcs); commands =kzalloc (AT_NUM *(sizeof *commands),GFP_ATOMIC );if (!commands) {
@@ -314,6 +326,15 @@ static int command_from_LL(isdn_ctrl *cnreturn -EINVAL ; } bcs = cs->bcs + ch; +switch (bcs->proto2) { +case L2_HDLC : + bcs->rx_bufsize =SBUFSIZE ; +break ; +default :/* assume transparent */ + bcs->rx_bufsize =TRANSBUFSIZE ; + } +dev_kfree_skb (bcs->rx_skb); +gigaset_new_rx_skb (bcs);if (!gigaset_add_event (cs, &bcs->at_state,EV_ACCEPT ,NULL ,0 ,NULL ))return -ENOMEM ;
drivers/isdn/gigaset/isocdata.c +25 -47
136 lines not on this page · raw message
PATCH 161/205 isdn/gigaset: correct CAPI voice connection encoding
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit 278a582989ade4cb5335762d6c5999562018859d upstream.
Make the Gigaset CAPI driver select L2_VOICE (AT^SBPR=2) as the layer 2 encoding for transparent connections, like the ISDN4Linux variant. L2_BITSYNC (AT^SBPR=0) mutes internal connections and distorts external ones.
Impact: bugfix
--- drivers/isdn/gigaset/capi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/isdn/gigaset/capi.c +4 -4
@@ -1338,13 +1338,13 @@ static void do_connect_req(struct gigase bcs->proto2 =L2_HDLC ;break ;case 1 : - bcs->proto2 =L2_BITSYNC ; + bcs->proto2 =L2_VOICE ;break ;default :dev_warn (cs->dev,"B1 Protocol %u unsupported, using Transparent\n" , cmsg->B1protocol); - bcs->proto2 =L2_BITSYNC ; + bcs->proto2 =L2_VOICE ; }if (cmsg->B2protocol !=1 ) dev_warn(cs->dev,
@@ -1467,13 +1467,13 @@ static void do_connect_resp(struct gigas bcs->proto2 =L2_HDLC ;break ;case 1 : - bcs->proto2 =L2_BITSYNC ; + bcs->proto2 =L2_VOICE ;break ;default :dev_warn (cs->dev,"B1 Protocol %u unsupported, using Transparent\n" , cmsg->B1protocol); - bcs->proto2 =L2_BITSYNC ; + bcs->proto2 =L2_VOICE ; }if (cmsg->B2protocol !=1 ) dev_warn(cs->dev,
PATCH 162/205 isdn/gigaset: correct CAPI DATA_B3 Delivery Confirmation
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit 23b36778b4c82577746d26e4ac0ae66c6f462475 upstream.
The Gigaset CAPI driver handled all DATA_B3_REQ messages as if the Delivery Confirmation flag bit was set, delaying the emission of the DATA_B3_CONF reply until the data was actually transmitted. Some CAPI applications (notably Asterisk) aren't happy with that behaviour. Change it to actually evaluate the Delivery Confirmation flag as described the CAPI specification.
Impact: bugfix
--- drivers/isdn/gigaset/capi.c | 83 +++++++++++++++++++++++++++----------------- 1 file changed, 51 insertions(+), 32 deletions(-)
drivers/isdn/gigaset/capi.c +51 -32
@@ -331,6 +331,39 @@ static const char *format_ie(const charreturn result; } +/* +* emit DATA_B3_CONF message +*/ +static void send_data_b3_conf (struct cardstate *cs,struct capi_ctr *ctr, +u16 appl,u16 msgid,int channel, +u16 handle,u16 info) +{ +struct sk_buff *cskb; +u8 *msg; + + cskb =alloc_skb (CAPI_DATA_B3_CONF_LEN ,GFP_ATOMIC ); +if (!cskb) { +dev_err (cs->dev,"%s: out of memory\n" , __func__); +return ; + } +/* frequent message, avoid _cmsg overhead */ + msg =__skb_put (cskb,CAPI_DATA_B3_CONF_LEN ); +CAPIMSG_SETLEN (msg,CAPI_DATA_B3_CONF_LEN ); +CAPIMSG_SETAPPID (msg, appl); +CAPIMSG_SETCOMMAND (msg,CAPI_DATA_B3 ); +CAPIMSG_SETSUBCOMMAND (msg,CAPI_CONF ); +CAPIMSG_SETMSGID (msg, msgid); +CAPIMSG_SETCONTROLLER (msg, ctr->cnr); +CAPIMSG_SETPLCI_PART (msg, channel); +CAPIMSG_SETNCCI_PART (msg,1 ); +CAPIMSG_SETHANDLE_CONF (msg, handle); +CAPIMSG_SETINFO_CONF (msg, info); + +/* emit message */ +dump_rawmsg (DEBUG_MCMD , __func__, msg); +capi_ctr_handle_message (ctr, appl, cskb); +} +/* * driver interface functions
@@ -351,7 +384,6 @@ void gigaset_skb_sent(struct bc_state *bstruct gigaset_capi_ctr *iif = cs->iif;struct gigaset_capi_appl *ap = bcs->ap;unsigned char *req =skb_mac_header (dskb); -struct sk_buff *cskb;u16 flags;/* update statistics */
@@ -368,34 +400,17 @@ void gigaset_skb_sent(struct bc_state *breturn ; } -/* ToDo: honor unset "delivery confirmation" bit */ +/* +* send DATA_B3_CONF if "delivery confirmation" bit was set in request; +* otherwise it has already been sent by do_data_b3_req() +*/ flags =CAPIMSG_FLAGS (req); - -/* build DATA_B3_CONF message */ - cskb =alloc_skb (CAPI_DATA_B3_CONF_LEN ,GFP_ATOMIC ); -if (!cskb) { -dev_err (cs->dev,"%s: out of memory\n" , __func__); -return ; - } -/* frequent message, avoid _cmsg overhead */ -CAPIMSG_SETLEN (cskb->data,CAPI_DATA_B3_CONF_LEN ); -CAPIMSG_SETAPPID (cskb->data, ap->id); -CAPIMSG_SETCOMMAND (cskb->data,CAPI_DATA_B3 ); -CAPIMSG_SETSUBCOMMAND (cskb->data,CAPI_CONF ); -CAPIMSG_SETMSGID (cskb->data,CAPIMSG_MSGID (req)); -CAPIMSG_SETCONTROLLER (cskb->data, iif->ctr.cnr); -CAPIMSG_SETPLCI_PART (cskb->data, bcs->channel +1 ); -CAPIMSG_SETNCCI_PART (cskb->data,1 ); -CAPIMSG_SETHANDLE_CONF (cskb->data,CAPIMSG_HANDLE_REQ (req)); -if (flags & ~CAPI_FLAGS_DELIVERY_CONFIRMATION ) -CAPIMSG_SETINFO_CONF (cskb->data, - CapiFlagsNotSupportedByProtocol); -else -CAPIMSG_SETINFO_CONF (cskb->data,CAPI_NOERROR ); - -/* emit message */ -dump_rawmsg (DEBUG_LLDATA ,"DATA_B3_CONF" , cskb->data); -capi_ctr_handle_message (&iif->ctr, ap->id, cskb); +if (flags &CAPI_FLAGS_DELIVERY_CONFIRMATION ) +send_data_b3_conf (cs, &iif->ctr, ap->id,CAPIMSG_MSGID (req), + bcs->channel +1 ,CAPIMSG_HANDLE_REQ (req), + (flags & ~CAPI_FLAGS_DELIVERY_CONFIRMATION ) ? + CapiFlagsNotSupportedByProtocol : +CAPI_NOERROR ); }EXPORT_SYMBOL_GPL (gigaset_skb_sent);
@@ -1806,6 +1821,8 @@ static void do_data_b3_req(struct gigaseu16 msglen =CAPIMSG_LEN (skb->data);u16 datalen =CAPIMSG_DATALEN (skb->data);u16 flags =CAPIMSG_FLAGS (skb->data); +u16 msgid =CAPIMSG_MSGID (skb->data); +u16 handle =CAPIMSG_HANDLE_REQ (skb->data);/* frequent message, avoid _cmsg overhead */ dump_rawmsg (DEBUG_LLDATA ,"DATA_B3_REQ" , skb->data);
@@ -1856,12 +1873,14 @@ static void do_data_b3_req(struct gigasereturn ; } -/* DATA_B3_CONF reply will be sent by gigaset_skb_sent() */ -/* -* ToDo: honor unset "delivery confirmation" bit -* (send DATA_B3_CONF immediately?) +* DATA_B3_CONF will be sent by gigaset_skb_sent() only if "delivery +* confirmation" bit is set; otherwise we have to send it now */ +if (!(flags &CAPI_FLAGS_DELIVERY_CONFIRMATION )) +send_data_b3_conf (cs, &iif->ctr, ap->id, msgid, channel, handle, + flags ? CapiFlagsNotSupportedByProtocol + :CAPI_NOERROR ); }/*
PATCH 163/205 isdn/gigaset: encode HLC and BC together
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit 1ce368ff288ed872a8fee93b8a2b7706111feb9a upstream.
Adapt to buggy device firmware which accepts setting HLC only in the same command line as BC, by encoding HLC and BC in a single command if both are specified, and rejecting HLC without BC.
Impact: bugfix
--- drivers/isdn/gigaset/capi.c | 81 ++++++++++++++++++++++++---------------- drivers/isdn/gigaset/ev-layer.c | 4 - drivers/isdn/gigaset/gigaset.h | 5 -- 3 files changed, 52 insertions(+), 38 deletions(-)
drivers/isdn/gigaset/capi.c +49 -32
@@ -1177,7 +1177,7 @@ static void do_connect_req(struct gigasechar **commands;char *s;u8 *pp; -int i, l; +int i, l, lbc, lhlc;u16 info;/* decode message */
@@ -1304,42 +1304,59 @@ static void do_connect_req(struct gigase goto error; } -/* check/encode parameter: BC */ -if (cmsg->BC && cmsg->BC[0 ]) { -/* explicit BC overrides CIP */ - l =2 *cmsg->BC[0 ] +7 ; +/* +* check/encode parameters: BC & HLC +* must be encoded together as device doesn't accept HLC separately +* explicit parameters override values derived from CIP +*/ + +/* determine lengths */ +if (cmsg->BC && cmsg->BC[0 ])/* BC specified explicitly */ + lbc =2 *cmsg->BC[0 ]; +else if (cip2bchlc[cmsg->CIPValue].bc)/* BC derived from CIP */ + lbc =strlen (cip2bchlc[cmsg->CIPValue].bc); +else /* no BC */ + lbc =0 ; +if (cmsg->HLC && cmsg->HLC[0 ])/* HLC specified explicitly */ + lhlc =2 *cmsg->HLC[0 ]; +else if (cip2bchlc[cmsg->CIPValue].hlc)/* HLC derived from CIP */ + lhlc =strlen (cip2bchlc[cmsg->CIPValue].hlc); +else /* no HLC */ + lhlc =0 ; + +if (lbc) { +/* have BC: allocate and assemble command string */ + l = lbc +7 ;/* "^SBC=" + value + "\r" + null byte */ +if (lhlc) + l += lhlc +7 ;/* ";^SHLC=" + value */ commands[AT_BC ] =kmalloc (l,GFP_KERNEL );if (!commands[AT_BC ]) goto oom;strcpy (commands[AT_BC ],"^SBC=" ); -decode_ie (cmsg->BC, commands[AT_BC ]+5 ); +if (cmsg->BC && cmsg->BC[0 ])/* BC specified explicitly */ +decode_ie (cmsg->BC, commands[AT_BC ] +5 ); +else /* BC derived from CIP */ +strcpy (commands[AT_BC ] +5 , + cip2bchlc[cmsg->CIPValue].bc); +if (lhlc) { +strcpy (commands[AT_BC ] + lbc +5 ,";^SHLC=" ); +if (cmsg->HLC && cmsg->HLC[0 ]) +/* HLC specified explicitly */ +decode_ie (cmsg->HLC, + commands[AT_BC ] + lbc +12 ); +else /* HLC derived from CIP */ +strcpy (commands[AT_BC ] + lbc +12 , + cip2bchlc[cmsg->CIPValue].hlc); + }strcpy (commands[AT_BC ] + l -2 ,"\r" ); - }else if (cip2bchlc[cmsg->CIPValue].bc) { - l =strlen (cip2bchlc[cmsg->CIPValue].bc) +7 ; - commands[AT_BC ] =kmalloc (l,GFP_KERNEL ); -if (!commands[AT_BC ]) - goto oom; -snprintf (commands[AT_BC ], l,"^SBC=%s\r" , - cip2bchlc[cmsg->CIPValue].bc); - } - -/* check/encode parameter: HLC */ -if (cmsg->HLC && cmsg->HLC[0 ]) { -/* explicit HLC overrides CIP */ - l =2 *cmsg->HLC[0 ] +7 ; - commands[AT_HLC ] =kmalloc (l,GFP_KERNEL ); -if (!commands[AT_HLC ]) - goto oom; -strcpy (commands[AT_HLC ],"^SHLC=" ); -decode_ie (cmsg->HLC, commands[AT_HLC ]+5 ); -strcpy (commands[AT_HLC ] + l -2 ,"\r" ); - }else if (cip2bchlc[cmsg->CIPValue].hlc) { - l =strlen (cip2bchlc[cmsg->CIPValue].hlc) +7 ; - commands[AT_HLC ] =kmalloc (l,GFP_KERNEL ); -if (!commands[AT_HLC ]) - goto oom; -snprintf (commands[AT_HLC ], l,"^SHLC=%s\r" , - cip2bchlc[cmsg->CIPValue].hlc); + }else { +/* no BC */ +if (lhlc) { +dev_notice (cs->dev,"%s: cannot set HLC without BC\n" , +"CONNECT_REQ" ); + info = CapiIllMessageParmCoding;/* ? */ + goto error; + } }/* check/encode parameter: B Protocol */
drivers/isdn/gigaset/ev-layer.c +1 -3
@@ -282,9 +282,7 @@ struct reply_t gigaset_tab_cid[] =/* dial */ {EV_DIAL, -1, -1, -1, -1, -1, {ACT_DIAL} }, {RSP_INIT, 0, 0, SEQ_DIAL, 601, 5, {ACT_CMD+AT_BC} }, -{RSP_OK, 601, 601, -1, 602, 5, {ACT_CMD+AT_HLC} }, -{RSP_NULL, 602, 602, -1, 603, 5, {ACT_CMD+AT_PROTO} }, -{RSP_OK, 602, 602, -1, 603, 5, {ACT_CMD+AT_PROTO} }, +{RSP_OK, 601, 601, -1, 603, 5, {ACT_CMD+AT_PROTO} }, {RSP_OK, 603, 603, -1, 604, 5, {ACT_CMD+AT_TYPE} }, {RSP_OK, 604, 604, -1, 605, 5, {ACT_CMD+AT_MSN} }, {RSP_NULL, 605, 605, -1, 606, 5, {ACT_CMD+AT_CLIP} },
drivers/isdn/gigaset/gigaset.h +2 -3
@@ -186,10 +186,9 @@ void gigaset_dbg_buffer(enum debuglevel#define AT_BC 3#define AT_PROTO 4#define AT_TYPE 5 -#define AT_HLC 6 -#define AT_CLIP 7 +#define AT_CLIP 6/* total number */ -#define AT_NUM 8 +#define AT_NUM 7/* variables in struct at_state_t */ #define VAR_ZSAU 0
PATCH 164/205 isdn/gigaset: correct CAPI connection state storage
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tilman Schmidt <[email protected]>
commit 1b4843c5e8cbab86830da8a53b8288882060c059 upstream.
CAPI applications can handle several connections in parallel, so one connection state per application isn't sufficient. Store the connection state in the channel structure instead.
Impact: bugfix
--- drivers/isdn/gigaset/capi.c | 225 +++++++++++++++++++++++++++++++---------- drivers/isdn/gigaset/common.c | 4 drivers/isdn/gigaset/gigaset.h | 4 3 files changed, 180 insertions(+), 53 deletions(-)
drivers/isdn/gigaset/capi.c +173 -52
@@ -70,7 +70,7 @@#define MAX_NUMBER_DIGITS 20#define MAX_FMT_IE_LEN 20 -/* values for gigaset_capi_appl.connected */ +/* values for bcs->apconnstate */ #define APCONN_NONE 0/* inactive/listening */ #define APCONN_SETUP 1/* connecting */ #define APCONN_ACTIVE 2/* B channel up */
@@ -84,7 +84,6 @@ struct gigaset_capi_appl {u16 nextMessageNumber;u32 listenInfoMask;u32 listenCIPmask; -int connected; };/* CAPI specific controller data structure */
@@ -395,7 +394,7 @@ void gigaset_skb_sent(struct bc_state *b }/* don't send further B3 messages if disconnected */ -if (ap->connected <APCONN_ACTIVE ) { +if (bcs->apconnstate <APCONN_ACTIVE ) {gig_dbg (DEBUG_LLDATA ,"disconnected, discarding ack" );return ; }
@@ -439,7 +438,7 @@ void gigaset_skb_rcvd(struct bc_state *b }/* don't send further B3 messages if disconnected */ -if (ap->connected <APCONN_ACTIVE ) { +if (bcs->apconnstate <APCONN_ACTIVE ) {gig_dbg (DEBUG_LLDATA ,"disconnected, discarding data" );dev_kfree_skb_any (skb);return ;
@@ -511,6 +510,7 @@ int gigaset_isdn_icall(struct at_state_tu32 actCIPmask;struct sk_buff *skb;unsigned int msgsize; +unsigned long flags;int i;/*
@@ -635,7 +635,14 @@ int gigaset_isdn_icall(struct at_state_t format_ie(iif->hcmsg.CalledPartyNumber));/* scan application list for matching listeners */ - bcs->ap =NULL ; +spin_lock_irqsave (&bcs->aplock, flags); +if (bcs->ap !=NULL || bcs->apconnstate !=APCONN_NONE ) { +dev_warn (cs->dev,"%s: channel not properly cleared (%p/%d)\n" , + __func__, bcs->ap, bcs->apconnstate); + bcs->ap =NULL ; + bcs->apconnstate =APCONN_NONE ; + } +spin_unlock_irqrestore (&bcs->aplock, flags); actCIPmask =1 | (1 << iif->hcmsg.CIPValue);list_for_each_entry (ap, &iif->appls, ctrlist)if (actCIPmask & ap->listenCIPmask) {
@@ -653,10 +660,12 @@ int gigaset_isdn_icall(struct at_state_tdump_cmsg (DEBUG_CMD , __func__, &iif->hcmsg);/* add to listeners on this B channel, update state */ +spin_lock_irqsave (&bcs->aplock, flags); ap->bcnext = bcs->ap; bcs->ap = ap; bcs->chstate |=CHS_NOTIFY_LL ; - ap->connected =APCONN_SETUP ; + bcs->apconnstate =APCONN_SETUP ; +spin_unlock_irqrestore (&bcs->aplock, flags);/* emit message */ capi_ctr_handle_message (&iif->ctr, ap->id, skb);
@@ -681,7 +690,7 @@ static void send_disconnect_ind(struct bstruct gigaset_capi_ctr *iif = cs->iif;struct sk_buff *skb; -if (ap->connected ==APCONN_NONE ) +if (bcs->apconnstate ==APCONN_NONE )return ; capi_cmsg_header(&iif->hcmsg, ap->id, CAPI_DISCONNECT, CAPI_IND,
@@ -695,7 +704,6 @@ static void send_disconnect_ind(struct b }capi_cmsg2message (&iif->hcmsg,__skb_put (skb,CAPI_DISCONNECT_IND_LEN ));dump_cmsg (DEBUG_CMD , __func__, &iif->hcmsg); - ap->connected =APCONN_NONE ;capi_ctr_handle_message (&iif->ctr, ap->id, skb); }
@@ -712,9 +720,9 @@ static void send_disconnect_b3_ind(strucstruct sk_buff *skb;/* nothing to do if no logical connection active */ -if (ap->connected <APCONN_ACTIVE ) +if (bcs->apconnstate <APCONN_ACTIVE )return ; - ap->connected =APCONN_SETUP ; + bcs->apconnstate =APCONN_SETUP ; capi_cmsg_header(&iif->hcmsg, ap->id, CAPI_DISCONNECT_B3, CAPI_IND, ap->nextMessageNumber++,
@@ -741,14 +749,25 @@ void gigaset_isdn_connD(struct bc_state {struct cardstate *cs = bcs->cs;struct gigaset_capi_ctr *iif = cs->iif; -struct gigaset_capi_appl *ap = bcs->ap; +struct gigaset_capi_appl *ap;struct sk_buff *skb;unsigned int msgsize; +unsigned long flags; +spin_lock_irqsave (&bcs->aplock, flags); + ap = bcs->ap;if (!ap) { +spin_unlock_irqrestore (&bcs->aplock, flags);dev_err (cs->dev,"%s: no application\n" , __func__);return ; } +if (bcs->apconnstate ==APCONN_NONE ) { +spin_unlock_irqrestore (&bcs->aplock, flags); +dev_warn (cs->dev,"%s: application %u not connected\n" , + __func__, ap->id); +return ; + } +spin_unlock_irqrestore (&bcs->aplock, flags);while (ap->bcnext) {/* this should never happen */ dev_warn(cs->dev, "%s: dropping extra application %u\n",
@@ -757,11 +776,6 @@ void gigaset_isdn_connD(struct bc_state CapiCallGivenToOtherApplication); ap->bcnext = ap->bcnext->bcnext; } -if (ap->connected ==APCONN_NONE ) { -dev_warn (cs->dev,"%s: application %u not connected\n" , - __func__, ap->id); -return ; - }/* prepare CONNECT_ACTIVE_IND message * Note: LLC not supported by device
@@ -799,17 +813,24 @@ void gigaset_isdn_connD(struct bc_statevoid gigaset_isdn_hupD (struct bc_state *bcs) {struct gigaset_capi_appl *ap; +unsigned long flags;/* * ToDo: pass on reason code reported by device * (requires ev-layer state machine extension to collect * ZCAU device reply) */ -for (ap = bcs->ap; ap !=NULL ; ap = ap->bcnext) { +spin_lock_irqsave (&bcs->aplock, flags); +while (bcs->ap !=NULL ) { + ap = bcs->ap; + bcs->ap = ap->bcnext; +spin_unlock_irqrestore (&bcs->aplock, flags);send_disconnect_b3_ind (bcs, ap);send_disconnect_ind (bcs, ap,0 ); +spin_lock_irqsave (&bcs->aplock, flags); } - bcs->ap =NULL ; + bcs->apconnstate =APCONN_NONE ; +spin_unlock_irqrestore (&bcs->aplock, flags); }/**
@@ -823,24 +844,21 @@ void gigaset_isdn_connB(struct bc_state {struct cardstate *cs = bcs->cs;struct gigaset_capi_ctr *iif = cs->iif; -struct gigaset_capi_appl *ap = bcs->ap; +struct gigaset_capi_appl *ap;struct sk_buff *skb; +unsigned long flags;unsigned int msgsize;u8 command; +spin_lock_irqsave (&bcs->aplock, flags); + ap = bcs->ap;if (!ap) { +spin_unlock_irqrestore (&bcs->aplock, flags);dev_err (cs->dev,"%s: no application\n" , __func__);return ; } -while (ap->bcnext) { -/* this should never happen */ -dev_warn (cs->dev,"%s: dropping extra application %u\n" , - __func__, ap->bcnext->id); -send_disconnect_ind (bcs, ap->bcnext, - CapiCallGivenToOtherApplication); - ap->bcnext = ap->bcnext->bcnext; - } -if (!ap->connected) { +if (!bcs->apconnstate) { +spin_unlock_irqrestore (&bcs->aplock, flags);dev_warn (cs->dev,"%s: application %u not connected\n" , __func__, ap->id);return ;
@@ -852,13 +870,26 @@ void gigaset_isdn_connB(struct bc_state* CONNECT_B3_ACTIVE_IND in reply to CONNECT_B3_RESP * Parameters in both cases always: NCCI = 1, NCPI empty */ -if (ap->connected >=APCONN_ACTIVE ) { +if (bcs->apconnstate >=APCONN_ACTIVE ) { command =CAPI_CONNECT_B3_ACTIVE ; msgsize =CAPI_CONNECT_B3_ACTIVE_IND_BASELEN ; }else { command =CAPI_CONNECT_B3 ; msgsize =CAPI_CONNECT_B3_IND_BASELEN ; } + bcs->apconnstate =APCONN_ACTIVE ; + +spin_unlock_irqrestore (&bcs->aplock, flags); + +while (ap->bcnext) { +/* this should never happen */ +dev_warn (cs->dev,"%s: dropping extra application %u\n" , + __func__, ap->bcnext->id); +send_disconnect_ind (bcs, ap->bcnext, + CapiCallGivenToOtherApplication); + ap->bcnext = ap->bcnext->bcnext; + } +capi_cmsg_header (&iif->hcmsg, ap->id, command,CAPI_IND , ap->nextMessageNumber++, iif->ctr.cnr | ((bcs->channel +1 ) <<8 ) | (1 <<16 ));
@@ -869,7 +900,6 @@ void gigaset_isdn_connB(struct bc_state }capi_cmsg2message (&iif->hcmsg,__skb_put (skb, msgsize));dump_cmsg (DEBUG_CMD , __func__, &iif->hcmsg); - ap->connected =APCONN_ACTIVE ;capi_ctr_handle_message (&iif->ctr, ap->id, skb); }
@@ -975,6 +1005,61 @@ static void gigaset_register_appl(struct ap->rp = *rp;list_add (&ap->ctrlist, &iif->appls); +dev_info (cs->dev,"application %u registered\n" , ap->id); +} + +/* +* remove CAPI application from channel +* helper function to keep indentation levels down and stay in 80 columns +*/ + +static inline void remove_appl_from_channel (struct bc_state *bcs, +struct gigaset_capi_appl *ap) +{ +struct cardstate *cs = bcs->cs; +struct gigaset_capi_appl *bcap; +unsigned long flags; +int prevconnstate; + +spin_lock_irqsave (&bcs->aplock, flags); + bcap = bcs->ap; +if (bcap ==NULL ) { +spin_unlock_irqrestore (&bcs->aplock, flags); +return ; + } + +/* check first application on channel */ +if (bcap == ap) { + bcs->ap = ap->bcnext; +if (bcs->ap !=NULL ) { +spin_unlock_irqrestore (&bcs->aplock, flags); +return ; + } + +/* none left, clear channel state */ + prevconnstate = bcs->apconnstate; + bcs->apconnstate =APCONN_NONE ; +spin_unlock_irqrestore (&bcs->aplock, flags); + +if (prevconnstate ==APCONN_ACTIVE ) { +dev_notice (cs->dev,"%s: hanging up channel %u\n" , + __func__, bcs->channel); +gigaset_add_event (cs, &bcs->at_state, +EV_HUP ,NULL ,0 ,NULL ); +gigaset_schedule_event (cs); + } +return ; + } + +/* check remaining list */ +do { +if (bcap->bcnext == ap) { + bcap->bcnext = bcap->bcnext->bcnext; +return ; + } + bcap = bcap->bcnext; + }while (bcap !=NULL ); +spin_unlock_irqrestore (&bcs->aplock, flags); }/*
@@ -986,19 +1071,19 @@ static void gigaset_release_appl(struct = container_of(ctr, struct gigaset_capi_ctr, ctr);struct cardstate *cs = iif->ctr.driverdata;struct gigaset_capi_appl *ap, *tmp; +unsigned ch;list_for_each_entry_safe (ap, tmp, &iif->appls, ctrlist)if (ap->id == appl) { -if (ap->connected !=APCONN_NONE ) { -dev_err (cs->dev, -"%s: application %u still connected\n" , - __func__, ap->id); -/* ToDo: clear active connection */ - } +/* remove from any channels */ +for (ch =0 ; ch < cs->channels; ch++) +remove_appl_from_channel (&cs->bcs[ch], ap); + +/* remove from registration list */ list_del (&ap->ctrlist);kfree (ap); +dev_info (cs->dev,"application %u released\n" , appl); } - }/*
@@ -1177,6 +1262,7 @@ static void do_connect_req(struct gigasechar **commands;char *s;u8 *pp; +unsigned long flags;int i, l, lbc, lhlc;u16 info;
@@ -1192,8 +1278,15 @@ static void do_connect_req(struct gigasesend_conf (iif, ap, skb, CapiNoPlciAvailable);return ; } +spin_lock_irqsave (&bcs->aplock, flags); +if (bcs->ap !=NULL || bcs->apconnstate !=APCONN_NONE ) +dev_warn (cs->dev,"%s: channel not properly cleared (%p/%d)\n" , + __func__, bcs->ap, bcs->apconnstate); ap->bcnext =NULL ; bcs->ap = ap; + bcs->apconnstate =APCONN_SETUP ; +spin_unlock_irqrestore (&bcs->aplock, flags); + bcs->rx_bufsize = ap->rp.datablklen;dev_kfree_skb (bcs->rx_skb);gigaset_new_rx_skb (bcs);
@@ -1430,7 +1523,6 @@ static void do_connect_req(struct gigase goto error; }gigaset_schedule_event (cs); - ap->connected =APCONN_SETUP ;send_conf (iif, ap, skb, CapiSuccess);return ;
@@ -1458,6 +1550,7 @@ static void do_connect_resp(struct gigas_cmsg *cmsg = &iif->acmsg;struct bc_state *bcs;struct gigaset_capi_appl *oap; +unsigned long flags;int channel;/* decode message */
@@ -1477,12 +1570,21 @@ static void do_connect_resp(struct gigasswitch (cmsg->Reject) {case 0 :/* Accept */ /* drop all competing applications, keep only this one */ -for (oap = bcs->ap; oap !=NULL ; oap = oap->bcnext) -if (oap != ap) +spin_lock_irqsave (&bcs->aplock, flags); +while (bcs->ap !=NULL ) { + oap = bcs->ap; + bcs->ap = oap->bcnext; +if (oap != ap) { +spin_unlock_irqrestore (&bcs->aplock, flags);send_disconnect_ind (bcs, oap, CapiCallGivenToOtherApplication); +spin_lock_irqsave (&bcs->aplock, flags); + } + } ap->bcnext =NULL ; bcs->ap = ap; +spin_unlock_irqrestore (&bcs->aplock, flags); + bcs->rx_bufsize = ap->rp.datablklen;dev_kfree_skb (bcs->rx_skb);gigaset_new_rx_skb (bcs);
@@ -1553,31 +1655,45 @@ static void do_connect_resp(struct gigassend_disconnect_ind (bcs, ap,0 );/* remove it from the list of listening apps */ +spin_lock_irqsave (&bcs->aplock, flags);if (bcs->ap == ap) { bcs->ap = ap->bcnext; -if (bcs->ap ==NULL ) +if (bcs->ap ==NULL ) {/* last one: stop ev-layer hupD notifications */ + bcs->apconnstate =APCONN_NONE ; bcs->chstate &= ~CHS_NOTIFY_LL ; + } +spin_unlock_irqrestore (&bcs->aplock, flags);return ; }for (oap = bcs->ap; oap !=NULL ; oap = oap->bcnext) {if (oap->bcnext == ap) { oap->bcnext = oap->bcnext->bcnext; +spin_unlock_irqrestore (&bcs->aplock, flags);return ; } } +spin_unlock_irqrestore (&bcs->aplock, flags);dev_err (cs->dev,"%s: application %u not found\n" , __func__, ap->id);return ;default :/* Reject */ /* drop all competing applications, keep only this one */ -for (oap = bcs->ap; oap !=NULL ; oap = oap->bcnext) -if (oap != ap) +spin_lock_irqsave (&bcs->aplock, flags); +while (bcs->ap !=NULL ) { + oap = bcs->ap; + bcs->ap = oap->bcnext; +if (oap != ap) { +spin_unlock_irqrestore (&bcs->aplock, flags);send_disconnect_ind (bcs, oap, CapiCallGivenToOtherApplication); +spin_lock_irqsave (&bcs->aplock, flags); + } + } ap->bcnext =NULL ; bcs->ap = ap; +spin_unlock_irqrestore (&bcs->aplock, flags);/* reject call - will trigger DISCONNECT_IND for this app */ dev_info(cs->dev, "%s: Reject=%x\n",
@@ -1600,6 +1716,7 @@ static void do_connect_b3_req(struct gig {struct cardstate *cs = iif->ctr.driverdata;_cmsg *cmsg = &iif->acmsg; +struct bc_state *bcs;int channel;/* decode message */
@@ -1614,9 +1731,10 @@ static void do_connect_b3_req(struct gigsend_conf (iif, ap, skb, CapiIllContrPlciNcci);return ; } + bcs = &cs->bcs[channel-1 ];/* mark logical connection active */ - ap->connected =APCONN_ACTIVE ; + bcs->apconnstate =APCONN_ACTIVE ;/* build NCCI: always 1 (one B3 connection only) */ cmsg->adr.adrNCCI |=1 <<16 ;
@@ -1662,7 +1780,7 @@ static void do_connect_b3_resp(struct gi if (cmsg->Reject) { /* Reject: clear B3 connect received flag */ - ap->connected = APCONN_SETUP; + bcs->apconnstate = APCONN_SETUP; /* trigger hangup, causing eventual DISCONNECT_IND */ if (!gigaset_add_event(cs, &bcs->at_state,
@@ -1734,11 +1852,11 @@ static void do_disconnect_req(struct gig }/* skip if DISCONNECT_IND already sent */ -if (!ap->connected) +if (!bcs->apconnstate)return ;/* check for active logical connection */ -if (ap->connected >=APCONN_ACTIVE ) { +if (bcs->apconnstate >=APCONN_ACTIVE ) {/* * emit DISCONNECT_B3_IND with cause 0x3301 * use separate cmsg structure, as the content of iif->acmsg
@@ -1787,6 +1905,7 @@ static void do_disconnect_b3_req(struct {struct cardstate *cs = iif->ctr.driverdata;_cmsg *cmsg = &iif->acmsg; +struct bc_state *bcs;int channel;/* decode message */
@@ -1802,17 +1921,17 @@ static void do_disconnect_b3_req(structsend_conf (iif, ap, skb, CapiIllContrPlciNcci);return ; } + bcs = &cs->bcs[channel-1 ];/* reject if logical connection not active */ -if (ap->connected <APCONN_ACTIVE ) { +if (bcs->apconnstate <APCONN_ACTIVE ) {send_conf (iif, ap, skb, CapiMessageNotSupportedInCurrentState);return ; }/* trigger hangup, causing eventual DISCONNECT_B3_IND */ -if (!gigaset_add_event (cs, &cs->bcs[channel-1 ].at_state, -EV_HUP ,NULL ,0 ,NULL )) { +if (!gigaset_add_event (cs, &bcs->at_state,EV_HUP ,NULL ,0 ,NULL )) {send_conf (iif, ap, skb,CAPI_MSGOSRESOURCEERR );return ; }
@@ -1833,6 +1952,7 @@ static void do_data_b3_req(struct gigase struct sk_buff *skb) {struct cardstate *cs = iif->ctr.driverdata; +struct bc_state *bcs;int channel =CAPIMSG_PLCI_PART (skb->data);u16 ncci =CAPIMSG_NCCI_PART (skb->data);u16 msglen =CAPIMSG_LEN (skb->data);
@@ -1855,6 +1975,7 @@ static void do_data_b3_req(struct gigasesend_conf (iif, ap, skb, CapiIllContrPlciNcci);return ; } + bcs = &cs->bcs[channel-1 ];if (msglen !=CAPI_DATA_B3_REQ_LEN && msglen !=CAPI_DATA_B3_REQ_LEN64 )dev_notice (cs->dev,"%s: unexpected length %d\n" ,"DATA_B3_REQ" , msglen);
@@ -1874,7 +1995,7 @@ static void do_data_b3_req(struct gigase }/* reject if logical connection not active */ -if (ap->connected <APCONN_ACTIVE ) { +if (bcs->apconnstate <APCONN_ACTIVE ) {send_conf (iif, ap, skb, CapiMessageNotSupportedInCurrentState);return ; }
@@ -1885,7 +2006,7 @@ static void do_data_b3_req(struct gigaseskb_pull (skb, msglen);/* pass to device-specific module */ -if (cs->ops->send_skb (&cs->bcs[channel-1 ], skb) <0 ) { +if (cs->ops->send_skb (bcs, skb) <0 ) {send_conf (iif, ap, skb,CAPI_MSGOSRESOURCEERR );return ; }
drivers/isdn/gigaset/common.c +4 -0
@@ -649,6 +649,10 @@ static struct bc_state *gigaset_initbcs(for (i =0 ; i <AT_NUM ; ++i) bcs->commands[i] =NULL ; +spin_lock_init (&bcs->aplock); + bcs->ap =NULL ; + bcs->apconnstate =0 ; +gig_dbg (DEBUG_INIT ," setting up bcs[%d]->hw" , channel);if (cs->ops->initbcshw (bcs))return bcs;
drivers/isdn/gigaset/gigaset.h +3 -1
@@ -403,7 +403,9 @@ struct bc_state {struct bas_bc_state *bas;/* usb hardware driver (base) */ } hw; -void *ap;/* LL application structure */ +void *ap;/* associated LL application */ +int apconnstate;/* LL application connection state */ +spinlock_t aplock; };struct cardstate {
PATCH 165/205 ACPI: skip checking BM_STS if the BIOS doesnt ask for it
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Len Brown <[email protected]>
commit 718be4aaf3613cf7c2d097f925abc3d3553c0605 upstream.
It turns out that there is a bit in the _CST for Intel FFH C3 that tells the OS if we should be checking BM_STS or not.
Linux has been unconditionally checking BM_STS.
If the chip-set is configured to enable BM_STS,
it can retard or completely prevent entry into
deep C-states -- as illustrated by turbostat:
http://userweb.kernel.org/~lenb/acpi/utils/pmtools/turbostat/
ref: Intel Processor Vendor-Specific ACPI Interface Specification table 4 "_CST FFH GAS Field Encoding"
Bit 1: Set to 1 if OSPM should use Bus Master avoidance for this C-state
https://bugzilla.kernel.org/show_bug.cgi?id=15886
--- arch/x86/kernel/acpi/cstate.c | 9 +++++++++ drivers/acpi/processor_idle.c | 2 +- include/acpi/processor.h | 3 ++- 3 files changed, 12 insertions(+), 2 deletions(-)
arch/x86/kernel/acpi/cstate.c +9 -0
@@ -145,6 +145,15 @@ int acpi_processor_ffh_cstate_probe(unsi percpu_entry->states[cx->index].eax = cx->address; percpu_entry->states[cx->index].ecx =MWAIT_ECX_INTERRUPT_BREAK ; } + +/* +* For _CST FFH on Intel, if GAS.access_size bit 1 is cleared, +* then we should skip checking BM_STS for this C-state. +* ref: "Intel Processor Vendor-Specific ACPI Interface Specification" +*/ +if ((c->x86_vendor ==X86_VENDOR_INTEL ) && !(reg->access_size &0x2 )) + cx->bm_sts_skip =1 ; +return retval; }EXPORT_SYMBOL_GPL (acpi_processor_ffh_cstate_probe);
drivers/acpi/processor_idle.c +1 -1
@@ -955,7 +955,7 @@ static int acpi_idle_enter_bm(struct cpuif (acpi_idle_suspend)return (acpi_idle_enter_c1 (dev, state)); -if (acpi_idle_bm_check ()) { +if (!cx->bm_sts_skip &&acpi_idle_bm_check ()) {if (dev->safe_state) { dev->last_state = dev->safe_state;return dev->safe_state->enter (dev, dev->safe_state);
include/acpi/processor.h +2 -1
@@ -48,7 +48,7 @@ struct acpi_power_register {u8 space_id;u8 bit_width;u8 bit_offset; -u8 reserved; +u8 access_size;u64 address; } __attribute__ ((packed));
@@ -74,6 +74,7 @@ struct acpi_processor_cx {u32 power;u32 usage;u64 time; +u8 bm_sts_skip;struct acpi_processor_cx_policy promotion;struct acpi_processor_cx_policy demotion;char desc[ACPI_CX_DESC_LEN ];
PATCH 166/205 ACPI / PM: Do not enable GPEs for system wakeup in advance
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit cb1cb1780f2025a7d612de09131bf6530f80fb1a upstream.
After commit 9630bdd9b15d2f489c646d8bc04b60e53eb5ec78 (ACPI: Use GPE reference counting to support shared GPEs) the wakeup enable mask bits of GPEs are set as soon as the GPEs are enabled to wake up the system. Unfortunately, this leads to a regression reported by Michal Hocko, where a system is woken up from ACPI S5 by a device that is not supposed to do that, because the wakeup enable mask bit of this device's GPE is always set when acpi_enter_sleep_state() calls acpi_hw_enable_all_wakeup_gpes(), although it should only be set if the device is supposed to wake up the system from the target state.
To work around this issue, rework the ACPI power management code so that GPEs are not enabled to wake up the system upfront, but only during a system state transition when the target state of the system is known. [Of course, this means that the reference counting of "wakeup" GPEs doesn't really make sense and it is sufficient to set/unset the wakeup mask bits for them during system sleep transitions. This will allow us to simplify the GPE handling code quite a bit, but that change is too intrusive for 2.6.35.]
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15951
--- drivers/acpi/button.c | 4 ++-- drivers/acpi/wakeup.c | 20 +++++++------------- 2 files changed, 9 insertions(+), 15 deletions(-)
drivers/acpi/button.c +2 -2
@@ -425,7 +425,7 @@ static int acpi_button_add(struct acpi_d/* Button's GPE is run-wake GPE */ acpi_enable_gpe (device->wakeup.gpe_device, device->wakeup.gpe_number, -ACPI_GPE_TYPE_WAKE_RUN ); +ACPI_GPE_TYPE_RUNTIME ); device->wakeup.run_wake_count++; device->wakeup.state.enabled =1 ; }
@@ -449,7 +449,7 @@ static int acpi_button_remove(struct acpif (device->wakeup.flags.valid) {acpi_disable_gpe (device->wakeup.gpe_device, device->wakeup.gpe_number, -ACPI_GPE_TYPE_WAKE_RUN ); +ACPI_GPE_TYPE_RUNTIME ); device->wakeup.run_wake_count--; device->wakeup.state.enabled =0 ; }
drivers/acpi/wakeup.c +7 -13
@@ -64,16 +64,13 @@ void acpi_enable_wakeup_device(u8 sleep_struct acpi_device *dev = container_of(node, struct acpi_device, wakeup_list); -if (!dev->wakeup.flags.valid) -continue ; - -if ((!dev->wakeup.state.enabled && !dev->wakeup.prepare_count) +if (!dev->wakeup.flags.valid || !dev->wakeup.state.enabled || sleep_state > (u32 ) dev->wakeup.sleep_state)continue ;/* The wake-up power should have been enabled already. */ -acpi_set_gpe (dev->wakeup.gpe_device, dev->wakeup.gpe_number, -ACPI_GPE_ENABLE ); +acpi_enable_gpe (dev->wakeup.gpe_device, dev->wakeup.gpe_number, +ACPI_GPE_TYPE_WAKE ); } }
@@ -96,6 +93,8 @@ void acpi_disable_wakeup_device(u8 sleep || (sleep_state > (u32) dev->wakeup.sleep_state))continue ; +acpi_disable_gpe (dev->wakeup.gpe_device, dev->wakeup.gpe_number, +ACPI_GPE_TYPE_WAKE );acpi_disable_wakeup_device_power (dev); } }
@@ -109,13 +108,8 @@ int __init acpi_wakeup_device_init(void)struct acpi_device *dev =container_of (node, struct acpi_device, wakeup_list); -/* In case user doesn't load button driver */ -if (!dev->wakeup.flags.always_enabled || - dev->wakeup.state.enabled) -continue ; -acpi_enable_gpe (dev->wakeup.gpe_device, dev->wakeup.gpe_number, -ACPI_GPE_TYPE_WAKE ); - dev->wakeup.state.enabled =1 ; +if (dev->wakeup.flags.always_enabled) + dev->wakeup.state.enabled =1 ; }mutex_unlock (&acpi_device_lock);return 0 ;
PATCH 167/205 ACPI: Unconditionally set SCI_EN on resume
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Matthew Garrett <[email protected]>
commit b6dacf63e9fb2e7a1369843d6cef332f76fca6a3 upstream.
The ACPI spec tells us that the firmware will reenable SCI_EN on resume. Reality disagrees in some cases. The ACPI spec tells us that the only way to set SCI_EN is via an SMM call.
https://bugzilla.kernel.org/show_bug.cgi?id=13745 shows us that doing so may break machines. Tracing the ACPI calls made by Windows shows that it unconditionally sets SCI_EN on resume with a direct register write, and therefore the overwhelming probability is that everything is fine with this behaviour.
--- arch/x86/kernel/acpi/sleep.c | 2 drivers/acpi/sleep.c | 157 ------------------------------------------- include/linux/acpi.h | 1 3 files changed, 2 insertions(+), 158 deletions(-)
arch/x86/kernel/acpi/sleep.c +0 -2
@@ -162,8 +162,6 @@ static int __init acpi_sleep_setup(char#endif if (strncmp (str,"old_ordering" ,12 ) ==0 )acpi_old_suspend_ordering (); -if (strncmp (str,"sci_force_enable" ,16 ) ==0 ) -acpi_set_sci_en_on_resume (); str =strchr (str,',' );if (str !=NULL ) str +=strspn (str,", \t" );
drivers/acpi/sleep.c +2 -155
193 lines not on this page · raw message
include/linux/acpi.h +0 -1
@@ -251,7 +251,6 @@ int acpi_check_mem_region(resource_size_void __init acpi_no_s4_hw_signature (void );void __init acpi_old_suspend_ordering (void );void __init acpi_s4_no_nvs (void ); -void __init acpi_set_sci_en_on_resume (void );#endif /* CONFIG_PM_SLEEP */ struct acpi_osc_context {
PATCH 168/205 libertas/sdio: 8686: set ECSI bit for 1-bit transfers
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel Mack <[email protected]>
commit 8a64c0f6b7ec7f758c4ef445e49f479e27fa2236 upstream.
When operating in 1-bit mode, SDAT1 is used as dedicated interrupt line. However, the 8686 will only drive this line when the ECSI bit is set in the CCCR_IF register.
Thanks to Alagu Sankar for pointing me in the right direction.
--- drivers/net/wireless/libertas/if_sdio.c | 22 ++++++++++++++++++++++ include/linux/mmc/sdio.h | 2 ++ 2 files changed, 24 insertions(+)
drivers/net/wireless/libertas/if_sdio.c +22 -0
@@ -35,6 +35,8 @@#include <linux/mmc/card.h> #include <linux/mmc/sdio_func.h> #include <linux/mmc/sdio_ids.h> +#include <linux/mmc/sdio.h> +#include <linux/mmc/host.h> #include "host.h" #include "decl.h"
@@ -943,6 +945,7 @@ static int if_sdio_probe(struct sdio_funint ret, i;unsigned int model;struct if_sdio_packet *packet; +struct mmc_host *host = func->card->host;lbs_deb_enter (LBS_DEB_SDIO );
@@ -1023,6 +1026,25 @@ static int if_sdio_probe(struct sdio_funif (ret) goto disable; +/* For 1-bit transfers to the 8686 model, we need to enable the +* interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0 +* bit to allow access to non-vendor registers. */ +if ((card->model ==IF_SDIO_MODEL_8686 ) && + (host->caps &MMC_CAP_SDIO_IRQ ) && + (host->ios.bus_width ==MMC_BUS_WIDTH_1 )) { +u8 reg; + + func->card->quirks |=MMC_QUIRK_LENIENT_FN0 ; + reg =sdio_f0_readb (func,SDIO_CCCR_IF , &ret); +if (ret) + goto release_int; + + reg |=SDIO_BUS_ECSI ; +sdio_f0_writeb (func, reg,SDIO_CCCR_IF , &ret); +if (ret) + goto release_int; + } + card->ioport =sdio_readb (func,IF_SDIO_IOPORT , &ret);if (ret) goto release_int;
include/linux/mmc/sdio.h +2 -0
@@ -94,6 +94,8 @@#define SDIO_BUS_WIDTH_1BIT 0x00#define SDIO_BUS_WIDTH_4BIT 0x02 +#define SDIO_BUS_ECSI 0x20/* Enable continuous SPI interrupt */ +#define SDIO_BUS_SCSI 0x40/* Support continuous SPI interrupt */ #define SDIO_BUS_ASYNC_INT 0x20
PATCH 169/205 dm9000: fix "BUG: spinlock recursion"
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Baruch Siach <[email protected]>
commit 380fefb2ddabd4cd5f14dbe090481f0544e65078 upstream.
dm9000_set_rx_csum and dm9000_hash_table are called from atomic context (in dm9000_init_dm9000), and from non-atomic context (via ethtool_ops and net_device_ops respectively). This causes a spinlock recursion BUG. Fix this by renaming these functions to *_unlocked for the atomic context, and make the original functions locking wrappers for use in the non-atomic context.
--- drivers/net/dm9000.c | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-)
drivers/net/dm9000.c +27 -11
@@ -476,17 +476,13 @@ static uint32_t dm9000_get_rx_csum(strucreturn dm->rx_csum; } -static int dm9000_set_rx_csum (struct net_device *dev,uint32_t data) +static int dm9000_set_rx_csum_unlocked (struct net_device *dev,uint32_t data) {board_info_t *dm =to_dm9000_board (dev); -unsigned long flags;if (dm->can_csum) { dm->rx_csum = data; - -spin_lock_irqsave (&dm->lock, flags);iow (dm,DM9000_RCSR , dm->rx_csum ?RCSR_CSUM :0 ); -spin_unlock_irqrestore (&dm->lock, flags);return 0 ; }
@@ -494,6 +490,19 @@ static int dm9000_set_rx_csum(struct netreturn -EOPNOTSUPP ; } +static int dm9000_set_rx_csum (struct net_device *dev,uint32_t data) +{ +board_info_t *dm =to_dm9000_board (dev); +unsigned long flags; +int ret; + +spin_lock_irqsave (&dm->lock, flags); + ret =dm9000_set_rx_csum_unlocked (dev, data); +spin_unlock_irqrestore (&dm->lock, flags); + +return ret; +} +static int dm9000_set_tx_csum (struct net_device *dev,uint32_t data) {board_info_t *dm =to_dm9000_board (dev);
@@ -722,7 +731,7 @@ static unsigned char dm9000_type_to_char* Set DM9000 multicast address */ static void -dm9000_hash_table (struct net_device *dev) +dm9000_hash_table_unlocked (struct net_device *dev) {board_info_t *db =netdev_priv (dev);struct dev_mc_list *mcptr;
@@ -730,12 +739,9 @@ dm9000_hash_table(struct net_device *devu32 hash_val;u16 hash_table[4 ];u8 rcr =RCR_DIS_LONG |RCR_DIS_CRC |RCR_RXEN ; -unsigned long flags;dm9000_dbg (db,1 ,"entering %s\n" , __func__); -spin_lock_irqsave (&db->lock, flags); -for (i =0 , oft =DM9000_PAR ; i <6 ; i++, oft++)iow (db, oft, dev->dev_addr[i]);
@@ -765,6 +771,16 @@ dm9000_hash_table(struct net_device *dev }iow (db,DM9000_RCR , rcr); +} + +static void +dm9000_hash_table (struct net_device *dev) +{ +board_info_t *db =netdev_priv (dev); +unsigned long flags; + +spin_lock_irqsave (&db->lock, flags); +dm9000_hash_table_unlocked (dev);spin_unlock_irqrestore (&db->lock, flags); }
@@ -784,7 +800,7 @@ dm9000_init_dm9000(struct net_device *de db->io_mode =ior (db,DM9000_ISR ) >>6 ;/* ISR bit7:6 keeps I/O mode */ /* Checksum mode */ -dm9000_set_rx_csum (dev, db->rx_csum); +dm9000_set_rx_csum_unlocked (dev, db->rx_csum);/* GPIO0 on pre-activate PHY */ iow (db,DM9000_GPR ,0 );/* REG_1F bit0 activate phyxcer */
@@ -811,7 +827,7 @@ dm9000_init_dm9000(struct net_device *deiow (db,DM9000_ISR ,ISR_CLR_STATUS );/* Clear interrupt status */ /* Set address filter table */ -dm9000_hash_table (dev); +dm9000_hash_table_unlocked (dev); imr =IMR_PAR |IMR_PTM |IMR_PRM ;if (db->type !=TYPE_DM9000E )
PATCH 170/205 mfd: Remove unneeded and dangerous clearing of clientdata
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Wolfram Sang <[email protected]>
commit 28ade0f217a3a3ff992b01e06e6e425c250a8406 upstream.
Unlike real i2c-devices which get detached from the driver, dummy-devices get truly unregistered. So, there has never been a need to clear the clientdata because the device will go away anyhow. For the occasions fixed here, clearing clientdata was even dangerous as the structure was freed already.
--- drivers/mfd/88pm860x-i2c.c | 1 - drivers/mfd/max8925-i2c.c | 2 -- 2 files changed, 3 deletions(-)
drivers/mfd/88pm860x-i2c.c +0 -1
@@ -200,7 +200,6 @@ static int __devexit pm860x_remove(strucpm860x_device_exit (chip);i2c_unregister_device (chip->companion); -i2c_set_clientdata (chip->companion,NULL );i2c_set_clientdata (chip->client,NULL );kfree (chip);return 0 ;
drivers/mfd/max8925-i2c.c +0 -2
@@ -173,8 +173,6 @@ static int __devexit max8925_remove(strumax8925_device_exit (chip);i2c_unregister_device (chip->adc);i2c_unregister_device (chip->rtc); -i2c_set_clientdata (chip->adc,NULL ); -i2c_set_clientdata (chip->rtc,NULL );i2c_set_clientdata (chip->i2c,NULL );kfree (chip);return 0 ;
PATCH 171/205 firmware_class: fix memory leak - free allocated pages
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Woodhouse <[email protected]>
commit dd336c554d8926c3348a2d5f2a5ef5597f6d1a06 upstream.
fix memory leak introduced by the patch 6e03a201bbe:
firmware: speed up request_firmware()
1. vfree won't release pages there were allocated explicitly and mapped using vmap. The memory has to be vunmap-ed and the pages needs to be freed explicitly
2. page array is moved into the 'struct firmware' so that we can free it from release_firmware() and not only in fw_dev_release()
The fix doesn't break the firmware load speed.
--- drivers/base/firmware_class.c | 26 ++++++++++++++++++++------ include/linux/firmware.h | 1 + 2 files changed, 21 insertions(+), 6 deletions(-)
drivers/base/firmware_class.c +20 -6
@@ -130,6 +130,17 @@ static ssize_t firmware_loading_show(strreturn sprintf (buf,"%d\n" , loading); } +static void firmware_free_data (const struct firmware *fw) +{ +int i; +vunmap (fw->data); +if (fw->pages) { +for (i =0 ; i <PFN_UP (fw->size); i++) +__free_page (fw->pages[i]); +kfree (fw->pages); + } +} +/* Some architectures don't have PAGE_KERNEL_RO */ #ifndef PAGE_KERNEL_RO #define PAGE_KERNEL_RO PAGE_KERNEL
@@ -162,21 +173,21 @@ static ssize_t firmware_loading_store(stmutex_unlock (&fw_lock);break ; } -vfree (fw_priv->fw->data); - fw_priv->fw->data =NULL ; +firmware_free_data (fw_priv->fw); +memset (fw_priv->fw,0 ,sizeof (struct firmware )); +/* If the pages are not owned by 'struct firmware' */ for (i =0 ; i < fw_priv->nr_pages; i++)__free_page (fw_priv->pages[i]);kfree (fw_priv->pages); fw_priv->pages =NULL ; fw_priv->page_array_size =0 ; fw_priv->nr_pages =0 ; - fw_priv->fw->size =0 ;set_bit (FW_STATUS_LOADING , &fw_priv->status);mutex_unlock (&fw_lock);break ;case 0 :if (test_bit (FW_STATUS_LOADING , &fw_priv->status)) { -vfree (fw_priv->fw->data); +vunmap (fw_priv->fw->data); fw_priv->fw->data =vmap (fw_priv->pages, fw_priv->nr_pages,0 ,PAGE_KERNEL_RO );
@@ -184,7 +195,10 @@ static ssize_t firmware_loading_store(stdev_err (dev,"%s: vmap() failed\n" , __func__); goto err; } -/* Pages will be freed by vfree() */ +/* Pages are now owned by 'struct firmware' */ + fw_priv->fw->pages = fw_priv->pages; + fw_priv->pages =NULL ; + fw_priv->page_array_size =0 ; fw_priv->nr_pages =0 ;complete (&fw_priv->completion);
@@ -578,7 +592,7 @@ release_firmware(const struct firmware *if (fw->data == builtin->data) goto free_fw; } -vfree (fw->data); +firmware_free_data (fw); free_fw:kfree (fw); }
include/linux/firmware.h +1 -0
@@ -12,6 +12,7 @@struct firmware {size_t size;const u8 *data; +struct page **pages; };struct device ;
PATCH 172/205 revert "[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)"
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrej Gelenberg <[email protected]>
commit accd846698439ba18250e8fd5681af280446b853 upstream.
395913d0b1db37092ea3d9d69b832183b1dd84c5 ("[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)") is not needed, because there is no rwsem lock in cpufreq_ondemand and cpufreq_conservative anymore. Lock should not be released until the work done.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=1594
--- drivers/cpufreq/cpufreq.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/cpufreq/cpufreq.c +1 -10
@@ -1774,17 +1774,8 @@ static int __cpufreq_set_policy(struct cdprintk ("governor switch\n" );/* end old governor */ -if (data->governor) { -/* -* Need to release the rwsem around governor -* stop due to lock dependency between -* cancel_delayed_work_sync and the read lock -* taken in the delayed work handler. -*/ -unlock_policy_rwsem_write (data->cpu); +if (data->governor)__cpufreq_governor (data,CPUFREQ_GOV_STOP ); -lock_policy_rwsem_write (data->cpu); - }/* start new governor */ data->governor = policy->governor;
PATCH 173/205 V4L/DVB: dvb-core: Fix ULE decapsulation bug
In reply to Greg KH2.6.34-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ang Way Chuang <[email protected]>
commit 5c331fc8c19e181bffab46e9d18e1637cdc47170 upstream.
Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation code has a bug that incorrectly treats ULE SNDU packed into the remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer field on the subsequent MPEG2-TS frame.
--- drivers/media/dvb/dvb-core/dvb_net.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/media/dvb/dvb-core/dvb_net.c +11 -1
@@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_deviconst u8 *ts, *ts_end, *from_where =NULL ;u8 ts_remain =0 , how_much =0 , new_ts =1 ;struct ethhdr *ethh =NULL ; +bool error = false;#ifdef ULE_DEBUG /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
@@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_devi/* Drop partly decoded SNDU, reset state, resync on PUSI. */ if (priv->ule_skb) { -dev_kfree_skb ( priv->ule_skb ); + error = true; +dev_kfree_skb (priv->ule_skb); + } + +if (error || priv->ule_sndu_remain) { dev->stats.rx_errors++; dev->stats.rx_frame_errors++; + error = false; } +reset_ule (priv); priv->need_pusi =1 ;continue ;
@@ -534,6 +541,7 @@ static void dvb_net_ule( struct net_devi from_where +=2 ; } + priv->ule_sndu_remain = priv->ule_sndu_len +2 ;/* * State of current TS: * ts_remain (remaining bytes in the current TS cell)
@@ -543,6 +551,7 @@ static void dvb_net_ule( struct net_devi*/ switch (ts_remain) {case 1 : + priv->ule_sndu_remain--; priv->ule_sndu_type = from_where[0 ] <<8 ; priv->ule_sndu_type_1 =1 ;/* first byte of ule_type is set. */ ts_remain -=1 ; from_where +=1 ;
@@ -556,6 +565,7 @@ static void dvb_net_ule( struct net_devidefault :/* complete ULE header is present in current TS. */ /* Extract ULE type field. */ if (priv->ule_sndu_type_1) { + priv->ule_sndu_type_1 =0 ; priv->ule_sndu_type |= from_where[0 ]; from_where +=1 ;/* points to payload start. */ ts_remain -=1 ;