3.0.5-stable review
Subsystems (101)
cover 3.0.5-stable review
This is the start of the stable review cycle for the 3.0.5 release. There are 244 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.
Responses should be made by Friday, September 30, 20:00:00 UTC. Anything received after that time might be too late.
The whole patch series would normally be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.0.5-rc1.gz
and the diffstat can be found below.
As kernel.org is still having some difficulities, I'll be responding to this email with the whole 3.0.5-rc1 patch for those that wish to test it out.
thanks,
greg k-h
PATCH 1/244 kernel/printk: do not turn off bootconsole in printk_late_init() if keep_bootcon
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nishanth Aravamudan <[email protected]>
commit 4c30c6f566c0989ddaee3407da44751e340a63ed upstream.
It seems that 7bf693951a8e ("console: allow to retain boot console via boot option keep_bootcon") doesn't always achieve what it aims, as when printk_late_init() runs it unconditionally turns off all boot consoles. With this patch, I am able to see more messages on the boot console in KVM guests than I can without, when keep_bootcon is specified.
I think it is appropriate for the relevant -stable trees. However, it's more of an annoyance than a serious bug (ideally you don't need to keep the boot console around as console handover should be working -- I was encountering a situation where the console handover wasn't working and not having the boot console available meant I couldn't see why).
--- kernel/printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/printk.c +1 -1
@@ -1584,7 +1584,7 @@ static int __init printk_late_init(void)struct console *con;for_each_console (con) { -if (con->flags &CON_BOOT ) { +if (!keep_bootcon && con->flags &CON_BOOT ) {printk (KERN_INFO "turn off boot console %s%d\n" , con->name, con->index);unregister_console (con);
PATCH 2/244 rapidio: fix use of non-compatible registers
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alexandre Bounine <[email protected]>
commit 284fb68d00c56e971ed01e0b4bac5ddd4d1b74ab upstream.
Replace/remove use of RIO v.1.2 registers/bits that are not forward-compatible with newer versions of RapidIO specification.
RapidIO specification v.1.3 removed Write Port CSR, Doorbell CSR, Mailbox CSR and Mailbox and Doorbell bits of the PEF CAR.
Use of removed (since RIO v.1.3) register bits affects users of currently available 1.3 and 2.x compliant devices who may use not so recent kernel versions.
Removing checks for unsupported bits makes corresponding routines compatible with all versions of RapidIO specification. Therefore, backporting makes stable kernel versions compliant with RIO v.1.3 and later as well.
--- drivers/net/rionet.c | 23 ++++++++--------------- drivers/rapidio/rio-scan.c | 3 +-- include/linux/rio_regs.h | 18 +++++++++--------- 3 files changed, 18 insertions(+), 26 deletions(-)
drivers/net/rionet.c +8 -15
@@ -80,13 +80,13 @@ static int rionet_capable = 1;*/ static struct rio_dev **rionet_active; -#define is_rionet_capable (pef, src_ops, dst_ops) \ - ((pef & RIO_PEF_INB_MBOX) && \ - (pef & RIO_PEF_INB_DOORBELL) && \ +#define is_rionet_capable (src_ops, dst_ops) \ + ((src_ops & RIO_SRC_OPS_DATA_MSG) && \ + (dst_ops & RIO_DST_OPS_DATA_MSG) && \ (src_ops & RIO_SRC_OPS_DOORBELL) && \ (dst_ops & RIO_DST_OPS_DOORBELL))#define dev_rionet_capable (dev) \ - is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops) + is_rionet_capable(dev->src_ops, dev->dst_ops)#define RIONET_MAC_MATCH (x) (*(u32 *)x == 0x00010001)#define RIONET_GET_DESTID (x) (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device {int i, rc =0 ;struct rionet_peer *peer, *tmp; -u32 pwdcsr;struct rionet_private *rnet =netdev_priv (ndev);if (netif_msg_ifup (rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_devicecontinue ; } -/* -* If device has initialized inbound doorbells, -* send a join message -*/ -rio_read_config_32 (peer->rdev,RIO_WRITE_PORT_CSR , &pwdcsr); -if (pwdcsr &RIO_DOORBELL_AVAIL ) -rio_send_doorbell (peer->rdev,RIONET_DOORBELL_JOIN ); +/* Send a join message */ +rio_send_doorbell (peer->rdev,RIONET_DOORBELL_JOIN ); } out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct ristatic int rionet_probe (struct rio_dev *rdev,const struct rio_device_id *id) {int rc = -ENODEV ; -u32 lpef, lsrc_ops, ldst_ops; +u32 lsrc_ops, ldst_ops;struct rionet_peer *peer;struct net_device *ndev =NULL ;
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev ** on later probes */ if (!rionet_check) { -rio_local_read_config_32 (rdev->net->hport,RIO_PEF_CAR , &lpef);rio_local_read_config_32 (rdev->net->hport,RIO_SRC_OPS_CAR , &lsrc_ops);rio_local_read_config_32 (rdev->net->hport,RIO_DST_OPS_CAR , &ldst_ops); -if (!is_rionet_capable (lpef, lsrc_ops, ldst_ops)) { +if (!is_rionet_capable (lsrc_ops, ldst_ops)) {printk (KERN_ERR "%s: local device is not network capable\n" ,DRV_NAME );
drivers/rapidio/rio-scan.c +1 -2
@@ -505,8 +505,7 @@ static struct rio_dev __devinit *rio_set rdev->dev.dma_mask = &rdev->dma_mask; rdev->dev.coherent_dma_mask =DMA_BIT_MASK (32 ); -if ((rdev->pef &RIO_PEF_INB_DOORBELL ) && - (rdev->dst_ops &RIO_DST_OPS_DOORBELL )) +if (rdev->dst_ops &RIO_DST_OPS_DOORBELL )rio_init_dbell_res (&rdev->riores[RIO_DOORBELL_RESOURCE ],0 ,0xffff );
include/linux/rio_regs.h +9 -9
@@ -36,12 +36,12 @@#define RIO_PEF_PROCESSOR 0x20000000/* [I] Processor */ #define RIO_PEF_SWITCH 0x10000000/* [I] Switch */ #define RIO_PEF_MULTIPORT 0x08000000/* [VI, 2.1] Multiport */ -#define RIO_PEF_INB_MBOX 0x00f00000/* [II] Mailboxes */ -#define RIO_PEF_INB_MBOX0 0x00800000/* [II] Mailbox 0 */ -#define RIO_PEF_INB_MBOX1 0x00400000/* [II] Mailbox 1 */ -#define RIO_PEF_INB_MBOX2 0x00200000/* [II] Mailbox 2 */ -#define RIO_PEF_INB_MBOX3 0x00100000/* [II] Mailbox 3 */ -#define RIO_PEF_INB_DOORBELL 0x00080000/* [II] Doorbells */ +#define RIO_PEF_INB_MBOX 0x00f00000/* [II, <= 1.2] Mailboxes */ +#define RIO_PEF_INB_MBOX0 0x00800000/* [II, <= 1.2] Mailbox 0 */ +#define RIO_PEF_INB_MBOX1 0x00400000/* [II, <= 1.2] Mailbox 1 */ +#define RIO_PEF_INB_MBOX2 0x00200000/* [II, <= 1.2] Mailbox 2 */ +#define RIO_PEF_INB_MBOX3 0x00100000/* [II, <= 1.2] Mailbox 3 */ +#define RIO_PEF_INB_DOORBELL 0x00080000/* [II, <= 1.2] Doorbells */ #define RIO_PEF_EXT_RT 0x00000200/* [III, 1.3] Extended route table support */ #define RIO_PEF_STD_RT 0x00000100/* [III, 1.3] Standard route table support */ #define RIO_PEF_CTLS 0x00000010/* [III] CTLS */
@@ -102,7 +102,7 @@#define RIO_SWITCH_RT_LIMIT 0x34/* [III, 1.3] Switch Route Table Destination ID Limit CAR */ #define RIO_RT_MAX_DESTID 0x0000ffff -#define RIO_MBOX_CSR 0x40/* [II] Mailbox CSR */ +#define RIO_MBOX_CSR 0x40/* [II, <= 1.2] Mailbox CSR */ #define RIO_MBOX0_AVAIL 0x80000000/* [II] Mbox 0 avail */ #define RIO_MBOX0_FULL 0x40000000/* [II] Mbox 0 full */ #define RIO_MBOX0_EMPTY 0x20000000/* [II] Mbox 0 empty */
@@ -128,8 +128,8 @@#define RIO_MBOX3_FAIL 0x00000008/* [II] Mbox 3 fail */ #define RIO_MBOX3_ERROR 0x00000004/* [II] Mbox 3 error */ -#define RIO_WRITE_PORT_CSR 0x44/* [I] Write Port CSR */ -#define RIO_DOORBELL_CSR 0x44/* [II] Doorbell CSR */ +#define RIO_WRITE_PORT_CSR 0x44/* [I, <= 1.2] Write Port CSR */ +#define RIO_DOORBELL_CSR 0x44/* [II, <= 1.2] Doorbell CSR */ #define RIO_DOORBELL_AVAIL 0x80000000/* [II] Doorbell avail */ #define RIO_DOORBELL_FULL 0x40000000/* [II] Doorbell full */ #define RIO_DOORBELL_EMPTY 0x20000000/* [II] Doorbell empty */
Here's the 3.0.5-rc1 patch, attached and signed.
greg k-h
Makefile +2 -2
@@ -1,7 +1,7 @@ VERSION = 3 PATCHLEVEL = 0 -SUBLEVEL = 4 -EXTRAVERSION = +SUBLEVEL = 5 +EXTRAVERSION = -rc1 NAME = Sneaky Weasel # *DOCUMENTATION*
arch/arm/Kconfig +14 -0
@@ -1298,6 +1298,20 @@ source "drivers/pci/Kconfig" source "drivers/pcmcia/Kconfig" +config ARM_ERRATA_764369 + bool "ARM errata: Data cache line maintenance operation by MVA may not succeed" + depends on CPU_V7 && SMP + help + This option enables the workaround for erratum 764369 + affecting Cortex-A9 MPCore with two or more processors (all + current revisions). Under certain timing circumstances, a data + cache line maintenance operation by MVA targeting an Inner + Shareable memory region may fail to proceed up to either the + Point of Coherency or to the Point of Unification of the + system. This workaround adds a DSB instruction before the + relevant cache maintenance functions and sets a specific bit + in the diagnostic control register of the SCU. + endmenu menu "Kernel Features"
arch/arm/include/asm/futex.h +17 -17
@@ -25,17 +25,17 @@#ifdef CONFIG_SMP -#define __futex_atomic_op (insn, ret, oldval, uaddr, oparg) \ +#define __futex_atomic_op (insn, ret, oldval, tmp, uaddr, oparg) \ smp_mb(); \ __asm__ __volatile__( \ - "1: ldrex %1, [%2]\n" \ + "1: ldrex %1, [%3]\n" \ " " insn "\n" \ - "2: strex %1, %0, [%2]\n" \ - " teq %1, #0\n" \ + "2: strex %2, %0, [%3]\n" \ + " teq %2, #0\n" \ " bne 1b\n" \ " mov %0, #0\n" \ - __futex_atomic_ex_table("%4") \ - : "=&r" (ret), "=&r" (oldval) \ + __futex_atomic_ex_table("%5") \ + : "=&r" (ret), "=&r" (oldval), "=&r" (tmp) \ : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT) \ : "cc", "memory")
@@ -73,14 +73,14 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,#include <linux/preempt.h> #include <asm/domain.h> -#define __futex_atomic_op (insn, ret, oldval, uaddr, oparg) \ +#define __futex_atomic_op (insn, ret, oldval, tmp, uaddr, oparg) \ __asm__ __volatile__( \ - "1: " T(ldr) " %1, [%2]\n" \ + "1: " T(ldr) " %1, [%3]\n" \ " " insn "\n" \ - "2: " T(str) " %0, [%2]\n" \ + "2: " T(str) " %0, [%3]\n" \ " mov %0, #0\n" \ - __futex_atomic_ex_table("%4") \ - : "=&r" (ret), "=&r" (oldval) \ + __futex_atomic_ex_table("%5") \ + : "=&r" (ret), "=&r" (oldval), "=&r" (tmp) \ : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT) \ : "cc", "memory")
@@ -117,7 +117,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)int cmp = (encoded_op >>24 ) &15 ;int oparg = (encoded_op <<8 ) >>20 ;int cmparg = (encoded_op <<20 ) >>20 ; -int oldval =0 , ret; +int oldval =0 , ret, tmp;if (encoded_op & (FUTEX_OP_OPARG_SHIFT <<28 )) oparg =1 << oparg;
@@ -129,19 +129,19 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)switch (op) {case FUTEX_OP_SET : -__futex_atomic_op ("mov %0, %3" , ret, oldval, uaddr, oparg); +__futex_atomic_op ("mov %0, %4" , ret, oldval, tmp, uaddr, oparg);break ;case FUTEX_OP_ADD : -__futex_atomic_op ("add %0, %1, %3" , ret, oldval, uaddr, oparg); +__futex_atomic_op ("add %0, %1, %4" , ret, oldval, tmp, uaddr, oparg);break ;case FUTEX_OP_OR : -__futex_atomic_op ("orr %0, %1, %3" , ret, oldval, uaddr, oparg); +__futex_atomic_op ("orr %0, %1, %4" , ret, oldval, tmp, uaddr, oparg);break ;case FUTEX_OP_ANDN : -__futex_atomic_op ("and %0, %1, %3" , ret, oldval, uaddr, ~oparg); +__futex_atomic_op ("and %0, %1, %4" , ret, oldval, tmp, uaddr, ~oparg);break ;case FUTEX_OP_XOR : -__futex_atomic_op ("eor %0, %1, %3" , ret, oldval, uaddr, oparg); +__futex_atomic_op ("eor %0, %1, %4" , ret, oldval, tmp, uaddr, oparg);break ;default : ret = -ENOSYS ;
arch/arm/include/asm/hardware/cache-l2x0.h +1 -1
@@ -64,7 +64,7 @@#define L2X0_AUX_CTRL_MASK 0xc0000fff#define L2X0_AUX_CTRL_ASSOCIATIVITY_SHIFT 16#define L2X0_AUX_CTRL_WAY_SIZE_SHIFT 17 -#define L2X0_AUX_CTRL_WAY_SIZE_MASK (0x3 << 17) +#define L2X0_AUX_CTRL_WAY_SIZE_MASK (0x7 << 17)#define L2X0_AUX_CTRL_SHARE_OVERRIDE_SHIFT 22#define L2X0_AUX_CTRL_NS_LOCKDOWN_SHIFT 26#define L2X0_AUX_CTRL_NS_INT_CTRL_SHIFT 27
arch/arm/kernel/smp_scu.c +10 -0
@@ -13,6 +13,7 @@#include <asm/smp_scu.h> #include <asm/cacheflush.h> +#include <asm/cputype.h> #define SCU_CTRL 0x00#define SCU_CONFIG 0x04
@@ -36,6 +37,15 @@ void __init scu_enable(void __iomem *scu_base) {u32 scu_ctrl; +#ifdef CONFIG_ARM_ERRATA_764369 +/* Cortex-A9 only */ +if ((read_cpuid (CPUID_ID ) &0xff0ffff0 ) ==0x410fc090 ) { + scu_ctrl =__raw_readl (scu_base +0x30 ); +if (!(scu_ctrl &1 )) +__raw_writel (scu_ctrl |0x1 , scu_base +0x30 ); + } +#endif + scu_ctrl =__raw_readl (scu_base +SCU_CTRL );/* already enabled? */ if (scu_ctrl &1 )
arch/arm/mach-davinci/board-da850-evm.c +28 -0
@@ -115,6 +115,32 @@ static struct spi_board_info da850evm_spi_info[] = { }, }; +#ifdef CONFIG_MTD +static void da850_evm_m25p80_notify_add (struct mtd_info *mtd) +{ +char *mac_addr = davinci_soc_info.emac_pdata->mac_addr; +size_t retlen; + +if (!strcmp (mtd->name,"MAC-Address" )) { + mtd->read (mtd,0 ,ETH_ALEN , &retlen, mac_addr); +if (retlen ==ETH_ALEN ) +pr_info ("Read MAC addr from SPI Flash: %pM\n" , + mac_addr); + } +} + +static struct mtd_notifier da850evm_spi_notifier = { + .add = da850_evm_m25p80_notify_add, +}; + +static void da850_evm_setup_mac_addr (void ) +{ +register_mtd_user (&da850evm_spi_notifier); +} +#else +static void da850_evm_setup_mac_addr (void ) { } +#endif +static struct mtd_partition da850_evm_norflash_partition[] = { { .name ="bootloaders + env" ,
@@ -1237,6 +1263,8 @@ static __init void da850_evm_init(void)if (ret)pr_warning ("da850_evm_init: spi 1 registration failed: %d\n" , ret); + +da850_evm_setup_mac_addr (); }#ifdef CONFIG_SERIAL_8250_CONSOLE
arch/arm/mach-davinci/sleep.S +5 -1
@@ -217,7 +217,11 @@ ddr2clk_stop_done: ENDPROC(davinci_ddr_psc_config) CACHE_FLUSH: - .word arm926_flush_kern_cache_all +#ifdef CONFIG_CPU_V6 + .word v6_flush_kern_cache_all +#else + .word arm926_flush_kern_cache_all +#endif ENTRY(davinci_cpu_suspend_sz) .word . - davinci_cpu_suspend
arch/arm/mach-dove/common.c +1 -1
@@ -160,7 +160,7 @@ void __init dove_spi0_init(void)void __init dove_spi1_init (void ) { -orion_spi_init (DOVE_SPI1_PHYS_BASE ,get_tclk ()); +orion_spi_1_init (DOVE_SPI1_PHYS_BASE ,get_tclk ()); }/*****************************************************************************
arch/arm/mach-integrator/integrator_ap.c +3 -3
@@ -337,15 +337,15 @@ static unsigned long timer_reload;static void integrator_clocksource_init (u32 khz) {void __iomem *base = (void __iomem *)TIMER2_VA_BASE ; -u32 ctrl =TIMER_CTRL_ENABLE ; +u32 ctrl =TIMER_CTRL_ENABLE |TIMER_CTRL_PERIODIC ;if (khz >=1500 ) { khz /=16 ; - ctrl =TIMER_CTRL_DIV16 ; + ctrl |=TIMER_CTRL_DIV16 ; } -writel (ctrl, base +TIMER_CTRL );writel (0xffff , base +TIMER_LOAD ); +writel (ctrl, base +TIMER_CTRL );clocksource_mmio_init (base +TIMER_VALUE ,"timer2" , khz *1000 ,200 ,16 , clocksource_mmio_readl_down);
arch/arm/mm/cache-v7.S +20 -0
@@ -174,6 +174,10 @@ ENTRY(v7_coherent_user_range) dcache_line_size r2, r3 sub r3, r2, #1 bic r12, r0, r3 +#ifdef CONFIG_ARM_ERRATA_764369 + ALT_SMP(W(dsb)) + ALT_UP(W(nop)) +#endif 1: USER( mcr p15, 0, r12, c7, c11, 1 ) @ clean D line to the point of unification add r12, r12, r2
@@ -223,6 +227,10 @@ ENTRY(v7_flush_kern_dcache_area) add r1, r0, r1 sub r3, r2, #1 bic r0, r0, r3 +#ifdef CONFIG_ARM_ERRATA_764369 + ALT_SMP(W(dsb)) + ALT_UP(W(nop)) +#endif 1: mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line / unified line add r0, r0, r2
@@ -247,6 +255,10 @@ v7_dma_inv_range: sub r3, r2, #1 tst r0, r3 bic r0, r0, r3 +#ifdef CONFIG_ARM_ERRATA_764369 + ALT_SMP(W(dsb)) + ALT_UP(W(nop)) +#endif mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line tst r1, r3
@@ -270,6 +282,10 @@ v7_dma_clean_range: dcache_line_size r2, r3 sub r3, r2, #1 bic r0, r0, r3 +#ifdef CONFIG_ARM_ERRATA_764369 + ALT_SMP(W(dsb)) + ALT_UP(W(nop)) +#endif 1: mcr p15, 0, r0, c7, c10, 1 @ clean D / U line add r0, r0, r2
@@ -288,6 +304,10 @@ ENTRY(v7_dma_flush_range) dcache_line_size r2, r3 sub r3, r2, #1 bic r0, r0, r3 +#ifdef CONFIG_ARM_ERRATA_764369 + ALT_SMP(W(dsb)) + ALT_UP(W(nop)) +#endif 1: mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line add r0, r0, r2
arch/arm/mm/dma-mapping.c +2 -0
@@ -322,6 +322,8 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,if (addr) *handle =pfn_to_dma (dev,page_to_pfn (page)); +else +__dma_free_buffer (page, size);return addr; }
arch/arm/plat-mxc/include/mach/iomux-v3.h +1 -1
@@ -66,7 +66,6 @@ typedef u64 iomux_v3_cfg_t;#define MUX_MODE_MASK ((iomux_v3_cfg_t)0x1f << MUX_MODE_SHIFT)#define MUX_PAD_CTRL_SHIFT 41#define MUX_PAD_CTRL_MASK ((iomux_v3_cfg_t)0x1ffff << MUX_PAD_CTRL_SHIFT) -#define NO_PAD_CTRL ((iomux_v3_cfg_t)1 << (MUX_PAD_CTRL_SHIFT + 16))#define MUX_SEL_INPUT_SHIFT 58#define MUX_SEL_INPUT_MASK ((iomux_v3_cfg_t)0xf << MUX_SEL_INPUT_SHIFT)
@@ -85,6 +84,7 @@ typedef u64 iomux_v3_cfg_t;* Use to set PAD control */ +#define NO_PAD_CTRL (1 << 16)#define PAD_CTL_DVS (1 << 13)#define PAD_CTL_HYS (1 << 8)
arch/powerpc/sysdev/fsl_rio.c +3 -2
@@ -54,6 +54,7 @@#define ODSR_CLEAR 0x1c00#define LTLEECSR_ENABLE_ALL 0xFFC000FC#define ESCSR_CLEAR 0x07120204 +#define IECSR_CLEAR 0x80000000#define RIO_PORT1_EDCSR 0x0640#define RIO_PORT2_EDCSR 0x0680
@@ -1089,11 +1090,11 @@ static void port_error_handler(struct rio_mport *port, int offset)if (offset ==0 ) {out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_EDCSR ),0 ); -out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_IECSR ),0 ); +out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_IECSR ),IECSR_CLEAR );out_be32 ((u32 *)(rio_regs_win +RIO_ESCSR ),ESCSR_CLEAR ); }else {out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_EDCSR ),0 ); -out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_IECSR ),0 ); +out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_IECSR ),IECSR_CLEAR );out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_ESCSR ),ESCSR_CLEAR ); } }
arch/sparc/Kconfig +1 -0
@@ -53,6 +53,7 @@ config SPARC64 select HAVE_PERF_EVENTS select PERF_USE_VMALLOC select IRQ_PREFLOW_FASTEOI + select HAVE_C_RECORDMCOUNT config ARCH_DEFCONFIG string
arch/sparc/include/asm/sigcontext.h +14 -0
@@ -45,6 +45,19 @@ typedef struct {int si_mask; } __siginfo32_t; +#define __SIGC_MAXWIN 7 + +typedef struct { +unsigned long locals[8 ]; +unsigned long ins[8 ]; +}__siginfo_reg_window ; + +typedef struct { +int wsaved; +__siginfo_reg_window reg_window[__SIGC_MAXWIN]; +unsigned long rwbuf_stkptrs[__SIGC_MAXWIN]; +}__siginfo_rwin_t ; + #ifdef CONFIG_SPARC64 typedef struct { unsigned int si_float_regs [64];
@@ -73,6 +86,7 @@ struct sigcontext { unsigned long ss_size; } sigc_stack;unsigned long sigc_mask; +__siginfo_rwin_t * sigc_rwin_save; };#else
arch/sparc/include/asm/spinlock_32.h +9 -2
@@ -131,6 +131,15 @@ static inline void arch_write_lock(arch_rwlock_t *rw) *(volatile __u32 *)&lp->lock = ~0U ; } +static void inline arch_write_unlock (arch_rwlock_t *lock) +{ + __asm__ __volatile__( +" st %%g0, [%0]" + :/* no outputs */ + :"r" (lock) + :"memory" ); +} +static inline int arch_write_trylock (arch_rwlock_t *rw) {unsigned int val;
@@ -175,8 +184,6 @@ static inline int __arch_read_trylock(arch_rwlock_t *rw) res; \ }) -#define arch_write_unlock (rw) do { (rw)->lock = 0; } while(0) -#define arch_spin_lock_flags (lock, flags) arch_spin_lock(lock)#define arch_read_lock_flags (rw, flags) arch_read_lock(rw)#define arch_write_lock_flags (rw, flags) arch_write_lock(rw)
arch/sparc/include/asm/spinlock_64.h +0 -6
@@ -210,14 +210,8 @@ static int inline arch_write_trylock(arch_rwlock_t *lock)return result; } -#define arch_read_lock (p) arch_read_lock(p)#define arch_read_lock_flags (p, f) arch_read_lock(p) -#define arch_read_trylock (p) arch_read_trylock(p) -#define arch_read_unlock (p) arch_read_unlock(p) -#define arch_write_lock (p) arch_write_lock(p)#define arch_write_lock_flags (p, f) arch_write_lock(p) -#define arch_write_unlock (p) arch_write_unlock(p) -#define arch_write_trylock (p) arch_write_trylock(p)#define arch_read_can_lock (rw) (!((rw)->lock & 0x80000000UL))#define arch_write_can_lock (rw) (!(rw)->lock)
arch/sparc/kernel/Makefile +1 -0
@@ -32,6 +32,7 @@ obj-$(CONFIG_SPARC32) += sun4m_irq.o sun4c_irq.o sun4d_irq.o obj-y += process_$(BITS).o obj-y += signal_$(BITS).o +obj-y += sigutil_$(BITS).o obj-$(CONFIG_SPARC32) += ioport.o obj-y += setup_$(BITS).o obj-y += idprom.o
arch/sparc/kernel/irq.h +1 -1
@@ -88,7 +88,7 @@ BTFIXUPDEF_CALL(void, set_irq_udt, int)#define set_irq_udt (cpu) BTFIXUP_CALL(set_irq_udt)(cpu)/* All SUN4D IPIs are sent on this IRQ, may be shared with hard IRQs */ -#define SUN4D_IPI_IRQ 14 +#define SUN4D_IPI_IRQ 13extern void sun4d_ipi_interrupt (void );
arch/sparc/kernel/pcic.c +2 -2
@@ -352,8 +352,8 @@ int __init pcic_probe(void)strcpy (pbm->prom_name, namebuf); { -extern volatile int t_nmi[1 ]; -extern int pcic_nmi_trap_patch[1 ]; +extern volatile int t_nmi[4 ]; +extern int pcic_nmi_trap_patch[4 ]; t_nmi[0 ] = pcic_nmi_trap_patch[0 ]; t_nmi[1 ] = pcic_nmi_trap_patch[1 ];
arch/sparc/kernel/setup_64.c +8 -2
@@ -440,8 +440,14 @@ static void __init init_sparc64_elf_hwcap(void) cap |=AV_SPARC_VIS ;if (tlb_type == cheetah || tlb_type == cheetah_plus) cap |=AV_SPARC_VIS |AV_SPARC_VIS2 ; -if (tlb_type == cheetah_plus) - cap |=AV_SPARC_POPC ; +if (tlb_type == cheetah_plus) { +unsigned long impl, ver; + + __asm__ __volatile__("rdpr %%ver, %0" :"=r" (ver)); + impl = ((ver >>32 ) &0xffff ); +if (impl ==PANTHER_IMPL ) + cap |=AV_SPARC_POPC ; + }if (tlb_type == hypervisor) {if (sun4v_chip_type ==SUN4V_CHIP_NIAGARA1 ) cap |=AV_SPARC_ASI_BLK_INIT ;
arch/sparc/kernel/signal32.c +105 -79
328 lines not on this page · raw message
arch/sparc/kernel/signal_32.c +79 -93
291 lines not on this page · raw message
arch/sparc/kernel/signal_64.c +47 -61
185 lines not on this page · raw message
arch/sparc/kernel/sigutil.h new file +9 -0
@@ -0,0 +1,9 @@ +#ifndef _SIGUTIL_H +#define _SIGUTIL_H + +int save_fpu_state (struct pt_regs *regs,__siginfo_fpu_t __user *fpu); +int restore_fpu_state (struct pt_regs *regs,__siginfo_fpu_t __user *fpu); +int save_rwin_state (int wsaved,__siginfo_rwin_t __user *rwin); +int restore_rwin_state (__siginfo_rwin_t __user *rp); + +#endif /* _SIGUTIL_H */
arch/sparc/kernel/sigutil_32.c new file +120 -0
120 lines not on this page · raw message
arch/sparc/kernel/sigutil_64.c new file +93 -0
93 lines not on this page · raw message
arch/x86/kernel/amd_iommu.c +10 -8
@@ -531,7 +531,9 @@ static void build_inv_all(struct iommu_cmd *cmd)* Writes the command to the IOMMUs command buffer and informs the * hardware about the new command. */ -static int iommu_queue_command (struct amd_iommu *iommu,struct iommu_cmd *cmd) +static int iommu_queue_command_sync (struct amd_iommu *iommu, +struct iommu_cmd *cmd, +bool sync) {u32 left, tail, head, next_tail;unsigned long flags;
@@ -565,13 +567,18 @@ again:copy_cmd_to_buffer (iommu, cmd, tail);/* We need to sync now to make sure all commands are processed */ - iommu->need_sync = true; + iommu->need_sync = sync;spin_unlock_irqrestore (&iommu->lock, flags);return 0 ; } +static int iommu_queue_command (struct amd_iommu *iommu,struct iommu_cmd *cmd) +{ +return iommu_queue_command_sync (iommu, cmd, true); +} +/* * This function queues a completion wait command into the command * buffer of an IOMMU
@@ -587,7 +594,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu)build_completion_wait (&cmd, (u64)&sem); - ret =iommu_queue_command (iommu, &cmd); + ret =iommu_queue_command_sync (iommu, &cmd, false);if (ret)return ret;
@@ -773,14 +780,9 @@ static void domain_flush_complete(struct protection_domain *domain)static void domain_flush_devices (struct protection_domain *domain) {struct iommu_dev_data *dev_data; -unsigned long flags; - -spin_lock_irqsave (&domain->lock, flags);list_for_each_entry (dev_data, &domain->dev_list, list)device_flush_dte (dev_data->dev); - -spin_unlock_irqrestore (&domain->lock, flags); }/****************************************************************************
arch/x86/kernel/cpu/perf_event.c +3 -0
@@ -1856,6 +1856,9 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)perf_callchain_store (entry, regs->ip); +if (!current->mm) +return ; +if (perf_callchain_user32 (regs, entry))return ;
arch/x86/kernel/cpu/perf_event_intel.c +1 -0
@@ -1495,6 +1495,7 @@ static __init int intel_pmu_init(void)break ;case 42 :/* SandyBridge */ +case 45 :/* SandyBridge, "Romely-EP" */ memcpy (hw_cache_event_ids, snb_hw_cache_event_ids,sizeof (hw_cache_event_ids));
arch/x86/pci/acpi.c +9 -0
@@ -361,6 +361,15 @@ struct pci_bus * __devinit pci_acpi_scan_root(struct acpi_pci_root *root) } } +/* After the PCI-E bus has been walked and all devices discovered, +* configure any settings of the fabric that might be necessary. +*/ +if (bus) { +struct pci_bus *child; +list_for_each_entry (child, &bus->children, node) +pcie_bus_configure_settings (child, child->self->pcie_mpss); + } +if (!bus)kfree (sd);
arch/x86/platform/mrst/mrst.c +3 -1
@@ -689,7 +689,9 @@ static int __init sfi_parse_devs(struct sfi_table_header *table) irq_attr.trigger =1 ; irq_attr.polarity =1 ;io_apic_set_pci_routing (NULL , pentry->irq, &irq_attr); - } + }else + pentry->irq =0 ;/* No irq */ +switch (pentry->type) {case SFI_DEV_TYPE_IPC :/* ID as IRQ is a hack that will go away */
arch/x86/xen/setup.c +21 -0
@@ -185,6 +185,19 @@ static unsigned long __init xen_set_identity(const struct e820entry *list, PFN_UP(start_pci), PFN_DOWN(last));return identity; } + +static unsigned long __init xen_get_max_pages (void ) +{ +unsigned long max_pages =MAX_DOMAIN_PAGES ; +domid_t domid =DOMID_SELF ; +int ret; + + ret =HYPERVISOR_memory_op (XENMEM_maximum_reservation, &domid); +if (ret >0 ) + max_pages = ret; +return min (max_pages,MAX_DOMAIN_PAGES ); +} +/** * machine_specific_memory_setup - Hook for machine specific memory setup. **/
@@ -293,6 +306,14 @@ char * __init xen_memory_setup(void)sanitize_e820_map (e820.map,ARRAY_SIZE (e820.map), &e820.nr_map); + extra_limit =xen_get_max_pages (); +if (max_pfn + extra_pages > extra_limit) { +if (extra_limit > max_pfn) + extra_pages = extra_limit - max_pfn; +else + extra_pages =0 ; + } + extra_pages +=xen_return_unused_memory (xen_start_info->nr_pages, &e820);/*
arch/x86/xen/smp.c +10 -0
@@ -32,6 +32,7 @@#include <xen/page.h> #include <xen/events.h> +#include <xen/hvc-console.h> #include "xen-ops.h" #include "mmu.h"
@@ -207,6 +208,15 @@ static void __init xen_smp_prepare_cpus(unsigned int max_cpus)unsigned cpu;unsigned int i; +if (skip_ioapic_setup) { +char *m = (max_cpus ==0 ) ? +"The nosmp parameter is incompatible with Xen; " \ +"use Xen dom0_max_vcpus=1 parameter" : +"The noapic parameter is incompatible with Xen" ; + +xen_raw_printk (m); +panic (m); + }xen_init_lock_cpu (0 );smp_store_cpu_info (0 );
arch/x86/xen/xen-asm_32.S +5 -3
@@ -113,11 +113,13 @@ xen_iret_start_crit: /* * If there's something pending, mask events again so we can - * jump back into xen_hypervisor_callback + * jump back into xen_hypervisor_callback. Otherwise do not + * touch XEN_vcpu_info_mask. */ - sete XEN_vcpu_info_mask(%eax) + jne 1f + movb $1, XEN_vcpu_info_mask(%eax) - popl %eax +1: popl %eax /* * From this point on the registers are restored and the stack
block/blk-cgroup.c +16 -21
@@ -785,10 +785,10 @@ static int blkio_policy_parse_and_set(char *buf, {char *s[4 ], *p, *major_s =NULL , *minor_s =NULL ;int ret; -unsigned long major, minor, temp; +unsigned long major, minor;int i =0 ;dev_t dev; -u64 bps, iops; +u64 temp;memset (s,0 ,sizeof (s));
@@ -826,20 +826,23 @@ static int blkio_policy_parse_and_set(char *buf, dev =MKDEV (major, minor); - ret =blkio_check_dev_num (dev); + ret =strict_strtoull (s[1 ],10 , &temp);if (ret) -return ret; +return -EINVAL ; - newpn->dev = dev; +/* For rule removal, do not check for device presence. */ +if (temp) { + ret =blkio_check_dev_num (dev); +if (ret) +return ret; + } -if (s[1 ] ==NULL ) -return -EINVAL ; + newpn->dev = dev;switch (plid) {case BLKIO_POLICY_PROP : - ret =strict_strtoul (s[1 ],10 , &temp); -if (ret || (temp <BLKIO_WEIGHT_MIN && temp >0 ) || - temp >BLKIO_WEIGHT_MAX ) +if ((temp <BLKIO_WEIGHT_MIN && temp >0 ) || + temp >BLKIO_WEIGHT_MAX )return -EINVAL ; newpn->plid = plid;
@@ -850,26 +853,18 @@ static int blkio_policy_parse_and_set(char *buf,switch (fileid) {case BLKIO_THROTL_read_bps_device:case BLKIO_THROTL_write_bps_device: - ret =strict_strtoull (s[1 ],10 , &bps); -if (ret) -return -EINVAL ; - newpn->plid = plid; newpn->fileid = fileid; - newpn->val.bps = bps; + newpn->val.bps = temp;break ;case BLKIO_THROTL_read_iops_device:case BLKIO_THROTL_write_iops_device: - ret =strict_strtoull (s[1 ],10 , &iops); -if (ret) -return -EINVAL ; - -if (iops >THROTL_IOPS_MAX ) +if (temp >THROTL_IOPS_MAX )return -EINVAL ; newpn->plid = plid; newpn->fileid = fileid; - newpn->val.iops = (unsigned int )iops; + newpn->val.iops = (unsigned int )temp;break ; }break ;
block/blk-core.c +6 -7
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)EXPORT_SYMBOL (blk_put_queue);/* -* Note: If a driver supplied the queue lock, it should not zap that lock -* unexpectedly as some queue cleanup components like elevator_exit() and -* blk_throtl_exit() need queue lock. +* Note: If a driver supplied the queue lock, it is disconnected +* by this function. The actual state of the lock doesn't matter +* here as the request_queue isn't accessible after this point +* (QUEUE_FLAG_DEAD is set) and no other requests will be queued. */ void blk_cleanup_queue (struct request_queue *q) {
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)queue_flag_set_unlocked (QUEUE_FLAG_DEAD , q);mutex_unlock (&q->sysfs_lock); -if (q->elevator) -elevator_exit (q->elevator); - -blk_throtl_exit (q); +if (q->queue_lock != &q->__queue_lock) + q->queue_lock = &q->__queue_lock;blk_put_queue (q); }
block/blk-sysfs.c +5 -0
@@ -472,6 +472,11 @@ static void blk_release_queue(struct kobject *kobj)blk_sync_queue (q); +if (q->elevator) +elevator_exit (q->elevator); + +blk_throtl_exit (q); +if (rl->rq_pool)mempool_destroy (rl->rq_pool);
drivers/acpi/acpica/acconfig.h +1 -1
@@ -121,7 +121,7 @@/* Maximum sleep allowed via Sleep() operator */ -#define ACPI_MAX_SLEEP 20000/* Two seconds */ +#define ACPI_MAX_SLEEP 2000/* Two seconds */ /****************************************************************************** *
drivers/acpi/acpica/aclocal.h +1 -0
@@ -357,6 +357,7 @@ struct acpi_predefined_data {char *pathname;const union acpi_predefined_info *predefined;union acpi_operand_object *parent_package; +struct acpi_namespace_node *node;u32 flags;u8 node_flags; };
drivers/acpi/acpica/nspredef.c +1 -0
@@ -212,6 +212,7 @@ acpi_ns_check_predefined_names(struct acpi_namespace_node *node, goto cleanup; } data->predefined = predefined; + data->node = node; data->node_flags = node->flags; data->pathname = pathname;
drivers/acpi/acpica/nsrepair2.c +15 -0
@@ -503,6 +503,21 @@ acpi_ns_repair_TSS(struct acpi_predefined_data *data, {union acpi_operand_object *return_object = *return_object_ptr;acpi_status status; +struct acpi_namespace_node *node; + +/* +* We can only sort the _TSS return package if there is no _PSS in the +* same scope. This is because if _PSS is present, the ACPI specification +* dictates that the _TSS Power Dissipation field is to be ignored, and +* therefore some BIOSs leave garbage values in the _TSS Power field(s). +* In this case, it is best to just return the _TSS package as-is. +* (May, 2011) +*/ + status = +acpi_ns_get_node (data->node,"^_PSS" ,ACPI_NS_NO_UPSEARCH , &node); +if (ACPI_SUCCESS (status)) { +return (AE_OK ); + } status = acpi_ns_check_sorted_list(data, return_object, 5, 1, ACPI_SORT_DESCENDING,
drivers/ata/ahci.c +1 -0
@@ -267,6 +267,7 @@ static const struct pci_device_id ahci_pci_tbl[] = { { PCI_VDEVICE(INTEL, 0x1e05), board_ahci }, /* Panther Point RAID */ { PCI_VDEVICE(INTEL, 0x1e06), board_ahci }, /* Panther Point RAID */ { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point RAID */ + { PCI_VDEVICE(INTEL, 0x1e0e), board_ahci }, /* Panther Point RAID *//* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
drivers/ata/pata_via.c +18 -0
@@ -124,6 +124,17 @@ static const struct via_isa_bridge { { NULL } }; +static const struct dmi_system_id no_atapi_dma_dmi_table[] = { + { + .ident ="AVERATEC 3200" , + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AVERATEC" ), +DMI_MATCH (DMI_BOARD_NAME ,"3200" ), + }, + }, + { } +}; +struct via_port {u8 cached_device; };
@@ -355,6 +366,13 @@ static unsigned long via_mode_filter(struct ata_device *dev, unsigned long mask) mask &= ~ATA_MASK_UDMA ; } } + +if (dev->class ==ATA_DEV_ATAPI && +dmi_check_system (no_atapi_dma_dmi_table)) { +ata_dev_printk (dev,KERN_WARNING ,"controller locks up on ATAPI DMA, forcing PIO\n" ); + mask &=ATA_MASK_PIO ; + } +return mask; }
drivers/base/firmware_class.c +6 -5
@@ -521,11 +521,6 @@ static int _request_firmware(const struct firmware **firmware_p,if (!firmware_p)return -EINVAL ; -if (WARN_ON (usermodehelper_is_disabled ())) { -dev_err (device,"firmware: %s will not be loaded\n" , name); -return -EBUSY ; - } - *firmware_p = firmware =kzalloc (sizeof (*firmware),GFP_KERNEL );if (!firmware) { dev_err(device, "%s: kmalloc(struct firmware) failed\n",
@@ -539,6 +534,12 @@ static int _request_firmware(const struct firmware **firmware_p,return 0 ; } +if (WARN_ON (usermodehelper_is_disabled ())) { +dev_err (device,"firmware: %s will not be loaded\n" , name); + retval = -EBUSY ; + goto out; + } +if (uevent)dev_dbg (device,"firmware: requesting %s\n" , name);
drivers/block/floppy.c +4 -4
@@ -4250,7 +4250,7 @@ static int __init floppy_init(void) use_virtual_dma = can_use_virtual_dma &1 ; fdc_state[0 ].address =FDC1 ;if (fdc_state[0 ].address ==-1 ) { -del_timer (&fd_timeout); +del_timer_sync (&fd_timeout); err = -ENODEV ; goto out_unreg_region; }
@@ -4261,7 +4261,7 @@ static int __init floppy_init(void) fdc =0 ;/* reset fdc in case of unexpected interrupt */ err =floppy_grab_irq_and_dma ();if (err) { -del_timer (&fd_timeout); +del_timer_sync (&fd_timeout); err = -EBUSY ; goto out_unreg_region; }
@@ -4318,7 +4318,7 @@ static int __init floppy_init(void)user_reset_fdc (-1 ,FD_RESET_ALWAYS , false); } fdc =0 ; -del_timer (&fd_timeout); +del_timer_sync (&fd_timeout); current_drive =0 ; initialized = true;if (have_no_fdc) {
@@ -4368,7 +4368,7 @@ out_unreg_blkdev:unregister_blkdev (FLOPPY_MAJOR ,"fd" ); out_put_disk:while (dr--) { -del_timer (&motor_off_timer[dr]); +del_timer_sync (&motor_off_timer[dr]);if (disks[dr]->queue)blk_cleanup_queue (disks[dr]->queue);put_disk (disks[dr]);
drivers/char/tpm/tpm.c +8 -1
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,u32 count, ordinal;unsigned long stop; +if (bufsiz >TPM_BUFSIZE ) + bufsiz =TPM_BUFSIZE ; + count =be32_to_cpu (*((__be32 *) (buf +2 ))); ordinal =be32_to_cpu (*((__be32 *) (buf +6 )));if (count ==0 )
@@ -1052,6 +1055,7 @@ ssize_t tpm_read(struct file *file, char __user *buf, {struct tpm_chip *chip = file->private_data;ssize_t ret_size; +int rc;del_singleshot_timer_sync (&chip->user_read_timer);flush_work_sync (&chip->work);
@@ -1062,8 +1066,11 @@ ssize_t tpm_read(struct file *file, char __user *buf, ret_size = size;mutex_lock (&chip->buffer_mutex); -if (copy_to_user (buf, chip->data_buffer, ret_size)) + rc =copy_to_user (buf, chip->data_buffer, ret_size); +memset (chip->data_buffer,0 , ret_size); +if (rc) ret_size = -EFAULT ; +mutex_unlock (&chip->buffer_mutex); }
drivers/cpufreq/pcc-cpufreq.c +3 -0
@@ -261,6 +261,9 @@ static int pcc_get_offset(int cpu) pr =per_cpu (processors, cpu); pcc_cpu_data =per_cpu_ptr (pcc_cpu_info, cpu); +if (!pr) +return -ENODEV ; + status =acpi_evaluate_object (pr->handle,"PCCP" ,NULL , &buffer);if (ACPI_FAILURE (status))return -ENODEV ;
drivers/firewire/ohci.c +3 -0
@@ -291,6 +291,9 @@ static const struct { {PCI_VENDOR_ID_NEC ,PCI_ANY_ID ,PCI_ANY_ID , QUIRK_CYCLE_TIMER}, + {PCI_VENDOR_ID_O2, PCI_ANY_ID, PCI_ANY_ID, + QUIRK_NO_MSI}, + {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID, QUIRK_CYCLE_TIMER},
drivers/gpu/drm/nouveau/nouveau_sgdma.c +4 -1
@@ -37,8 +37,11 @@ nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,return -ENOMEM ; nvbe->ttm_alloced =kmalloc (sizeof (bool ) * num_pages,GFP_KERNEL ); -if (!nvbe->ttm_alloced) +if (!nvbe->ttm_alloced) { +kfree (nvbe->pages); + nvbe->pages =NULL ;return -ENOMEM ; + } nvbe->nr_pages =0 ;while (num_pages--) {
drivers/gpu/drm/radeon/evergreen.c +36 -6
89 lines not on this page · raw message
drivers/gpu/drm/radeon/ni.c +10 -6
@@ -39,6 +39,7 @@ extern int evergreen_mc_wait_for_idle(struct radeon_device *rdev);extern void evergreen_mc_program (struct radeon_device *rdev);extern void evergreen_irq_suspend (struct radeon_device *rdev);extern int evergreen_mc_init (struct radeon_device *rdev); +extern void evergreen_fix_pci_max_read_req_size (struct radeon_device *rdev);#define EVERGREEN_PFP_UCODE_SIZE 1120#define EVERGREEN_PM4_UCODE_SIZE 1376
@@ -669,6 +670,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)WREG32 (GRBM_CNTL ,GRBM_READ_TIMEOUT (0xff )); +evergreen_fix_pci_max_read_req_size (rdev); + mc_shared_chmap =RREG32 (MC_SHARED_CHMAP ); mc_arb_ramcfg =RREG32 (MC_ARB_RAMCFG );
@@ -1158,6 +1161,7 @@ int cayman_cp_resume(struct radeon_device *rdev)SOFT_RESET_PA |SOFT_RESET_SH |SOFT_RESET_VGT | +SOFT_RESET_SPI | SOFT_RESET_SX));RREG32 (GRBM_SOFT_RESET );mdelay (15 );
@@ -1182,7 +1186,8 @@ int cayman_cp_resume(struct radeon_device *rdev)/* Initialize the ring buffer's read and write pointers */ WREG32 (CP_RB0_CNTL , tmp |RB_RPTR_WR_ENA ); -WREG32 (CP_RB0_WPTR ,0 ); + rdev->cp.wptr =0 ; +WREG32 (CP_RB0_WPTR , rdev->cp.wptr);/* set the wb address wether it's enabled or not */ WREG32 (CP_RB0_RPTR_ADDR , (rdev->wb.gpu_addr +RADEON_WB_CP_RPTR_OFFSET ) &0xFFFFFFFC );
@@ -1202,7 +1207,6 @@ int cayman_cp_resume(struct radeon_device *rdev)WREG32 (CP_RB0_BASE , rdev->cp.gpu_addr >>8 ); rdev->cp.rptr =RREG32 (CP_RB0_RPTR ); - rdev->cp.wptr =RREG32 (CP_RB0_WPTR );/* ring1 - compute only */ /* Set ring buffer size */
@@ -1215,7 +1219,8 @@ int cayman_cp_resume(struct radeon_device *rdev)/* Initialize the ring buffer's read and write pointers */ WREG32 (CP_RB1_CNTL , tmp |RB_RPTR_WR_ENA ); -WREG32 (CP_RB1_WPTR ,0 ); + rdev->cp1.wptr =0 ; +WREG32 (CP_RB1_WPTR , rdev->cp1.wptr);/* set the wb address wether it's enabled or not */ WREG32 (CP_RB1_RPTR_ADDR , (rdev->wb.gpu_addr +RADEON_WB_CP1_RPTR_OFFSET ) &0xFFFFFFFC );
@@ -1227,7 +1232,6 @@ int cayman_cp_resume(struct radeon_device *rdev)WREG32 (CP_RB1_BASE , rdev->cp1.gpu_addr >>8 ); rdev->cp1.rptr =RREG32 (CP_RB1_RPTR ); - rdev->cp1.wptr =RREG32 (CP_RB1_WPTR );/* ring2 - compute only */ /* Set ring buffer size */
@@ -1240,7 +1244,8 @@ int cayman_cp_resume(struct radeon_device *rdev)/* Initialize the ring buffer's read and write pointers */ WREG32 (CP_RB2_CNTL , tmp |RB_RPTR_WR_ENA ); -WREG32 (CP_RB2_WPTR ,0 ); + rdev->cp2.wptr =0 ; +WREG32 (CP_RB2_WPTR , rdev->cp2.wptr);/* set the wb address wether it's enabled or not */ WREG32 (CP_RB2_RPTR_ADDR , (rdev->wb.gpu_addr +RADEON_WB_CP2_RPTR_OFFSET ) &0xFFFFFFFC );
@@ -1252,7 +1257,6 @@ int cayman_cp_resume(struct radeon_device *rdev)WREG32 (CP_RB2_BASE , rdev->cp2.gpu_addr >>8 ); rdev->cp2.rptr =RREG32 (CP_RB2_RPTR ); - rdev->cp2.wptr =RREG32 (CP_RB2_WPTR );/* start the rings */ cayman_cp_start (rdev);
drivers/gpu/drm/radeon/r100.c +10 -12
@@ -721,11 +721,11 @@ void r100_fence_ring_emit(struct radeon_device *rdev,int r100_copy_blit (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence) {uint32_t cur_pages; -uint32_t stride_bytes =PAGE_SIZE ; +uint32_t stride_bytes =RADEON_GPU_PAGE_SIZE ;uint32_t pitch;uint32_t stride_pixels;unsigned ndw;
@@ -737,7 +737,7 @@ int r100_copy_blit(struct radeon_device *rdev,/* radeon pitch is /64 */ pitch = stride_bytes /64 ; stride_pixels = stride_bytes /4 ; - num_loops =DIV_ROUND_UP (num_pages,8191 ); + num_loops =DIV_ROUND_UP (num_gpu_pages,8191 );/* Ask for enough room for blit + flush + fence */ ndw =64 + (10 * num_loops);
@@ -746,12 +746,12 @@ int r100_copy_blit(struct radeon_device *rdev,DRM_ERROR ("radeon: moving bo (%d) asking for %u dw.\n" , r, ndw);return -EINVAL ; } -while (num_pages >0 ) { - cur_pages = num_pages; +while (num_gpu_pages >0 ) { + cur_pages = num_gpu_pages;if (cur_pages >8191 ) { cur_pages =8191 ; } - num_pages -= cur_pages; + num_gpu_pages -= cur_pages;/* pages are in Y direction - height page width in X direction - width */
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,radeon_ring_write (rdev, (0x1fff ) | (0x1fff <<16 ));radeon_ring_write (rdev,0 );radeon_ring_write (rdev, (0x1fff ) | (0x1fff <<16 )); -radeon_ring_write (rdev, num_pages); -radeon_ring_write (rdev, num_pages); +radeon_ring_write (rdev, cur_pages); +radeon_ring_write (rdev, cur_pages);radeon_ring_write (rdev, cur_pages | (stride_pixels <<16 )); }radeon_ring_write (rdev,PACKET0 (RADEON_DSTCACHE_CTLSTAT ,0 ));
@@ -990,7 +990,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)/* Force read & write ptr to 0 */ WREG32 (RADEON_CP_RB_CNTL , tmp |RADEON_RB_RPTR_WR_ENA |RADEON_RB_NO_UPDATE );WREG32 (RADEON_CP_RB_RPTR_WR ,0 ); -WREG32 (RADEON_CP_RB_WPTR ,0 ); + rdev->cp.wptr =0 ; +WREG32 (RADEON_CP_RB_WPTR , rdev->cp.wptr);/* set the wb address whether it's enabled or not */ WREG32(R_00070C_CP_RB_RPTR_ADDR,
@@ -1007,9 +1008,6 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)WREG32 (RADEON_CP_RB_CNTL , tmp);udelay (10 ); rdev->cp.rptr =RREG32 (RADEON_CP_RB_RPTR ); - rdev->cp.wptr =RREG32 (RADEON_CP_RB_WPTR ); -/* protect against crazy HW on resume */ - rdev->cp.wptr &= rdev->cp.ptr_mask;/* Set cp mode to bus mastering & enable cp*/ WREG32(RADEON_CP_CSQ_MODE, REG_SET(RADEON_INDIRECT2_START, indirect2_start) |
drivers/gpu/drm/radeon/r200.c +2 -2
@@ -84,7 +84,7 @@ static int r200_get_vtx_size_0(uint32_t vtx_fmt_0)int r200_copy_dma (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence) {uint32_t size;
@@ -93,7 +93,7 @@ int r200_copy_dma(struct radeon_device *rdev,int r =0 ;/* radeon pitch is /64 */ - size = num_pages <<PAGE_SHIFT ; + size = num_gpu_pages <<RADEON_GPU_PAGE_SHIFT ; num_loops =DIV_ROUND_UP (size,0x1FFFFF ); r =radeon_ring_lock (rdev, num_loops *4 +64 );if (r) {
drivers/gpu/drm/radeon/r600.c +8 -6
@@ -2208,7 +2208,8 @@ int r600_cp_resume(struct radeon_device *rdev)/* Initialize the ring buffer's read and write pointers */ WREG32 (CP_RB_CNTL , tmp |RB_RPTR_WR_ENA );WREG32 (CP_RB_RPTR_WR ,0 ); -WREG32 (CP_RB_WPTR ,0 ); + rdev->cp.wptr =0 ; +WREG32 (CP_RB_WPTR , rdev->cp.wptr);/* set the wb address whether it's enabled or not */ WREG32(CP_RB_RPTR_ADDR,
@@ -2233,7 +2234,6 @@ int r600_cp_resume(struct radeon_device *rdev)WREG32 (CP_DEBUG , (1 <<27 ) | (1 <<28 )); rdev->cp.rptr =RREG32 (CP_RB_RPTR ); - rdev->cp.wptr =RREG32 (CP_RB_WPTR );r600_cp_start (rdev); rdev->cp.ready = true;
@@ -2355,21 +2355,23 @@ void r600_fence_ring_emit(struct radeon_device *rdev, }int r600_copy_blit (struct radeon_device *rdev, -uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages,struct radeon_fence *fence) +uint64_t src_offset, +uint64_t dst_offset, +unsigned num_gpu_pages, +struct radeon_fence *fence) {int r;mutex_lock (&rdev->r600_blit.mutex); rdev->r600_blit.vb_ib =NULL ; - r =r600_blit_prepare_copy (rdev, num_pages *RADEON_GPU_PAGE_SIZE ); + r =r600_blit_prepare_copy (rdev, num_gpu_pages *RADEON_GPU_PAGE_SIZE );if (r) {if (rdev->r600_blit.vb_ib)radeon_ib_free (rdev, &rdev->r600_blit.vb_ib);mutex_unlock (&rdev->r600_blit.mutex);return r; } -r600_kms_blit_copy (rdev, src_offset, dst_offset, num_pages *RADEON_GPU_PAGE_SIZE ); +r600_kms_blit_copy (rdev, src_offset, dst_offset, num_gpu_pages *RADEON_GPU_PAGE_SIZE );r600_blit_done_copy (rdev, fence);mutex_unlock (&rdev->r600_blit.mutex);return 0 ;
drivers/gpu/drm/radeon/radeon.h +4 -3
@@ -322,6 +322,7 @@ union radeon_gart_table {#define RADEON_GPU_PAGE_SIZE 4096#define RADEON_GPU_PAGE_MASK (RADEON_GPU_PAGE_SIZE - 1) +#define RADEON_GPU_PAGE_SHIFT 12struct radeon_gart {dma_addr_t table_addr;
@@ -914,17 +915,17 @@ struct radeon_asic {int (*copy_blit)(struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence);int (*copy_dma)(struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence);int (*copy)(struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence);uint32_t (*get_engine_clock)(struct radeon_device *rdev);void (*set_engine_clock)(struct radeon_device *rdev,uint32_t eng_clock);
drivers/gpu/drm/radeon/radeon_asic.h +4 -4
@@ -75,7 +75,7 @@ uint32_t r100_pll_rreg(struct radeon_device *rdev, uint32_t reg);int r100_copy_blit (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence); int r100_set_surface_reg(struct radeon_device *rdev, int reg, uint32_t tiling_flags, uint32_t pitch,
@@ -143,7 +143,7 @@ extern void r100_post_page_flip(struct radeon_device *rdev, int crtc);extern int r200_copy_dma (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages, +unsigned num_gpu_pages,struct radeon_fence *fence);void r200_set_safe_registers (struct radeon_device *rdev);
@@ -311,7 +311,7 @@ void r600_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);int r600_ring_test (struct radeon_device *rdev);int r600_copy_blit (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages,struct radeon_fence *fence); +unsigned num_gpu_pages,struct radeon_fence *fence);void r600_hpd_init (struct radeon_device *rdev);void r600_hpd_fini (struct radeon_device *rdev);bool r600_hpd_sense (struct radeon_device *rdev,enum radeon_hpd_id hpd);
@@ -403,7 +403,7 @@ void evergreen_bandwidth_update(struct radeon_device *rdev);void evergreen_ring_ib_execute (struct radeon_device *rdev,struct radeon_ib *ib);int evergreen_copy_blit (struct radeon_device *rdev,uint64_t src_offset,uint64_t dst_offset, -unsigned num_pages,struct radeon_fence *fence); +unsigned num_gpu_pages,struct radeon_fence *fence);void evergreen_hpd_init (struct radeon_device *rdev);void evergreen_hpd_fini (struct radeon_device *rdev);bool evergreen_hpd_sense (struct radeon_device *rdev,enum radeon_hpd_id hpd);
drivers/gpu/drm/radeon/radeon_clocks.c +3 -0
@@ -219,6 +219,9 @@ void radeon_get_clock_info(struct drm_device *dev) }else {DRM_INFO ("Using generic clock info\n" ); +/* may need to be per card */ + rdev->clock.max_pixel_clock =35000 ; +if (rdev->flags &RADEON_IS_IGP ) { p1pll->reference_freq =1432 ; p2pll->reference_freq =1432 ;
drivers/gpu/drm/radeon/radeon_combios.c +8 -0
@@ -3279,6 +3279,14 @@ void radeon_combios_asic_init(struct drm_device *dev) rdev->pdev->subsystem_device == 0x30a4)return ; +/* quirk for rs4xx Compaq Presario V5245EU laptop to make it resume +* - it hangs on resume inside the dynclk 1 table. +*/ +if (rdev->family ==CHIP_RS480 && + rdev->pdev->subsystem_vendor ==0x103c && + rdev->pdev->subsystem_device ==0x30ae ) +return ; +/* DYN CLK 1 */ table =combios_get_table_offset (dev,COMBIOS_DYN_CLK_1_TABLE );if (table)
drivers/gpu/drm/radeon/radeon_encoders.c +8 -1
@@ -1507,7 +1507,14 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)switch (mode) {case DRM_MODE_DPMS_ON : args.ucAction =ATOM_ENABLE ; -atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args); +/* workaround for DVOOutputControl on some RS690 systems */ +if (radeon_encoder->encoder_id ==ENCODER_OBJECT_ID_INTERNAL_DDI ) { +u32 reg =RREG32 (RADEON_BIOS_3_SCRATCH ); +WREG32 (RADEON_BIOS_3_SCRATCH , reg & ~ATOM_S3_DFP2I_ACTIVE ); +atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args); +WREG32 (RADEON_BIOS_3_SCRATCH , reg); + }else +atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args);if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT )) { args.ucAction =ATOM_LCD_BLON ;atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args);
drivers/gpu/drm/radeon/radeon_ttm.c +6 -1
@@ -277,7 +277,12 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,DRM_ERROR ("Trying to move memory with CP turned off.\n" );return -EINVAL ; } - r =radeon_copy (rdev, old_start, new_start, new_mem->num_pages, fence); + +BUILD_BUG_ON ((PAGE_SIZE %RADEON_GPU_PAGE_SIZE ) !=0 ); + + r =radeon_copy (rdev, old_start, new_start, + new_mem->num_pages * (PAGE_SIZE /RADEON_GPU_PAGE_SIZE ),/* GPU pages */ + fence);/* FIXME: handle copy error */ r =ttm_bo_move_accel_cleanup (bo, (void *)fence,NULL , evict, no_wait_reserve, no_wait_gpu, new_mem);
drivers/hwmon/ds620.c +1 -1
@@ -72,7 +72,7 @@ struct ds620_data {char valid;/* !=0 if following fields are valid */ unsigned long last_updated;/* In jiffies */ -u16 temp[3 ];/* Register values, word */ +s16 temp[3 ];/* Register values, word */ };/*
drivers/hwmon/max16065.c +1 -1
@@ -124,7 +124,7 @@ static inline int MV_TO_LIMIT(int mv, int range)static inline int ADC_TO_CURR (int adc,int gain) { -return adc *1400000 / gain *255 ; +return adc *1400000 / (gain *255 ); }/*
drivers/infiniband/hw/cxgb3/iwch_cm.c +5 -5
@@ -287,7 +287,7 @@ void __free_ep(struct kref *kref)if (test_bit (RELEASE_RESOURCES , &ep->com.flags)) {cxgb3_remove_tid (ep->com.tdev, (void *)ep, ep->hwtid);dst_release (ep->dst); -l2t_release (L2DATA (ep->com.tdev), ep->l2t); +l2t_release (ep->com.tdev, ep->l2t); }kfree (ep); }
@@ -1178,7 +1178,7 @@ static int act_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)release_tid (ep->com.tdev,GET_TID (rpl),NULL );cxgb3_free_atid (ep->com.tdev, ep->atid);dst_release (ep->dst); -l2t_release (L2DATA (ep->com.tdev), ep->l2t); +l2t_release (ep->com.tdev, ep->l2t);put_ep (&ep->com);return CPL_RET_BUF_DONE ; }
@@ -1375,7 +1375,7 @@ static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)if (!child_ep) { printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n", __func__); -l2t_release (L2DATA (tdev), l2t); +l2t_release (tdev, l2t);dst_release (dst); goto reject; }
@@ -1952,7 +1952,7 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)if (!err) goto out; -l2t_release (L2DATA (h->rdev.t3cdev_p), ep->l2t); +l2t_release (h->rdev.t3cdev_p, ep->l2t); fail4:dst_release (ep->dst); fail3:
@@ -2123,7 +2123,7 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,PDBG ("%s ep %p redirect to dst %p l2t %p\n" , __func__, ep, new, l2t);dst_hold (new); -l2t_release (L2DATA (ep->com.tdev), ep->l2t); +l2t_release (ep->com.tdev, ep->l2t); ep->l2t = l2t;dst_release (old); ep->dst = new;
drivers/leds/ledtrig-timer.c +2 -0
@@ -41,6 +41,7 @@ static ssize_t led_delay_on_store(struct device *dev,if (count == size) {led_blink_set (led_cdev, &state, &led_cdev->blink_delay_off); + led_cdev->blink_delay_on = state; ret = count; }
@@ -69,6 +70,7 @@ static ssize_t led_delay_off_store(struct device *dev,if (count == size) {led_blink_set (led_cdev, &led_cdev->blink_delay_on, &state); + led_cdev->blink_delay_off = state; ret = count; }
drivers/md/linear.h +1 -1
@@ -10,9 +10,9 @@ typedef struct dev_info dev_info_t;struct linear_private_data { +struct rcu_head rcu;sector_t array_sectors;dev_info_t disks[0 ]; -struct rcu_head rcu; };
drivers/md/md.c +10 -2
@@ -1084,8 +1084,11 @@ static int super_90_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version ret =0 ; } rdev->sectors = rdev->sb_start; +/* Limit to 4TB as metadata cannot record more than that */ +if (rdev->sectors >= (2ULL <<32 )) + rdev->sectors = (2ULL <<32 ) -2 ; -if (rdev->sectors < sb->size *2 && sb->level >1 ) +if (rdev->sectors < ((sector_t )sb->size) *2 && sb->level >=1 )/* "this cannot possibly happen" ... */ ret = -EINVAL ;
@@ -1119,7 +1122,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev) mddev->clevel[0 ] =0 ; mddev->layout = sb->layout; mddev->raid_disks = sb->raid_disks; - mddev->dev_sectors = sb->size *2 ; + mddev->dev_sectors = ((sector_t )sb->size) *2 ; mddev->events = ev1; mddev->bitmap_info.offset =0 ; mddev->bitmap_info.default_offset =MD_SB_BYTES >>9 ;
@@ -1361,6 +1364,11 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors) rdev->sb_start =calc_dev_sboffset (rdev);if (!num_sectors || num_sectors > rdev->sb_start) num_sectors = rdev->sb_start; +/* Limit to 4TB as metadata cannot record more than that. +* 4TB == 2^32 KB, or 2*2^32 sectors. +*/ +if (num_sectors >= (2ULL <<32 )) + num_sectors = (2ULL <<32 ) -2 ;md_super_write (rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, rdev->sb_page);md_super_wait (rdev->mddev);
drivers/media/dvb/dvb-usb/vp7045.c +4 -22
@@ -224,26 +224,8 @@ static struct dvb_usb_device_properties vp7045_properties;static int vp7045_usb_probe (struct usb_interface *intf,const struct usb_device_id *id) { -struct dvb_usb_device *d; -int ret =dvb_usb_device_init (intf, &vp7045_properties, -THIS_MODULE , &d, adapter_nr); -if (ret) -return ret; - - d->priv =kmalloc (20 ,GFP_KERNEL ); -if (!d->priv) { -dvb_usb_device_exit (intf); -return -ENOMEM ; - } - -return ret; -} - -static void vp7045_usb_disconnect (struct usb_interface *intf) -{ -struct dvb_usb_device *d =usb_get_intfdata (intf); -kfree (d->priv); -dvb_usb_device_exit (intf); +return dvb_usb_device_init (intf, &vp7045_properties, +THIS_MODULE ,NULL , adapter_nr); }static struct usb_device_id vp7045_usb_table [] = {
@@ -258,7 +240,7 @@ MODULE_DEVICE_TABLE(usb, vp7045_usb_table);static struct dvb_usb_device_properties vp7045_properties = { .usb_ctrl =CYPRESS_FX2 , .firmware ="dvb-usb-vp7045-01.fw" , - .size_of_priv =sizeof (u8 *), + .size_of_priv =20 , .num_adapters =1 , .adapter = {
@@ -305,7 +287,7 @@ static struct dvb_usb_device_properties vp7045_properties = {static struct usb_driver vp7045_usb_driver = { .name ="dvb_usb_vp7045" , .probe = vp7045_usb_probe, - .disconnect = vp7045_usb_disconnect, + .disconnect = dvb_usb_device_exit, .id_table = vp7045_usb_table, };
drivers/media/rc/nuvoton-cir.c +8 -37
87 lines not on this page · raw message
drivers/media/rc/nuvoton-cir.h +0 -1
@@ -67,7 +67,6 @@ static int debug;struct nvt_dev {struct pnp_dev *pdev;struct rc_dev *rdev; -struct ir_raw_event rawir;spinlock_t nvt_lock;
drivers/mfd/omap-usb-host.c +0 -1
@@ -676,7 +676,6 @@ static void usbhs_omap_tll_init(struct device *dev, u8 tll_channel_count) | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); - reg |= (1 << (i +1 )); }else continue ;
drivers/mfd/tps65910-irq.c +2 -0
@@ -178,8 +178,10 @@ int tps65910_irq_init(struct tps65910 *tps65910, int irq,switch (tps65910_chip_id (tps65910)) {case TPS65910 : tps65910->irq_num =TPS65910_NUM_IRQ ; +break ;case TPS65911 : tps65910->irq_num =TPS65911_NUM_IRQ ; +break ; }/* Register with genirq */
drivers/mmc/core/core.c +31 -4
@@ -132,7 +132,7 @@ void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)if (mrq->done) mrq->done (mrq); -mmc_host_clk_gate (host); +mmc_host_clk_release (host); } }
@@ -191,7 +191,7 @@ mmc_start_request(struct mmc_host *host, struct mmc_request *mrq) mrq->stop->mrq = mrq; } } -mmc_host_clk_ungate (host); +mmc_host_clk_hold (host);led_trigger_event (host->led,LED_FULL ); host->ops->request (host, mrq); }
@@ -634,15 +634,17 @@ static inline void mmc_set_ios(struct mmc_host *host)*/ void mmc_set_chip_select (struct mmc_host *host,int mode) { +mmc_host_clk_hold (host); host->ios.chip_select = mode;mmc_set_ios (host); +mmc_host_clk_release (host); }/* * Sets the host clock to the highest possible frequency that * is below "hz". */ -void mmc_set_clock (struct mmc_host *host,unsigned int hz) +static void __mmc_set_clock (struct mmc_host *host,unsigned int hz) {WARN_ON (hz < host->f_min);
@@ -653,6 +655,13 @@ void mmc_set_clock(struct mmc_host *host, unsigned int hz)mmc_set_ios (host); } +void mmc_set_clock (struct mmc_host *host,unsigned int hz) +{ +mmc_host_clk_hold (host); +__mmc_set_clock (host, hz); +mmc_host_clk_release (host); +} +#ifdef CONFIG_MMC_CLKGATE /* * This gates the clock by setting it to 0 Hz.
@@ -685,7 +694,7 @@ void mmc_ungate_clock(struct mmc_host *host)if (host->clk_old) {BUG_ON (host->ios.clock);/* This call will also set host->clk_gated to false */ -mmc_set_clock (host, host->clk_old); +__mmc_set_clock (host, host->clk_old); } }
@@ -713,8 +722,10 @@ void mmc_set_ungated(struct mmc_host *host)*/ void mmc_set_bus_mode (struct mmc_host *host,unsigned int mode) { +mmc_host_clk_hold (host); host->ios.bus_mode = mode;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -722,8 +733,10 @@ void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode)*/ void mmc_set_bus_width (struct mmc_host *host,unsigned int width) { +mmc_host_clk_hold (host); host->ios.bus_width = width;mmc_set_ios (host); +mmc_host_clk_release (host); }/**
@@ -921,8 +934,10 @@ u32 mmc_select_voltage(struct mmc_host *host, u32 ocr) ocr &=3 << bit; +mmc_host_clk_hold (host); host->ios.vdd = bit;mmc_set_ios (host); +mmc_host_clk_release (host); }else {pr_warning ("%s: host doesn't support card's voltages\n" ,mmc_hostname (host));
@@ -969,8 +984,10 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, bool cmd11*/ void mmc_set_timing (struct mmc_host *host,unsigned int timing) { +mmc_host_clk_hold (host); host->ios.timing = timing;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -978,8 +995,10 @@ void mmc_set_timing(struct mmc_host *host, unsigned int timing)*/ void mmc_set_driver_type (struct mmc_host *host,unsigned int drv_type) { +mmc_host_clk_hold (host); host->ios.drv_type = drv_type;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -997,6 +1016,8 @@ static void mmc_power_up(struct mmc_host *host) {int bit; +mmc_host_clk_hold (host); +/* If ocr is set, we use it */ if (host->ocr) bit =ffs (host->ocr) -1 ;
@@ -1032,10 +1053,14 @@ static void mmc_power_up(struct mmc_host *host)* time required to reach a stable voltage. */ mmc_delay (10 ); + +mmc_host_clk_release (host); }static void mmc_power_off (struct mmc_host *host) { +mmc_host_clk_hold (host); + host->ios.clock =0 ; host->ios.vdd =0 ;
@@ -1053,6 +1078,8 @@ static void mmc_power_off(struct mmc_host *host) host->ios.bus_width =MMC_BUS_WIDTH_1 ; host->ios.timing =MMC_TIMING_LEGACY ;mmc_set_ios (host); + +mmc_host_clk_release (host); }/*
drivers/mmc/core/host.c +6 -6
@@ -119,14 +119,14 @@ static void mmc_host_clk_gate_work(struct work_struct *work) }/** -* mmc_host_clk_ungate - ungate hardware MCI clocks +* mmc_host_clk_hold - ungate hardware MCI clocks * @host: host to ungate. * * Makes sure the host ios.clock is restored to a non-zero value * past this call. Increase clock reference count and ungate clock * if we're the first user. */ -void mmc_host_clk_ungate (struct mmc_host *host) +void mmc_host_clk_hold (struct mmc_host *host) {unsigned long flags;
@@ -164,14 +164,14 @@ static bool mmc_host_may_gate_card(struct mmc_card *card) }/** -* mmc_host_clk_gate - gate off hardware MCI clocks +* mmc_host_clk_release - gate off hardware MCI clocks * @host: host to gate. * * Calls the host driver with ios.clock set to zero as often as possible * in order to gate off hardware MCI clocks. Decrease clock reference * count and schedule disabling of clock. */ -void mmc_host_clk_gate (struct mmc_host *host) +void mmc_host_clk_release (struct mmc_host *host) {unsigned long flags;
@@ -179,7 +179,7 @@ void mmc_host_clk_gate(struct mmc_host *host) host->clk_requests--;if (mmc_host_may_gate_card (host->card) && !host->clk_requests) -schedule_work (&host->clk_gate_work); +queue_work (system_nrt_wq, &host->clk_gate_work);spin_unlock_irqrestore (&host->clk_lock, flags); }
@@ -231,7 +231,7 @@ static inline void mmc_host_clk_exit(struct mmc_host *host)if (cancel_work_sync (&host->clk_gate_work))mmc_host_clk_gate_delayed (host);if (host->clk_gated) -mmc_host_clk_ungate (host); +mmc_host_clk_hold (host);/* There should be only one user now */ WARN_ON (host->clk_requests >1 ); }
drivers/mmc/core/host.h +4 -4
@@ -16,16 +16,16 @@ int mmc_register_host_class(void);void mmc_unregister_host_class (void );#ifdef CONFIG_MMC_CLKGATE -void mmc_host_clk_ungate (struct mmc_host *host); -void mmc_host_clk_gate (struct mmc_host *host); +void mmc_host_clk_hold (struct mmc_host *host); +void mmc_host_clk_release (struct mmc_host *host);unsigned int mmc_host_clk_rate (struct mmc_host *host);#else -static inline void mmc_host_clk_ungate (struct mmc_host *host) +static inline void mmc_host_clk_hold (struct mmc_host *host) { } -static inline void mmc_host_clk_gate (struct mmc_host *host) +static inline void mmc_host_clk_release (struct mmc_host *host) { }
drivers/mmc/host/sdhci-s3c.c +2 -0
@@ -301,6 +301,8 @@ static int sdhci_s3c_platform_8bit_width(struct sdhci_host *host, int width) ctrl &= ~SDHCI_CTRL_8BITBUS ;break ;default : + ctrl &= ~SDHCI_CTRL_4BITBUS ; + ctrl &= ~SDHCI_CTRL_8BITBUS ;break ; }
drivers/net/bnx2.c +7 -0
@@ -416,6 +416,9 @@ struct cnic_eth_dev *bnx2_cnic_probe(struct net_device *dev)struct bnx2 *bp =netdev_priv (dev);struct cnic_eth_dev *cp = &bp->cnic_eth_dev; +if (!cp->max_iscsi_conn) +return NULL ; + cp->drv_owner =THIS_MODULE ; cp->chip_id = bp->chip_id; cp->pdev = bp->pdev;
@@ -8177,6 +8180,10 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev) bp->timer.data = (unsigned long ) bp; bp->timer.function = bnx2_timer; +#ifdef BCM_CNIC + bp->cnic_eth_dev.max_iscsi_conn = +bnx2_reg_rd_ind (bp,BNX2_FW_MAX_ISCSI_CONN ); +#endif pci_save_state (pdev);return 0 ;
drivers/net/bnx2x/bnx2x_dcb.c +1 -0
@@ -1858,6 +1858,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)break ;case DCB_CAP_ATTR_DCBX : *cap =BNX2X_DCBX_CAPS ; +break ;default : rval = -EINVAL ;break ;
drivers/net/bnx2x/bnx2x_main.c +4 -2
@@ -4138,7 +4138,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)int igu_seg_id;int port =BP_PORT (bp);int func =BP_FUNC (bp); -int reg_offset; +int reg_offset, reg_offset_en5;u64 section;int index;struct hc_sp_status_block_data sp_sb_data;
@@ -4161,6 +4161,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp) reg_offset = (port ?MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0 ); + reg_offset_en5 = (port ?MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 : +MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0 );for (index =0 ; index <MAX_DYNAMIC_ATTN_GRPS ; index++) {int sindex;/* take care of sig[0]..sig[4] */
@@ -4175,7 +4177,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)* and not 16 between the different groups */ bp->attn_group[index].sig[4 ] =REG_RD (bp, - reg_offset +0x10 +0x4 *index); + reg_offset_en5 +0x4 *index); else bp->attn_group[index].sig[4] = 0; }
drivers/net/bnx2x/bnx2x_reg.h +12 -0
@@ -1325,6 +1325,18 @@Latched ump_tx_parity; [31] MCP Latched scpad_parity; */ #define MISC_REG_AEU_ENABLE4_PXP_0 0xa108#define MISC_REG_AEU_ENABLE4_PXP_1 0xa1a8 +/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped +* as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC +* attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6] +* mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1 +* parity; [31-10] Reserved; */ +#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0 0xa688 +/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped +* as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC +* attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6] +* mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1 +* parity; [31-10] Reserved; */ +#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 0xa6b0/* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu 128 bit vector */ #define MISC_REG_AEU_GENERAL_ATTN_0 0xa000
drivers/net/cnic.c +28 -29
149 lines not on this page · raw message
drivers/net/cxgb3/cxgb3_offload.c +18 -5
@@ -1149,12 +1149,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)if (te && te->ctx && te->client && te->client->redirect) { update_tcb = te->client->redirect (te->ctx, old, new, e);if (update_tcb) { +rcu_read_lock ();l2t_hold (L2DATA (tdev), e); +rcu_read_unlock ();set_l2t_ix (tdev, tid, e); } } }
Lines of this file are not shown. View the raw message.
drivers/net/sfc/mcdi.c +17 -29
46 lines not on this page · raw message
drivers/net/usb/cdc_ncm.c +56 -100
156 lines not on this page · raw message
drivers/net/wireless/ath/ath9k/ar9002_calib.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/ath/carl9170/main.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlegacy/iwl-3945-rs.c +8 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlegacy/iwl-core.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlegacy/iwl-hcmd.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlegacy/iwl3945-base.c +4 -4
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlegacy/iwl4965-base.c +5 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/iwlwifi/iwl-scan.c +16 -14
Lines of this file are not shown. View the raw message.
drivers/net/wireless/rt2x00/rt2800lib.c +39 -25
64 lines not on this page · raw message
drivers/net/wireless/rt2x00/rt2800usb.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/rt2x00/rt2x00usb.c +1 -13
Lines of this file are not shown. View the raw message.
drivers/net/wireless/rtlwifi/rtl8192cu/trx.c +6 -5
Lines of this file are not shown. View the raw message.
drivers/pci/hotplug/pcihp_slot.c +1 -44
45 lines not on this page · raw message
drivers/pci/pci.c +67 -0
67 lines not on this page · raw message
drivers/pci/probe.c +150 -0
150 lines not on this page · raw message
drivers/scsi/hpsa.c +37 -20
57 lines not on this page · raw message
drivers/scsi/isci/unsolicited_frame_control.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/scsi/isci/unsolicited_frame_control.h +1 -1
Lines of this file are not shown. View the raw message.
drivers/scsi/iscsi_tcp.c +41 -20
61 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_attr.c +72 -75
147 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_bsg.c +29 -23
52 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_els.c +64 -39
103 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_init.c +65 -17
82 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_scsi.c +30 -67
97 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_sli.c +67 -39
106 lines not on this page · raw message
drivers/usb/host/xhci-ring.c +63 -27
90 lines not on this page · raw message
drivers/usb/serial/option.c +101 -3
104 lines not on this page · raw message
fs/9p/v9fs.c +35 -10
45 lines not on this page · raw message
fs/9p/vfs_inode.c +120 -57
177 lines not on this page · raw message
fs/9p/vfs_inode_dotl.c +135 -27
162 lines not on this page · raw message
fs/proc/task_mmu.c +55 -25
80 lines not on this page · raw message
ipc/mqueue.c +64 -61
125 lines not on this page · raw message
kernel/sched.c +26 -15
41 lines not on this page · raw message
mm/page_alloc.c +45 -13
58 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Quoted 6 lines · Greg KH
This is the start of the stable review cycle for the 3.0.5 release. There are 244 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.
Quoted 6 lines
Responses should be made by Friday, September 30, 20:00:00 UTC. Anything received after that time might be too late.
The whole patch series would normally be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.0.5-rc1.gzand the diffstat can be found below.
Doh, I forgot the diffstat, here it is.
Makefile | 4 +- arch/arm/Kconfig | 14 ++ arch/arm/include/asm/futex.h | 34 ++-- arch/arm/include/asm/hardware/cache-l2x0.h | 2 +- arch/arm/kernel/smp_scu.c | 10 + arch/arm/mach-davinci/board-da850-evm.c | 28 +++ arch/arm/mach-davinci/sleep.S | 6 +- arch/arm/mach-dove/common.c | 2 +- arch/arm/mach-integrator/integrator_ap.c | 6 +- arch/arm/mm/cache-v7.S | 20 ++ arch/arm/mm/dma-mapping.c | 2 + arch/arm/plat-mxc/include/mach/iomux-v3.h | 2 +- arch/powerpc/sysdev/fsl_rio.c | 5 +- arch/sparc/Kconfig | 1 + arch/sparc/include/asm/sigcontext.h | 14 ++ arch/sparc/include/asm/spinlock_32.h | 11 +- arch/sparc/include/asm/spinlock_64.h | 6 - arch/sparc/kernel/Makefile | 1 + arch/sparc/kernel/irq.h | 2 +- arch/sparc/kernel/pcic.c | 4 +- arch/sparc/kernel/setup_64.c | 10 +- arch/sparc/kernel/signal32.c | 184 +++++++++++--------- arch/sparc/kernel/signal_32.c | 172 +++++++++---------- arch/sparc/kernel/signal_64.c | 108 +++++------- arch/sparc/kernel/sigutil.h | 9 + arch/sparc/kernel/sigutil_32.c | 120 +++++++++++++ arch/sparc/kernel/sigutil_64.c | 93 ++++++++++ arch/x86/kernel/amd_iommu.c | 18 +- arch/x86/kernel/cpu/perf_event.c | 3 + arch/x86/kernel/cpu/perf_event_intel.c | 1 + arch/x86/pci/acpi.c | 9 + arch/x86/platform/mrst/mrst.c | 4 +- arch/x86/xen/setup.c | 21 +++ arch/x86/xen/smp.c | 10 + arch/x86/xen/xen-asm_32.S | 8 +- block/blk-cgroup.c | 37 ++--- block/blk-core.c | 13 +- block/blk-sysfs.c | 5 + drivers/acpi/acpica/acconfig.h | 2 +- drivers/acpi/acpica/aclocal.h | 1 + drivers/acpi/acpica/nspredef.c | 1 + drivers/acpi/acpica/nsrepair2.c | 15 ++ drivers/ata/ahci.c | 1 + drivers/ata/pata_via.c | 18 ++ drivers/base/firmware_class.c | 11 +- drivers/block/floppy.c | 8 +- drivers/char/tpm/tpm.c | 9 +- drivers/cpufreq/pcc-cpufreq.c | 3 + drivers/firewire/ohci.c | 3 + drivers/gpu/drm/nouveau/nouveau_sgdma.c | 5 +- drivers/gpu/drm/radeon/evergreen.c | 42 ++++- drivers/gpu/drm/radeon/ni.c | 16 +- drivers/gpu/drm/radeon/r100.c | 22 +-- drivers/gpu/drm/radeon/r200.c | 4 +- drivers/gpu/drm/radeon/r600.c | 14 +- drivers/gpu/drm/radeon/radeon.h | 7 +- drivers/gpu/drm/radeon/radeon_asic.h | 8 +- drivers/gpu/drm/radeon/radeon_clocks.c | 3 + drivers/gpu/drm/radeon/radeon_combios.c | 8 + drivers/gpu/drm/radeon/radeon_encoders.c | 9 +- drivers/gpu/drm/radeon/radeon_ttm.c | 7 +- drivers/hwmon/ds620.c | 2 +- drivers/hwmon/max16065.c | 2 +- drivers/infiniband/hw/cxgb3/iwch_cm.c | 10 +- drivers/leds/ledtrig-timer.c | 2 + drivers/md/linear.h | 2 +- drivers/md/md.c | 12 +- drivers/media/dvb/dvb-usb/vp7045.c | 26 +--- drivers/media/rc/nuvoton-cir.c | 45 +---- drivers/media/rc/nuvoton-cir.h | 1 - drivers/mfd/omap-usb-host.c | 1 - drivers/mfd/tps65910-irq.c | 2 + drivers/mmc/core/core.c | 35 ++++- drivers/mmc/core/host.c | 12 +- drivers/mmc/core/host.h | 8 +- drivers/mmc/host/sdhci-s3c.c | 2 + drivers/net/bnx2.c | 7 + drivers/net/bnx2x/bnx2x_dcb.c | 1 + drivers/net/bnx2x/bnx2x_main.c | 6 +- drivers/net/bnx2x/bnx2x_reg.h | 12 ++ drivers/net/cnic.c | 57 +++--- drivers/net/cxgb3/cxgb3_offload.c | 23 ++- drivers/net/cxgb3/l2t.c | 15 ++- drivers/net/cxgb3/l2t.h | 16 ++- drivers/net/e1000/e1000_hw.c | 6 + drivers/net/ibmveth.c | 31 +++- drivers/net/igb/igb_main.c | 2 +- drivers/net/irda/smsc-ircc2.c | 2 +- drivers/net/ixgbe/ixgbe_main.c | 4 +- drivers/net/rionet.c | 23 +-- drivers/net/sfc/efx.c | 18 +-- drivers/net/sfc/io.h | 15 +-- drivers/net/sfc/mcdi.c | 46 ++--- drivers/net/sfc/nic.c | 7 - drivers/net/sfc/nic.h | 2 - drivers/net/sfc/siena.c | 25 +--- drivers/net/sfc/workarounds.h | 2 - drivers/net/tg3.c | 30 ++-- drivers/net/usb/asix.c | 4 + drivers/net/usb/cdc_ncm.c | 156 ++++++----------- drivers/net/wireless/ath/ath9k/ar9002_calib.c | 3 +- .../net/wireless/ath/ath9k/ar9003_2p2_initvals.h | 2 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 4 + drivers/net/wireless/ath/carl9170/main.c | 4 +- drivers/net/wireless/b43/main.c | 3 +- drivers/net/wireless/iwlegacy/iwl-3945-rs.c | 13 +- drivers/net/wireless/iwlegacy/iwl-core.c | 4 +- drivers/net/wireless/iwlegacy/iwl-hcmd.c | 2 +- drivers/net/wireless/iwlegacy/iwl-tx.c | 4 +- drivers/net/wireless/iwlegacy/iwl3945-base.c | 8 +- drivers/net/wireless/iwlegacy/iwl4965-base.c | 10 +- drivers/net/wireless/iwlwifi/iwl-agn.c | 5 + drivers/net/wireless/iwlwifi/iwl-scan.c | 30 ++-- drivers/net/wireless/iwlwifi/iwl-tx.c | 2 + drivers/net/wireless/rt2x00/rt2800lib.c | 64 ++++--- drivers/net/wireless/rt2x00/rt2800usb.c | 4 +- drivers/net/wireless/rt2x00/rt2x00usb.c | 14 +-- drivers/net/wireless/rtlwifi/core.c | 8 + drivers/net/wireless/rtlwifi/rtl8192cu/trx.c | 11 +- drivers/net/wireless/rtlwifi/usb.c | 1 + drivers/pci/dmar.c | 2 +- drivers/pci/hotplug/pcihp_slot.c | 45 +----- drivers/pci/pci.c | 67 +++++++ drivers/pci/probe.c | 150 ++++++++++++++++ drivers/rapidio/rio-scan.c | 3 +- drivers/regulator/tps65910-regulator.c | 7 + drivers/rtc/interface.c | 2 +- drivers/s390/cio/qdio_thinint.c | 15 +- drivers/scsi/3w-9xxx.c | 2 + drivers/scsi/Makefile | 2 +- drivers/scsi/aacraid/commsup.c | 2 + drivers/scsi/bnx2fc/bnx2fc.h | 8 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 28 +++- drivers/scsi/bnx2fc/bnx2fc_hwi.c | 24 +++- drivers/scsi/bnx2fc/bnx2fc_io.c | 2 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 2 +- drivers/scsi/fcoe/fcoe.c | 19 ++- drivers/scsi/hpsa.c | 57 ++++-- drivers/scsi/isci/host.c | 3 + drivers/scsi/isci/phy.c | 13 ++ drivers/scsi/isci/registers.h | 12 ++ drivers/scsi/isci/request.c | 30 ++-- drivers/scsi/isci/unsolicited_frame_control.c | 2 +- drivers/scsi/isci/unsolicited_frame_control.h | 2 +- drivers/scsi/iscsi_tcp.c | 61 +++++-- drivers/scsi/libfc/fc_rport.c | 14 ++ drivers/scsi/libiscsi_tcp.c | 14 +-- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_attr.c | 147 ++++++++-------- drivers/scsi/lpfc/lpfc_bsg.c | 52 +++--- drivers/scsi/lpfc/lpfc_crtn.h | 2 + drivers/scsi/lpfc/lpfc_els.c | 103 +++++++---- drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- drivers/scsi/lpfc/lpfc_hw.h | 7 +- drivers/scsi/lpfc/lpfc_hw4.h | 30 ++-- drivers/scsi/lpfc/lpfc_init.c | 82 +++++++-- drivers/scsi/lpfc/lpfc_mbox.c | 2 +- drivers/scsi/lpfc/lpfc_scsi.c | 97 ++++------- drivers/scsi/lpfc/lpfc_sli.c | 106 +++++++---- drivers/scsi/lpfc/lpfc_sli4.h | 2 + drivers/scsi/mpt2sas/mpt2sas_base.c | 19 ++- drivers/scsi/mpt2sas/mpt2sas_base.h | 3 + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 3 +- drivers/scsi/qla2xxx/qla_init.c | 3 - drivers/scsi/qla2xxx/qla_isr.c | 1 - drivers/tty/pty.c | 17 ++- drivers/tty/serial/8250.c | 8 +- drivers/tty/serial/8250_pci.c | 6 +- drivers/tty/serial/8250_pnp.c | 3 + drivers/tty/serial/max3107-aava.c | 2 +- drivers/tty/serial/max3107.c | 2 +- drivers/tty/serial/mrst_max3110.c | 2 +- drivers/tty/serial/omap-serial.c | 3 +- drivers/tty/tty_io.c | 3 +- drivers/usb/host/ehci-hub.c | 7 +- drivers/usb/host/ehci-s5p.c | 1 + drivers/usb/host/pci-quirks.c | 28 +++- drivers/usb/host/xhci-hub.c | 19 ++- drivers/usb/host/xhci-ring.c | 90 +++++++--- drivers/usb/host/xhci.c | 28 +++- drivers/usb/musb/cppi_dma.c | 26 ++- drivers/usb/serial/ftdi_sio.c | 20 ++- drivers/usb/serial/option.c | 104 +++++++++++- drivers/usb/serial/pl2303.c | 26 +++- drivers/video/savage/savagefb.h | 2 +- drivers/zorro/zorro.c | 7 +- fs/9p/acl.c | 22 ++- fs/9p/acl.h | 6 +- fs/9p/cache.c | 20 +-- fs/9p/cache.h | 9 - fs/9p/v9fs.c | 45 ++++- fs/9p/v9fs.h | 29 +++- fs/9p/v9fs_vfs.h | 6 +- fs/9p/vfs_file.c | 36 +++- fs/9p/vfs_inode.c | 177 +++++++++++++------ fs/9p/vfs_inode_dotl.c | 162 ++++++++++++++--- fs/9p/vfs_super.c | 2 +- fs/block_dev.c | 7 +- fs/btrfs/inode.c | 5 +- fs/cifs/cifssmb.c | 3 +- fs/cifs/connect.c | 4 +- fs/ext4/inode.c | 4 +- fs/fs-writeback.c | 26 ++- fs/namei.c | 4 + fs/proc/task_mmu.c | 80 ++++++--- include/linux/mfd/wm8994/pdata.h | 2 +- include/linux/pci.h | 15 ++- include/linux/rio_regs.h | 18 +- include/linux/rtc.h | 3 + include/linux/tty.h | 2 + include/linux/tty_driver.h | 3 + include/linux/writeback.h | 1 + include/net/9p/9p.h | 29 +++ ipc/mqueue.c | 127 +++++++------- kernel/irq/chip.c | 2 +- kernel/printk.c | 2 +- kernel/sched.c | 41 +++-- kernel/time/alarmtimer.c | 18 ++- kernel/workqueue.c | 7 +- lib/xz/xz_dec_bcj.c | 27 ++- mm/page-writeback.c | 4 +- mm/page_alloc.c | 58 +++++-- mm/vmalloc.c | 8 + mm/vmscan.c | 18 ++- net/8021q/vlan_core.c | 2 + net/9p/client.c | 13 +- net/9p/trans_virtio.c | 17 ++- net/atm/br2684.c | 7 +- net/bluetooth/hci_event.c | 17 +- net/bridge/br_if.c | 6 +- net/bridge/br_multicast.c | 21 ++- net/core/fib_rules.c | 4 +- net/core/neighbour.c | 8 +- net/core/scm.c | 2 +- net/ipv4/igmp.c | 2 +- net/ipv4/netfilter.c | 18 +- net/ipv4/route.c | 8 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_input.c | 2 +- net/ipv6/ipv6_sockglue.c | 9 +- net/ipv6/mcast.c | 2 +- net/ipv6/syncookies.c | 2 +- net/mac80211/sta_info.c | 2 +- net/sched/sch_prio.c | 2 +- net/socket.c | 10 +- net/wireless/nl80211.c | 5 +- net/wireless/reg.c | 1 + net/xfrm/xfrm_input.c | 5 + sound/core/pcm_lib.c | 33 +++- sound/pci/fm801.c | 15 +- sound/pci/hda/patch_cirrus.c | 2 +- sound/pci/hda/patch_realtek.c | 13 +- sound/pci/hda/patch_sigmatel.c | 1 + sound/soc/blackfin/bf5xx-ad193x.c | 4 +- sound/soc/codecs/ad193x.c | 3 +- sound/soc/codecs/ad193x.h | 5 +- sound/soc/codecs/ssm2602.c | 3 +- sound/soc/fsl/mpc5200_dma.c | 6 +- sound/soc/omap/omap-mcbsp.c | 6 + sound/soc/soc-jack.c | 4 +- sound/usb/card.c | 7 +- tools/perf/util/symbol.c | 2 + 264 files changed, 3338 insertions(+), 1714 deletions(-)
PATCH 3/244 arch/powerpc/sysdev/fsl_rio.c: correct IECSR register clear value
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Liu Gang-B34182 <[email protected]>
commit 671ee7f0ce62e4b991b47fcf1c161c3f710dabbc upstream.
This bug causes the IECSR register clear failure. In this case, the RETE (retry error threshold exceeded) interrupt will be generated and cannot be cleared. So the related ISR may be called persistently.
The RETE bit in IECSR is cleared by writing a 1 to it.
--- arch/powerpc/sysdev/fsl_rio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/sysdev/fsl_rio.c +3 -2
@@ -54,6 +54,7 @@#define ODSR_CLEAR 0x1c00#define LTLEECSR_ENABLE_ALL 0xFFC000FC#define ESCSR_CLEAR 0x07120204 +#define IECSR_CLEAR 0x80000000#define RIO_PORT1_EDCSR 0x0640#define RIO_PORT2_EDCSR 0x0680
@@ -1089,11 +1090,11 @@ static void port_error_handler(struct riif (offset ==0 ) {out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_EDCSR ),0 ); -out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_IECSR ),0 ); +out_be32 ((u32 *)(rio_regs_win +RIO_PORT1_IECSR ),IECSR_CLEAR );out_be32 ((u32 *)(rio_regs_win +RIO_ESCSR ),ESCSR_CLEAR ); }else {out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_EDCSR ),0 ); -out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_IECSR ),0 ); +out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_IECSR ),IECSR_CLEAR );out_be32 ((u32 *)(rio_regs_win +RIO_PORT2_ESCSR ),ESCSR_CLEAR ); } }
PATCH 4/244 sfi: table irq 0xFF means no interrupt
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
commit a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5 upstream.
According to the SFI specification irq number 0xFF means device has no interrupt or interrupt attached via GPIO.
Currently, we don't handle this special case and set irq field in *_board_info structs to 255. It leads to confusion in some drivers. Accelerometer driver tries to register interrupt 255, fails and prints "Cannot get IRQ" to dmesg.
--- arch/x86/platform/mrst/mrst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/platform/mrst/mrst.c +3 -1
@@ -689,7 +689,9 @@ static int __init sfi_parse_devs(struct irq_attr.trigger =1 ; irq_attr.polarity =1 ;io_apic_set_pci_routing (NULL , pentry->irq, &irq_attr); - } + }else + pentry->irq =0 ;/* No irq */ +switch (pentry->type) {case SFI_DEV_TYPE_IPC :/* ID as IRQ is a hack that will go away */
Re: [004/244] sfi: table irq 0xFF means no interrupt
Quoted 16 lines · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
commit
a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5upstream.According to the SFI specification irq number
0xFFmeans device has no interrupt or interrupt attached via GPIO.Currently, we don't handle this special case and set irq field in
*_board_infostructs to 255. It leads to confusion in some drivers. Accelerometer driver tries to register interrupt 255, fails and prints "Cannot get IRQ" to dmesg.
Quoted 4 lines
Signed-off-by Kirill A. Shutemov <[email protected]>Signed-off-by Alan Cox <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Please, take this as well:
http://lkml.org/lkml/2011/9/14/40
Signature · 1 line
Kirill A. Shutemov
Re: [004/244] sfi: table irq 0xFF means no interrupt
Quoted 17 lines · Kirill A. Shutemov
Quoted 16 lines · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
commit
a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5upstream.According to the SFI specification irq number
0xFFmeans device has no interrupt or interrupt attached via GPIO.Currently, we don't handle this special case and set irq field in
*_board_infostructs to 255. It leads to confusion in some drivers. Accelerometer driver tries to register interrupt 255, fails and prints "Cannot get IRQ" to dmesg.
Quoted 8 lines
Quoted 4 lines
Signed-off-by Kirill A. Shutemov <[email protected]>Signed-off-by Alan Cox <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Please, take this as well:
Is that patch in Linus's tree? If so, what is the git commit id of it?
thanks,
greg k-h
Re: [004/244] sfi: table irq 0xFF means no interrupt
Quoted 23 lines · Greg KH
Quoted 22 lines · Kirill A. Shutemov
Quoted 20 lines · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
commit
a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5upstream.According to the SFI specification irq number
0xFFmeans device has no interrupt or interrupt attached via GPIO.Currently, we don't handle this special case and set irq field in
*_board_infostructs to 255. It leads to confusion in some drivers. Accelerometer driver tries to register interrupt 255, fails and prints "Cannot get IRQ" to dmesg.Signed-off-by Kirill A. Shutemov <[email protected]>Signed-off-by Alan Cox <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 5 lines
Quoted 3 lines
Please, take this as well:
Is that patch in Linus's tree?
No, it isn't.
Do not apply "sfi: table irq 0xFF means no interrupt" in this case. It breaks kexec. Better to take both patches into next stable release.
Signature · 1 line
Kirill A. Shutemov
Re: [004/244] sfi: table irq 0xFF means no interrupt
Quoted 26 lines · Kirill A. Shutemov
Quoted 25 lines · Greg KH
Quoted 24 lines · Kirill A. Shutemov
Quoted 16 lines · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
commit
a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5upstream.According to the SFI specification irq number
0xFFmeans device has no interrupt or interrupt attached via GPIO.Currently, we don't handle this special case and set irq field in
*_board_infostructs to 255. It leads to confusion in some drivers. Accelerometer driver tries to register interrupt 255, fails and prints "Cannot get IRQ" to dmesg.Quoted 4 lines
Signed-off-by Kirill A. Shutemov <[email protected]>Signed-off-by Alan Cox <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Please, take this as well:
Quoted 8 lines
Quoted 3 lines
Quoted 1 line
Is that patch in Linus's tree?
No, it isn't.
Do not apply "sfi: table irq
0xFFmeans no interrupt" in this case. It breaks kexec. Better to take both patches into next stable release.
Ok, I've dropped this patch from the release.
Please let me know when you get the fixup patch into Linus's tree, and let me know that it needs to be added to the 3.0-stable tree, along with this one.
greg k-h
PATCH 5/244 ASoC: soc-jack: Fix checking return value of request_any_context_irq
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Axel Lin <[email protected]>
commit d2b4c7bd7eabfaa2e3e5b8107d5eeb56ac879813 upstream.
request_any_context_irq() returns a negative value on failure. On success, it returns either IRQC_IS_HARDIRQ or IRQC_IS_NESTED.
--- sound/soc/soc-jack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-jack.c +1 -1
@@ -327,7 +327,7 @@ int snd_soc_jack_add_gpios(struct snd_soIRQF_TRIGGER_FALLING , gpios[i].name, &gpios[i]); -if (ret) +if (ret <0 ) goto err;if (gpios[i].wake) {
PATCH 6/244 ASoC: ad193x: fix registers definition
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Scott Jiang <[email protected]>
commit bf545ed72f2eeac664695a8ea2199d9ddaef6020 upstream.
fix dac word len mask and adc tdm fmt shift value
--- sound/soc/codecs/ad193x.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/ad193x.h +2 -2
@@ -34,7 +34,7 @@#define AD193X_DAC_LEFT_HIGH (1 << 3)#define AD193X_DAC_BCLK_INV (1 << 7)#define AD193X_DAC_CTRL2 0x804 -#define AD193X_DAC_WORD_LEN_MASK 0xC +#define AD193X_DAC_WORD_LEN_MASK 0x18#define AD193X_DAC_MASTER_MUTE 1#define AD193X_DAC_CHNL_MUTE 0x805#define AD193X_DACL1_MUTE 0
@@ -63,7 +63,7 @@#define AD193X_ADC_CTRL1 0x80f#define AD193X_ADC_SERFMT_MASK 0x60#define AD193X_ADC_SERFMT_STEREO (0 << 5) -#define AD193X_ADC_SERFMT_TDM (1 << 2) +#define AD193X_ADC_SERFMT_TDM (1 << 5)#define AD193X_ADC_SERFMT_AUX (2 << 5)#define AD193X_ADC_WORD_LEN_MASK 0x3#define AD193X_ADC_CTRL2 0x810
PATCH 7/244 ASoC: ad193x: fix dac word len setting
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Scott Jiang <[email protected]>
commit 95c93d8525ebce1024bda7316f602ae45c36cd6f upstream.
dac word len value should left shift before setting
--- sound/soc/codecs/ad193x.c | 3 ++- sound/soc/codecs/ad193x.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/ad193x.c +2 -1
@@ -307,7 +307,8 @@ static int ad193x_hw_params(struct snd_psnd_soc_write (codec,AD193X_PLL_CLK_CTRL0 , reg); reg =snd_soc_read (codec,AD193X_DAC_CTRL2 ); - reg = (reg & (~AD193X_DAC_WORD_LEN_MASK )) | word_len; + reg = (reg & (~AD193X_DAC_WORD_LEN_MASK )) + | (word_len <<AD193X_DAC_WORD_LEN_SHFT );snd_soc_write (codec,AD193X_DAC_CTRL2 , reg); reg =snd_soc_read (codec,AD193X_ADC_CTRL1 );
sound/soc/codecs/ad193x.h +1 -0
@@ -34,6 +34,7 @@#define AD193X_DAC_LEFT_HIGH (1 << 3)#define AD193X_DAC_BCLK_INV (1 << 7)#define AD193X_DAC_CTRL2 0x804 +#define AD193X_DAC_WORD_LEN_SHFT 3#define AD193X_DAC_WORD_LEN_MASK 0x18#define AD193X_DAC_MASTER_MUTE 1#define AD193X_DAC_CHNL_MUTE 0x805
PATCH 8/244 omap-serial: Allow IXON and IXOFF to be disabled.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nick Pelly <[email protected]>
commit b280a97d1caf6fe1d38b51ebb31219391f5ad1a0 upstream.
Fixes logic bug that software flow control cannot be disabled, because serial_omap_configure_xonxoff() is not called if both IXON and IXOFF bits are cleared.
--- drivers/tty/serial/omap-serial.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/tty/serial/omap-serial.c +1 -2
@@ -806,8 +806,7 @@ serial_omap_set_termios(struct uart_portserial_omap_set_mctrl (&up->port, up->port.mctrl);/* Software Flow Control Configuration */ -if (termios->c_iflag & (IXON |IXOFF )) -serial_omap_configure_xonxoff (up, termios); +serial_omap_configure_xonxoff (up, termios);spin_unlock_irqrestore (&up->port.lock, flags);dev_dbg (up->port.dev,"serial_omap_set_termios+%d\n" , up->pdev->id);
PATCH 9/244 serial: 8250_pnp: add Intermec CV60 touchscreen device
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Bjorn Helgaas <[email protected]>
commit ab8ba3a2d2cba6a658ef596cd5b2e0905b6c8a9f upstream.
It would have been nice if Intermec had supplied a PNP0501 _CID for the COM3 device, but they didn't, so we have to recognize it explicitly.
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40612
--- drivers/tty/serial/8250_pnp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tty/serial/8250_pnp.c +3 -0
@@ -109,6 +109,9 @@ static const struct pnp_device_id pnp_de/* IBM */ /* IBM Thinkpad 701 Internal Modem Voice */ { "IBM0033", 0 }, +/* Intermec */ +/* Intermec CV60 touchscreen port */ + { "PNP4972", 0 },/* Intertex */ /* Intertex 28k8 33k6 Voice EXT PnP */ { "IXDC801", 0 },
PATCH 10/244 8250_pci: add support for Rosewill RC-305 4x serial port card
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Smith <[email protected]>
commit 44178176ecc55ad370b837dd2c4b4b8bed1e3823 upstream.
This patch adds support for the Rosewill RC-305 four-port PCI serial card, and probably any other four-port serial cards based on the Moschip MCS9865 chip, assuming that the EEPROM on the card was programmed in accordance with Table 6 of the MCS9865 EEPROM Application Note version 0.3 dated 16-May-2008, available from the Moschip web site (registration required).
This patch is based on an earlier patch [1] for the SYBA 6x serial port card by Ira W. Snyder.
[1]: http://www.gossamer-threads.com/lists/linux/kernel/1162435
--- drivers/tty/serial/8250_pci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tty/serial/8250_pci.c +5 -1
@@ -3886,7 +3886,7 @@ static struct pci_device_id serial_pci_t 0, 0, pbn_b0_1_115200 },/* -* Best Connectivity PCI Multi I/O cards +* Best Connectivity and Rosewill PCI Multi I/O cards */ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
@@ -3894,6 +3894,10 @@ static struct pci_device_id serial_pci_t 0, 0, pbn_b0_1_115200 }, {PCI_VENDOR_ID_NETMOS ,PCI_DEVICE_ID_NETMOS_9865 , +0xA000 ,0x3002 , + 0, 0, pbn_b0_bt_2_115200 }, + + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,0xA000 ,0x3004 , 0, 0, pbn_b0_bt_4_115200 }, /* Intel CE4100 */
PATCH 11/244 8250: Fix race condition in serial8250_backup_timeout().
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Al Cooper <[email protected]>
commit dbb3b1ca5609d1f3848cd387d06cc60aaacf7f98 upstream.
This is to fix an issue where output will suddenly become very slow. The problem occurs on 8250 UARTS with the hardware bug UART_BUG_THRE.
BACKGROUND
For normal UARTs (without UART_BUG_THRE): When the serial core layer gets new transmit data and the transmitter is idle, it buffers the data and calls the 8250s' serial8250_start_tx() routine which will simply enable the TX interrupt in the IER register and return. This should immediately fire a THRE interrupt and begin transmitting the data.
For buggy UARTs (with UART_BUG_THRE): merely enabling the TX interrupt in IER does not necessarily generate a new THRE interrupt. Therefore, a background timer periodically checks to see if there is pending data, and starts transmission if that is the case.
The bug happens on SMP systems when the system has nothing to transmit, the transmit interrupt is disabled and the following sequence occurs:
- CPU0: The background timer routine serial8250_backup_timeout() starts and saves the state of the interrupt enable register (IER) and then disables all interrupts in IER. NOTE: The transmit interrupt (TI) bit is saved as disabled.
- CPU1: The serial core gets data to transmit, grabs the port lock and calls serial8250_start_tx() which enables the TI in IER.
- CPU0: serial8250_backup_timeout() waits for the port lock.
- CPU1: finishes (with TI enabled) and releases the port lock.
- CPU0: serial8250_backup_timeout() calls the interrupt routine which will transmit the next fifo's worth of data and then restores the IER from the previously saved value (TI disabled).
At this point, as long as the serial core has more transmit data buffered, it will not call serial8250_start_tx() again and the background timer routine will slowly transmit the data.
The fix is to have serial8250_start_tx() get the port lock before it saves the IER state and release it after restoring IER. This will prevent serial8250_start_tx() from running in parallel.
--- drivers/tty/serial/8250.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/tty/serial/8250.c +5 -3
@@ -1819,6 +1819,8 @@ static void serial8250_backup_timeout(ununsigned int iir, ier =0 , lsr;unsigned long flags; +spin_lock_irqsave (&up->port.lock, flags); +/* * Must disable interrupts or else we risk racing with the interrupt * based handler.
@@ -1836,10 +1838,8 @@ static void serial8250_backup_timeout(un* the "Diva" UART used on the management processor on many HP * ia64 and parisc boxes. */ -spin_lock_irqsave (&up->port.lock, flags); lsr =serial_in (up,UART_LSR ); up->lsr_saved_flags |= lsr &LSR_SAVE_FLAGS ; -spin_unlock_irqrestore (&up->port.lock, flags);if ((iir &UART_IIR_NO_INT ) && (up->ier &UART_IER_THRI ) && (!uart_circ_empty (&up->port.state->xmit) || up->port.x_char) && (lsr &UART_LSR_THRE )) {
@@ -1848,11 +1848,13 @@ static void serial8250_backup_timeout(un }if (!(iir &UART_IIR_NO_INT )) -serial8250_handle_port (up); +transmit_chars (up);if (is_real_interrupt (up->port.irq))serial_out (up,UART_IER , ier); +spin_unlock_irqrestore (&up->port.lock, flags); +/* Standard timer interval plus 0.2s to keep the port running */ mod_timer (&up->timer, jiffies +uart_poll_timeout (&up->port) +HZ /5 );
PATCH 12/244 tty: Add "spi:" prefix for spi modalias
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Axel Lin <[email protected]>
commit 8c4074cd2254606aeb788d518ccc27c9f97129e1 upstream.
Since commit e0626e38 (spi: prefix modalias with "spi:"), the spi modalias is prefixed with "spi:".
This patch adds "spi:" prefix and removes "-spi" suffix in the modalias.
--- drivers/tty/serial/max3107-aava.c | 2 +- drivers/tty/serial/max3107.c | 2 +- drivers/tty/serial/mrst_max3110.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/tty/serial/max3107-aava.c +1 -1
@@ -340,5 +340,5 @@ module_exit(max3107_exit);MODULE_DESCRIPTION ("MAX3107 driver" );MODULE_AUTHOR ("Aavamobile" ); -MODULE_ALIAS ("aava-max3107-spi" ); +MODULE_ALIAS ("spi:aava-max3107" );MODULE_LICENSE ("GPL v2" );
drivers/tty/serial/max3107.c +1 -1
@@ -1209,5 +1209,5 @@ module_exit(max3107_exit);MODULE_DESCRIPTION ("MAX3107 driver" );MODULE_AUTHOR ("Aavamobile" ); -MODULE_ALIAS ("max3107-spi" ); +MODULE_ALIAS ("spi:max3107" );MODULE_LICENSE ("GPL v2" );
drivers/tty/serial/mrst_max3110.c +1 -1
@@ -917,4 +917,4 @@ module_init(serial_m3110_init);module_exit (serial_m3110_exit);MODULE_LICENSE ("GPL v2" ); -MODULE_ALIAS ("max3110-uart" ); +MODULE_ALIAS ("spi:max3110-uart" );
PATCH 13/244 TTY: pty, fix pty counting
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jiri Slaby <[email protected]>
commit 24d406a6bf736f7aebdc8fa0f0ec86e0890c6d24 upstream.
tty_operations->remove is normally called like:queue_release_one_tty
->tty_shutdown
->tty_driver_remove_tty
->tty_operations->remove
However tty_shutdown() is called from queue_release_one_tty() only if tty_operations->shutdown is NULL. But for pty, it is not. pty_unix98_shutdown() is used there as ->shutdown.
So tty_operations->remove of pty (i.e. pty_unix98_remove()) is never called. This results in invalid pty_count. I.e. what can be seen in /proc/sys/kernel/pty/nr.
I see this was already reported at:
https://lkml.org/lkml/2009/11/5/370
But it was not fixed since then.
This patch is kind of a hackish way. The problem lies in ->install. We allocate there another tty (so-called tty->link). So ->install is called once, but ->remove twice, for both tty and tty->link. The fix here is to count both tty and tty->link and divide the count by 2 for user.
And to have ->remove called, let's make tty_driver_remove_tty() global and call that from pty_unix98_shutdown() (tty_operations->shutdown).
While at it, let's document that when ->shutdown is defined, tty_shutdown() is not called.
--- drivers/tty/pty.c | 17 +++++++++++++++-- drivers/tty/tty_io.c | 3 +-- include/linux/tty.h | 2 ++ include/linux/tty_driver.h | 3 +++ 4 files changed, 21 insertions(+), 4 deletions(-)
drivers/tty/pty.c +15 -2
@@ -446,8 +446,19 @@ static inline void legacy_pty_init(void)int pty_limit =NR_UNIX98_PTY_DEFAULT ;static int pty_limit_min;static int pty_limit_max =NR_UNIX98_PTY_MAX ; +static int tty_count;static int pty_count; +static inline void pty_inc_count (void ) +{ + pty_count = (++tty_count) /2 ; +} + +static inline void pty_dec_count (void ) +{ + pty_count = (--tty_count) /2 ; +} +static struct cdev ptmx_cdev;static struct ctl_table pty_table[] = {
@@ -542,6 +553,7 @@ static struct tty_struct *pts_unix98_loostatic void pty_unix98_shutdown (struct tty_struct *tty) { +tty_driver_remove_tty (tty->driver, tty);/* We have our own method as we don't use the tty index */ kfree (tty->termios); }
@@ -588,7 +600,8 @@ static int pty_unix98_install(struct tty*/ tty_driver_kref_get (driver); tty->count++; - pty_count++; +pty_inc_count ();/* tty */ +pty_inc_count ();/* tty->link */ return 0 ; err_free_mem:deinitialize_tty_struct (o_tty);
@@ -602,7 +615,7 @@ err_free_tty:static void pty_unix98_remove (struct tty_driver *driver,struct tty_struct *tty) { - pty_count--; +pty_dec_count (); }static const struct tty_operations ptm_unix98_ops = {
drivers/tty/tty_io.c +1 -2
@@ -1294,8 +1294,7 @@ static int tty_driver_install_tty(struct* * Locking: tty_mutex for now */ -static void tty_driver_remove_tty (struct tty_driver *driver, -struct tty_struct *tty) +void tty_driver_remove_tty (struct tty_driver *driver,struct tty_struct *tty) {if (driver->ops->remove) driver->ops->remove (driver, tty);
include/linux/tty.h +2 -0
@@ -420,6 +420,8 @@ extern void tty_driver_flush_buffer(struextern void tty_throttle (struct tty_struct *tty);extern void tty_unthrottle (struct tty_struct *tty);extern int tty_do_resize (struct tty_struct *tty,struct winsize *ws); +extern void tty_driver_remove_tty (struct tty_driver *driver, +struct tty_struct *tty);extern void tty_shutdown (struct tty_struct *tty);extern void tty_free_termios (struct tty_struct *tty);extern int is_current_pgrp_orphaned (void );
include/linux/tty_driver.h +3 -0
@@ -47,6 +47,9 @@* * This routine is called synchronously when a particular tty device * is closed for the last time freeing up the resources. +* Note that tty_shutdown() is not called if ops->shutdown is defined. +* This means one is responsible to take care of calling ops->remove (e.g. +* via tty_driver_remove_tty) and releasing tty->termios. * * * void (*cleanup)(struct tty_struct * tty);
PATCH 14/244 USB: ftdi_sio: add Calao reference board support
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
commit c96fbdd0ab97235f930ebf24b38fa42a2e3458cf upstream.
Calao use on there dev kits a FT2232 where the port 0 is used for the JTAG and port 1 for the UART
They use the same VID and PID as FTDI Chip but they program the manufacturer name in the eeprom
So use this information to detect it
--- drivers/usb/serial/ftdi_sio.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +19 -1
@@ -101,6 +101,7 @@ static int ftdi_jtag_probe(struct usb_static int ftdi_mtxorb_hack_setup (struct usb_serial *serial);static int ftdi_NDI_device_setup (struct usb_serial *serial);static int ftdi_stmclite_probe (struct usb_serial *serial); +static int ftdi_8u2232c_probe (struct usb_serial *serial);static void ftdi_USB_UIRT_setup (struct ftdi_private *priv);static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv);
@@ -128,6 +129,10 @@ static struct ftdi_sio_quirk ftdi_stmcli .probe = ftdi_stmclite_probe, }; +static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { + .probe = ftdi_8u2232c_probe, +}; +/* * The 8U232AM has the same API as the sio except for: * - it can support MUCH higher baudrates; up to:
@@ -177,7 +182,8 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) }, { USB_DEVICE(FTDI_VID, FTDI_232RL_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) , + .driver_info = (kernel_ulong_t)&ftdi_8u2232c_quirk }, { USB_DEVICE(FTDI_VID, FTDI_4232H_PID) }, { USB_DEVICE(FTDI_VID, FTDI_232H_PID) }, { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
@@ -1732,6 +1738,18 @@ static int ftdi_jtag_probe(struct usb_sereturn 0 ; } + +static int ftdi_8u2232c_probe (struct usb_serial *serial) +{ +struct usb_device *udev = serial->dev; + +dbg ("%s" , __func__); + +if (strcmp (udev->manufacturer,"CALAO Systems" ) ==0 ) +return ftdi_jtag_probe (serial); + +return 0 ; +}/* * First and second port on STMCLiteadaptors is reserved for JTAG interface
PATCH 15/244 usb: s5p-ehci: fix a NULL pointer deference
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yulgon Kim <[email protected]>
commit e5d3d4463fb30998385f9e78ab3c7f63b5813000 upstream.
This patch fixes a NULL pointer deference. A NULL pointer dereference happens since s5p_ehci->hcd field is not initialized yet in probe function.
--- drivers/usb/host/ehci-s5p.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/ehci-s5p.c +1 -0
@@ -86,6 +86,7 @@ static int __devinit s5p_ehci_probe(stru goto fail_hcd; } + s5p_ehci->hcd = hcd; s5p_ehci->clk =clk_get (&pdev->dev,"usbhost" );if (IS_ERR (s5p_ehci->clk)) {
PATCH 16/244 USB option driver add PID of Huawei Vodafone K3806
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Bird <[email protected]>
commit 0e69d75ccb2f091757b38d4d6a2ed739e06b615e upstream.
This patch adds the product ID of Huawei's Vodafone K3806 mobile broadband modem to option.c. This is necessary so that the driver gets loaded on demand without the intervention of usb_modeswitch. This has the benefit of it becoming available faster and also ensures that the option driver is not bound to a network interface that should be claimed by cdc_ether.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -148,6 +148,7 @@ static void option_instat_callback(struc#define HUAWEI_PRODUCT_K4505 0x1464#define HUAWEI_PRODUCT_K3765 0x1465#define HUAWEI_PRODUCT_E14AC 0x14AC +#define HUAWEI_PRODUCT_K3806 0x14AE#define HUAWEI_PRODUCT_K3770 0x14C9#define HUAWEI_PRODUCT_K3771 0x14CA#define HUAWEI_PRODUCT_K4510 0x14CB
@@ -551,6 +552,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
PATCH 17/244 USB option driver add PID of Huawei Vodafone K4605
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Bird <[email protected]>
commit 7e1805844da18a37e6d251d286f93c94b52d791e upstream.
This patch adds the product ID of Huawei's Vodafone K4605 mobile broadband modem to option.c. This is necessary so that the driver gets loaded on demand without the intervention of usb_modeswitch. This has the benefit of it becoming available faster and also ensures that the option driver is not bound to a network interface that should be claimed by suitable network driver.
--- drivers/usb/serial/option.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +5 -2
@@ -149,6 +149,7 @@ static void option_instat_callback(struc#define HUAWEI_PRODUCT_K3765 0x1465#define HUAWEI_PRODUCT_E14AC 0x14AC#define HUAWEI_PRODUCT_K3806 0x14AE +#define HUAWEI_PRODUCT_K4605 0x14C6#define HUAWEI_PRODUCT_K3770 0x14C9#define HUAWEI_PRODUCT_K3771 0x14CA#define HUAWEI_PRODUCT_K4510 0x14CB
@@ -553,6 +554,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
@@ -1136,10 +1138,11 @@ static int option_probe(struct usb_seria serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)return -ENODEV ; -/* Don't bind network interfaces on Huawei K3765 & K4505 */ +/* Don't bind network interfaces on Huawei K3765, K4505 & K4605 */ if (serial->dev->descriptor.idVendor ==HUAWEI_VENDOR_ID && (serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K3765 || - serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4505 ) && + serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4505 || + serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4605 ) && serial->interface->cur_altsetting->desc.bInterfaceNumber ==1 )return -ENODEV ;
PATCH 18/244 USB: option: add YUGA device id to driver
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Gavin.zhu" <[email protected]>
commit c6eb2d75ffcdfafa37ff010bf467de20d468ef79 upstream.
--- drivers/usb/serial/option.c | 92 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
drivers/usb/serial/option.c +92 -0
@@ -418,6 +418,56 @@ static void option_instat_callback(struc#define SAMSUNG_VENDOR_ID 0x04e8#define SAMSUNG_PRODUCT_GT_B3730 0x6889 +/* YUGA products www.yuga-info.com*/ +#define YUGA_VENDOR_ID 0x257A +#define YUGA_PRODUCT_CEM600 0x1601 +#define YUGA_PRODUCT_CEM610 0x1602 +#define YUGA_PRODUCT_CEM500 0x1603 +#define YUGA_PRODUCT_CEM510 0x1604 +#define YUGA_PRODUCT_CEM800 0x1605 +#define YUGA_PRODUCT_CEM900 0x1606 + +#define YUGA_PRODUCT_CEU818 0x1607 +#define YUGA_PRODUCT_CEU816 0x1608 +#define YUGA_PRODUCT_CEU828 0x1609 +#define YUGA_PRODUCT_CEU826 0x160A +#define YUGA_PRODUCT_CEU518 0x160B +#define YUGA_PRODUCT_CEU516 0x160C +#define YUGA_PRODUCT_CEU528 0x160D +#define YUGA_PRODUCT_CEU526 0x160F + +#define YUGA_PRODUCT_CWM600 0x2601 +#define YUGA_PRODUCT_CWM610 0x2602 +#define YUGA_PRODUCT_CWM500 0x2603 +#define YUGA_PRODUCT_CWM510 0x2604 +#define YUGA_PRODUCT_CWM800 0x2605 +#define YUGA_PRODUCT_CWM900 0x2606 + +#define YUGA_PRODUCT_CWU718 0x2607 +#define YUGA_PRODUCT_CWU716 0x2608 +#define YUGA_PRODUCT_CWU728 0x2609 +#define YUGA_PRODUCT_CWU726 0x260A +#define YUGA_PRODUCT_CWU518 0x260B +#define YUGA_PRODUCT_CWU516 0x260C +#define YUGA_PRODUCT_CWU528 0x260D +#define YUGA_PRODUCT_CWU526 0x260F + +#define YUGA_PRODUCT_CLM600 0x2601 +#define YUGA_PRODUCT_CLM610 0x2602 +#define YUGA_PRODUCT_CLM500 0x2603 +#define YUGA_PRODUCT_CLM510 0x2604 +#define YUGA_PRODUCT_CLM800 0x2605 +#define YUGA_PRODUCT_CLM900 0x2606 + +#define YUGA_PRODUCT_CLU718 0x2607 +#define YUGA_PRODUCT_CLU716 0x2608 +#define YUGA_PRODUCT_CLU728 0x2609 +#define YUGA_PRODUCT_CLU726 0x260A +#define YUGA_PRODUCT_CLU518 0x260B +#define YUGA_PRODUCT_CLU516 0x260C +#define YUGA_PRODUCT_CLU528 0x260D +#define YUGA_PRODUCT_CLU526 0x260F +/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {OPTION_BLACKLIST_NONE =0 ,
@@ -1009,6 +1059,48 @@ static const struct usb_device_id option { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM500) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM510) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM800) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM900) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU818) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU816) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU828) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU826) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU518) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU516) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU528) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU526) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM600) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM610) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM500) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM510) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM800) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM900) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU718) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU716) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU728) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU726) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU518) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU516) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU528) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU526) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM600) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM610) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM500) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM510) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM800) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM900) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU718) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU716) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU728) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU726) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU518) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
PATCH 19/244 USB option driver K3765/K4505 avoid CDC_DATA interface
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Bird <[email protected]>
commit 6118514e8749105334f46ccec6faf9a439be6cf9 upstream.
Currently the Option driver avoids binding interface 1 on Huawei K3765 and K4505 broadband modems as it should be handled by the cdc_ether driver instead. This patch ensures we don't bind the interface 2 on those devices as that is CDC_DATA.
--- drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +2 -1
@@ -1235,7 +1235,8 @@ static int option_probe(struct usb_seria (serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K3765 || serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4505 || serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4605 ) && - serial->interface->cur_altsetting->desc.bInterfaceNumber == 1) + (serial->interface->cur_altsetting->desc.bInterfaceNumber ==1 || + serial->interface->cur_altsetting->desc.bInterfaceNumber == 2)) return -ENODEV;/* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */
PATCH 20/244 usb: musb: cppi: fix build errors due to DBG and missing musb variable
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Per Forlin <[email protected]>
commit f847a79ab3c1faca3022061045cd22e4678c1b1c upstream.
Replace DBG with dev_dbg and fix invalid access of musb->controller. With this patch cppi_dma builds successfully.
--- drivers/usb/musb/cppi_dma.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-)
drivers/usb/musb/cppi_dma.c +17 -9
@@ -226,8 +226,10 @@ static int cppi_controller_stop(struct dstruct cppi *controller;void __iomem *tibase;int i; +struct musb *musb; controller = container_of(c, struct cppi, controller); + musb = controller->musb; tibase = controller->tibase;/* DISABLE INDIVIDUAL CHANNEL Interrupts */
@@ -289,9 +291,11 @@ cppi_channel_allocate(struct dma_controlu8 index;struct cppi_channel *cppi_ch;void __iomem *tibase; +struct musb *musb; controller = container_of(c, struct cppi, controller); tibase = controller->tibase; + musb = controller->musb;/* ep0 doesn't use DMA; remember cppi indices are 0..N-1 */ index = ep->epnum -1 ;
@@ -339,7 +343,8 @@ static void cppi_channel_release(struct c = container_of(channel, struct cppi_channel, channel); tibase = c->controller->tibase;if (!c->hw_ep) -dev_dbg (musb->controller,"releasing idle DMA channel %p\n" , c); +dev_dbg (c->controller->musb->controller, +"releasing idle DMA channel %p\n" , c);else if (!c->transmit)core_rxirq_enable (tibase, c->index +1 );
@@ -357,10 +362,11 @@ cppi_dump_rx(int level, struct cppi_chanmusb_ep_select (base, c->index +1 ); - DBG(level, "RX DMA%d%s: %d left, csr %04x, " - "%08x H%08x S%08x C%08x, " - "B%08x L%08x %08x .. %08x" - "\n", + dev_dbg(c->controller->musb->controller, + "RX DMA%d%s: %d left, csr %04x, " + "%08x H%08x S%08x C%08x, " + "B%08x L%08x %08x .. %08x" + "\n", c->index, tag, musb_readl(c->controller->tibase, DAVINCI_RXCPPI_BUFCNT0_REG + 4 * c->index),
@@ -387,10 +393,11 @@ cppi_dump_tx(int level, struct cppi_chanmusb_ep_select (base, c->index +1 ); - DBG(level, "TX DMA%d%s: csr %04x, " - "H%08x S%08x C%08x %08x, " - "F%08x L%08x .. %08x" - "\n", + dev_dbg(c->controller->musb->controller, + "TX DMA%d%s: csr %04x, " + "H%08x S%08x C%08x %08x, " + "F%08x L%08x .. %08x" + "\n", c->index, tag, musb_readw(c->hw_ep->regs, MUSB_TXCSR),
@@ -1022,6 +1029,7 @@ static bool cppi_rx_scan(struct cppi *cpint i;dma_addr_t safe2ack;void __iomem *regs = rx->hw_ep->regs; +struct musb *musb = cppi->musb;cppi_dump_rx (6 , rx,"/K" );
PATCH 21/244 USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in ehci_bus_resume().
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Wang Zhi <[email protected]>
commit d0f2fb2500b1c5fe4967eb45d8c9bc758d7aef80 upstream.
Quoted 1 line
From EHCI Spec p.28 HC should clear
PORT_SUSPENDwhen SW clears
PORT_RESUME. In Intel Oaktrail platform, MPH (Multi-Port Host Controller) core clears PORT_SUSPEND directly when SW sets PORT_RESUME bit. If we rely on PORT_SUSPEND bit to stop USB resume, we will miss the action of clearing PORT_RESUME. This will cause unexpected long resume signal on USB bus.
--- drivers/usb/host/ehci-hub.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/usb/host/ehci-hub.c +3 -4
@@ -343,7 +343,7 @@ static int ehci_bus_resume (struct usb_hu32 temp;u32 power_okay;int i; -u8 resume_needed =0 ; +unsigned long resume_needed =0 ;if (time_before (jiffies, ehci->next_statechange))msleep (5 );
@@ -416,7 +416,7 @@ static int ehci_bus_resume (struct usb_hif (test_bit (i, &ehci->bus_suspended) && (temp &PORT_SUSPEND )) { temp |=PORT_RESUME ; - resume_needed =1 ; +set_bit (i, &resume_needed); }ehci_writel (ehci, temp, &ehci->regs->port_status [i]); }
@@ -431,8 +431,7 @@ static int ehci_bus_resume (struct usb_h i =HCS_N_PORTS (ehci->hcs_params);while (i--) { temp =ehci_readl (ehci, &ehci->regs->port_status [i]); -if (test_bit (i, &ehci->bus_suspended) && - (temp &PORT_SUSPEND )) { +if (test_bit (i, &resume_needed)) { temp &= ~(PORT_RWC_BITS |PORT_RESUME );ehci_writel (ehci, temp, &ehci->regs->port_status [i]);ehci_vdbg (ehci,"resumed port %d\n" , i +1 );
PATCH 22/244 xHCI: fix port U3 status check condition
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andiry Xu <[email protected]>
commit 5ac04bf190e6f8b17238aef179ebd7f2bdfec919 upstream.
Fix the port U3 status check when Clear PORT_SUSPEND Feature. The port status should be masked with PORT_PLS_MASK to check if it's in U3 state.
This should be backported to kernels as old as 2.6.37.
--- drivers/usb/host/xhci-hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +1 -1
@@ -664,7 +664,7 @@ int xhci_hub_control(struct usb_hcd *hcdxhci_dbg (xhci,"PORTSC %04x\n" , temp);if (temp &PORT_RESET ) goto error; -if (temp &XDEV_U3 ) { +if ((temp &PORT_PLS_MASK ) ==XDEV_U3 ) {if ((temp &PORT_PE ) ==0 ) goto error;
PATCH 23/244 xHCI: report USB2 port in resuming as suspend
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andiry Xu <[email protected]>
commit 8a8ff2f9399b23b968901f585ccb5a70a537c5ae upstream.
When a USB2 port initiate a remote wakeup, software shall ensure that resume is signaled for at least 20ms, and then write '0' to the PLS field. According to this, xhci driver do the following things:
1. When receive a remote wakeup event in irq_handler, set the resume_done value as jiffies + 20ms, and modify rh_timer to poll root hub status at that time;
2. When receive a GetPortStatus request, if the jiffies is after the resume_done value, clear the resume signal and resume_done.
However, if usb_port_resume() is called before the rh_timer triggered, it will indicate the port as Suspend Cleared and skip the clear resume signal part. The device will fail the usb_get_status request in finish_port_resume(), and usbcore will try a reset-resume instead. Device will work OK after reset-resume, but resume_done value is not cleared in this case, and xhci_bus_suspend() will fail because when it finds a non-zero resume_done value, it will regard the port as resuming and return -EBUSY.
This causes issue on some platforms that the system fail to suspend after remote wakeup from suspend by USB2 devices connected to xHCI port.
To fix this issue, report the port status as suspend if the resume is signaling less that 20ms, and usb_port_resume() will wait 25ms and check port status again, so xHCI driver can clear the resume signaling and resume_done value.
This should be backported to kernels as old as 2.6.37.
--- drivers/usb/host/xhci-hub.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +12 -3
@@ -463,11 +463,12 @@ int xhci_hub_control(struct usb_hcd *hcd && (temp & PORT_POWER)) status |=USB_PORT_STAT_SUSPEND ; } -if ((temp &PORT_PLS_MASK ) ==XDEV_RESUME ) { +if ((temp &PORT_PLS_MASK ) ==XDEV_RESUME && + !DEV_SUPERSPEED (temp)) {if ((temp &PORT_RESET ) || !(temp &PORT_PE )) goto error; -if (!DEV_SUPERSPEED (temp) &&time_after_eq (jiffies, - bus_state->resume_done[wIndex])) { +if (time_after_eq (jiffies, + bus_state->resume_done[wIndex])) {xhci_dbg (xhci,"Resume USB2 port %d\n" , wIndex +1 ); bus_state->resume_done[wIndex] =0 ;
@@ -487,6 +488,14 @@ int xhci_hub_control(struct usb_hcd *hcdxhci_ring_device (xhci, slot_id); bus_state->port_c_suspend |=1 << wIndex; bus_state->suspended_ports &= ~(1 << wIndex); + }else { +/* +* The resume has been signaling for less than +* 20ms. Report the port status as SUSPEND, +* let the usbcore check port status again +* and clear resume signaling later. +*/ + status |=USB_PORT_STAT_SUSPEND ; } } if ((temp & PORT_PLS_MASK) == XDEV_U0
PATCH 24/244 xhci: Fix memory leak during failed enqueue.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit d13565c12828ce0cd2a3862bf6260164a0653352 upstream.
When the isochronous transfer support was introduced, and the xHCI driver switched to using urb->hcpriv to store an "urb_priv" pointer, a couple of memory leaks were introduced into the URB enqueue function in its error handling paths.
xhci_urb_enqueue allocates urb_priv, but it doesn't free it if changing the control endpoint's max packet size fails or the bulk endpoint is in the middle of allocating or deallocating streams.
xhci_urb_enqueue also doesn't free urb_priv if any of the four endpoint types' enqueue functions fail. Instead, it expects those functions to free urb_priv if an error occurs. However, the bulk, control, and interrupt enqueue functions do not free urb_priv if the endpoint ring is NULL. It will, however, get freed if prepare_transfer() fails in those enqueue functions.
Several of the error paths in the isochronous endpoint enqueue function also fail to free it. xhci_queue_isoc_tx_prepare() doesn't free urb_priv if prepare_ring() indicates there is not enough room for all the isochronous TDs in this URB. If individual isochronous TDs fail to be queued (perhaps due to an endpoint state change), urb_priv is also leaked.
This argues that the freeing of urb_priv should be done in the function that allocated it, xhci_urb_enqueue.
This patch looks rather ugly, but refactoring the code will have to wait because this patch needs to be backported to stable kernels.
This patch should be backported to kernels as old as 2.6.36.
--- drivers/usb/host/xhci-ring.c | 5 +---- drivers/usb/host/xhci.c | 21 +++++++++++++++++---- 2 files changed, 18 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-ring.c +1 -4
@@ -2508,11 +2508,8 @@ static int prepare_transfer(struct xhci_if (td_index ==0 ) { ret =usb_hcd_link_urb_to_ep (bus_to_hcd (urb->dev->bus), urb); -if (unlikely (ret)) { -xhci_urb_free_priv (xhci, urb_priv); - urb->hcpriv =NULL ; +if (unlikely (ret))return ret; - } } td->urb = urb;
drivers/usb/host/xhci.c +17 -4
@@ -1085,8 +1085,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcdif (urb->dev->speed ==USB_SPEED_FULL ) { ret =xhci_check_maxpacket (xhci, slot_id, ep_index, urb); -if (ret <0 ) +if (ret <0 ) { +xhci_urb_free_priv (xhci, urb_priv); + urb->hcpriv =NULL ;return ret; + } }/* We have a spinlock and interrupts disabled, so we must pass
@@ -1097,6 +1100,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd goto dying; ret =xhci_queue_ctrl_tx (xhci,GFP_ATOMIC , urb, slot_id, ep_index); +if (ret) + goto free_priv;spin_unlock_irqrestore (&xhci->lock, flags); }else if (usb_endpoint_xfer_bulk (&urb->ep->desc)) {spin_lock_irqsave (&xhci->lock, flags);
@@ -1117,6 +1122,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd ret =xhci_queue_bulk_tx (xhci,GFP_ATOMIC , urb, slot_id, ep_index); } +if (ret) + goto free_priv;spin_unlock_irqrestore (&xhci->lock, flags); }else if (usb_endpoint_xfer_int (&urb->ep->desc)) {spin_lock_irqsave (&xhci->lock, flags);
@@ -1124,6 +1131,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd goto dying; ret =xhci_queue_intr_tx (xhci,GFP_ATOMIC , urb, slot_id, ep_index); +if (ret) + goto free_priv;spin_unlock_irqrestore (&xhci->lock, flags); }else {spin_lock_irqsave (&xhci->lock, flags);
@@ -1131,18 +1140,22 @@ int xhci_urb_enqueue(struct usb_hcd *hcd goto dying; ret =xhci_queue_isoc_tx_prepare (xhci,GFP_ATOMIC , urb, slot_id, ep_index); +if (ret) + goto free_priv;spin_unlock_irqrestore (&xhci->lock, flags); } exit:return ret; dying: -xhci_urb_free_priv (xhci, urb_priv); - urb->hcpriv =NULL ;xhci_dbg (xhci,"Ep 0x%x: URB %p submitted for " "non-responsive xHCI host.\n" , urb->ep->desc.bEndpointAddress, urb); + ret = -ESHUTDOWN ; +free_priv: +xhci_urb_free_priv (xhci, urb_priv); + urb->hcpriv =NULL ;spin_unlock_irqrestore (&xhci->lock, flags); -return -ESHUTDOWN ; +return ret; }/* Get the right ring for the given URB.
PATCH 25/244 xhci: Fix failed enqueue in the middle of isoch TD.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit 522989a27c7badb608155b1f1dea3487ed431f74 upstream.
When an isochronous transfer is enqueued, xhci_queue_isoc_tx_prepare() will ensure that there is enough room on the transfer rings for all of the isochronous TDs for that URB. However, when xhci_queue_isoc_tx() is enqueueing individual isoc TDs, the prepare_transfer() function can fail if the endpoint state has changed to disabled, error, or some other unknown state.
With the current code, if Nth TD (not the first TD) fails, the ring is left in a sorry state. The partially enqueued TDs are left on the ring, and the first TRB of the TD is not given back to the hardware. The enqueue pointer is left on the TRB after the last successfully enqueued TD. This means the ring is basically useless. Any new transfers will be enqueued after the failed TDs, which the hardware will never read because the cycle bit indicates it does not own them. The ring will fill up with untransferred TDs, and the endpoint will be basically unusable.
The untransferred TDs will also remain on the TD list. Since the td_list is a FIFO, this basically means the ring handler will be waiting on TDs that will never be completed (or worse, dereference memory that doesn't exist any more).
Change the code to clean up the isochronous ring after a failed transfer. If the first TD failed, simply return and allow the xhci_urb_enqueue function to free the urb_priv. If the Nth TD failed, first remove the TDs from the td_list. Then convert the TRBs that were enqueued into No-op TRBs. Make sure to flip the cycle bit on all enqueued TRBs (including any link TRBs in the middle or between TDs), but leave the cycle bit of the first TRB (which will show software-owned) intact. Then move the ring enqueue pointer back to the first TRB and make sure to change the xhci_ring's cycle state to what is appropriate for that ring segment.
This ensures that the No-op TRBs will be overwritten by subsequent TDs, and the hardware will not start executing random TRBs because the cycle bit was left as hardware-owned.
This bug is unlikely to be hit, but it was something I noticed while tracking down the watchdog timer issue. I verified that the fix works by injecting some errors on the 250th isochronous URB queued, although I could not verify that the ring is in the correct state because uvcvideo refused to talk to the device after the first usb_submit_urb() failed. Ring debugging shows that the ring looks correct, however.
This patch should be backported to kernels as old as 2.6.36.
--- drivers/usb/host/xhci-ring.c | 50 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 44 insertions(+), 6 deletions(-)
drivers/usb/host/xhci-ring.c +44 -6
@@ -516,8 +516,12 @@ void xhci_find_new_dequeue_state(struct (unsigned long long) addr); } +/* flip_cycle means flip the cycle bit of all but the first and last TRB. +* (The last TRB actually points to the ring enqueue pointer, which is not part +* of this TD.) This is used to remove partially enqueued isoc TDs from a ring. +*/ static void td_to_noop (struct xhci_hcd *xhci,struct xhci_ring *ep_ring, -struct xhci_td *cur_td) +struct xhci_td *cur_td,bool flip_cycle) {struct xhci_segment *cur_seg;union xhci_trb *cur_trb;
@@ -531,6 +535,12 @@ static void td_to_noop(struct xhci_hcd ** leave the pointers intact. */ cur_trb->generic.field[3 ] &=cpu_to_le32 (~TRB_CHAIN ); +/* Flip the cycle bit (link TRBs can't be the first +* or last TRB). +*/ +if (flip_cycle) + cur_trb->generic.field[3 ] ^= +cpu_to_le32 (TRB_CYCLE );xhci_dbg (xhci,"Cancel (unchain) link TRB\n" ); xhci_dbg(xhci, "Address = %p (0x%llx dma); " "in seg %p (0x%llx dma)\n",
@@ -544,6 +554,11 @@ static void td_to_noop(struct xhci_hcd * cur_trb->generic.field[2 ] =0 ;/* Preserve only the cycle bit of this TRB */ cur_trb->generic.field[3 ] &=cpu_to_le32 (TRB_CYCLE ); +/* Flip the cycle bit except on the first or last TRB */ +if (flip_cycle && cur_trb != cur_td->first_trb && + cur_trb != cur_td->last_trb) + cur_trb->generic.field[3 ] ^= +cpu_to_le32 (TRB_CYCLE ); cur_trb->generic.field[3 ] |=cpu_to_le32 (TRB_TYPE (TRB_TR_NOOP )); xhci_dbg(xhci, "Cancel TRB %p (0x%llx dma) "
@@ -722,7 +737,7 @@ static void handle_stopped_endpoint(stru cur_td->urb->stream_id, cur_td, &deq_state); else -td_to_noop (xhci ,ep_ring ,cur_td ); +td_to_noop (xhci ,ep_ring ,cur_td ,false ); remove_finished_td:/* * The event handler won't see a completion for this TD anymore,
@@ -3231,6 +3246,7 @@ static int xhci_queue_isoc_tx(struct xhc start_trb = &ep_ring->enqueue->generic; start_cycle = ep_ring->cycle_state; + urb_priv = urb->hcpriv;/* Queue the first TRB, even if it's zero-length */ for (i =0 ; i < num_tds; i++) {unsigned int total_packet_count;
@@ -3254,12 +3270,13 @@ static int xhci_queue_isoc_tx(struct xhc ret =prepare_transfer (xhci, xhci->devs[slot_id], ep_index, urb->stream_id, trbs_per_td, urb, i, mem_flags); -if (ret <0 ) -return ret; +if (ret <0 ) { +if (i ==0 ) +return ret; + goto cleanup; + } - urb_priv = urb->hcpriv; td = urb_priv->td[i]; -for (j =0 ; j < trbs_per_td; j++) {u32 remainder =0 ; field =TRB_TBC (burst_count) |TRB_TLBPC (residue);
@@ -3349,6 +3366,27 @@ static int xhci_queue_isoc_tx(struct xhcgiveback_first_trb (xhci, slot_id, ep_index, urb->stream_id, start_cycle, start_trb);return 0 ; +cleanup: +/* Clean up a partially enqueued isoc transfer. */ + +for (i--; i >=0 ; i--) +list_del (&urb_priv->td[i]->td_list); + +/* Use the first TD as a temporary variable to turn the TDs we've queued +* into No-ops with a software-owned cycle bit. That way the hardware +* won't accidentally start executing bogus TDs when we partially +* overwrite them. td->first_trb and td->start_seg are already set. +*/ + urb_priv->td[0 ]->last_trb = ep_ring->enqueue; +/* Every TRB except the first & last will have its cycle bit flipped. */ +td_to_noop (xhci, ep_ring, urb_priv->td[0 ], true); + +/* Reset the ring enqueue back to the first TRB and its cycle bit. */ + ep_ring->enqueue = urb_priv->td[0 ]->first_trb; + ep_ring->enq_seg = urb_priv->td[0 ]->start_seg; + ep_ring->cycle_state = start_cycle; +usb_hcd_unlink_urb_from_ep (bus_to_hcd (urb->dev->bus), urb); +return ret; }/*
PATCH 26/244 xhci: Remove TDs from TD lists when URBs are canceled.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit 585df1d90cb07a02ca6c7a7d339e56e46d50dafb upstream.
When a driver tries to cancel an URB, and the host controller is dying, xhci_urb_dequeue will giveback the URB without removing the xhci_tds that comprise that URB from the td_list or the cancelled_td_list. This can cause a race condition between the driver calling URB dequeue and the stop endpoint command watchdog timer.
If the timer fires on a dying host, and a driver attempts to resubmit while the watchdog timer has dropped the xhci->lock to giveback a cancelled URB, URBs may be given back by the xhci_urb_dequeue() function. At that point, the URB's priv pointer will be freed and set to NULL, but the TDs will remain on the td_list. This will cause an oops in xhci_giveback_urb_in_irq() when the watchdog timer attempts to loop through the endpoints' td_lists, giving back killed URBs.
Make sure that xhci_urb_dequeue() removes TDs from the TD lists and canceled TD lists before it gives back the URB.
This patch should be backported to kernels as old as 2.6.36.
--- drivers/usb/host/xhci-ring.c | 16 ++++++++-------- drivers/usb/host/xhci.c | 7 +++++++ 2 files changed, 15 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-ring.c +8 -8
@@ -744,7 +744,7 @@ remove_finished_td:* so remove it from the endpoint ring's TD list. Keep it in * the cancelled TD list for URB completion later. */ -list_del (&cur_td->td_list); +list_del_init (&cur_td->td_list); } last_unlinked_td = cur_td;xhci_stop_watchdog_timer_in_irq (xhci, ep);
@@ -772,7 +772,7 @@ remove_finished_td: do { cur_td = list_entry(ep->cancelled_td_list.next, struct xhci_td, cancelled_td_list); - list_del(&cur_td->cancelled_td_list); + list_del_init(&cur_td->cancelled_td_list); /* Clean up the cancelled URB */ /* Doesn't matter what we pass for status, since the core will
@@ -880,9 +880,9 @@ void xhci_stop_endpoint_command_watchdog cur_td =list_first_entry (&ring->td_list, struct xhci_td, td_list); -list_del (&cur_td->td_list); +list_del_init (&cur_td->td_list);if (!list_empty (&cur_td->cancelled_td_list)) -list_del (&cur_td->cancelled_td_list); +list_del_init (&cur_td->cancelled_td_list);xhci_giveback_urb_in_irq (xhci, cur_td, -ESHUTDOWN ,"killed" ); }
@@ -891,7 +891,7 @@ void xhci_stop_endpoint_command_watchdog &temp_ep->cancelled_td_list, struct xhci_td, cancelled_td_list); -list_del (&cur_td->cancelled_td_list); +list_del_init (&cur_td->cancelled_td_list);xhci_giveback_urb_in_irq (xhci, cur_td, -ESHUTDOWN ,"killed" ); }
@@ -1582,10 +1582,10 @@ td_cleanup:else *status =0 ; } -list_del (&td->td_list); +list_del_init (&td->td_list);/* Was this TD slated to be cancelled but completed anyway? */ if (!list_empty (&td->cancelled_td_list)) -list_del (&td->cancelled_td_list); +list_del_init (&td->cancelled_td_list); urb_priv->td_cnt++;/* Giveback the urb when all the tds are completed */
@@ -3370,7 +3370,7 @@ cleanup:/* Clean up a partially enqueued isoc transfer. */ for (i--; i >=0 ; i--) -list_del (&urb_priv->td[i]->td_list); +list_del_init (&urb_priv->td[i]->td_list);/* Use the first TD as a temporary variable to turn the TDs we've queued * into No-ops with a software-owned cycle bit. That way the hardware
drivers/usb/host/xhci.c +7 -0
@@ -1252,6 +1252,13 @@ int xhci_urb_dequeue(struct usb_hcd *hcdif (temp ==0xffffffff || (xhci->xhc_state &XHCI_STATE_HALTED )) {xhci_dbg (xhci,"HW died, freeing TD.\n" ); urb_priv = urb->hcpriv; +for (i = urb_priv->td_cnt; i < urb_priv->length; i++) { + td = urb_priv->td[i]; +if (!list_empty (&td->td_list)) +list_del_init (&td->td_list); +if (!list_empty (&td->cancelled_td_list)) +list_del_init (&td->cancelled_td_list); + }usb_hcd_unlink_urb_from_ep (hcd, urb);spin_unlock_irqrestore (&xhci->lock, flags);
PATCH 27/244 xhci: Handle zero-length isochronous packets.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit 48df4a6fd8c40c0bbcbca2044f5f2bc75dcf6db1 upstream.
For a long time, the xHCI driver has had this note:
/* FIXME: Ignoring zero-length packets, can those happen? */
It turns out that, yes, there are drivers that need to queue zero-length transfers for isochronous OUT transfers. Without this patch, users will see kernel hang messages when a driver attempts to enqueue an isochronous URB with a zero length transfer (because count_isoc_trbs_needed will return zero for that TD, xhci_td->last_trb will never be set, and updating the dequeue pointer will cause an infinite loop).
Matěj ran into this issue when using an NI Audio4DJ USB soundcard with the snd-usb-caiaq driver. See
https://bugzilla.kernel.org/show_bug.cgi?id=40702
Fix count_isoc_trbs_needed() to return 1 for zero-length transfers (thanks Alan on the math help). Update the various TRB field calculations to deal with zero-length transfers. We're still transferring one packet with a zero-length data payload, so the total_packet_count should be 1. The Transfer Burst Count (TBC) and Transfer Last Burst Packet Count (TLBPC) fields should be set to zero.
This patch should be backported to kernels as old as 2.6.36.
--- drivers/usb/host/xhci-ring.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/usb/host/xhci-ring.c +11 -10
@@ -2692,6 +2692,10 @@ static u32 xhci_v1_0_td_remainder(int ru {int packets_transferred; +/* One TRB with a zero-length data packet. */ +if (running_total ==0 && trb_buff_len ==0 ) +return 0 ; +/* All the TRB queueing functions don't count the current TRB in * running_total. */
@@ -3133,20 +3137,15 @@ static int count_isoc_trbs_needed(struct struct urb *urb, int i) { int num_trbs = 0; -u64 addr, td_len, running_total; +u64 addr, td_len; addr = (u64) (urb->transfer_dma + urb->iso_frame_desc[i].offset); td_len = urb->iso_frame_desc[i].length; - running_total =TRB_MAX_BUFF_SIZE - (addr & (TRB_MAX_BUFF_SIZE -1 )); - running_total &=TRB_MAX_BUFF_SIZE -1 ; -if (running_total !=0 ) - num_trbs++; - -while (running_total < td_len) { + num_trbs =DIV_ROUND_UP (td_len + (addr & (TRB_MAX_BUFF_SIZE -1 )), +TRB_MAX_BUFF_SIZE ); +if (num_trbs ==0 ) num_trbs++; - running_total +=TRB_MAX_BUFF_SIZE ; - }return num_trbs; }
@@ -3258,9 +3257,11 @@ static int xhci_queue_isoc_tx(struct xhc addr = start_addr + urb->iso_frame_desc[i].offset; td_len = urb->iso_frame_desc[i].length; td_remain_len = td_len; -/* FIXME: Ignoring zero-length packets, can those happen? */ total_packet_count =roundup (td_len,le16_to_cpu (urb->ep->desc.wMaxPacketSize)); +/* A zero-length transfer still involves at least one packet. */ +if (total_packet_count ==0 ) + total_packet_count++; burst_count =xhci_get_burst_count (xhci, urb->dev, urb, total_packet_count); residue = xhci_get_last_burst_packet_count(xhci,
PATCH 28/244 sendmmsg/sendmsg: fix unsafe user pointer access
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mathieu Desnoyers <[email protected]>
commit bc909d9ddbf7778371e36a651d6e4194b1cc7d4c upstream.
Dereferencing a user pointer directly from kernel-space without going through the copy_from_user family of functions is a bad idea. Two of such usages can be found in the sendmsg code path called from sendmmsg, added by
commit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a upstream. commit 5b47b8038f183b44d2d8ff1c7d11a5c1be706b34 in the 3.0-stable tree.
Usages are performed through memcmp() and memcpy() directly. Fix those by using the already copied msg_sys structure instead of the __user *msg structure. Note that msg_sys can be set to NULL by verify_compat_iovec() or verify_iovec(), which requires additional NULL pointer checks.
--- net/socket.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/socket.c +6 -4
@@ -1965,8 +1965,9 @@ static int __sys_sendmsg(struct socket ** used_address->name_len is initialized to UINT_MAX so that the first * destination address never matches. */ -if (used_address && used_address->name_len == msg_sys->msg_namelen && - !memcmp (&used_address->name, msg->msg_name, +if (used_address && msg_sys->msg_name && + used_address->name_len == msg_sys->msg_namelen && + !memcmp (&used_address->name, msg_sys->msg_name, used_address->name_len)) { err =sock_sendmsg_nosec (sock, msg_sys, total_len); goto out_freectl;
@@ -1978,8 +1979,9 @@ static int __sys_sendmsg(struct socket **/ if (used_address && err >=0 ) { used_address->name_len = msg_sys->msg_namelen; -memcpy (&used_address->name, msg->msg_name, - used_address->name_len); +if (msg_sys->msg_name) +memcpy (&used_address->name, msg_sys->msg_name, + used_address->name_len); } out_freectl:
PATCH 29/244 ath9k: Fix PS wrappers in ath9k_set_coverage_class
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit 8b2a3827bb12430d932cd479b22d906baf08c212 upstream.
this callback is called during suspend/resume and also via iw command. it configures parameters like sifs, slottime, acktimeout in ath9k_hw_init_global_settings where few REG_READ, REG_RMW are also done and hence the need for PS wrappers
--- drivers/net/wireless/ath/ath9k/main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +4 -0
@@ -2260,7 +2260,11 @@ static void ath9k_set_coverage_class(strmutex_lock (&sc->mutex); ah->coverage_class = coverage_class; + +ath9k_ps_wakeup (sc);ath9k_hw_init_global_settings (ah); +ath9k_ps_restore (sc); +mutex_unlock (&sc->mutex); }
PATCH 30/244 ibmveth: Fix leak when recycling skb and hypervisor returns error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Blanchard <[email protected]>
commit c6f59d13e24187ff95427a9f4a5a7e14fb8faf5a upstream.
If h_add_logical_lan_buffer returns an error we need to free the skb.
--- drivers/net/ibmveth.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/ibmveth.c +9 -3
@@ -394,7 +394,7 @@ static inline struct sk_buff *ibmveth_rx }/* recycle the current buffer on the rx queue */ -static void ibmveth_rxq_recycle_buffer (struct ibmveth_adapter *adapter) +static int ibmveth_rxq_recycle_buffer (struct ibmveth_adapter *adapter) {u32 q_index = adapter->rx_queue.index;u64 correlator = adapter->rx_queue.queue_addr[q_index].correlator;
@@ -402,6 +402,7 @@ static void ibmveth_rxq_recycle_buffer(sunsigned int index = correlator &0xffffffffUL ;union ibmveth_buf_desc desc;unsigned long lpar_rc; +int ret =1 ;BUG_ON (pool >=IBMVETH_NUM_BUFF_POOLS );BUG_ON (index >= adapter->rx_buff_pool[pool].size);
@@ -409,7 +410,7 @@ static void ibmveth_rxq_recycle_buffer(sif (!adapter->rx_buff_pool[pool].active) {ibmveth_rxq_harvest_buffer (adapter);ibmveth_free_buffer_pool (adapter, &adapter->rx_buff_pool[pool]); -return ; + goto out; } desc.fields.flags_len = IBMVETH_BUF_VALID |
@@ -422,12 +423,16 @@ static void ibmveth_rxq_recycle_buffer(snetdev_dbg (adapter->netdev,"h_add_logical_lan_buffer failed " "during recycle rc=%ld" , lpar_rc);ibmveth_remove_buffer_from_pool (adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator); + ret =0 ; }if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) { adapter->rx_queue.index =0 ; adapter->rx_queue.toggle = !adapter->rx_queue.toggle; } + +out: +return ret; }static void ibmveth_rxq_harvest_buffer (struct ibmveth_adapter *adapter)
@@ -1083,8 +1088,9 @@ restart_poll:if (rx_flush)ibmveth_flush_buffer (skb->data, length + offset); +if (!ibmveth_rxq_recycle_buffer (adapter)) +kfree_skb (skb); skb = new_skb; -ibmveth_rxq_recycle_buffer (adapter); }else {ibmveth_rxq_harvest_buffer (adapter);skb_reserve (skb, offset);
PATCH 31/244 carl9170: Fix mismatch in carl9170_op_set_key mutex lock-unlock
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alexey Khoroshilov <[email protected]>
commit 66cb54bd24086b2d871a03035de9b0e79b2b725e upstream.
If is_main_vif(ar, vif) reports that we have to fall back to software encryption, we goto err_softw; before locking ar->mutex. As a result, we have unprotected call to carl9170_set_operating_mode and unmatched mutex_unlock.
The patch fix the issue by adding mutex_lock before goto.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/wireless/ath/carl9170/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/carl9170/main.c +3 -1
@@ -1066,8 +1066,10 @@ static int carl9170_op_set_key(struct ie* the high througput speed in 802.11n networks. */ -if (!is_main_vif (ar, vif)) +if (!is_main_vif (ar, vif)) { +mutex_lock (&ar->mutex); goto err_softw; + }/* * While the hardware supports *catch-all* key, for offloading
PATCH 32/244 ath9k_hw: Fix STA (AR9485) bringup issue due to incorrect MAC address
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Senthil Balasubramanian <[email protected]>
commit b503c7a273c0a3018ad11ea8c513c639120afbf4 upstream.
Due to some recent optimization done in the way the mac address bytes are written into the OTP memory, some AR9485 chipsets were forced to use the first byte from the eeprom template and the remaining bytes are read from OTP.
AR9485 happens to use generic eeprom template which has 0x1 as the first byte causes issues in bringing up the card.
So fixed the eeprom template accordingly to address the issue.
--- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +1 -1
@@ -68,7 +68,7 @@ static int ar9003_hw_power_interpolate(istatic const struct ar9300_eeprom ar9300_default = { .eepromVersion =2 , .templateVersion =2 , - .macAddr = {1 ,2 ,3 ,4 ,5 ,6 }, + .macAddr = {0 ,2 ,3 ,4 ,5 ,6 }, .custData = {0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 }, .baseEepHeader = {
PATCH 33/244 rt2x00: do not drop usb dev reference counter on suspend
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 543cc38c8fe86deba4169977c61eb88491036837 upstream.
When hibernating ->resume may not be called by usb core, but disconnect and probe instead, so we do not increase the counter after decreasing it in ->supend. As a result we free memory early, and get crash when unplugging usb dongle.
BUG: unable to handle kernel paging request at 6b6b6b9f IP: [<c06909b0>] driver_sysfs_remove+0x10/0x30
*pdpt = 0000000034f21001 *pde = 0000000000000000
Pid: 20, comm: khubd Not tainted 3.1.0-rc1-wl+ #20 LENOVO 6369CTO/6369CTO
EIP: 0060:[<c06909b0>] EFLAGS: 00010202 CPU: 1
EIP is at driver_sysfs_remove+0x10/0x30
EAX: 6b6b6b6b EBX: f52bba34 ECX: 00000000 EDX: 6b6b6b6b
ESI: 6b6b6b6b EDI: c0a0ea20 EBP: f61c9e68 ESP: f61c9e64
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process khubd (pid: 20, ti=f61c8000 task=f6138270 task.ti=f61c8000)
Call Trace: [<c06909ef>] __device_release_driver+0x1f/0xa0 [<c0690b20>] device_release_driver+0x20/0x40 [<c068fd64>] bus_remove_device+0x84/0xe0 [<c068e12a>] ? device_remove_attrs+0x2a/0x80 [<c068e267>] device_del+0xe7/0x170 [<c06d93d4>] usb_disconnect+0xd4/0x180 [<c06d9d61>] hub_thread+0x691/0x1600 [<c0473260>] ? wake_up_bit+0x30/0x30 [<c0442a39>] ? complete+0x49/0x60 [<c06d96d0>] ? hub_disconnect+0xd0/0xd0 [<c06d96d0>] ? hub_disconnect+0xd0/0xd0 [<c0472eb4>] kthread+0x74/0x80 [<c0472e40>] ? kthread_worker_fn+0x150/0x150 [<c0809b3e>] kernel_thread_helper+0x6/0x10
--- drivers/net/wireless/rt2x00/rt2x00usb.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-)
drivers/net/wireless/rt2x00/rt2x00usb.c +1 -13
@@ -870,18 +870,8 @@ int rt2x00usb_suspend(struct usb_interfa {struct ieee80211_hw *hw =usb_get_intfdata (usb_intf);struct rt2x00_dev *rt2x00dev = hw->priv; -int retval; - retval =rt2x00lib_suspend (rt2x00dev, state); -if (retval) -return retval; - -/* -* Decrease usbdev refcount. -*/ -usb_put_dev (interface_to_usbdev (usb_intf)); - -return 0 ; +return rt2x00lib_suspend (rt2x00dev, state); }EXPORT_SYMBOL_GPL (rt2x00usb_suspend);
@@ -890,8 +880,6 @@ int rt2x00usb_resume(struct usb_interfacstruct ieee80211_hw *hw =usb_get_intfdata (usb_intf);struct rt2x00_dev *rt2x00dev = hw->priv; -usb_get_dev (interface_to_usbdev (usb_intf)); -return rt2x00lib_resume (rt2x00dev); }EXPORT_SYMBOL_GPL (rt2x00usb_resume);
PATCH 34/244 savagedb: Fix typo causing regression in savage4 series video chip detection
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: John Stanley <[email protected]>
commit 4b00e4b3940eabb38adeec0823751820fe2d6fda upstream.
Two additional savage4 variants were added, but the S3_SAVAGE4_SERIES macro was incompletely modified, resulting in a false positive detection of a savage4 card regardless of which savage card is actually present.
For non-savage4 series cards, such as a Savage/IX-MV card, this results in garbled video and/or a hard-hang at boot time. Fix this by changing an '||' to an '&&' in the S3_SAVAGE4_SERIES macro.
--- drivers/video/savage/savagefb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/savage/savagefb.h +1 -1
@@ -55,7 +55,7 @@#define S3_SAVAGE3D_SERIES (chip) ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX)) -#define S3_SAVAGE4_SERIES (chip) ((chip>=S3_SAVAGE4) || (chip<=S3_PROSAVAGEDDR)) +#define S3_SAVAGE4_SERIES (chip) ((chip>=S3_SAVAGE4) && (chip<=S3_PROSAVAGEDDR))#define S3_SAVAGE_MOBILE_SERIES (chip) ((chip==S3_SAVAGE_MX) || (chip==S3_SUPERSAVAGE))
PATCH 35/244 pata_via: disable ATAPI DMA on AVERATEC 3200
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit 6d0e194d2eefcaab6dbdca1f639748660144acb5 upstream.
On AVERATEC 3200, pata_via causes memory corruption with ATAPI DMA, which often leads to random kernel oops. The cause of the problem is not well understood yet and only small subset of machines using the controller seem affected. Blacklist ATAPI DMA on the machine.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=11426
--- drivers/ata/pata_via.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/ata/pata_via.c +18 -0
@@ -124,6 +124,17 @@ static const struct via_isa_bridge { { NULL } }; +static const struct dmi_system_id no_atapi_dma_dmi_table[] = { + { + .ident ="AVERATEC 3200" , + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AVERATEC" ), +DMI_MATCH (DMI_BOARD_NAME ,"3200" ), + }, + }, + { } +}; +struct via_port {u8 cached_device; };
@@ -355,6 +366,13 @@ static unsigned long via_mode_filter(str mask &= ~ATA_MASK_UDMA ; } } + +if (dev->class ==ATA_DEV_ATAPI && +dmi_check_system (no_atapi_dma_dmi_table)) { +ata_dev_printk (dev,KERN_WARNING ,"controller locks up on ATAPI DMA, forcing PIO\n" ); + mask &=ATA_MASK_PIO ; + } +return mask; }
PATCH 36/244 atm: br2684: Fix oops due to skb->dev being NULL
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel Schwierzeck <[email protected]>
commit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream.
This oops have been already fixed with commit
27141666b69f535a4d63d7bc6d9e84ee5032f82a
atm: [br2684] Fix oops due to skb->dev being NULL
It happens that if a packet arrives in a VC between the call to open it on the hardware and the call to change the backend to br2684, br2684_regvcc processes the packet and oopses dereferencing skb->dev because it is NULL before the call to br2684_push().
but have been introduced again with commit
b6211ae7f2e56837c6a4849316396d1535606e90
atm: Use SKB queue and list helpers instead of doing it by-hand.
--- net/atm/br2684.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/atm/br2684.c +4 -3
@@ -558,12 +558,13 @@ static int br2684_regvcc(struct atm_vccspin_unlock_irqrestore (&rq->lock, flags); skb_queue_walk_safe(&queue, skb, tmp) { -struct net_device *dev = skb->dev; +struct net_device *dev; + +br2684_push (atmvcc, skb); + dev = skb->dev; dev->stats.rx_bytes -= skb->len; dev->stats.rx_packets--; - -br2684_push (atmvcc, skb); }/* initialize netdev carrier state */
PATCH 37/244 rt2x00: fix crash in rt2800usb_write_tx_desc
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 4b1bfb7d2d125af6653d6c2305356b2677f79dc6 upstream.
Patch should fix this oops:
BUG: unable to handle kernel NULL pointer dereference at 000000a0 IP: [<f8e06078>] rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb] *pdpt = 000000002408c001 *pde = 0000000024079067 *pte = 0000000000000000 Oops: 0000 [#1] SMP EIP: 0060:[<f8e06078>] EFLAGS: 00010282 CPU: 0 EIP is at rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb] EAX: 00000035 EBX: ef2bef10 ECX: 00000000 EDX: d40958a0 ESI: ef1865f8 EDI: ef1865f8 EBP: d4095878 ESP: d409585c DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 Call Trace: [<f8da5e85>] rt2x00queue_write_tx_frame+0x155/0x300 [rt2x00lib] [<f8da424c>] rt2x00mac_tx+0x7c/0x370 [rt2x00lib] [<c04882b2>] ? mark_held_locks+0x62/0x90 [<c081f645>] ? _raw_spin_unlock_irqrestore+0x35/0x60 [<c04884ba>] ? trace_hardirqs_on_caller+0x5a/0x170 [<c04885db>] ? trace_hardirqs_on+0xb/0x10 [<f8d618ac>] __ieee80211_tx+0x5c/0x1e0 [mac80211] [<f8d631fc>] ieee80211_tx+0xbc/0xe0 [mac80211] [<f8d63163>] ? ieee80211_tx+0x23/0xe0 [mac80211] [<f8d632e1>] ieee80211_xmit+0xc1/0x200 [mac80211] [<f8d63220>] ? ieee80211_tx+0xe0/0xe0 [mac80211] [<c0487d45>] ? lock_release_holdtime+0x35/0x1b0 [<f8d63986>] ? ieee80211_subif_start_xmit+0x446/0x5f0 [mac80211] [<f8d637dd>] ieee80211_subif_start_xmit+0x29d/0x5f0 [mac80211] [<f8d63924>] ? ieee80211_subif_start_xmit+0x3e4/0x5f0 [mac80211] [<c0760188>] ? sock_setsockopt+0x6a8/0x6f0 [<c0760000>] ? sock_setsockopt+0x520/0x6f0 [<c076daef>] dev_hard_start_xmit+0x2ef/0x650
Oops might happen because we perform parallel putting new entries in a queue (rt2x00queue_write_tx_frame()) and removing entries after finishing transmitting (rt2800usb_work_txdone()). There are cases when _txdone may process an entry that was not fully send and nullify entry->skb .
To fix check in _txdone if entry has flags that indicate pending transmission and wait until flags get cleared.
--- drivers/net/wireless/rt2x00/rt2800lib.c | 10 ++++++++++ drivers/net/wireless/rt2x00/rt2800usb.c | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-)
drivers/net/wireless/rt2x00/rt2800lib.c +10 -0
@@ -38,6 +38,7 @@#include <linux/kernel.h> #include <linux/module.h> #include <linux/slab.h> +#include <linux/sched.h> #include "rt2x00.h" #include "rt2800lib.h"
@@ -607,6 +608,15 @@ static bool rt2800_txdone_entry_check(stint wcid, ack, pid;int tx_wcid, tx_ack, tx_pid; +if (test_bit (ENTRY_OWNER_DEVICE_DATA , &entry->flags) || + !test_bit (ENTRY_DATA_STATUS_PENDING , &entry->flags)) { +WARNING (entry->queue->rt2x00dev, +"Data pending for entry %u in queue %u\n" , + entry->entry_idx, entry->queue->qid); +cond_resched (); +return false; + } + wcid =rt2x00_get_field32 (reg,TX_STA_FIFO_WCID ); ack =rt2x00_get_field32 (reg,TX_STA_FIFO_TX_ACK_REQUIRED ); pid =rt2x00_get_field32 (reg,TX_STA_FIFO_PID_TYPE );
drivers/net/wireless/rt2x00/rt2800usb.c +3 -1
@@ -477,8 +477,10 @@ static void rt2800usb_work_txdone(structwhile (!rt2x00queue_empty (queue)) { entry =rt2x00queue_get_entry (queue,Q_INDEX_DONE ); -if (test_bit (ENTRY_OWNER_DEVICE_DATA , &entry->flags)) +if (test_bit (ENTRY_OWNER_DEVICE_DATA , &entry->flags) || + !test_bit (ENTRY_DATA_STATUS_PENDING , &entry->flags))break ; +if (test_bit (ENTRY_DATA_IO_FAILED , &entry->flags))rt2x00lib_txdone_noinfo (entry,TXDONE_FAILURE );else if (rt2x00queue_status_timeout (entry))
PATCH 38/244 rt2x00: fix crash in rt2800usb_get_txwi
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 674db1344443204b6ce3293f2df8fd1b7665deea upstream.
Patch should fix this oops:
BUG: unable to handle kernel NULL pointer dereference at 000000a0 IP: [<f81b30c9>] rt2800usb_get_txwi+0x19/0x70 [rt2800usb] *pdpt = 0000000000000000 *pde = f000ff53f000ff53 Oops: 0000 [#1] SMP
Pid: 198, comm: kworker/u:3 Tainted: G W 3.0.0-wl+ #9 LENOVO 6369CTO/6369CTO
EIP: 0060:[<f81b30c9>] EFLAGS: 00010283 CPU: 1
EIP is at rt2800usb_get_txwi+0x19/0x70 [rt2800usb]
EAX: 00000000 EBX: f465e140 ECX: f4494960 EDX: ef24c5f8
ESI: 810f21f5 EDI: f1da9960 EBP: f4581e80 ESP: f4581e70
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process kworker/u:3 (pid: 198, ti=f4580000 task=f4494960 task.ti=f4580000)
Call Trace: [<f804790f>] rt2800_txdone_entry+0x2f/0xf0 [rt2800lib] [<c045110d>] ? warn_slowpath_common+0x7d/0xa0 [<f81b3a38>] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb] [<f81b3a38>] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb] [<f81b3a13>] rt2800usb_work_txdone+0x263/0x360 [rt2800usb] [<c046a8d6>] process_one_work+0x186/0x440 [<c046a85a>] ? process_one_work+0x10a/0x440 [<f81b37b0>] ? rt2800usb_probe_hw+0x120/0x120 [rt2800usb] [<c046c283>] worker_thread+0x133/0x310 [<c04885db>] ? trace_hardirqs_on+0xb/0x10 [<c046c150>] ? manage_workers+0x1e0/0x1e0 [<c047054c>] kthread+0x7c/0x90 [<c04704d0>] ? __init_kthread_worker+0x60/0x60 [<c0826b42>] kernel_thread_helper+0x6/0x1
Oops might happen because we check rt2x00queue_empty(queue) twice, but this condition can change and we can process entry in rt2800_txdone_entry(), which was already processed by rt2800usb_txdone_entry_check() -> rt2x00lib_txdone_noinfo() and has nullify entry->skb .
--- drivers/net/wireless/rt2x00/rt2800lib.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/rt2x00/rt2800lib.c +3 -4
@@ -764,12 +764,11 @@ void rt2800_txdone(struct rt2x00_dev *rt entry =rt2x00queue_get_entry (queue,Q_INDEX_DONE );if (rt2800_txdone_entry_check (entry, reg))break ; + entry =NULL ; } -if (!entry ||rt2x00queue_empty (queue)) -break ; - -rt2800_txdone_entry (entry, reg); +if (entry) +rt2800_txdone_entry (entry, reg); } }EXPORT_SYMBOL_GPL (rt2800_txdone);
PATCH 39/244 sparc64: remove unnecessary macros from spinlock_64.h
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mikael Pettersson <[email protected]>
commit a0fba3eb059e73fed2d376a901f8117734c12f1f upstream.
The sparc64 spinlock_64.h contains a number of operations defined first as static inline functions, and then as macros with the same names and parameters as the functions. Maybe this was needed at some point in the past, but now nothing seems to depend on these macros (checked with a recursive grep looking for ifdefs on these names). Other archs don't define these identity-macros.
So this patch deletes these unnecessary macros.
Compile-tested with sparc64_defconfig.
--- arch/sparc/include/asm/spinlock_64.h | 6 ------ 1 file changed, 6 deletions(-)
arch/sparc/include/asm/spinlock_64.h +0 -6
@@ -210,14 +210,8 @@ static int inline arch_write_trylock(arcreturn result; } -#define arch_read_lock (p) arch_read_lock(p)#define arch_read_lock_flags (p, f) arch_read_lock(p) -#define arch_read_trylock (p) arch_read_trylock(p) -#define arch_read_unlock (p) arch_read_unlock(p) -#define arch_write_lock (p) arch_write_lock(p)#define arch_write_lock_flags (p, f) arch_write_lock(p) -#define arch_write_unlock (p) arch_write_unlock(p) -#define arch_write_trylock (p) arch_write_trylock(p)#define arch_read_can_lock (rw) (!((rw)->lock & 0x80000000UL))#define arch_write_can_lock (rw) (!(rw)->lock)
PATCH 40/244 sparc32: unbreak arch_write_unlock()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mikael Pettersson <[email protected]>
commit 3f6aa0b113846a8628baa649af422cfc6fb1d786 upstream.
The sparc32 version of arch_write_unlock() is just a plain assignment. Unfortunately this allows the compiler to schedule side-effects in a protected region to occur after the HW-level unlock, which is broken. E.g., the following trivial test case gets miscompiled:
#include <linux/spinlock.h>
rwlock_t lock;
int counter;
void foo(void) { write_lock(&lock); ++counter; write_unlock(&lock); }Fixed by adding a compiler memory barrier to arch_write_unlock(). The sparc64 version combines the barrier and assignment into a single asm(), and implements the operation as a static inline, so that's what I did too.
Compile-tested with sparc32_defconfig + CONFIG_SMP=y.
--- arch/sparc/include/asm/spinlock_32.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/sparc/include/asm/spinlock_32.h +9 -2
@@ -131,6 +131,15 @@ static inline void arch_write_lock(arch_ *(volatile __u32 *)&lp->lock = ~0U ; } +static void inline arch_write_unlock (arch_rwlock_t *lock) +{ + __asm__ __volatile__( +" st %%g0, [%0]" + :/* no outputs */ + :"r" (lock) + :"memory" ); +} +static inline int arch_write_trylock (arch_rwlock_t *rw) {unsigned int val;
@@ -175,8 +184,6 @@ static inline int __arch_read_trylock(ar res; \ }) -#define arch_write_unlock (rw) do { (rw)->lock = 0; } while(0) -#define arch_spin_lock_flags (lock, flags) arch_spin_lock(lock)#define arch_read_lock_flags (rw, flags) arch_read_lock(rw)#define arch_write_lock_flags (rw, flags) arch_write_lock(rw)
PATCH 41/244 sparc: Allow handling signals when stack is corrupted.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "David S. Miller" <[email protected]>
commit 5598473a5b40c47a8c5349dd2c2630797169cf1a upstream.
If we can't push the pending register windows onto the user's stack, we disallow signal delivery even if the signal would be delivered on a valid seperate signal stack.
Add a register window save area in the signal frame, and store any unsavable windows there.
On sigreturn, if any windows are still queued up in the signal frame, try to push them back onto the stack and if that fails we kill the process immediately.
This allows the debug/tst-longjmp_chk2 glibc test case to pass.
--- arch/sparc/include/asm/sigcontext.h | 14 ++ arch/sparc/kernel/Makefile | 1 arch/sparc/kernel/signal32.c | 184 ++++++++++++++++++++---------------- arch/sparc/kernel/signal_32.c | 172 +++++++++++++++------------------ arch/sparc/kernel/signal_64.c | 108 +++++++++------------ arch/sparc/kernel/sigutil.h | 9 + arch/sparc/kernel/sigutil_32.c | 120 +++++++++++++++++++++++ arch/sparc/kernel/sigutil_64.c | 93 ++++++++++++++++++ 8 files changed, 468 insertions(+), 233 deletions(-)
arch/sparc/include/asm/sigcontext.h +14 -0
@@ -45,6 +45,19 @@ typedef struct {int si_mask; } __siginfo32_t; +#define __SIGC_MAXWIN 7 + +typedef struct { +unsigned long locals[8 ]; +unsigned long ins[8 ]; +}__siginfo_reg_window ; + +typedef struct { +int wsaved; +__siginfo_reg_window reg_window[__SIGC_MAXWIN]; +unsigned long rwbuf_stkptrs[__SIGC_MAXWIN]; +}__siginfo_rwin_t ; + #ifdef CONFIG_SPARC64 typedef struct { unsigned int si_float_regs [64];
@@ -73,6 +86,7 @@ struct sigcontext { unsigned long ss_size; } sigc_stack;unsigned long sigc_mask; +__siginfo_rwin_t * sigc_rwin_save; };#else
arch/sparc/kernel/Makefile +1 -0
@@ -32,6 +32,7 @@ obj-$(CONFIG_SPARC32) += sun4m_irq.o s obj-y += process_$(BITS).o obj-y += signal_$(BITS).o +obj-y += sigutil_$(BITS).o obj-$(CONFIG_SPARC32) += ioport.o obj-y += setup_$(BITS).o obj-y += idprom.o
arch/sparc/kernel/signal32.c +105 -79
328 lines not on this page · raw message
arch/sparc/kernel/signal_32.c +79 -93
291 lines not on this page · raw message
arch/sparc/kernel/signal_64.c +47 -61
185 lines not on this page · raw message
arch/sparc/kernel/sigutil.h new file +9 -0
@@ -0,0 +1,9 @@ +#ifndef _SIGUTIL_H +#define _SIGUTIL_H + +int save_fpu_state (struct pt_regs *regs,__siginfo_fpu_t __user *fpu); +int restore_fpu_state (struct pt_regs *regs,__siginfo_fpu_t __user *fpu); +int save_rwin_state (int wsaved,__siginfo_rwin_t __user *rwin); +int restore_rwin_state (__siginfo_rwin_t __user *rp); + +#endif /* _SIGUTIL_H */
arch/sparc/kernel/sigutil_32.c new file +120 -0
120 lines not on this page · raw message
arch/sparc/kernel/sigutil_64.c new file +93 -0
93 lines not on this page · raw message
PATCH 42/244 sparc64: Set HAVE_C_RECORDMCOUNT
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit 178a29600340bef5b13cd4157053679debe35351 ]
--- arch/sparc/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/sparc/Kconfig +1 -0
@@ -53,6 +53,7 @@ config SPARC64 select HAVE_PERF_EVENTS select PERF_USE_VMALLOC select IRQ_PREFLOW_FASTEOI + select HAVE_C_RECORDMCOUNT config ARCH_DEFCONFIG string
PATCH 43/244 sparc: fix array bounds error setting up PCIC NMI trap
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ian Campbell <[email protected]>
commit 4a0342ca8e8150bd47e7118a76e300692a1b6b7b upstream.
CC arch/sparc/kernel/pcic.oarch/sparc/kernel/pcic.c: In function 'pcic_probe':arch/sparc/kernel/pcic.c:359:33: error: array subscript is above array bounds [-Werror=array-bounds] arch/sparc/kernel/pcic.c:359:8: error: array subscript is above array bounds [-Werror=array-bounds] arch/sparc/kernel/pcic.c:360:33: error: array subscript is above array bounds [-Werror=array-bounds] arch/sparc/kernel/pcic.c:360:8: error: array subscript is above array bounds [-Werror=array-bounds] arch/sparc/kernel/pcic.c:361:33: error: array subscript is above array bounds [-Werror=array-bounds] arch/sparc/kernel/pcic.c:361:8: error: array subscript is above array bounds [-Werror=array-bounds]
cc1: all warnings being treated as errors
I'm not particularly familiar with sparc but t_nmi (defined in head_32.S via the TRAP_ENTRY macro) and pcic_nmi_trap_patch (defined in entry.S) both appear to be 4 instructions long and I presume from the usage that instructions are int sized.
--- arch/sparc/kernel/pcic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/sparc/kernel/pcic.c +2 -2
@@ -352,8 +352,8 @@ int __init pcic_probe(void)strcpy (pbm->prom_name, namebuf); { -extern volatile int t_nmi[1 ]; -extern int pcic_nmi_trap_patch[1 ]; +extern volatile int t_nmi[4 ]; +extern int pcic_nmi_trap_patch[4 ]; t_nmi[0 ] = pcic_nmi_trap_patch[0 ]; t_nmi[1 ] = pcic_nmi_trap_patch[1 ];
PATCH 44/244 sparc32,sun4d: Change IPI IRQ level to prevent collision between IPI and timer interrupt
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kjetil Oftedal <[email protected]>
commit 38f7f8f05e8239e9871f7e1c4b0a842080e85315 upstream.
On Sun4d systems running in SMP mode, IRQ 14 is used for timer interrupts and has a specialized interrupt handler. IPI is currently set to use IRQ 14 as well, which causes it to trigger the timer interrupt handler, and not the IPI interrupt handler.
The IPI interrupt is therefore changed to IRQ 13, which is the highest normally handled interrupt. This IRQ is also used for SBUS interrupts, however there is nothing in the IPI/SBUS interrupt handlers that indicate that they will not handle sharing the interrupt.
(IRQ 13 is indicated as audio interrupt, which is unlikely to be found in a sun4d system)
--- arch/sparc/kernel/irq.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/kernel/irq.h +1 -1
@@ -88,7 +88,7 @@ BTFIXUPDEF_CALL(void, set_irq_udt, int)#define set_irq_udt (cpu) BTFIXUP_CALL(set_irq_udt)(cpu)/* All SUN4D IPIs are sent on this IRQ, may be shared with hard IRQs */ -#define SUN4D_IPI_IRQ 14 +#define SUN4D_IPI_IRQ 13extern void sun4d_ipi_interrupt (void );
PATCH 45/244 regulator: tps65910: Add missing breaks in switch/case
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Axel Lin <[email protected]>
commit d04156bca629740a661fd0738cd69ba1f08b2b20 upstream.
Also add a default case in tps65910_list_voltage_dcdc to silence 'volt' may be used uninitialized in this function warning.
--- drivers/regulator/tps65910-regulator.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/regulator/tps65910-regulator.c +7 -0
@@ -759,8 +759,13 @@ static int tps65910_list_voltage_dcdc(st mult = (selector /VDD1_2_NUM_VOLTS ) +1 ; volt =VDD1_2_MIN_VOLT + (selector %VDD1_2_NUM_VOLTS ) *VDD1_2_OFFSET ; +break ;case TPS65911_REG_VDDCTRL : volt =VDDCTRL_MIN_VOLT + (selector *VDDCTRL_OFFSET ); +break ; +default : +BUG (); +return -EINVAL ; }return volt *100 * mult;
@@ -898,9 +903,11 @@ static __devinit int tps65910_probe(strucase TPS65910 : pmic->get_ctrl_reg = &tps65910_get_ctrl_register; info = tps65910_regs; +break ;case TPS65911 : pmic->get_ctrl_reg = &tps65911_get_ctrl_register; info = tps65911_regs; +break ;default :pr_err ("Invalid tps chip version\n" );return -ENODEV ;
PATCH 46/244 sparc64: Only Panther cheetah+ chips have POPC.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "David S. Miller" <[email protected]>
commit 1a8e0da5937a6c87807083baa318cf8f98dac9aa upstream.
--- arch/sparc/kernel/setup_64.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/sparc/kernel/setup_64.c +8 -2
@@ -440,8 +440,14 @@ static void __init init_sparc64_elf_hwca cap |=AV_SPARC_VIS ;if (tlb_type == cheetah || tlb_type == cheetah_plus) cap |=AV_SPARC_VIS |AV_SPARC_VIS2 ; -if (tlb_type == cheetah_plus) - cap |=AV_SPARC_POPC ; +if (tlb_type == cheetah_plus) { +unsigned long impl, ver; + + __asm__ __volatile__("rdpr %%ver, %0" :"=r" (ver)); + impl = ((ver >>32 ) &0xffff ); +if (impl ==PANTHER_IMPL ) + cap |=AV_SPARC_POPC ; + }if (tlb_type == hypervisor) {if (sun4v_chip_type ==SUN4V_CHIP_NIAGARA1 ) cap |=AV_SPARC_ASI_BLK_INIT ;
PATCH 47/244 drm/radeon/kms: add s/r quirk for Compaq Presario V5245EU
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 302a8e8b06d312dcb3b718dfeb42aa912b5f426b upstream.
Fixes resume on Compaq Presario V5245EU.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=41642
--- drivers/gpu/drm/radeon/radeon_combios.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/radeon/radeon_combios.c +8 -0
@@ -3279,6 +3279,14 @@ void radeon_combios_asic_init(struct drm rdev->pdev->subsystem_device == 0x30a4)return ; +/* quirk for rs4xx Compaq Presario V5245EU laptop to make it resume +* - it hangs on resume inside the dynclk 1 table. +*/ +if (rdev->family ==CHIP_RS480 && + rdev->pdev->subsystem_vendor ==0x103c && + rdev->pdev->subsystem_device ==0x30ae ) +return ; +/* DYN CLK 1 */ table =combios_get_table_offset (dev,COMBIOS_DYN_CLK_1_TABLE );if (table)
PATCH 48/244 drm/radeon/kms: evergreen & ni reset SPI block on CP resume
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jerome Glisse <[email protected]>
commit a49a50dad48586d42ebac1a6730c3a3cd5603421 upstream.
For some reason SPI block is in broken state after module unloading. This lead to broken rendering after reloading module. Fix this by reseting SPI block in CP resume function
--- drivers/gpu/drm/radeon/evergreen.c | 1 + drivers/gpu/drm/radeon/ni.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/radeon/evergreen.c +1 -0
@@ -1357,6 +1357,7 @@ int evergreen_cp_resume(struct radeon_deSOFT_RESET_PA |SOFT_RESET_SH |SOFT_RESET_VGT | +SOFT_RESET_SPI | SOFT_RESET_SX));RREG32 (GRBM_SOFT_RESET );mdelay (15 );
drivers/gpu/drm/radeon/ni.c +1 -0
@@ -1158,6 +1158,7 @@ int cayman_cp_resume(struct radeon_devicSOFT_RESET_PA |SOFT_RESET_SH |SOFT_RESET_VGT | +SOFT_RESET_SPI | SOFT_RESET_SX));RREG32 (GRBM_SOFT_RESET );mdelay (15 );
PATCH 49/244 ARM: 7014/1: cache-l2x0: Fix L2 Cache size calculation.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 43c734be5571a4daad9f0a3e0b3229a1c0049917 upstream.
This patch fixes L2 Cache size calculations for L2C-210, L2C-310 and PL310, by changing the L2X0_AUX_CTRL_WAY_SIZE_MASK from 2 bits to 3 bits.
The Auxiliary Control Register for L2C-210, L2C-310 and PL310 has 3bits [19:17] for Way size, however the existing code only uses 2 bits to get this value. This results in incorrect cachesize calculations.
It also results in performing operations on the whole cache when we erroneously decide that the range is big enough (due to l2x0_size being too small) and also prints incorrect cachesize.
--- arch/arm/include/asm/hardware/cache-l2x0.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/include/asm/hardware/cache-l2x0.h +1 -1
@@ -64,7 +64,7 @@#define L2X0_AUX_CTRL_MASK 0xc0000fff#define L2X0_AUX_CTRL_ASSOCIATIVITY_SHIFT 16#define L2X0_AUX_CTRL_WAY_SIZE_SHIFT 17 -#define L2X0_AUX_CTRL_WAY_SIZE_MASK (0x3 << 17) +#define L2X0_AUX_CTRL_WAY_SIZE_MASK (0x7 << 17)#define L2X0_AUX_CTRL_SHARE_OVERRIDE_SHIFT 22#define L2X0_AUX_CTRL_NS_LOCKDOWN_SHIFT 26#define L2X0_AUX_CTRL_NS_INT_CTRL_SHIFT 27
PATCH 50/244 md/linear: avoid corrupting structure while waiting for rcu_free to complete.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit 1b6afa17581027218088a18a9ceda600e0ddba7a upstream.
I don't know what I was thinking putting 'rcu' after a dynamically sized array! The array could still be in use when we call rcu_free() (That is the point) so we mustn't corrupt it.
--- drivers/md/linear.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/linear.h +1 -1
@@ -10,9 +10,9 @@ typedef struct dev_info dev_info_t;struct linear_private_data { +struct rcu_head rcu;sector_t array_sectors;dev_info_t disks[0 ]; -struct rcu_head rcu; };
PATCH 51/244 drm/radeon/kms: set a default max_pixel_clock
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dave Airlie <[email protected]>
commit 9adceaa5b3d2480e2252c4a7f9c4bd7d66b8c4a2 upstream.
On some Power rv100 cards, we have no ATY OF table, but we have no combios table either, and hence we refuse all modes on VGA-0 since we end up with a 0 max pixel clock.
--- drivers/gpu/drm/radeon/radeon_clocks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/radeon/radeon_clocks.c +3 -0
@@ -219,6 +219,9 @@ void radeon_get_clock_info(struct drm_de }else {DRM_INFO ("Using generic clock info\n" ); +/* may need to be per card */ + rdev->clock.max_pixel_clock =35000 ; +if (rdev->flags &RADEON_IS_IGP ) { p1pll->reference_freq =1432 ; p2pll->reference_freq =1432 ;
PATCH 52/244 drm/radeon/kms: make sure pci max read request size is valid on evergreen+ (v2)
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit d054ac16eeb658bccadb06b12c39cee22243b10f upstream.
If the bios or OS sets the pci max read request size to 0 or an invalid value (6,7), it can result in a hang or slowdown. Check and set it to something sane if it's invalid.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=42162
v2: use pci reg defines from include/linux/pci_regs.h
--- drivers/gpu/drm/radeon/evergreen.c | 27 +++++++++++++++++++++++++++ drivers/gpu/drm/radeon/ni.c | 3 +++ 2 files changed, 30 insertions(+)
drivers/gpu/drm/radeon/evergreen.c +27 -0
@@ -41,6 +41,31 @@ static void evergreen_gpu_init(struct ravoid evergreen_fini (struct radeon_device *rdev);static void evergreen_pcie_gen2_enable (struct radeon_device *rdev); +void evergreen_fix_pci_max_read_req_size (struct radeon_device *rdev) +{ +u16 ctl, v; +int cap, err; + + cap =pci_pcie_cap (rdev->pdev); +if (!cap) +return ; + + err =pci_read_config_word (rdev->pdev, cap +PCI_EXP_DEVCTL , &ctl); +if (err) +return ; + + v = (ctl &PCI_EXP_DEVCTL_READRQ ) >>12 ; + +/* if bios or OS sets MAX_READ_REQUEST_SIZE to an invalid value, fix it +* to avoid hangs or perfomance issues +*/ +if ((v ==0 ) || (v ==6 ) || (v ==7 )) { + ctl &= ~PCI_EXP_DEVCTL_READRQ ; + ctl |= (2 <<12 ); +pci_write_config_word (rdev->pdev, cap +PCI_EXP_DEVCTL , ctl); + } +} +void evergreen_pre_page_flip (struct radeon_device *rdev,int crtc) {/* enable the pflip int */
@@ -1866,6 +1891,8 @@ static void evergreen_gpu_init(struct raWREG32 (GRBM_CNTL ,GRBM_READ_TIMEOUT (0xff )); +evergreen_fix_pci_max_read_req_size (rdev); + cc_gc_shader_pipe_config =RREG32 (CC_GC_SHADER_PIPE_CONFIG ) & ~2 ; cc_gc_shader_pipe_config |=
drivers/gpu/drm/radeon/ni.c +3 -0
@@ -39,6 +39,7 @@ extern int evergreen_mc_wait_for_idle(stextern void evergreen_mc_program (struct radeon_device *rdev);extern void evergreen_irq_suspend (struct radeon_device *rdev);extern int evergreen_mc_init (struct radeon_device *rdev); +extern void evergreen_fix_pci_max_read_req_size (struct radeon_device *rdev);#define EVERGREEN_PFP_UCODE_SIZE 1120#define EVERGREEN_PM4_UCODE_SIZE 1376
@@ -669,6 +670,8 @@ static void cayman_gpu_init(struct radeoWREG32 (GRBM_CNTL ,GRBM_READ_TIMEOUT (0xff )); +evergreen_fix_pci_max_read_req_size (rdev); + mc_shared_chmap =RREG32 (MC_SHARED_CHMAP ); mc_arb_ramcfg =RREG32 (MC_ARB_RAMCFG );
PATCH 53/244 mm: page allocator: initialise ZLC for first zone eligible for zone_reclaim
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mel Gorman <[email protected]>
commit cd38b115d5ad79b0100ac6daa103c4fe2c50a913 upstream.
There have been a small number of complaints about significant stalls while copying large amounts of data on NUMA machines reported on a distribution bugzilla. In these cases, zone_reclaim was enabled by default due to large NUMA distances. In general, the complaints have not been about the workload itself unless it was a file server (in which case the recommendation was disable zone_reclaim).
The stalls are mostly due to significant amounts of time spent scanning the preferred zone for pages to free. After a failure, it might fallback to another node (as zonelists are often node-ordered rather than zone-ordered) but stall quickly again when the next allocation attempt occurs. In bad cases, each page allocated results in a full scan of the preferred zone.
Patch 1 checks the preferred zone for recent allocation failure
which is particularly important if zone_reclaim has failed recently. This avoids rescanning the zone in the near future and instead falling back to another node. This may hurt node locality in some cases but a failure to zone_reclaim is more expensive than a remote access.
Patch 2 clears the zlc information after direct reclaim.
Otherwise, zone_reclaim can mark zones full, direct reclaim can reclaim enough pages but the zone is still not considered for allocation.
This was tested on a 24-thread 2-node x86_64 machine. The tests were focused on large amounts of IO. All tests were bound to the CPUs on node-0 to avoid disturbances due to processes being scheduled on different nodes. The kernels tested are
3.0-rc6-vanilla Vanilla 3.0-rc6
zlcfirst Patch 1 applied
zlcreconsider Patches 1+2 applied
FS-Mark
./fs_mark -d /tmp/fsmark-10813 -D 100 -N 5000 -n 208 -L 35 -t 24 -S0 -s 524288
fsmark-3.0-rc6 3.0-rc6 3.0-rc6
vanilla zlcfirs zlcreconsider
Files/s min 54.90 ( 0.00%) 49.80 (-10.24%) 49.10 (-11.81%) Files/s mean 100.11 ( 0.00%) 135.17 (25.94%) 146.93 (31.87%) Files/s stddev 57.51 ( 0.00%) 138.97 (58.62%) 158.69 (63.76%) Files/s max 361.10 ( 0.00%) 834.40 (56.72%) 802.40 (55.00%) Overhead min 76704.00 ( 0.00%) 76501.00 ( 0.27%) 77784.00 (-1.39%) Overhead mean 1485356.51 ( 0.00%) 1035797.83 (43.40%) 1594680.26 (-6.86%) Overhead stddev 1848122.53 ( 0.00%) 881489.88 (109.66%) 1772354.90 ( 4.27%) Overhead max 7989060.00 ( 0.00%) 3369118.00 (137.13%) 10135324.00 (-21.18%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds) 501.49 493.91 499.93
Total Elapsed Time (seconds) 2451.57 2257.48 2215.92
MMTests Statistics: vmstat
Page Ins 46268 63840 66008
Page Outs 90821596 90671128 88043732
Swap Ins 0 0 0 Swap Outs 0 0 0 Direct pages scanned 13091697 8966863 8971790 Kswapd pages scanned 0 1830011 1831116 Kswapd pages reclaimed 0 1829068 1829930 Direct pages reclaimed 13037777 8956828 8648314
Kswapd efficiency 100% 99% 99%
Kswapd velocity 0.000 810.643 826.346
Direct efficiency 99% 99% 96%
Direct velocity 5340.128 3972.068 4048.788
Percentage direct scans 100% 83% 83%
Page writes by reclaim 0 3 0
Slabs scanned 796672 720640 720256
Direct inode steals 7422667 7160012 7088638 Kswapd inode steals 0 1736840 2021238
Test completes far faster with a large increase in the number of files created per second. Standard deviation is high as a small number of iterations were much higher than the mean. The number of pages scanned by zone_reclaim is reduced and kswapd is used for more work.
LARGE DD
3.0-rc6 3.0-rc6 3.0-rc6
vanilla zlcfirst zlcreconsider
download tar 59 ( 0.00%) 59 ( 0.00%) 55 ( 7.27%)
dd source files 527 ( 0.00%) 296 (78.04%) 320 (64.69%)
delete source 36 ( 0.00%) 19 (89.47%) 20 (80.00%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds) 125.03 118.98 122.01 Total Elapsed Time (seconds) 624.56 375.02 398.06
MMTests Statistics: vmstat
Page Ins 3594216 439368 407032
Page Outs 23380832 23380488 23377444
Swap Ins 0 0 0
Swap Outs 0 436 287
Direct pages scanned 17482342 69315973 82864918
Kswapd pages scanned 0 519123 575425 Kswapd pages reclaimed 0 466501 522487
Direct pages reclaimed 5858054 2732949 2712547
Kswapd efficiency 100% 89% 90%
Kswapd velocity 0.000 1384.254 1445.574
Direct efficiency 33% 3% 3%
Direct velocity 27991.453 184832.737 208171.929
Percentage direct scans 100% 99% 99%
Page writes by reclaim 0 5082 13917
Slabs scanned 17280 29952 35328
Direct inode steals 115257 1431122 332201
Kswapd inode steals 0 0 979532
This test downloads a large tarfile and copies it with dd a number of times - similar to the most recent bug report I've dealt with. Time to completion is reduced. The number of pages scanned directly is still disturbingly high with a low efficiency but this is likely due to the number of dirty pages encountered. The figures could probably be improved with more work around how kswapd is used and how dirty pages are handled but that is separate work and this result is significant on its own.
Streaming Mapped Writer
MMTests Statistics: duration
User/Sys Time Running Test (seconds) 124.47 111.67 112.64
Total Elapsed Time (seconds) 2138.14 1816.30 1867.56
MMTests Statistics: vmstat
Page Ins 90760 89124 89516
Page Outs 121028340 120199524 120736696
Swap Ins 0 86 55
Swap Outs 0 0 0
Direct pages scanned 114989363 96461439 96330619 Kswapd pages scanned 56430948 56965763 57075875 Kswapd pages reclaimed 27743219 27752044 27766606
Direct pages reclaimed 49777 46884 36655
Kswapd efficiency 49% 48% 48%
Kswapd velocity 26392.541 31363.631 30561.736
Direct efficiency 0% 0% 0%
Direct velocity 53780.091 53108.759 51581.004
Percentage direct scans 67% 62% 62% Page writes by reclaim 385 122 1513
Slabs scanned 43008 39040 42112
Direct inode steals 0 10 8
Kswapd inode steals 733 534 477
This test just creates a large file mapping and writes to it linearly. Time to completion is again reduced.
The gains are mostly down to two things. In many cases, there is less scanning as zone_reclaim simply gives up faster due to recent failures. The second reason is that memory is used more efficiently. Instead of scanning the preferred zone every time, the allocator falls back to another zone and uses it instead improving overall memory utilisation.
This patch: initialise ZLC for first zone eligible for zone_reclaim.
The zonelist cache (ZLC) is used among other things to record if zone_reclaim() failed for a particular zone recently. The intention is to avoid a high cost scanning extremely long zonelists or scanning within the zone uselessly.
Currently the zonelist cache is setup only after the first zone has been considered and zone_reclaim() has been called. The objective was to avoid a costly setup but zone_reclaim is itself quite expensive. If it is failing regularly such as the first eligible zone having mostly mapped pages, the cost in scanning and allocation stalls is far higher than the ZLC initialisation step.
This patch initialises ZLC before the first eligible zone calls zone_reclaim(). Once initialised, it is checked whether the zone failed zone_reclaim recently. If it has, the zone is skipped. As the first zone is now being checked, additional care has to be taken about zones marked full. A zone can be marked "full" because it should not have enough unmapped pages for zone_reclaim but this is excessive as direct reclaim or kswapd may succeed where zone_reclaim fails. Only mark zones "full" after zone_reclaim fails if it failed to reclaim enough pages after scanning.
--- mm/page_alloc.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-)
mm/page_alloc.c +22 -13
@@ -1664,7 +1664,7 @@ zonelist_scan:continue ;if ((alloc_flags &ALLOC_CPUSET ) && !cpuset_zone_allowed_softwall (zone, gfp_mask)) - goto try_next_zone; +continue ;BUILD_BUG_ON (ALLOC_NO_WATERMARKS <NR_WMARK );if (!(alloc_flags &ALLOC_NO_WATERMARKS )) {
@@ -1676,17 +1676,36 @@ zonelist_scan: classzone_idx, alloc_flags)) goto try_this_zone; +if (NUMA_BUILD && !did_zlc_setup && nr_online_nodes >1 ) { +/* +* we do zlc_setup if there are multiple nodes +* and before considering the first zone allowed +* by the cpuset. +*/ + allowednodes =zlc_setup (zonelist, alloc_flags); + zlc_active =1 ; + did_zlc_setup =1 ; + } +if (zone_reclaim_mode ==0 ) goto this_zone_full; +/* +* As we may have just activated ZLC, check if the first +* eligible zone has failed zone_reclaim recently. +*/ +if (NUMA_BUILD && zlc_active && + !zlc_zone_worth_trying (zonelist, z, allowednodes)) +continue ; + ret =zone_reclaim (zone, gfp_mask, order); switch (ret) { case ZONE_RECLAIM_NOSCAN: /* did not scan */ - goto try_next_zone; + continue; case ZONE_RECLAIM_FULL: /* scanned but unreclaimable */ - goto this_zone_full; + continue; default: /* did we reclaim enough */ if (!zone_watermark_ok(zone, order, mark,
@@ -1703,16 +1722,6 @@ try_this_zone: this_zone_full:if (NUMA_BUILD )zlc_mark_zone_full (zonelist, z); -try_next_zone: -if (NUMA_BUILD && !did_zlc_setup && nr_online_nodes >1 ) { -/* -* we do zlc_setup after the first zone is tried but only -* if there are multiple nodes make it worthwhile -*/ - allowednodes =zlc_setup (zonelist, alloc_flags); - zlc_active =1 ; - did_zlc_setup =1 ; - } }if (unlikely (NUMA_BUILD && page ==NULL && zlc_active)) {
PATCH 54/244 mm: page allocator: reconsider zones for allocation after direct reclaim
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mel Gorman <[email protected]>
commit 76d3fbf8fbf6cc78ceb63549e0e0c5bc8a88f838 upstream.
With zone_reclaim_mode enabled, it's possible for zones to be considered full in the zonelist_cache so they are skipped in the future. If the process enters direct reclaim, the ZLC may still consider zones to be full even after reclaiming pages. Reconsider all zones for allocation if direct reclaim returns successfully.
--- mm/page_alloc.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
mm/page_alloc.c +23 -0
@@ -1616,6 +1616,21 @@ static void zlc_mark_zone_full(struct zo set_bit(i, zlc->fullzones); } +/* +* clear all zones full, called after direct reclaim makes progress so that +* a zone that was recently full is not skipped over for up to a second +*/ +static void zlc_clear_zones_full (struct zonelist *zonelist) +{ +struct zonelist_cache *zlc;/* cached zonelist speedup info */ + + zlc = zonelist->zlcache_ptr; +if (!zlc) +return ; + +bitmap_zero (zlc->fullzones,MAX_ZONES_PER_ZONELIST ); +} +#else /* CONFIG_NUMA */ static nodemask_t *zlc_setup (struct zonelist *zonelist,int alloc_flags)
@@ -1632,6 +1647,10 @@ static int zlc_zone_worth_trying(structstatic void zlc_mark_zone_full (struct zonelist *zonelist,struct zoneref *z) { } + +static void zlc_clear_zones_full (struct zonelist *zonelist) +{ +}#endif /* CONFIG_NUMA */ /*
@@ -1963,6 +1982,10 @@ __alloc_pages_direct_reclaim(gfp_t gfp_mif (unlikely (!(*did_some_progress)))return NULL ; +/* After successful reclaim, reconsider all zones for allocation */ +if (NUMA_BUILD ) +zlc_clear_zones_full (zonelist); + retry: page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, high_zoneidx,
PATCH 55/244 igb: fix WOL on second port of i350 device
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Carolyn Wyborny <[email protected]>
commit 6d337dce664b6872ddf1655f6b1fcab76ce35b08 upstream.
This patch fixes a problem where WOL would fail on second port of i350 device.
--- drivers/net/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/igb/igb_main.c +1 -1
@@ -1985,7 +1985,7 @@ static int __devinit igb_probe(struct pcif (hw->bus.func ==0 ) hw->nvm.ops.read (hw,NVM_INIT_CONTROL3_PORT_A ,1 , &eeprom_data); -else if (hw->mac.type == e1000_82580) +else if (hw->mac.type >= e1000_82580) hw->nvm.ops.read (hw,NVM_INIT_CONTROL3_PORT_A +NVM_82580_LAN_FUNC_OFFSET (hw->bus.func),1 , &eeprom_data);
PATCH 56/244 MXC: iomux-v3: correct NO_PAD_CTRL definition
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Troy Kisky <[email protected]>
commit 425933b30b0ccfac58065bca6c853ea627443cdf upstream.
iomux-v3.c uses NO_PAD_CTRL as a 32 bit value
so it should not be shifted left by MUX_PAD_CTRL_SHIFT(41)
Previously, anything requesting NO_PAD_CTRL would get their pad control register set to 0.
Since it is a pad control mask, place it with the other mask values.
--- arch/arm/plat-mxc/include/mach/iomux-v3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/plat-mxc/include/mach/iomux-v3.h +1 -1
@@ -66,7 +66,6 @@ typedef u64 iomux_v3_cfg_t;#define MUX_MODE_MASK ((iomux_v3_cfg_t)0x1f << MUX_MODE_SHIFT)#define MUX_PAD_CTRL_SHIFT 41#define MUX_PAD_CTRL_MASK ((iomux_v3_cfg_t)0x1ffff << MUX_PAD_CTRL_SHIFT) -#define NO_PAD_CTRL ((iomux_v3_cfg_t)1 << (MUX_PAD_CTRL_SHIFT + 16))#define MUX_SEL_INPUT_SHIFT 58#define MUX_SEL_INPUT_MASK ((iomux_v3_cfg_t)0xf << MUX_SEL_INPUT_SHIFT)
@@ -85,6 +84,7 @@ typedef u64 iomux_v3_cfg_t;* Use to set PAD control */ +#define NO_PAD_CTRL (1 << 16)#define PAD_CTL_DVS (1 << 13)#define PAD_CTL_HYS (1 << 8)
PATCH 57/244 alarmtimers: Avoid possible null pointer traversal
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: John Stultz <[email protected]>
commit 971c90bfa2f0b4fe52d6d9002178d547706f1343 upstream.
We don't check if old_setting is non null before assigning it, so correct this.
--- kernel/time/alarmtimer.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
kernel/time/alarmtimer.c +2 -5
@@ -479,11 +479,8 @@ static int alarm_timer_set(struct k_itimif (!rtcdev)return -ENOTSUPP ; -/* Save old values */ - old_setting->it_interval = -ktime_to_timespec (timr->it.alarmtimer.period); - old_setting->it_value = -ktime_to_timespec (timr->it.alarmtimer.node.expires); +if (old_setting) +alarm_timer_get (timr, old_setting);/* If the timer was already set, cancel it */ alarm_cancel (&timr->it.alarmtimer);
PATCH 58/244 alarmtimers: Memset itimerspec passed into alarm_timer_get
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: John Stultz <[email protected]>
commit ea7802f630d356acaf66b3c0b28c00a945fc35dc upstream.
Following common_timer_get, zero out the itimerspec passed in.
--- kernel/time/alarmtimer.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/time/alarmtimer.c +2 -0
@@ -441,6 +441,8 @@ static int alarm_timer_create(struct k_istatic void alarm_timer_get (struct k_itimer *timr,struct itimerspec *cur_setting) { +memset (cur_setting,0 ,sizeof (struct itimerspec )); + cur_setting->it_interval =ktime_to_timespec (timr->it.alarmtimer.period); cur_setting->it_value =
PATCH 59/244 alarmtimers: Avoid possible denial of service with high freq periodic timers
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: John Stultz <[email protected]>
commit 6af7e471e5a7746b8024d70b4363d3dfe41d36b8 upstream.
Its possible to jam up the alarm timers by setting very small interval timers, which will cause the alarmtimer subsystem to spend all of its time firing and restarting timers. This can effectivly lock up a box.
A deeper fix is needed, closely mimicking the hrtimer code, but for now just cap the interval to 100us to avoid userland hanging the system.
--- kernel/time/alarmtimer.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/time/alarmtimer.c +9 -0
@@ -481,6 +481,15 @@ static int alarm_timer_set(struct k_itimif (!rtcdev)return -ENOTSUPP ; +/* +* XXX HACK! Currently we can DOS a system if the interval +* period on alarmtimers is too small. Cap the interval here +* to 100us and solve this properly in a future patch! -jstultz +*/ +if ((new_setting->it_interval.tv_sec ==0 ) && + (new_setting->it_interval.tv_nsec <100000 )) + new_setting->it_interval.tv_nsec =100000 ; +if (old_setting)alarm_timer_get (timr, old_setting);
PATCH 60/244 rtc: Fix RTC PIE frequency limit
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: John Stultz <[email protected]>
commit 938f97bcf1bdd1b681d5d14d1d7117a2e22d4434 upstream.
Thomas earlier submitted a fix to limit the RTC PIE freq, but picked 5000Hz out of the air. Willy noticed that we should instead use the 8192Hz max from the rtc man documentation.
--- drivers/rtc/interface.c | 2 +- include/linux/rtc.h | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/rtc/interface.c +1 -1
@@ -708,7 +708,7 @@ int rtc_irq_set_freq(struct rtc_device *int err =0 ;unsigned long flags; -if (freq <=0 || freq >5000 ) +if (freq <=0 || freq >RTC_MAX_FREQ )return -EINVAL ; retry:spin_lock_irqsave (&rtc->irq_task_lock, flags);
include/linux/rtc.h +3 -0
@@ -97,6 +97,9 @@ struct rtc_pll_info {#define RTC_AF 0x20/* Alarm interrupt */ #define RTC_UF 0x10/* Update interrupt for 1Hz RTC */ + +#define RTC_MAX_FREQ 8192 +#ifdef __KERNEL__#include <linux/types.h>
PATCH 61/244 sched: Separate the scheduler entry for preemption
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Gleixner <[email protected]>
commit c259e01a1ec90063042f758e409cd26b2a0963c8 upstream.
Block-IO and workqueues call into notifier functions from the scheduler core code with interrupts and preemption disabled. These calls should be made before entering the scheduler core.
To simplify this, separate the scheduler core code into __schedule(). __schedule() is directly called from the places which set PREEMPT_ACTIVE and from schedule(). This allows us to add the work checks into schedule(), so they are only called when a task voluntary goes to sleep.
--- kernel/sched.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
kernel/sched.c +10 -5
@@ -4242,9 +4242,9 @@ pick_next_task(struct rq *rq) }/* -* schedule() is the main scheduler function. +* __schedule() is the main scheduler function. */ -asmlinkage void __sched schedule(void) +static void __sched __schedule(void) {struct task_struct *prev, *next;unsigned long *switch_count;
@@ -4332,6 +4332,11 @@ need_resched:if (need_resched ()) goto need_resched; } + +asmlinkage void schedule(void) +{ +__schedule (); +}EXPORT_SYMBOL (schedule);#ifdef CONFIG_MUTEX_SPIN_ON_OWNER
@@ -4405,7 +4410,7 @@ asmlinkage void __sched notrace preempt_ do { add_preempt_count_notrace(PREEMPT_ACTIVE); - schedule(); + __schedule(); sub_preempt_count_notrace(PREEMPT_ACTIVE); /*
@@ -4433,7 +4438,7 @@ asmlinkage void __sched preempt_schedule do { add_preempt_count(PREEMPT_ACTIVE); local_irq_enable(); - schedule(); + __schedule(); local_irq_disable(); sub_preempt_count(PREEMPT_ACTIVE);
@@ -5558,7 +5563,7 @@ static inline int should_resched(void)static void __cond_resched (void ) {add_preempt_count (PREEMPT_ACTIVE ); -schedule (); +__schedule ();sub_preempt_count (PREEMPT_ACTIVE ); }
PATCH 62/244 sched: Move blk_schedule_flush_plug() out of __schedule()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Gleixner <[email protected]>
commit 9c40cef2b799f9b5e7fa5de4d2ad3a0168ba118c upstream.
There is no real reason to run blk_schedule_flush_plug() with interrupts and preemption disabled.
Move it into schedule() and call it when the task is going voluntarily to sleep. There might be false positives when the task is woken between that call and actually scheduling, but that's not really different from being woken immediately after switching away.
This fixes a deadlock in the scheduler where the blk_schedule_flush_plug() callchain enables interrupts and thereby allows a wakeup to happen of the task that's going to sleep.
--- kernel/sched.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
kernel/sched.c +15 -10
@@ -4285,16 +4285,6 @@ need_resched:if (to_wakeup)try_to_wake_up_local (to_wakeup); } - -/* -* If we are going to sleep and we have plugged IO -* queued, make sure to submit it to avoid deadlocks. -*/ -if (blk_needs_flush_plug (prev)) { -raw_spin_unlock (&rq->lock); -blk_schedule_flush_plug (prev); -raw_spin_lock (&rq->lock); - } } switch_count = &prev->nvcsw; }
@@ -4333,8 +4323,23 @@ need_resched: goto need_resched; } +static inline void sched_submit_work (struct task_struct *tsk) +{ +if (!tsk->state) +return ; +/* +* If we are going to sleep and we have plugged IO queued, +* make sure to submit it to avoid deadlocks. +*/ +if (blk_needs_flush_plug (tsk)) +blk_schedule_flush_plug (tsk); +} + asmlinkage void schedule(void) { +struct task_struct *tsk = current; + +sched_submit_work (tsk);__schedule (); }EXPORT_SYMBOL (schedule);
PATCH 63/244 sched: Fix a memory leak in __sdt_free()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: WANG Cong <[email protected]>
commit feff8fa0075bdfd43c841e9d689ed81adda988d6 upstream.
This patch fixes the following memory leak:
unreferenced object 0xffff880107266800 (size 512):
comm "sched-powersave", pid 3718, jiffies 4323097853 (age 27495.450s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81133940>] create_object+0x187/0x28b
[<ffffffff814ac103>] kmemleak_alloc+0x73/0x98
[<ffffffff811232ba>] __kmalloc_node+0x104/0x159
[<ffffffff81044b98>] kzalloc_node.clone.97+0x15/0x17
[<ffffffff8104cb90>] build_sched_domains+0xb7/0x7f3
[<ffffffff8104d4df>] partition_sched_domains+0x1db/0x24a
[<ffffffff8109ee4a>] do_rebuild_sched_domains+0x3b/0x47
[<ffffffff810a00c7>] rebuild_sched_domains+0x10/0x12
[<ffffffff8104d5ba>] sched_power_savings_store+0x6c/0x7b
[<ffffffff8104d5df>] sched_mc_power_savings_store+0x16/0x18
[<ffffffff8131322c>] sysdev_class_store+0x20/0x22
[<ffffffff81193876>] sysfs_write_file+0x108/0x144
[<ffffffff81135b10>] vfs_write+0xaf/0x102
[<ffffffff81135d23>] sys_write+0x4d/0x74
[<ffffffff814c8a42>] system_call_fastpath+0x16/0x1b
[<ffffffffffffffff>] 0xffffffffffffffff--- kernel/sched.c | 1 + 1 file changed, 1 insertion(+)
kernel/sched.c +1 -0
@@ -7423,6 +7423,7 @@ static void __sdt_free(const struct cpumstruct sched_domain *sd = *per_cpu_ptr (sdd->sd, j);if (sd && (sd->flags &SD_OVERLAP ))free_sched_groups (sd->groups,0 ); +kfree (*per_cpu_ptr (sdd->sd, j));kfree (*per_cpu_ptr (sdd->sg, j));kfree (*per_cpu_ptr (sdd->sgp, j)); }
PATCH 64/244 x86, perf: Check that current->mm is alive before getting user callchain
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrey Vagin <[email protected]>
commit 20afc60f892d285fde179ead4b24e6a7938c2f1b upstream.
An event may occur when an mm is already released.
I added an event in dequeue_entity() and caught a panic with the following backtrace:
[ 434.421110] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 [ 434.421258] IP: [<ffffffff810464ac>] __get_user_pages_fast+0x9c/0x120 ... [ 434.421258] Call Trace: [ 434.421258] [<ffffffff8101ae81>] copy_from_user_nmi+0x51/0xf0 [ 434.421258] [<ffffffff8109a0d5>] ? sched_clock_local+0x25/0x90 [ 434.421258] [<ffffffff8101b048>] perf_callchain_user+0x128/0x170 [ 434.421258] [<ffffffff811154cd>] ? __perf_event_header__init_id+0xed/0x100 [ 434.421258] [<ffffffff81116690>] perf_prepare_sample+0x200/0x280 [ 434.421258] [<ffffffff81118da8>] __perf_event_overflow+0x1b8/0x290 [ 434.421258] [<ffffffff81065240>] ? tg_shares_up+0x0/0x670 [ 434.421258] [<ffffffff8104fe1a>] ? walk_tg_tree+0x6a/0xb0 [ 434.421258] [<ffffffff81118f44>] perf_swevent_overflow+0xc4/0xf0 [ 434.421258] [<ffffffff81119150>] do_perf_sw_event+0x1e0/0x250 [ 434.421258] [<ffffffff81119204>] perf_tp_event+0x44/0x70 [ 434.421258] [<ffffffff8105701f>] ftrace_profile_sched_block+0xdf/0x110 [ 434.421258] [<ffffffff8106121d>] dequeue_entity+0x2ad/0x2d0 [ 434.421258] [<ffffffff810614ec>] dequeue_task_fair+0x1c/0x60 [ 434.421258] [<ffffffff8105818a>] dequeue_task+0x9a/0xb0 [ 434.421258] [<ffffffff810581e2>] deactivate_task+0x42/0xe0 [ 434.421258] [<ffffffff814bc019>] thread_return+0x191/0x808 [ 434.421258] [<ffffffff81098a44>] ? switch_task_namespaces+0x24/0x60 [ 434.421258] [<ffffffff8106f4c4>] do_exit+0x464/0x910 [ 434.421258] [<ffffffff8106f9c8>] do_group_exit+0x58/0xd0 [ 434.421258] [<ffffffff8106fa57>] sys_exit_group+0x17/0x20 [ 434.421258] [<ffffffff8100b202>] system_call_fastpath+0x16/0x1b
--- arch/x86/kernel/cpu/perf_event.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/cpu/perf_event.c +3 -0
@@ -1856,6 +1856,9 @@ perf_callchain_user(struct perf_callchaiperf_callchain_store (entry, regs->ip); +if (!current->mm) +return ; +if (perf_callchain_user32 (regs, entry))return ;
PATCH 65/244 mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release}
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mika Westerberg <[email protected]>
commit 08c14071fda4e69abb9d5b1566651cd092b158d3 upstream.
As per suggestion by Linus Walleij:
Quoted 7 lines
If you think the names of the functions are confusing then you may rename them, say like this:
mmc_host_clk_ungate()->mmc_host_clk_hold()mmc_host_clk_gate()->mmc_host_clk_release()Which would make the usecases more clear
(This is CC'd to stable@ because the next two patches, which fix observable races, depend on it.)
--- drivers/mmc/core/core.c | 4 ++-- drivers/mmc/core/host.c | 10 +++++----- drivers/mmc/core/host.h | 8 ++++---- 3 files changed, 11 insertions(+), 11 deletions(-)
drivers/mmc/core/core.c +2 -2
@@ -132,7 +132,7 @@ void mmc_request_done(struct mmc_host *hif (mrq->done) mrq->done (mrq); -mmc_host_clk_gate (host); +mmc_host_clk_release (host); } }
@@ -191,7 +191,7 @@ mmc_start_request(struct mmc_host *host, mrq->stop->mrq = mrq; } } -mmc_host_clk_ungate (host); +mmc_host_clk_hold (host);led_trigger_event (host->led,LED_FULL ); host->ops->request (host, mrq); }
drivers/mmc/core/host.c +5 -5
@@ -119,14 +119,14 @@ static void mmc_host_clk_gate_work(struc }/** -* mmc_host_clk_ungate - ungate hardware MCI clocks +* mmc_host_clk_hold - ungate hardware MCI clocks * @host: host to ungate. * * Makes sure the host ios.clock is restored to a non-zero value * past this call. Increase clock reference count and ungate clock * if we're the first user. */ -void mmc_host_clk_ungate (struct mmc_host *host) +void mmc_host_clk_hold (struct mmc_host *host) {unsigned long flags;
@@ -164,14 +164,14 @@ static bool mmc_host_may_gate_card(struc }/** -* mmc_host_clk_gate - gate off hardware MCI clocks +* mmc_host_clk_release - gate off hardware MCI clocks * @host: host to gate. * * Calls the host driver with ios.clock set to zero as often as possible * in order to gate off hardware MCI clocks. Decrease clock reference * count and schedule disabling of clock. */ -void mmc_host_clk_gate (struct mmc_host *host) +void mmc_host_clk_release (struct mmc_host *host) {unsigned long flags;
@@ -231,7 +231,7 @@ static inline void mmc_host_clk_exit(strif (cancel_work_sync (&host->clk_gate_work))mmc_host_clk_gate_delayed (host);if (host->clk_gated) -mmc_host_clk_ungate (host); +mmc_host_clk_hold (host);/* There should be only one user now */ WARN_ON (host->clk_requests >1 ); }
drivers/mmc/core/host.h +4 -4
@@ -16,16 +16,16 @@ int mmc_register_host_class(void);void mmc_unregister_host_class (void );#ifdef CONFIG_MMC_CLKGATE -void mmc_host_clk_ungate (struct mmc_host *host); -void mmc_host_clk_gate (struct mmc_host *host); +void mmc_host_clk_hold (struct mmc_host *host); +void mmc_host_clk_release (struct mmc_host *host);unsigned int mmc_host_clk_rate (struct mmc_host *host);#else -static inline void mmc_host_clk_ungate (struct mmc_host *host) +static inline void mmc_host_clk_hold (struct mmc_host *host) { } -static inline void mmc_host_clk_gate (struct mmc_host *host) +static inline void mmc_host_clk_release (struct mmc_host *host) { }
PATCH 66/244 mmc: core: prevent aggressive clock gating racing with ios updates
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mika Westerberg <[email protected]>
commit 778e277cb82411c9002ca28ccbd216c4d9eb9158 upstream.
We have seen at least two different races when clock gating kicks in in a middle of ios structure update.
First one happens when ios->clock is changed outside of aggressive clock gating framework, for example via mmc_set_clock(). The race might happen when we run following code:
mmc_set_ios():
... if (ios->clock > 0) mmc_set_ungated(host);
Now if gating kicks in right after the condition check we end up setting host->clk_gated to false even though we have just gated the clock. Next time a request is started we try to ungate and restore the clock in mmc_host_clk_hold(). However since we have host->clk_gated set to false the original clock is not restored.
This eventually will cause the host controller to hang since its clock is disabled while we are trying to issue a request. For example on Intel Medfield platform we see:
[ 13.818610] mmc2: Timeout waiting for hardware interrupt. [ 13.818698] sdhci: =========== REGISTER DUMP (mmc2)=========== [ 13.818753] sdhci: Sys addr: 0x00000000 | Version: 0x00008901 [ 13.818804] sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000 [ 13.818853] sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 [ 13.818903] sdhci: Present: 0x1fff0000 | Host ctl: 0x00000001 [ 13.818951] sdhci: Power: 0x0000000d | Blk gap: 0x00000000 [ 13.819000] sdhci: Wake-up: 0x00000000 | Clock: 0x00000000 [ 13.819049] sdhci: Timeout: 0x00000000 | Int stat: 0x00000000 [ 13.819098] sdhci: Int enab: 0x00ff00c3 | Sig enab: 0x00ff00c3 [ 13.819147] sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000 [ 13.819196] sdhci: Caps: 0x6bee32b2 | Caps_1: 0x00000000 [ 13.819245] sdhci: Cmd: 0x00000000 | Max curr: 0x00000000 [ 13.819292] sdhci: Host ctl2: 0x00000000 [ 13.819331] sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000 [ 13.819377] sdhci: =========================================== [ 13.919605] mmc2: Reset 0x2 never completed.
and it never recovers.
Second race might happen while running mmc_power_off():
static void mmc_power_off(struct mmc_host *host)
{
host->ios.clock = 0;
host->ios.vdd = 0;[ clock gating kicks in here ]
/*
* Reset ocr mask to be the highest possible voltage supported for
* this mmc host. This value will be used at next power up.
*/
host->ocr = 1 << (fls(host->ocr_avail) - 1);
if (!mmc_host_is_spi(host)) {
host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
host->ios.chip_select = MMC_CS_DONTCARE;
}
host->ios.power_mode = MMC_POWER_OFF;
host->ios.bus_width = MMC_BUS_WIDTH_1;
host->ios.timing = MMC_TIMING_LEGACY;
mmc_set_ios(host);
}If the clock gating worker kicks in while we are only partially updated the ios structure the host controller gets incomplete ios and might not work as supposed. Again on Intel Medfield platform we get:
[ 4.185349] kernel BUG at drivers/mmc/host/sdhci.c:1155! [ 4.185422] invalid opcode: 0000 [#1] PREEMPT SMP [ 4.185509] Modules linked in: [ 4.185565] [ 4.185608] Pid: 4, comm: kworker/0:0 Not tainted 3.0.0+ #240 Intel Corporation Medfield/iCDKA [ 4.185742] EIP: 0060:[<c136364e>] EFLAGS: 00010083 CPU: 0 [ 4.185827] EIP is at sdhci_set_power+0x3e/0xd0 [ 4.185891] EAX: f5ff98e0 EBX: f5ff98e0 ECX: 00000000 EDX: 00000001 [ 4.185970] ESI: f5ff977c EDI: f5ff9904 EBP: f644fe98 ESP: f644fe94 [ 4.186049] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 4.186125] Process kworker/0:0 (pid: 4, ti=f644e000 task=f644c0e0 task.ti=f644e000) [ 4.186219] Stack: [ 4.186257] f5ff98e0 f644feb0 c1365173 00000282 f5ff9460 f5ff96e0 f5ff96e0 f644feec [ 4.186418] c1355bd8 f644c0e0 c1499c3d f5ff96e0 f644fed4 00000006 f5ff96e0 00000286 [ 4.186579] f644fedc c107922b f644feec 00000286 f5ff9460 f5ff9700 f644ff10 c135839e [ 4.186739] Call Trace: [ 4.186802] [<c1365173>] sdhci_set_ios+0x1c3/0x340 [ 4.186883] [<c1355bd8>] mmc_gate_clock+0x68/0x120 [ 4.186963] [<c1499c3d>] ? _raw_spin_unlock_irqrestore+0x4d/0x60 [ 4.187052] [<c107922b>] ? trace_hardirqs_on+0xb/0x10 [ 4.187134] [<c135839e>] mmc_host_clk_gate_delayed+0xbe/0x130 [ 4.187219] [<c105ec09>] ? process_one_work+0xf9/0x5b0 [ 4.187300] [<c135841d>] mmc_host_clk_gate_work+0xd/0x10 [ 4.187379] [<c105ec82>] process_one_work+0x172/0x5b0 [ 4.187457] [<c105ec09>] ? process_one_work+0xf9/0x5b0 [ 4.187538] [<c1358410>] ? mmc_host_clk_gate_delayed+0x130/0x130 [ 4.187625] [<c105f3c8>] worker_thread+0x118/0x330 [ 4.187700] [<c1496cee>] ? preempt_schedule+0x2e/0x50 [ 4.187779] [<c105f2b0>] ? rescuer_thread+0x1f0/0x1f0 [ 4.187857] [<c1062cf4>] kthread+0x74/0x80 [ 4.187931] [<c1062c80>] ? __init_kthread_worker+0x60/0x60 [ 4.188015] [<c149acfa>] kernel_thread_helper+0x6/0xd [ 4.188079] Code: 81 fa 00 00 04 00 0f 84 a7 00 00 00 7f 21 81 fa 80 00 00 00 0f 84 92 00 00 00 81 fa 00 00 0 [ 4.188780] EIP: [<c136364e>] sdhci_set_power+0x3e/0xd0 SS:ESP 0068:f644fe94 [ 4.188898] ---[ end trace a7b23eecc71777e4 ]---
This BUG() comes from the fact that ios.power_mode was still in previous value (MMC_POWER_ON) and ios.vdd was set to zero.
We prevent these by inhibiting the clock gating while we update the ios structure.
Both problems can be reproduced by simply running the device in a reboot loop.
--- drivers/mmc/core/core.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-)
drivers/mmc/core/core.c +29 -2
@@ -634,15 +634,17 @@ static inline void mmc_set_ios(struct mm*/ void mmc_set_chip_select (struct mmc_host *host,int mode) { +mmc_host_clk_hold (host); host->ios.chip_select = mode;mmc_set_ios (host); +mmc_host_clk_release (host); }/* * Sets the host clock to the highest possible frequency that * is below "hz". */ -void mmc_set_clock (struct mmc_host *host,unsigned int hz) +static void __mmc_set_clock (struct mmc_host *host,unsigned int hz) {WARN_ON (hz < host->f_min);
@@ -653,6 +655,13 @@ void mmc_set_clock(struct mmc_host *hostmmc_set_ios (host); } +void mmc_set_clock (struct mmc_host *host,unsigned int hz) +{ +mmc_host_clk_hold (host); +__mmc_set_clock (host, hz); +mmc_host_clk_release (host); +} +#ifdef CONFIG_MMC_CLKGATE /* * This gates the clock by setting it to 0 Hz.
@@ -685,7 +694,7 @@ void mmc_ungate_clock(struct mmc_host *hif (host->clk_old) {BUG_ON (host->ios.clock);/* This call will also set host->clk_gated to false */ -mmc_set_clock (host, host->clk_old); +__mmc_set_clock (host, host->clk_old); } }
@@ -713,8 +722,10 @@ void mmc_set_ungated(struct mmc_host *ho*/ void mmc_set_bus_mode (struct mmc_host *host,unsigned int mode) { +mmc_host_clk_hold (host); host->ios.bus_mode = mode;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -722,8 +733,10 @@ void mmc_set_bus_mode(struct mmc_host *h*/ void mmc_set_bus_width (struct mmc_host *host,unsigned int width) { +mmc_host_clk_hold (host); host->ios.bus_width = width;mmc_set_ios (host); +mmc_host_clk_release (host); }/**
@@ -921,8 +934,10 @@ u32 mmc_select_voltage(struct mmc_host * ocr &=3 << bit; +mmc_host_clk_hold (host); host->ios.vdd = bit;mmc_set_ios (host); +mmc_host_clk_release (host); }else {pr_warning ("%s: host doesn't support card's voltages\n" ,mmc_hostname (host));
@@ -969,8 +984,10 @@ int mmc_set_signal_voltage(struct mmc_ho*/ void mmc_set_timing (struct mmc_host *host,unsigned int timing) { +mmc_host_clk_hold (host); host->ios.timing = timing;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -978,8 +995,10 @@ void mmc_set_timing(struct mmc_host *hos*/ void mmc_set_driver_type (struct mmc_host *host,unsigned int drv_type) { +mmc_host_clk_hold (host); host->ios.drv_type = drv_type;mmc_set_ios (host); +mmc_host_clk_release (host); }/*
@@ -997,6 +1016,8 @@ static void mmc_power_up(struct mmc_host {int bit; +mmc_host_clk_hold (host); +/* If ocr is set, we use it */ if (host->ocr) bit =ffs (host->ocr) -1 ;
@@ -1032,10 +1053,14 @@ static void mmc_power_up(struct mmc_host* time required to reach a stable voltage. */ mmc_delay (10 ); + +mmc_host_clk_release (host); }static void mmc_power_off (struct mmc_host *host) { +mmc_host_clk_hold (host); + host->ios.clock =0 ; host->ios.vdd =0 ;
@@ -1053,6 +1078,8 @@ static void mmc_power_off(struct mmc_hos host->ios.bus_width =MMC_BUS_WIDTH_1 ; host->ios.timing =MMC_TIMING_LEGACY ;mmc_set_ios (host); + +mmc_host_clk_release (host); }/*
PATCH 67/244 mmc: core: use non-reentrant workqueue for clock gating
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mika Westerberg <[email protected]>
commit 50a50f9248497484c678631a9c1a719f1aaeab79 upstream.
The default multithread workqueue can cause the same work to be executed concurrently on a different CPUs. This isn't really suitable for clock gating as it might already gated the clock and gating it twice results both host->clk_old and host->ios.clock to be set to 0.
To prevent this from happening we use system_nrt_wq instead.
--- drivers/mmc/core/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/host.c +1 -1
@@ -179,7 +179,7 @@ void mmc_host_clk_release(struct mmc_hos host->clk_requests--;if (mmc_host_may_gate_card (host->card) && !host->clk_requests) -schedule_work (&host->clk_gate_work); +queue_work (system_nrt_wq, &host->clk_gate_work);spin_unlock_irqrestore (&host->clk_lock, flags); }
PATCH 68/244 mmc: sdhci-s3c: Fix mmc card I/O problem
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Girish K S <[email protected]>
commit 49bb1e619568ec84785ceb366f07db2a6f0b64cc upstream.
This patch fixes the problem in sdhci-s3c host driver for Samsung Soc's. During the card identification stage the mmc core driver enumerates for the best bus width in combination with the highest available data rate. It starts enumerating from the highest bus width (8) to lowest width (1).
In case of few MMC cards the 4-bit bus enumeration fails and tries the 1-bit bus enumeration. When switched to 1-bit bus mode the host driver has to clear the previous bus width setting and apply the new setting.
The current patch will clear the previous bus mode and apply the new mode setting.
--- drivers/mmc/host/sdhci-s3c.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/sdhci-s3c.c +2 -0
@@ -301,6 +301,8 @@ static int sdhci_s3c_platform_8bit_width ctrl &= ~SDHCI_CTRL_8BITBUS ;break ;default : + ctrl &= ~SDHCI_CTRL_4BITBUS ; + ctrl &= ~SDHCI_CTRL_8BITBUS ;break ; }
PATCH 69/244 xen: x86_32: do not enable iterrupts when returning from exception in interrupt context
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Igor Mammedov <[email protected]>
commit d198d499148a0c64a41b3aba9e7dd43772832b91 upstream.
If vmalloc page_fault happens inside of interrupt handler with interrupts disabled then on exit path from exception handler when there is no pending interrupts, the following code (arch/x86/xen/xen-asm_32.S:112):
cmpw $0x0001, XEN_vcpu_info_pending(%eax) sete XEN_vcpu_info_mask(%eax)
will enable interrupts even if they has been previously disabled according to eflags from the bounce frame (arch/x86/xen/xen-asm_32.S:99)
testb $X86_EFLAGS_IF>>8, 8+1+ESP_OFFSET(%esp) setz XEN_vcpu_info_mask(%eax)
Solution is in setting XEN_vcpu_info_mask only when it should be set according to
cmpw $0x0001, XEN_vcpu_info_pending(%eax)
but not clearing it if there isn't any pending events.
Reproducer for bug is attached to RHBZ 707552
--- arch/x86/xen/xen-asm_32.S | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/x86/xen/xen-asm_32.S +5 -3
@@ -113,11 +113,13 @@ xen_iret_start_crit: /* * If there's something pending, mask events again so we can - * jump back into xen_hypervisor_callback + * jump back into xen_hypervisor_callback. Otherwise do not + * touch XEN_vcpu_info_mask. */ - sete XEN_vcpu_info_mask(%eax) + jne 1f + movb $1, XEN_vcpu_info_mask(%eax) - popl %eax +1: popl %eax /* * From this point on the registers are restored and the stack
PATCH 70/244 xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit ed467e69f16e6b480e2face7bc5963834d025f91 upstream.
We have hit a couple of customer bugs where they would like to use those parameters to run an UP kernel - but both of those options turn of important sources of interrupt information so we end up not being able to boot. The correct way is to pass in 'dom0_max_vcpus=1' on the Xen hypervisor line and the kernel will patch itself to be a UP kernel.
Fixes bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637308
--- arch/x86/xen/smp.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/x86/xen/smp.c +10 -0
@@ -32,6 +32,7 @@#include <xen/page.h> #include <xen/events.h> +#include <xen/hvc-console.h> #include "xen-ops.h" #include "mmu.h"
@@ -207,6 +208,15 @@ static void __init xen_smp_prepare_cpus(unsigned cpu;unsigned int i; +if (skip_ioapic_setup) { +char *m = (max_cpus ==0 ) ? +"The nosmp parameter is incompatible with Xen; " \ +"use Xen dom0_max_vcpus=1 parameter" : +"The noapic parameter is incompatible with Xen" ; + +xen_raw_printk (m); +panic (m); + }xen_init_lock_cpu (0 );smp_store_cpu_info (0 );
PATCH 71/244 hwmon: (max16065) Fix current calculation
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Guenter Roeck <[email protected]>
commit ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 upstream.
Current calculation is completely wrong. Add missing brackets to fix it.
--- drivers/hwmon/max16065.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/max16065.c +1 -1
@@ -124,7 +124,7 @@ static inline int MV_TO_LIMIT(int mv, instatic inline int ADC_TO_CURR (int adc,int gain) { -return adc *1400000 / gain *255 ; +return adc *1400000 / (gain *255 ); }/*
PATCH 72/244 ARM: 7081/1: mach-integrator: fix the clocksource
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Linus Walleij <[email protected]>
commit bb9ea77846620ed2b37e74c852d72c7a476b248c upstream.
I was intrigued by the fact that the clock stood still on the Integrator, but it wasn't strange at all, because the timer was set up all wrong and probably has been for a while. With this patch the clock starts ticking again:
make the timer periodic (reload), |= on the divisor bit and load the timer before starting it.
--- arch/arm/mach-integrator/integrator_ap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/mach-integrator/integrator_ap.c +3 -3
@@ -337,15 +337,15 @@ static unsigned long timer_reload;static void integrator_clocksource_init (u32 khz) {void __iomem *base = (void __iomem *)TIMER2_VA_BASE ; -u32 ctrl =TIMER_CTRL_ENABLE ; +u32 ctrl =TIMER_CTRL_ENABLE |TIMER_CTRL_PERIODIC ;if (khz >=1500 ) { khz /=16 ; - ctrl =TIMER_CTRL_DIV16 ; + ctrl |=TIMER_CTRL_DIV16 ; } -writel (ctrl, base +TIMER_CTRL );writel (0xffff , base +TIMER_LOAD ); +writel (ctrl, base +TIMER_CTRL );clocksource_mmio_init (base +TIMER_VALUE ,"timer2" , khz *1000 ,200 ,16 , clocksource_mmio_readl_down);
PATCH 73/244 ARM: davinci: da850 EVM: read mac address from SPI flash
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sudhakar Rajashekhara <[email protected]>
commit 810198bc9c109489dfadc57131c5183ce6ad2d7d upstream.
DA850/OMAP-L138 EMAC driver uses random mac address instead of a fixed one because the mac address is not stuffed into EMAC platform data.
This patch provides a function which reads the mac address stored in SPI flash (registered as MTD device) and populates the EMAC platform data. The function which reads the mac address is registered as a callback which gets called upon addition of MTD device.
NOTE: In case the MAC address stored in SPI flash is erased, follow the instructions at [1] to restore it.
Modifications in v2:
Guarded registering the mtd_notifier only when MTD is enabled. Earlier this was handled using mtd_has_partitions() call, but this has been removed in Linux v3.0.
Modifications in v3:
a. Guarded da850_evm_m25p80_notify_add() function and
da850evm_spi_notifier structure with CONFIG_MTD macros.
b. Renamed da850_evm_register_mtd_user() function to
da850_evm_setup_mac_addr() and removed the struct mtd_notifier argument to this function.
c. Passed the da850evm_spi_notifier structure to register_mtd_user()
function.
Modifications in v4:
Moved the da850_evm_setup_mac_addr() function within the first CONFIG_MTD ifdef construct.
--- arch/arm/mach-davinci/board-da850-evm.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/arm/mach-davinci/board-da850-evm.c +28 -0
@@ -115,6 +115,32 @@ static struct spi_board_info da850evm_sp }, }; +#ifdef CONFIG_MTD +static void da850_evm_m25p80_notify_add (struct mtd_info *mtd) +{ +char *mac_addr = davinci_soc_info.emac_pdata->mac_addr; +size_t retlen; + +if (!strcmp (mtd->name,"MAC-Address" )) { + mtd->read (mtd,0 ,ETH_ALEN , &retlen, mac_addr); +if (retlen ==ETH_ALEN ) +pr_info ("Read MAC addr from SPI Flash: %pM\n" , + mac_addr); + } +} + +static struct mtd_notifier da850evm_spi_notifier = { + .add = da850_evm_m25p80_notify_add, +}; + +static void da850_evm_setup_mac_addr (void ) +{ +register_mtd_user (&da850evm_spi_notifier); +} +#else +static void da850_evm_setup_mac_addr (void ) { } +#endif +static struct mtd_partition da850_evm_norflash_partition[] = { { .name ="bootloaders + env" ,
@@ -1237,6 +1263,8 @@ static __init void da850_evm_init(void)if (ret)pr_warning ("da850_evm_init: spi 1 registration failed: %d\n" , ret); + +da850_evm_setup_mac_addr (); }#ifdef CONFIG_SERIAL_8250_CONSOLE
PATCH 74/244 ARM: davinci: fix cache flush build error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Linus Walleij <[email protected]>
commit 897a6a1a14837d6d582bfd1fd7aba00be44b6469 upstream.
The TNET variant of DaVinci compiles some code that it shares with other DaVinci variants, however it has a V6 CPU rather than an ARM926T, thus the hardcoded call to arm926_flush_kern_cache_all() in sleep.S will obviously fail, and we need to build with the v6_flush_kern_cache_all() call instead. This was triggered by manually altering the DaVinci config to build the TNET version.
--- arch/arm/mach-davinci/sleep.S | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-davinci/sleep.S +5 -1
@@ -217,7 +217,11 @@ ddr2clk_stop_done: ENDPROC(davinci_ddr_psc_config) CACHE_FLUSH: - .word arm926_flush_kern_cache_all +#ifdef CONFIG_CPU_V6 + .word v6_flush_kern_cache_all +#else + .word arm926_flush_kern_cache_all +#endif ENTRY(davinci_cpu_suspend_sz) .word . - davinci_cpu_suspend
PATCH 75/244 drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Marcin Slusarz <[email protected]>
commit 17c8b960930da3599e47801a54ac0ea1070545d2 upstream.
Not cleaning after alloc failure would result in crash on destroy, because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when "pages" is not null.
--- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_sgdma.c +4 -1
@@ -37,8 +37,11 @@ nouveau_sgdma_populate(struct ttm_backenreturn -ENOMEM ; nvbe->ttm_alloced =kmalloc (sizeof (bool ) * num_pages,GFP_KERNEL ); -if (!nvbe->ttm_alloced) +if (!nvbe->ttm_alloced) { +kfree (nvbe->pages); + nvbe->pages =NULL ;return -ENOMEM ; + } nvbe->nr_pages =0 ;while (num_pages--) {
PATCH 76/244 Avoid dereferencing a request_queue after last close.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit 94007751bb02797ba87bac7aacee2731ac2039a3 upstream.
On the last close of an 'md' device which as been stopped, the device is destroyed and in particular the request_queue is freed. The free is done in a separate thread so it might happen a short time later.
__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been called.
Since commit f758eeabeb96f878c860e8f110f94ec8820822a9 bdev_inode_switch_bdi will dereference the 'old' bdi, which lives inside a request_queue, to get a spin lock. This causes the last close on an md device to sometime take a spin_lock which lives in freed memory - which results in an oops.
So move the called to bdev_inode_switch_bdi before the call to ->release.
--- fs/block_dev.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/block_dev.c +5 -2
@@ -1419,6 +1419,11 @@ static int __blkdev_put(struct block_devWARN_ON_ONCE (bdev->bd_holders);sync_blockdev (bdev);kill_bdev (bdev); +/* ->release can cause the old bdi to disappear, +* so must switch it out first +*/ +bdev_inode_switch_bdi (bdev->bd_inode, + &default_backing_dev_info); }if (bdev->bd_contains == bdev) {if (disk->fops->release)
@@ -1432,8 +1437,6 @@ static int __blkdev_put(struct block_devdisk_put_part (bdev->bd_part); bdev->bd_part =NULL ; bdev->bd_disk =NULL ; -bdev_inode_switch_bdi (bdev->bd_inode, - &default_backing_dev_info);if (bdev != bdev->bd_contains) victim = bdev->bd_contains; bdev->bd_contains =NULL ;
PATCH 77/244 md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
0.90 metadata uses an unsigned 32bit number to count the number of kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a larger type, so sizes above 2TB get truncated.
Also we allow rdev->sectors to be larger than 4TB, so it is possible for the array to be resized larger than the metadata can handle. So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in used.
Also the sanity check at the end of super_90_load should include level 1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
--- drivers/md/md.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/md/md.c +10 -2
@@ -1084,8 +1084,11 @@ static int super_90_load(mdk_rdev_t *rde ret =0 ; } rdev->sectors = rdev->sb_start; +/* Limit to 4TB as metadata cannot record more than that */ +if (rdev->sectors >= (2ULL <<32 )) + rdev->sectors = (2ULL <<32 ) -2 ; -if (rdev->sectors < sb->size *2 && sb->level >1 ) +if (rdev->sectors < ((sector_t )sb->size) *2 && sb->level >=1 )/* "this cannot possibly happen" ... */ ret = -EINVAL ;
@@ -1119,7 +1122,7 @@ static int super_90_validate(mddev_t *md mddev->clevel[0 ] =0 ; mddev->layout = sb->layout; mddev->raid_disks = sb->raid_disks; - mddev->dev_sectors = sb->size *2 ; + mddev->dev_sectors = ((sector_t )sb->size) *2 ; mddev->events = ev1; mddev->bitmap_info.offset =0 ; mddev->bitmap_info.default_offset =MD_SB_BYTES >>9 ;
@@ -1361,6 +1364,11 @@ super_90_rdev_size_change(mdk_rdev_t *rd rdev->sb_start =calc_dev_sboffset (rdev);if (!num_sectors || num_sectors > rdev->sb_start) num_sectors = rdev->sb_start; +/* Limit to 4TB as metadata cannot record more than that. +* 4TB == 2^32 KB, or 2*2^32 sectors. +*/ +if (num_sectors >= (2ULL <<32 )) + num_sectors = (2ULL <<32 ) -2 ;md_super_write (rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, rdev->sb_page);md_super_wait (rdev->mddev);
PATCH 78/244 nuvoton-cir: simplify raw IR sample handling
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jarod Wilson <[email protected]>
commit de4ed0c111ed078b8729a5cc49c23197740f5bad upstream.
The nuvoton-cir driver was storing up consecutive pulse-pulse and space-space samples internally, for no good reason, since ir_raw_event_store_with_filter() already merges back to back like samples types for us. This should also fix a regression introduced late in 3.0 that related to a timeout change, which actually becomes correct when coupled with this change. Tested with RC6 and RC5 on my own nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky behavior in 3.0 due to the timeout change.
--- drivers/media/rc/nuvoton-cir.c | 45 +++++++---------------------------------- drivers/media/rc/nuvoton-cir.h | 1 2 files changed, 8 insertions(+), 38 deletions(-)
drivers/media/rc/nuvoton-cir.c +8 -37
@@ -624,7 +624,6 @@ static void nvt_dump_rx_buf(struct nvt_dstatic void nvt_process_rx_ir_data (struct nvt_dev *nvt) {DEFINE_IR_RAW_EVENT (rawir); -unsigned int count;u32 carrier;u8 sample;int i;
@@ -637,65 +636,38 @@ static void nvt_process_rx_ir_data(strucif (nvt->carrier_detect_enabled) carrier =nvt_rx_carrier_detect (nvt); - count = nvt->pkts; -nvt_dbg_verbose ("Processing buffer of len %d" , count); +nvt_dbg_verbose ("Processing buffer of len %d" , nvt->pkts);init_ir_raw_event (&rawir); -for (i =0 ; i < count; i++) { - nvt->pkts--; +for (i =0 ; i < nvt->pkts; i++) { sample = nvt->buf[i]; rawir.pulse = ((sample &BUF_PULSE_BIT ) !=0 ); rawir.duration =US_TO_NS ((sample &BUF_LEN_MASK ) *SAMPLE_PERIOD ); -if ((sample &BUF_LEN_MASK ) ==BUF_LEN_MASK ) { -if (nvt->rawir.pulse == rawir.pulse) - nvt->rawir.duration += rawir.duration; -else { - nvt->rawir.duration = rawir.duration; - nvt->rawir.pulse = rawir.pulse; - } -continue ; - } - - rawir.duration += nvt->rawir.duration; - -init_ir_raw_event (&nvt->rawir); - nvt->rawir.duration =0 ; - nvt->rawir.pulse = rawir.pulse; - -if (sample ==BUF_PULSE_BIT ) - rawir.pulse = false; - -if (rawir.duration) { -nvt_dbg ("Storing %s with duration %d" , - rawir.pulse ?"pulse" :"space" , - rawir.duration); +nvt_dbg ("Storing %s with duration %d" , + rawir.pulse ?"pulse" :"space" , rawir.duration); -ir_raw_event_store_with_filter (nvt->rdev, &rawir); - } +ir_raw_event_store_with_filter (nvt->rdev, &rawir);/* * BUF_PULSE_BIT indicates end of IR data, BUF_REPEAT_BYTE * indicates end of IR signal, but new data incoming. In both * cases, it means we're ready to call ir_raw_event_handle */ -if ((sample ==BUF_PULSE_BIT ) && nvt->pkts) { +if ((sample ==BUF_PULSE_BIT ) && (i +1 < nvt->pkts)) {nvt_dbg ("Calling ir_raw_event_handle (signal end)\n" );ir_raw_event_handle (nvt->rdev); } } + nvt->pkts =0 ; +nvt_dbg ("Calling ir_raw_event_handle (buffer empty)\n" );ir_raw_event_handle (nvt->rdev); -if (nvt->pkts) { -nvt_dbg ("Odd, pkts should be 0 now... (its %u)" , nvt->pkts); - nvt->pkts =0 ; - } -nvt_dbg_verbose ("%s done" , __func__); }
@@ -1054,7 +1026,6 @@ static int nvt_probe(struct pnp_dev *pdespin_lock_init (&nvt->nvt_lock);spin_lock_init (&nvt->tx.lock); -init_ir_raw_event (&nvt->rawir); ret = -EBUSY ;/* now claim resources */
drivers/media/rc/nuvoton-cir.h +0 -1
@@ -67,7 +67,6 @@ static int debug;struct nvt_dev {struct pnp_dev *pdev;struct rc_dev *rdev; -struct ir_raw_event rawir;spinlock_t nvt_lock;
PATCH 79/244 vp7045: fix buffer setup
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Florian Mickler <[email protected]>
commit fc61ccd35fd59d5362d37c8bf9c0526c85086c84 upstream.
dvb_usb_device_init calls the frontend_attach method of this driver which uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to be allocated before that happens.
Luckily we can use the whole private data as the buffer as it gets separately allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for use via usb_control_msg.
This fixes a
BUG: unable to handle kernel paging request at 0000000000001e78
reported by Tino Keitel and diagnosed by Dan Carpenter.
--- drivers/media/dvb/dvb-usb/vp7045.c | 26 ++++---------------------- 1 file changed, 4 insertions(+), 22 deletions(-)
drivers/media/dvb/dvb-usb/vp7045.c +4 -22
@@ -224,26 +224,8 @@ static struct dvb_usb_device_propertiesstatic int vp7045_usb_probe (struct usb_interface *intf,const struct usb_device_id *id) { -struct dvb_usb_device *d; -int ret =dvb_usb_device_init (intf, &vp7045_properties, -THIS_MODULE , &d, adapter_nr); -if (ret) -return ret; - - d->priv =kmalloc (20 ,GFP_KERNEL ); -if (!d->priv) { -dvb_usb_device_exit (intf); -return -ENOMEM ; - } - -return ret; -} - -static void vp7045_usb_disconnect (struct usb_interface *intf) -{ -struct dvb_usb_device *d =usb_get_intfdata (intf); -kfree (d->priv); -dvb_usb_device_exit (intf); +return dvb_usb_device_init (intf, &vp7045_properties, +THIS_MODULE ,NULL , adapter_nr); }static struct usb_device_id vp7045_usb_table [] = {
@@ -258,7 +240,7 @@ MODULE_DEVICE_TABLE(usb, vp7045_usb_tablstatic struct dvb_usb_device_properties vp7045_properties = { .usb_ctrl =CYPRESS_FX2 , .firmware ="dvb-usb-vp7045-01.fw" , - .size_of_priv =sizeof (u8 *), + .size_of_priv =20 , .num_adapters =1 , .adapter = {
@@ -305,7 +287,7 @@ static struct dvb_usb_device_propertiesstatic struct usb_driver vp7045_usb_driver = { .name ="dvb_usb_vp7045" , .probe = vp7045_usb_probe, - .disconnect = vp7045_usb_disconnect, + .disconnect = dvb_usb_device_exit, .id_table = vp7045_usb_table, };
PATCH 80/244 net/9p: fix client code to fail more gracefully on protocol error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Van Hensbergen <[email protected]>
commit b85f7d92d7bd7e3298159e8b1eed8cb8cbbb0348 upstream.
There was a BUG_ON to protect against a bad id which could be dealt with more gracefully.
--- net/9p/client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/9p/client.c +2 -1
@@ -280,7 +280,8 @@ struct p9_req_t *p9_tag_lookup(struct p9* buffer to read the data into */ tag++; -BUG_ON (tag >= c->max_tag); +if (tag >= c->max_tag) +return NULL ; row = tag /P9_ROW_MAXTAG ; col = tag %P9_ROW_MAXTAG ;
PATCH 81/244 Fix the size of receive buffer packing onto VirtIO ring.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: jvrao <[email protected]>
commit 114e6f3a5ede73d5b56e145f04680c61c3dd67c4 upstream.
--- net/9p/trans_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/trans_virtio.c +1 -1
@@ -367,7 +367,7 @@ req_retry_pinned: in += inp; }else { in =pack_sg_list (chan->sg, out,VIRTQUEUE_NUM , rdata, - client->msize); + req->rc->capacity); } err =virtqueue_add_buf (chan->vq, chan->sg, out, in, req->tc);
PATCH 82/244 VirtIO can transfer VIRTQUEUE_NUM of pages.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: jvrao <[email protected]>
commit 7f781679dd596c8abde8336b4d0d166d6a4aad04 upstream.
--- net/9p/trans_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/trans_virtio.c +1 -1
@@ -592,7 +592,7 @@ static struct p9_trans_module p9_virtio_ .close = p9_virtio_close, .request = p9_virtio_request, .cancel = p9_virtio_cancel, - .maxsize = PAGE_SIZE*16, + .maxsize = PAGE_SIZE*VIRTQUEUE_NUM, .pref = P9_TRANS_PREF_PAYLOAD_SEP, .def = 0, .owner = THIS_MODULE,
PATCH 83/244 fs/9p: Fid is not valid after a failed clunk.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit 5034990e28efb2d232ee82443a9edd62defd17ba upstream.
free the fid even in case of failed clunk.
--- net/9p/client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/9p/client.c +4 -2
@@ -1250,9 +1250,11 @@ int p9_client_clunk(struct p9_fid *fid)P9_DPRINTK (P9_DEBUG_9P ,"<<< RCLUNK fid %d\n" , fid->fid);p9_free_req (clnt, req); -p9_fid_destroy (fid); - error: +/* +* Fid is not valid even after a failed clunk +*/ +p9_fid_destroy (fid);return err; }EXPORT_SYMBOL (p9_client_clunk);
PATCH 84/244 fs/9p: When doing inode lookup compare qid details and inode mode bits.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit fd2421f54423f307ecd31bdebdca6bc317e0c492 upstream.
This make sure we don't use wrong inode from the inode hash. The inode number of the file deleted is reused by the next file system object created and if we only use inode number for inode hash lookup we could end up with wrong struct inode.
Also compare inode generation number. Not all Linux file system provide st_gen in userspace. So it could be 0;
--- fs/9p/cache.c | 20 +++++++++----------- fs/9p/cache.h | 9 --------- fs/9p/v9fs.c | 2 +- fs/9p/v9fs.h | 2 +- fs/9p/vfs_inode.c | 36 +++++++++++++++++++++++++++++++++--- fs/9p/vfs_inode_dotl.c | 41 +++++++++++++++++++++++++++++++++++++---- 6 files changed, 81 insertions(+), 29 deletions(-)
fs/9p/cache.c +9 -11
@@ -108,11 +108,10 @@ static uint16_t v9fs_cache_inode_get_key void *buffer, uint16_t bufmax) {const struct v9fs_inode *v9inode = cookie_netfs_data; -memcpy (buffer, &v9inode->fscache_key->path, -sizeof (v9inode->fscache_key->path)); +memcpy (buffer, &v9inode->qid.path,sizeof (v9inode->qid.path));P9_DPRINTK (P9_DEBUG_FSC ,"inode %p get key %llu" , &v9inode->vfs_inode, - v9inode->fscache_key->path); -return sizeof (v9inode->fscache_key->path); + v9inode->qid.path); +return sizeof (v9inode->qid.path); } static void v9fs_cache_inode_get_attr(const void *cookie_netfs_data,
@@ -129,11 +128,10 @@ static uint16_t v9fs_cache_inode_get_aux void *buffer, uint16_t buflen) {const struct v9fs_inode *v9inode = cookie_netfs_data; -memcpy (buffer, &v9inode->fscache_key->version, -sizeof (v9inode->fscache_key->version)); +memcpy (buffer, &v9inode->qid.version,sizeof (v9inode->qid.version));P9_DPRINTK (P9_DEBUG_FSC ,"inode %p get aux %u" , &v9inode->vfs_inode, - v9inode->fscache_key->version); -return sizeof (v9inode->fscache_key->version); + v9inode->qid.version); +return sizeof (v9inode->qid.version); } static enum
@@ -143,11 +141,11 @@ fscache_checkaux v9fs_cache_inode_check_ {const struct v9fs_inode *v9inode = cookie_netfs_data; -if (buflen !=sizeof (v9inode->fscache_key->version)) +if (buflen !=sizeof (v9inode->qid.version))return FSCACHE_CHECKAUX_OBSOLETE ; -if (memcmp (buffer, &v9inode->fscache_key->version, -sizeof (v9inode->fscache_key->version))) +if (memcmp (buffer, &v9inode->qid.version, +sizeof (v9inode->qid.version)))return FSCACHE_CHECKAUX_OBSOLETE ;return FSCACHE_CHECKAUX_OKAY ;
fs/9p/cache.h +0 -9
@@ -93,15 +93,6 @@ static inline void v9fs_uncache_page(strBUG_ON (PageFsCache (page)); } -static inline void v9fs_fscache_set_key (struct inode *inode, -struct p9_qid *qid) -{ -struct v9fs_inode *v9inode =V9FS_I (inode); -spin_lock (&v9inode->fscache_lock); - v9inode->fscache_key = qid; -spin_unlock (&v9inode->fscache_lock); -} -static inline void v9fs_fscache_wait_on_page_write (struct inode *inode,struct page *page) {
fs/9p/v9fs.c +1 -1
@@ -487,8 +487,8 @@ static void v9fs_inode_init_once(void *fstruct v9fs_inode *v9inode = (struct v9fs_inode *)foo;#ifdef CONFIG_9P_FSCACHE v9inode->fscache =NULL ; - v9inode->fscache_key =NULL ;#endif +memset (&v9inode->qid,0 ,sizeof (v9inode->qid));inode_init_once (&v9inode->vfs_inode); }
fs/9p/v9fs.h +1 -1
@@ -125,8 +125,8 @@ struct v9fs_inode {#ifdef CONFIG_9P_FSCACHE spinlock_t fscache_lock;struct fscache_cookie *fscache; -struct p9_qid *fscache_key;#endif +struct p9_qid qid;unsigned int cache_validity;struct p9_fid *writeback_fid;struct mutex v_mutex;
fs/9p/vfs_inode.c +33 -3
@@ -216,7 +216,6 @@ struct inode *v9fs_alloc_inode(struct sureturn NULL ;#ifdef CONFIG_9P_FSCACHE v9inode->fscache =NULL ; - v9inode->fscache_key =NULL ;spin_lock_init (&v9inode->fscache_lock);#endif v9inode->writeback_fid =NULL ;
@@ -433,6 +432,37 @@ void v9fs_evict_inode(struct inode *inod } } +static int v9fs_test_inode (struct inode *inode,void *data) +{ +int umode; +struct v9fs_inode *v9inode =V9FS_I (inode); +struct p9_wstat *st = (struct p9_wstat *)data; +struct v9fs_session_info *v9ses =v9fs_inode2v9ses (inode); + + umode =p9mode2unixmode (v9ses, st->mode); +/* don't match inode of different type */ +if ((inode->i_mode &S_IFMT ) != (umode &S_IFMT )) +return 0 ; + +/* compare qid details */ +if (memcmp (&v9inode->qid.version, + &st->qid.version,sizeof (v9inode->qid.version))) +return 0 ; + +if (v9inode->qid.type != st->qid.type) +return 0 ; +return 1 ; +} + +static int v9fs_set_inode (struct inode *inode,void *data) +{ +struct v9fs_inode *v9inode =V9FS_I (inode); +struct p9_wstat *st = (struct p9_wstat *)data; + +memcpy (&v9inode->qid, &st->qid,sizeof (st->qid)); +return 0 ; +} +static struct inode *v9fs_qid_iget (struct super_block *sb,struct p9_qid *qid,struct p9_wstat *st)
@@ -443,7 +473,7 @@ static struct inode *v9fs_qid_iget(strucstruct v9fs_session_info *v9ses = sb->s_fs_info; i_ino =v9fs_qid2ino (qid); - inode =iget_locked (sb, i_ino); + inode =iget5_locked (sb, i_ino, v9fs_test_inode, v9fs_set_inode, st);if (!inode)return ERR_PTR (-ENOMEM );if (!(inode->i_state &I_NEW ))
@@ -453,6 +483,7 @@ static struct inode *v9fs_qid_iget(struc* FIXME!! we may need support for stale inodes * later. */ + inode->i_ino = i_ino; umode =p9mode2unixmode (v9ses, st->mode); retval =v9fs_init_inode (v9ses, inode, umode);if (retval)
@@ -460,7 +491,6 @@ static struct inode *v9fs_qid_iget(strucv9fs_stat2inode (st, inode, sb);#ifdef CONFIG_9P_FSCACHE -v9fs_fscache_set_key (inode, &st->qid);v9fs_cache_inode_get_cookie (inode);#endif unlock_new_inode (inode);
fs/9p/vfs_inode_dotl.c +37 -4
77 lines not on this page · raw message
PATCH 85/244 fs/9p: Fix invalid mount options/args
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Prem Karat <[email protected]>
commit a2dd43bb0d7b9ce28f8a39254c25840c0730498e upstream.
Without this fix, if any invalid mount options/args are passed while mouting the 9p fs, no error (-EINVAL) is returned and default arg value is assigned.
This fix returns -EINVAL when an invalid arguement is found while parsing mount options.
--- fs/9p/v9fs.c | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-)
fs/9p/v9fs.c +34 -9
@@ -78,6 +78,25 @@ static const match_table_t tokens = { {Opt_err, NULL} }; +/* Interpret mount options for cache mode */ +static int get_cache_mode (char *s) +{ +int version = -EINVAL ; + +if (!strcmp (s,"loose" )) { + version =CACHE_LOOSE ; +P9_DPRINTK (P9_DEBUG_9P ,"Cache mode: loose\n" ); + }else if (!strcmp (s,"fscache" )) { + version =CACHE_FSCACHE ; +P9_DPRINTK (P9_DEBUG_9P ,"Cache mode: fscache\n" ); + }else if (!strcmp (s,"none" )) { + version =CACHE_NONE ; +P9_DPRINTK (P9_DEBUG_9P ,"Cache mode: none\n" ); + }else +printk (KERN_INFO "9p: Unknown Cache mode %s.\n" , s); +return version; +} +/** * v9fs_parse_options - parse mount options into session structure * @v9ses: existing v9fs session information
@@ -97,7 +116,7 @@ static int v9fs_parse_options(struct v9f/* setup defaults */ v9ses->afid = ~0 ; v9ses->debug =0 ; - v9ses->cache =0 ; + v9ses->cache =CACHE_NONE ;#ifdef CONFIG_9P_FSCACHE v9ses->cachetag =NULL ;#endif
@@ -171,13 +190,13 @@ static int v9fs_parse_options(struct v9f "problem allocating copy of cache arg\n"); goto free_and_return; } + ret =get_cache_mode (s); +if (ret == -EINVAL ) { +kfree (s); + goto free_and_return; + } -if (strcmp (s,"loose" ) ==0 ) - v9ses->cache =CACHE_LOOSE ; -else if (strcmp (s,"fscache" ) ==0 ) - v9ses->cache =CACHE_FSCACHE ; -else - v9ses->cache =CACHE_NONE ; + v9ses->cache = ret;kfree (s);break ;
@@ -200,9 +219,15 @@ static int v9fs_parse_options(struct v9f }else { v9ses->flags |=V9FS_ACCESS_SINGLE ; v9ses->uid =simple_strtoul (s, &e,10 ); -if (*e !='\0' ) - v9ses->uid = ~0 ; +if (*e !='\0' ) { + ret = -EINVAL ; +printk (KERN_INFO "9p: Unknown access " +"argument %s.\n" , s); +kfree (s); + goto free_and_return; + } } +kfree (s);break ;
PATCH 86/244 fs/9p: Always ask new inode in create
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit ed80fcfac2565fa866d93ba14f0e75de17a8223e upstream.
This make sure we don't end up reusing the unlinked inode object. The ideal way is to use inode i_generation. But i_generation is not available in userspace always.
--- fs/9p/v9fs.h | 27 +++++++++++++++++++++++---- fs/9p/vfs_inode.c | 22 +++++++++++++++++----- fs/9p/vfs_inode_dotl.c | 30 +++++++++++++++++++++--------- 3 files changed, 61 insertions(+), 18 deletions(-)
fs/9p/v9fs.h +23 -4
@@ -153,13 +153,13 @@ extern void v9fs_vfs_put_link(struct den void *p);extern struct inode *v9fs_inode_from_fid (struct v9fs_session_info *v9ses,struct p9_fid *fid, -struct super_block *sb); +struct super_block *sb,int new);extern const struct inode_operations v9fs_dir_inode_operations_dotl;extern const struct inode_operations v9fs_file_inode_operations_dotl;extern const struct inode_operations v9fs_symlink_inode_operations_dotl;extern struct inode *v9fs_inode_from_fid_dotl (struct v9fs_session_info *v9ses,struct p9_fid *fid, -struct super_block *sb); +struct super_block *sb,int new);/* other default globals */ #define V9FS_PORT 564
@@ -201,8 +201,27 @@ v9fs_get_inode_from_fid(struct v9fs_sess struct super_block *sb) {if (v9fs_proto_dotl (v9ses)) -return v9fs_inode_from_fid_dotl (v9ses, fid, sb); +return v9fs_inode_from_fid_dotl (v9ses, fid, sb,0 );else -return v9fs_inode_from_fid (v9ses, fid, sb); +return v9fs_inode_from_fid (v9ses, fid, sb,0 ); } + +/** +* v9fs_get_new_inode_from_fid - Helper routine to populate an inode by +* issuing a attribute request +* @v9ses: session information +* @fid: fid to issue attribute request for +* @sb: superblock on which to create inode +* +*/ +static inline struct inode * +v9fs_get_new_inode_from_fid (struct v9fs_session_info *v9ses,struct p9_fid *fid, +struct super_block *sb) +{ +if (v9fs_proto_dotl (v9ses)) +return v9fs_inode_from_fid_dotl (v9ses, fid, sb,1 ); +else +return v9fs_inode_from_fid (v9ses, fid, sb,1 ); +} +#endif
fs/9p/vfs_inode.c +17 -5
@@ -454,6 +454,11 @@ static int v9fs_test_inode(struct inodereturn 1 ; } +static int v9fs_test_new_inode (struct inode *inode,void *data) +{ +return 0 ; +} +static int v9fs_set_inode (struct inode *inode,void *data) {struct v9fs_inode *v9inode =V9FS_I (inode);
@@ -465,15 +470,22 @@ static int v9fs_set_inode(struct inode *static struct inode *v9fs_qid_iget (struct super_block *sb,struct p9_qid *qid, -struct p9_wstat *st) +struct p9_wstat *st, +int new) {int retval, umode;unsigned long i_ino;struct inode *inode;struct v9fs_session_info *v9ses = sb->s_fs_info; +int (*test)(struct inode *,void *); + +if (new) + test = v9fs_test_new_inode; +else + test = v9fs_test_inode; i_ino =v9fs_qid2ino (qid); - inode =iget5_locked (sb, i_ino, v9fs_test_inode, v9fs_set_inode, st); + inode =iget5_locked (sb, i_ino, test, v9fs_set_inode, st);if (!inode)return ERR_PTR (-ENOMEM );if (!(inode->i_state &I_NEW ))
@@ -504,7 +516,7 @@ error:struct inode *v9fs_inode_from_fid (struct v9fs_session_info *v9ses,struct p9_fid *fid, -struct super_block *sb) +struct super_block *sb,int new) {struct p9_wstat *st;struct inode *inode =NULL ;
@@ -513,7 +525,7 @@ v9fs_inode_from_fid(struct v9fs_session_if (IS_ERR (st))return ERR_CAST (st); - inode =v9fs_qid_iget (sb, &st->qid, st); + inode =v9fs_qid_iget (sb, &st->qid, st, new);p9stat_free (st);kfree (st);return inode;
@@ -615,7 +627,7 @@ v9fs_create(struct v9fs_session_info *v9 }/* instantiate inode and assign the unopened fid to the dentry */ - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { err =PTR_ERR (inode);P9_DPRINTK (P9_DEBUG_VFS ,"inode creation failed %d\n" , err);
fs/9p/vfs_inode_dotl.c +21 -9
@@ -108,6 +108,12 @@ static int v9fs_test_inode_dotl(struct ireturn 1 ; } +/* Always get a new inode */ +static int v9fs_test_new_inode_dotl (struct inode *inode,void *data) +{ +return 0 ; +} +static int v9fs_set_inode_dotl (struct inode *inode,void *data) {struct v9fs_inode *v9inode =V9FS_I (inode);
@@ -121,16 +127,22 @@ static int v9fs_set_inode_dotl(struct instatic struct inode *v9fs_qid_iget_dotl (struct super_block *sb,struct p9_qid *qid,struct p9_fid *fid, -struct p9_stat_dotl *st) +struct p9_stat_dotl *st, +int new) {int retval;unsigned long i_ino;struct inode *inode;struct v9fs_session_info *v9ses = sb->s_fs_info; +int (*test)(struct inode *,void *); + +if (new) + test = v9fs_test_new_inode_dotl; +else + test = v9fs_test_inode_dotl; i_ino =v9fs_qid2ino (qid); - inode =iget5_locked (sb, i_ino, v9fs_test_inode_dotl, - v9fs_set_inode_dotl, st); + inode =iget5_locked (sb, i_ino, test, v9fs_set_inode_dotl, st);if (!inode)return ERR_PTR (-ENOMEM );if (!(inode->i_state &I_NEW ))
@@ -164,7 +176,7 @@ error:struct inode *v9fs_inode_from_fid_dotl (struct v9fs_session_info *v9ses,struct p9_fid *fid, -struct super_block *sb) +struct super_block *sb,int new) {struct p9_stat_dotl *st;struct inode *inode =NULL ;
@@ -173,7 +185,7 @@ v9fs_inode_from_fid_dotl(struct v9fs_sesif (IS_ERR (st))return ERR_CAST (st); - inode =v9fs_qid_iget_dotl (sb, &st->qid, fid, st); + inode =v9fs_qid_iget_dotl (sb, &st->qid, fid, st, new);kfree (st);return inode; }
@@ -263,7 +275,7 @@ v9fs_vfs_create_dotl(struct inode *dir, fid =NULL ; goto error; } - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { err =PTR_ERR (inode);P9_DPRINTK (P9_DEBUG_VFS ,"inode creation failed %d\n" , err);
@@ -383,7 +395,7 @@ static int v9fs_vfs_mkdir_dotl(struct in goto error; } - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { err =PTR_ERR (inode); P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
@@ -636,7 +648,7 @@ v9fs_vfs_symlink_dotl(struct inode *dir, }/* instantiate inode and assign the unopened fid to dentry */ - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { err =PTR_ERR (inode); P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
@@ -789,7 +801,7 @@ v9fs_vfs_mknod_dotl(struct inode *dir, s goto error; } - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { err =PTR_ERR (inode); P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
PATCH 87/244 net/9p: Fix the msize calculation.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Venkateswararao Jujjuri (JV)" <[email protected]>
commit c9ffb05ca5b5098d6ea468c909dd384d90da7d54 upstream.
msize represents the maximum PDU size that includes P9_IOHDRSZ.
--- net/9p/client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/9p/client.c +2 -2
@@ -822,8 +822,8 @@ struct p9_client *p9_client_create(constif (err) goto destroy_fidpool; -if ((clnt->msize+P9_IOHDRSZ ) > clnt->trans_mod->maxsize) - clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ ; +if (clnt->msize > clnt->trans_mod->maxsize) + clnt->msize = clnt->trans_mod->maxsize; err =p9_client_version (clnt);if (err)
PATCH 88/244 9p: close ACL leaks
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Al Viro <[email protected]>
commit 1ec95bf34d976b38897d1977b155a544d77b05e7 upstream.
--- fs/9p/acl.c | 22 +++++++++++++--------- fs/9p/acl.h | 6 +++--- fs/9p/vfs_inode_dotl.c | 9 ++++++--- 3 files changed, 22 insertions(+), 15 deletions(-)
fs/9p/acl.c +13 -9
@@ -185,12 +185,15 @@ int v9fs_acl_chmod(struct dentry *dentry }int v9fs_set_create_acl (struct dentry *dentry, -struct posix_acl *dpacl,struct posix_acl *pacl) +struct posix_acl **dpacl,struct posix_acl **pacl) { -v9fs_set_acl (dentry,ACL_TYPE_DEFAULT , dpacl); -v9fs_set_acl (dentry,ACL_TYPE_ACCESS , pacl); -posix_acl_release (dpacl); -posix_acl_release (pacl); +if (dentry) { +v9fs_set_acl (dentry,ACL_TYPE_DEFAULT , *dpacl); +v9fs_set_acl (dentry,ACL_TYPE_ACCESS , *pacl); + } +posix_acl_release (*dpacl); +posix_acl_release (*pacl); + *dpacl = *pacl =NULL ;return 0 ; }
@@ -212,11 +215,11 @@ int v9fs_acl_mode(struct inode *dir, modstruct posix_acl *clone;if (S_ISDIR (mode)) - *dpacl = acl; + *dpacl =posix_acl_dup (acl); clone =posix_acl_clone (acl,GFP_NOFS ); - retval = -ENOMEM ; +posix_acl_release (acl);if (!clone) - goto cleanup; +return -ENOMEM ; retval =posix_acl_create_masq (clone, &mode);if (retval <0 ) {
@@ -225,11 +228,12 @@ int v9fs_acl_mode(struct inode *dir, mod }if (retval >0 ) *pacl = clone; +else +posix_acl_release (clone); } *modep = mode;return 0 ; cleanup: -posix_acl_release (acl);return retval; }
fs/9p/acl.h +3 -3
@@ -19,7 +19,7 @@ extern int v9fs_get_acl(struct inode *,extern int v9fs_check_acl (struct inode *inode,int mask,unsigned int flags);extern int v9fs_acl_chmod (struct dentry *);extern int v9fs_set_create_acl (struct dentry *, -struct posix_acl *,struct posix_acl *); +struct posix_acl **,struct posix_acl **);extern int v9fs_acl_mode (struct inode *dir,mode_t *modep,struct posix_acl **dpacl,struct posix_acl **pacl);#else
@@ -33,8 +33,8 @@ static inline int v9fs_acl_chmod(structreturn 0 ; }static inline int v9fs_set_create_acl (struct dentry *dentry, -struct posix_acl *dpacl, -struct posix_acl *pacl) +struct posix_acl **dpacl, +struct posix_acl **pacl) {return 0 ; }
fs/9p/vfs_inode_dotl.c +6 -3
@@ -287,7 +287,7 @@ v9fs_vfs_create_dotl(struct inode *dir, goto error;/* Now set the ACL based on the default value */ -v9fs_set_create_acl (dentry, dacl, pacl); +v9fs_set_create_acl (dentry, &dacl, &pacl); v9inode =V9FS_I (inode);mutex_lock (&v9inode->v_mutex);
@@ -328,6 +328,7 @@ error: err_clunk_old_fid:if (ofid)p9_client_clunk (ofid); +v9fs_set_create_acl (NULL , &dacl, &pacl);return err; }
@@ -421,12 +422,13 @@ static int v9fs_vfs_mkdir_dotl(struct ind_instantiate (dentry, inode); }/* Now set the ACL based on the default value */ -v9fs_set_create_acl (dentry, dacl, pacl); +v9fs_set_create_acl (dentry, &dacl, &pacl);inc_nlink (dir);v9fs_invalidate_inode_attr (dir); error:if (fid)p9_client_clunk (fid); +v9fs_set_create_acl (NULL , &dacl, &pacl);return err; }
@@ -826,10 +828,11 @@ v9fs_vfs_mknod_dotl(struct inode *dir, sd_instantiate (dentry, inode); }/* Now set the ACL based on the default value */ -v9fs_set_create_acl (dentry, dacl, pacl); +v9fs_set_create_acl (dentry, &dacl, &pacl); error:if (fid)p9_client_clunk (fid); +v9fs_set_create_acl (NULL , &dacl, &pacl);return err; }
PATCH 89/244 irda: fix smsc-ircc2 section mismatch warning
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Randy Dunlap <[email protected]>
commit f470e5ae34d68880a38aa79ee5c102ebc2a1aef6 upstream.
Fix section mismatch warning:
WARNING: drivers/net/irda/smsc-ircc2.o(.devinit.text+0x1a7): Section mismatch in reference from the function smsc_ircc_pnp_probe() to the function .init.text:smsc_ircc_open()
--- drivers/net/irda/smsc-ircc2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/irda/smsc-ircc2.c +1 -1
@@ -515,7 +515,7 @@ static const struct net_device_ops smsc_* Try to open driver instance * */ -static int __init smsc_ircc_open (unsigned int fir_base,unsigned int sir_base,u8 dma,u8 irq) +static int __devinit smsc_ircc_open (unsigned int fir_base,unsigned int sir_base,u8 dma,u8 irq) {struct smsc_ircc_cb *self;struct net_device *dev;
PATCH 90/244 iommu/amd: Dont take domain->lock recursivly
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joerg Roedel <[email protected]>
commit e33acde91140f1809952d1c135c36feb66a51887 upstream.
The domain_flush_devices() function takes the domain->lock. But this function is only called from update_domain() which itself is already called unter the domain->lock. This causes a deadlock situation when the dma-address-space of a domain grows larger than 1GB.
--- arch/x86/kernel/amd_iommu.c | 5 ----- 1 file changed, 5 deletions(-)
arch/x86/kernel/amd_iommu.c +0 -5
@@ -773,14 +773,9 @@ static void domain_flush_complete(structstatic void domain_flush_devices (struct protection_domain *domain) {struct iommu_dev_data *dev_data; -unsigned long flags; - -spin_lock_irqsave (&domain->lock, flags);list_for_each_entry (dev_data, &domain->dev_list, list)device_flush_dte (dev_data->dev); - -spin_unlock_irqrestore (&domain->lock, flags); }/****************************************************************************
PATCH 91/244 iommu/amd: Make sure iommu->need_sync contains correct value
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joerg Roedel <[email protected]>
commit f1ca1512e765337a7c09eb875eedef8ea4e07654 upstream.
The value is only set to true but never set back to false, which causes to many completion-wait commands to be sent to hardware. Fix it with this patch.
--- arch/x86/kernel/amd_iommu.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
arch/x86/kernel/amd_iommu.c +10 -3
@@ -531,7 +531,9 @@ static void build_inv_all(struct iommu_c* Writes the command to the IOMMUs command buffer and informs the * hardware about the new command. */ -static int iommu_queue_command (struct amd_iommu *iommu,struct iommu_cmd *cmd) +static int iommu_queue_command_sync (struct amd_iommu *iommu, +struct iommu_cmd *cmd, +bool sync) {u32 left, tail, head, next_tail;unsigned long flags;
@@ -565,13 +567,18 @@ again:copy_cmd_to_buffer (iommu, cmd, tail);/* We need to sync now to make sure all commands are processed */ - iommu->need_sync = true; + iommu->need_sync = sync;spin_unlock_irqrestore (&iommu->lock, flags);return 0 ; } +static int iommu_queue_command (struct amd_iommu *iommu,struct iommu_cmd *cmd) +{ +return iommu_queue_command_sync (iommu, cmd, true); +} +/* * This function queues a completion wait command into the command * buffer of an IOMMU
@@ -587,7 +594,7 @@ static int iommu_completion_wait(structbuild_completion_wait (&cmd, (u64)&sem); - ret =iommu_queue_command (iommu, &cmd); + ret =iommu_queue_command_sync (iommu, &cmd, false);if (ret)return ret;
PATCH 92/244 ACPICA: Do not repair _TSS return package if _PSS is present
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Fenghua Yu <[email protected]>
commit 8f9c91273e36e5762c617c23e4fd48d5172e0dac upstream.
We can only sort the _TSS return package if there is no _PSS in the same scope. This is because if _PSS is present, the ACPI specification dictates that the _TSS Power Dissipation field is to be ignored, and therefore some BIOSs leave garbage values in the _TSS Power field(s). In this case, it is best to just return the _TSS package as-is.
--- drivers/acpi/acpica/aclocal.h | 1 + drivers/acpi/acpica/nspredef.c | 1 + drivers/acpi/acpica/nsrepair2.c | 15 +++++++++++++++ 3 files changed, 17 insertions(+)
drivers/acpi/acpica/aclocal.h +1 -0
@@ -357,6 +357,7 @@ struct acpi_predefined_data {char *pathname;const union acpi_predefined_info *predefined;union acpi_operand_object *parent_package; +struct acpi_namespace_node *node;u32 flags;u8 node_flags; };
drivers/acpi/acpica/nspredef.c +1 -0
@@ -212,6 +212,7 @@ acpi_ns_check_predefined_names(struct ac goto cleanup; } data->predefined = predefined; + data->node = node; data->node_flags = node->flags; data->pathname = pathname;
drivers/acpi/acpica/nsrepair2.c +15 -0
@@ -503,6 +503,21 @@ acpi_ns_repair_TSS(struct acpi_predefine {union acpi_operand_object *return_object = *return_object_ptr;acpi_status status; +struct acpi_namespace_node *node; + +/* +* We can only sort the _TSS return package if there is no _PSS in the +* same scope. This is because if _PSS is present, the ACPI specification +* dictates that the _TSS Power Dissipation field is to be ignored, and +* therefore some BIOSs leave garbage values in the _TSS Power field(s). +* In this case, it is best to just return the _TSS package as-is. +* (May, 2011) +*/ + status = +acpi_ns_get_node (data->node,"^_PSS" ,ACPI_NS_NO_UPSEARCH , &node); +if (ACPI_SUCCESS (status)) { +return (AE_OK ); + } status = acpi_ns_check_sorted_list(data, return_object, 5, 1, ACPI_SORT_DESCENDING,
PATCH 93/244 fs/9p: Add fid before dentry instantiation
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit 5441ae5eb3614d3c28f77073370738a2820c88e4 upstream.
d_instantiate marks the dentry positive. So a parallel lookup and mkdir of the directory can find dentry that doesn't have fid attached. This can result in both the code path doing v9fs_fid_add which results in v9fs_dentry leak.
--- fs/9p/vfs_inode.c | 4 +--- fs/9p/vfs_inode_dotl.c | 8 ++++---- 2 files changed, 5 insertions(+), 7 deletions(-)
fs/9p/vfs_inode.c +1 -3
@@ -633,13 +633,11 @@ v9fs_create(struct v9fs_session_info *v9P9_DPRINTK (P9_DEBUG_VFS ,"inode creation failed %d\n" , err); goto error; } -d_instantiate (dentry, inode); err =v9fs_fid_add (dentry, fid);if (err <0 ) goto error; - +d_instantiate (dentry, inode);return ofid; - error:if (ofid)p9_client_clunk (ofid);
fs/9p/vfs_inode_dotl.c +4 -4
@@ -281,10 +281,10 @@ v9fs_vfs_create_dotl(struct inode *dir,P9_DPRINTK (P9_DEBUG_VFS ,"inode creation failed %d\n" , err); goto error; } -d_instantiate (dentry, inode); err =v9fs_fid_add (dentry, fid);if (err <0 ) goto error; +d_instantiate (dentry, inode);/* Now set the ACL based on the default value */ v9fs_set_create_acl (dentry, &dacl, &pacl);
@@ -403,10 +403,10 @@ static int v9fs_vfs_mkdir_dotl(struct in err); goto error; } -d_instantiate (dentry, inode); err =v9fs_fid_add (dentry, fid);if (err <0 ) goto error; +d_instantiate (dentry, inode); fid =NULL ; }else {/*
@@ -657,10 +657,10 @@ v9fs_vfs_symlink_dotl(struct inode *dir, err); goto error; } -d_instantiate (dentry, inode); err =v9fs_fid_add (dentry, fid);if (err <0 ) goto error; +d_instantiate (dentry, inode); fid =NULL ; }else {/* Not in cached mode. No need to populate inode with stat */
@@ -810,10 +810,10 @@ v9fs_vfs_mknod_dotl(struct inode *dir, s err); goto error; } -d_instantiate (dentry, inode); err =v9fs_fid_add (dentry, fid);if (err <0 ) goto error; +d_instantiate (dentry, inode); fid =NULL ; }else {/*
PATCH 94/244 fs/9p: Dont update file type when updating file attributes
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit 45089142b1497dab2327d60f6c71c40766fc3ea4 upstream.
We should only update attributes that we can change on stat2inode. Also do file type initialization in v9fs_init_inode.
--- fs/9p/v9fs_vfs.h | 4 +- fs/9p/vfs_inode.c | 91 ++++++++++++++++++++++++++----------------------- fs/9p/vfs_inode_dotl.c | 23 ++++++++---- fs/9p/vfs_super.c | 2 - 4 files changed, 68 insertions(+), 52 deletions(-)
fs/9p/v9fs_vfs.h +2 -2
@@ -54,9 +54,9 @@ extern struct kmem_cache *v9fs_inode_cacstruct inode *v9fs_alloc_inode (struct super_block *sb);void v9fs_destroy_inode (struct inode *inode); -struct inode *v9fs_get_inode (struct super_block *sb,int mode); +struct inode *v9fs_get_inode (struct super_block *sb,int mode,dev_t );int v9fs_init_inode (struct v9fs_session_info *v9ses, -struct inode *inode,int mode); +struct inode *inode,int mode,dev_t );void v9fs_evict_inode (struct inode *inode);ino_t v9fs_qid2ino (struct p9_qid *qid);void v9fs_stat2inode (struct p9_wstat *,struct inode *,struct super_block *);
fs/9p/vfs_inode.c +50 -41
195 lines not on this page · raw message
fs/9p/vfs_inode_dotl.c +15 -8
@@ -153,7 +153,8 @@ static struct inode *v9fs_qid_iget_dotl(* later. */ inode->i_ino = i_ino; - retval =v9fs_init_inode (v9ses, inode, st->st_mode); + retval =v9fs_init_inode (v9ses, inode, + st->st_mode,new_decode_dev (st->st_rdev));if (retval) goto error;
@@ -414,7 +415,7 @@ static int v9fs_vfs_mkdir_dotl(struct in* inode with stat. We need to get an inode * so that we can set the acl with dentry */ - inode =v9fs_get_inode (dir->i_sb, mode); + inode =v9fs_get_inode (dir->i_sb, mode,0 );if (IS_ERR (inode)) { err =PTR_ERR (inode); goto error;
@@ -540,6 +541,7 @@ int v9fs_vfs_setattr_dotl(struct dentryvoid v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode) { +mode_t mode;struct v9fs_inode *v9inode =V9FS_I (inode);if ((stat->st_result_mask &P9_STATS_BASIC ) ==P9_STATS_BASIC ) {
@@ -552,11 +554,10 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl inode->i_uid = stat->st_uid; inode->i_gid = stat->st_gid; inode->i_nlink = stat->st_nlink; - inode->i_mode = stat->st_mode; - inode->i_rdev =new_decode_dev (stat->st_rdev); -if ((S_ISBLK (inode->i_mode)) || (S_ISCHR (inode->i_mode))) -init_special_inode (inode, inode->i_mode, inode->i_rdev); + mode = stat->st_mode &S_IALLUGO ; + mode |= inode->i_mode & ~S_IALLUGO ; + inode->i_mode = mode;i_size_write (inode, stat->st_size); inode->i_blocks = stat->st_blocks;
@@ -664,7 +665,7 @@ v9fs_vfs_symlink_dotl(struct inode *dir, fid =NULL ; }else {/* Not in cached mode. No need to populate inode with stat */ - inode =v9fs_get_inode (dir->i_sb,S_IFLNK ); + inode =v9fs_get_inode (dir->i_sb,S_IFLNK ,0 );if (IS_ERR (inode)) { err =PTR_ERR (inode); goto error;
@@ -820,7 +821,7 @@ v9fs_vfs_mknod_dotl(struct inode *dir, s* Not in cached mode. No need to populate inode with stat. * socket syscall returns a fd, so we need instantiate */ - inode =v9fs_get_inode (dir->i_sb, mode); + inode =v9fs_get_inode (dir->i_sb, mode, rdev);if (IS_ERR (inode)) { err =PTR_ERR (inode); goto error;
@@ -886,6 +887,11 @@ int v9fs_refresh_inode_dotl(struct p9_fi st =p9_client_getattr_dotl (fid,P9_STATS_ALL );if (IS_ERR (st))return PTR_ERR (st); +/* +* Don't update inode if the file type is different +*/ +if ((inode->i_mode &S_IFMT ) != (st->st_mode &S_IFMT )) + goto out;spin_lock (&inode->i_lock);/*
@@ -897,6 +903,7 @@ int v9fs_refresh_inode_dotl(struct p9_fiif (v9ses->cache) inode->i_size = i_size;spin_unlock (&inode->i_lock); +out:kfree (st);return 0 ; }
fs/9p/vfs_super.c +1 -1
@@ -149,7 +149,7 @@ static struct dentry *v9fs_mount(structelse sb->s_d_op = &v9fs_dentry_operations; - inode =v9fs_get_inode (sb,S_IFDIR | mode); + inode =v9fs_get_inode (sb,S_IFDIR | mode,0 );if (IS_ERR (inode)) { retval =PTR_ERR (inode); goto release_sb;
PATCH 95/244 fs/9p: Add OS dependent open flags in 9p protocol
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit f88657ce3f9713a0c62101dffb0e972a979e77b9 upstream.
Some of the flags are OS/arch dependent we add a 9p
protocol value which maps to asm-generic/fcntl.h values in Linux
Based on the original patch from Venkateswararao Jujjuri <[email protected]>
[extra comments from author as to why this needs to go to stable:
Earlier for different operation such as open we used the values of open flag as defined by the OS. But some of these flags such as O_DIRECT are arch dependent. So if we have the 9p client and server running on different architectures, we end up with client sending client architecture value of these open flag and server will try to map these values to what its architecture states. For ex: O_DIRECT on a x86 client maps to
#define O_DIRECT 00040000
Where as on sparc server it will maps to
#define O_DIRECT 0x100000
Hence we need to map these open flags to OS/arch independent flag values. Getting these changes to an early version of kernel ensures us that we work with different combination of client and server. We should ideally backport this patch to all possible kernel version.]
--- fs/9p/v9fs_vfs.h | 2 + fs/9p/vfs_file.c | 2 - fs/9p/vfs_inode_dotl.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++- include/net/9p/9p.h | 24 +++++++++++++++++++++ 4 files changed, 81 insertions(+), 2 deletions(-)
fs/9p/v9fs_vfs.h +2 -0
@@ -82,4 +82,6 @@ static inline void v9fs_invalidate_inode v9inode->cache_validity |=V9FS_INO_INVALID_ATTR ; return; } + +int v9fs_open_to_dotl_flags (int flags);#endif
fs/9p/vfs_file.c +1 -1
@@ -65,7 +65,7 @@ int v9fs_file_open(struct inode *inode, v9inode =V9FS_I (inode); v9ses =v9fs_inode2v9ses (inode);if (v9fs_proto_dotl (v9ses)) - omode = file->f_flags; + omode =v9fs_open_to_dotl_flags (file->f_flags);else omode =v9fs_uflags2omode (file->f_flags,v9fs_proto_dotu (v9ses));
fs/9p/vfs_inode_dotl.c +54 -1
67 lines not on this page · raw message
include/net/9p/9p.h +24 -0
@@ -278,6 +278,30 @@ enum p9_perm_t { P9_DMSETVTX = 0x00010000, }; +/* 9p2000.L open flags */ +#define P9_DOTL_RDONLY 00000000 +#define P9_DOTL_WRONLY 00000001 +#define P9_DOTL_RDWR 00000002 +#define P9_DOTL_NOACCESS 00000003 +#define P9_DOTL_CREATE 00000100 +#define P9_DOTL_EXCL 00000200 +#define P9_DOTL_NOCTTY 00000400 +#define P9_DOTL_TRUNC 00001000 +#define P9_DOTL_APPEND 00002000 +#define P9_DOTL_NONBLOCK 00004000 +#define P9_DOTL_DSYNC 00010000 +#define P9_DOTL_FASYNC 00020000 +#define P9_DOTL_DIRECT 00040000 +#define P9_DOTL_LARGEFILE 00100000 +#define P9_DOTL_DIRECTORY 00200000 +#define P9_DOTL_NOFOLLOW 00400000 +#define P9_DOTL_NOATIME 01000000 +#define P9_DOTL_CLOEXEC 02000000 +#define P9_DOTL_SYNC 04000000 + +/* 9p2000.L at flags */ +#define P9_DOTL_AT_REMOVEDIR 0x200 +/** * enum p9_qid_t - QID types * @P9_QTDIR: directory
PATCH 96/244 net/9p: Fix kernel crash with msize 512K
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit b49d8b5d7007a673796f3f99688b46931293873e upstream.
With msize equal to 512K (PAGE_SIZE * VIRTQUEUE_NUM), we hit multiple crashes. This patch fix those.
--- net/9p/trans_virtio.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
net/9p/trans_virtio.c +12 -5
@@ -263,7 +263,6 @@ p9_virtio_request(struct p9_client *clie {int in, out, inp, outp;struct virtio_chan *chan = client->trans; -char *rdata = (char *)req->rc+sizeof (struct p9_fcall );unsigned long flags;size_t pdata_off =0 ;struct trans_rpage_info *rpinfo =NULL ;
@@ -346,7 +345,8 @@ req_retry_pinned:* Arrange in such a way that server places header in the * alloced memory and payload onto the user buffer. */ - inp =pack_sg_list (chan->sg, out,VIRTQUEUE_NUM , rdata,11 ); + inp =pack_sg_list (chan->sg, out, +VIRTQUEUE_NUM , req->rc->sdata,11 );/* * Running executables in the filesystem may result in * a read request with kernel buffer as opposed to user buffer.
@@ -366,8 +366,8 @@ req_retry_pinned: } in += inp; }else { - in =pack_sg_list (chan->sg, out,VIRTQUEUE_NUM , rdata, - req->rc->capacity); + in =pack_sg_list (chan->sg, out,VIRTQUEUE_NUM , + req->rc->sdata, req->rc->capacity); } err =virtqueue_add_buf (chan->vq, chan->sg, out, in, req->tc);
@@ -592,7 +592,14 @@ static struct p9_trans_module p9_virtio_ .close = p9_virtio_close, .request = p9_virtio_request, .cancel = p9_virtio_cancel, - .maxsize = PAGE_SIZE*VIRTQUEUE_NUM, + +/* +* We leave one entry for input and one entry for response +* headers. We also skip one more entry to accomodate, address +* that are not at page boundary, that can result in an extra +* page in zero copy. +*/ + .maxsize = PAGE_SIZE * (VIRTQUEUE_NUM - 3), .pref = P9_TRANS_PREF_PAYLOAD_SEP, .def = 0, .owner = THIS_MODULE,
PATCH 97/244 fs/9p: Always ask new inode in lookup for cache mode disabled
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit 73f507171cfa407b19f254aef95cbb058c8180cf upstream.
This make sure we don't end up reusing the unlinked inode object. The ideal way is to use inode i_generation. But i_generation is not available in userspace always.
--- fs/9p/vfs_inode.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
fs/9p/vfs_inode.c +21 -7
@@ -799,6 +799,7 @@ static int v9fs_vfs_mkdir(struct inode *struct dentry *v9fs_vfs_lookup (struct inode *dir,struct dentry *dentry,struct nameidata *nameidata) { +struct dentry *res;struct super_block *sb;struct v9fs_session_info *v9ses;struct p9_fid *dfid, *fid;
@@ -830,22 +831,35 @@ struct dentry *v9fs_vfs_lookup(struct inreturn ERR_PTR (result); } - - inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); +/* +* Make sure we don't use a wrong inode due to parallel +* unlink. For cached mode create calls request for new +* inode. But with cache disabled, lookup should do this. +*/ +if (v9ses->cache) + inode =v9fs_get_inode_from_fid (v9ses, fid, dir->i_sb); +else + inode =v9fs_get_new_inode_from_fid (v9ses, fid, dir->i_sb);if (IS_ERR (inode)) { result =PTR_ERR (inode); inode =NULL ; goto error; } - result =v9fs_fid_add (dentry, fid);if (result <0 ) goto error_iput; - inst_out: -d_add (dentry, inode); -return NULL ; - +/* +* If we had a rename on the server and a parallel lookup +* for the new name, then make sure we instantiate with +* the new name. ie look up for a/b, while on server somebody +* moved b under k and client parallely did a lookup for +* k/b. +*/ + res =d_materialise_unique (dentry, inode); +if (!IS_ERR (res)) +return res; + result =PTR_ERR (res); error_iput:iput (inode); error:
PATCH 98/244 fs/9p: Use protocol-defined value for lock/getlock type field.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jim Garlick <[email protected]>
commit 51b8b4fb32271d39fbdd760397406177b2b0fd36 upstream.
--- fs/9p/vfs_file.c | 34 +++++++++++++++++++++++++++------- include/net/9p/9p.h | 5 +++++ 2 files changed, 32 insertions(+), 7 deletions(-)
fs/9p/vfs_file.c +27 -7
@@ -169,7 +169,18 @@ static int v9fs_file_do_lock(struct file/* convert posix lock to p9 tlock args */ memset (&flock,0 ,sizeof (flock)); - flock.type = fl->fl_type; +/* map the lock type */ +switch (fl->fl_type) { +case F_RDLCK : + flock.type =P9_LOCK_TYPE_RDLCK ; +break ; +case F_WRLCK : + flock.type =P9_LOCK_TYPE_WRLCK ; +break ; +case F_UNLCK : + flock.type =P9_LOCK_TYPE_UNLCK ; +break ; + } flock.start = fl->fl_start;if (fl->fl_end ==OFFSET_MAX ) flock.length =0 ;
@@ -245,7 +256,7 @@ static int v9fs_file_getlock(struct file/* convert posix lock to p9 tgetlock args */ memset (&glock,0 ,sizeof (glock)); - glock.type = fl->fl_type; + glock.type =P9_LOCK_TYPE_UNLCK ; glock.start = fl->fl_start;if (fl->fl_end ==OFFSET_MAX ) glock.length =0 ;
@@ -257,17 +268,26 @@ static int v9fs_file_getlock(struct file res =p9_client_getlock_dotl (fid, &glock);if (res <0 )return res; -if (glock.type !=F_UNLCK ) { - fl->fl_type = glock.type; +/* map 9p lock type to os lock type */ +switch (glock.type) { +case P9_LOCK_TYPE_RDLCK : + fl->fl_type =F_RDLCK ; +break ; +case P9_LOCK_TYPE_WRLCK : + fl->fl_type =F_WRLCK ; +break ; +case P9_LOCK_TYPE_UNLCK : + fl->fl_type =F_UNLCK ; +break ; + } +if (glock.type !=P9_LOCK_TYPE_UNLCK ) { fl->fl_start = glock.start;if (glock.length ==0 ) fl->fl_end =OFFSET_MAX ;else fl->fl_end = glock.start + glock.length -1 ; fl->fl_pid = glock.proc_id; - }else - fl->fl_type =F_UNLCK ; - + }return res; }
include/net/9p/9p.h +5 -0
@@ -344,6 +344,11 @@ enum p9_qid_t {/* Room for readdir header */ #define P9_READDIRHDRSZ 24 +/* 9p2000.L lock type */ +#define P9_LOCK_TYPE_RDLCK 0 +#define P9_LOCK_TYPE_WRLCK 1 +#define P9_LOCK_TYPE_UNLCK 2 +/** * struct p9_str - length prefixed string type * @len: length of the string
PATCH 99/244 PCI: Set PCI-E Max Payload Size on fabric
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jon Mason <[email protected]>
commit b03e7495a862b028294f59fc87286d6d78ee7fa1 upstream.
On a given PCI-E fabric, each device, bridge, and root port can have a different PCI-E maximum payload size. There is a sizable performance boost for having the largest possible maximum payload size on each PCI-E device. However, if improperly configured, fatal bus errors can occur. Thus, it is important to ensure that PCI-E payloads sends by a device are never larger than the MPS setting of all devices on the way to the destination.
This can be achieved two ways:
- A conservative approach is to use the smallest common denominator of the entire tree below a root complex for every device on that fabric.
This means for example that having a 128 bytes MPS USB controller on one leg of a switch will dramatically reduce performances of a video card or 10GE adapter on another leg of that same switch.
It also means that any hierarchy supporting hotplug slots (including expresscard or thunderbolt I suppose, dbl check that) will have to be entirely clamped to 128 bytes since we cannot predict what will be plugged into those slots, and we cannot change the MPS on a "live" system.
- A more optimal way is possible, if it falls within a couple of constraints:
* The top-level host bridge will never generate packets larger than the smallest TLP (or if it can be controlled independently from its MPS at least)
* The device will never generate packets larger than MPS (which can be configured via MRRS)
* No support of direct PCI-E <-> PCI-E transfers between devices without some additional code to specifically deal with that case
Then we can use an approach that basically ignores downstream requests and focuses exclusively on upstream requests. In that case, all we need to care about is that a device MPS is no larger than its parent MPS, which allows us to keep all switches/bridges to the max MPS supported by their parent and eventually the PHB.
In this case, your USB controller would no longer "starve" your 10GE Ethernet and your hotplug slots won't affect your global MPS. Additionally, the hotplugged devices themselves can be configured to a larger MPS up to the value configured in the hotplug bridge.
To choose between the two available options, two PCI kernel boot args have been added to the PCI calls. "pcie_bus_safe" will provide the former behavior, while "pcie_bus_perf" will perform the latter behavior. By default, the latter behavior is used.
NOTE: due to the location of the enablement, each arch will need to add calls to this function. This patch only enables x86.
This patch includes a number of changes recommended by Benjamin Herrenschmidt.
--- arch/x86/pci/acpi.c | 9 ++ drivers/pci/hotplug/pcihp_slot.c | 45 ------------ drivers/pci/pci.c | 67 ++++++++++++++++++ drivers/pci/probe.c | 145 +++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 15 +++- 5 files changed, 236 insertions(+), 45 deletions(-)
arch/x86/pci/acpi.c +9 -0
@@ -361,6 +361,15 @@ struct pci_bus * __devinit pci_acpi_scan } } +/* After the PCI-E bus has been walked and all devices discovered, +* configure any settings of the fabric that might be necessary. +*/ +if (bus) { +struct pci_bus *child; +list_for_each_entry (child, &bus->children, node) +pcie_bus_configure_settings (child, child->self->pcie_mpss); + } +if (!bus)kfree (sd);
drivers/pci/hotplug/pcihp_slot.c +1 -44
57 lines not on this page · raw message
drivers/pci/pci.c +67 -0
85 lines not on this page · raw message
drivers/pci/probe.c +145 -0
157 lines not on this page · raw message
include/linux/pci.h +14 -1
@@ -251,7 +251,8 @@ struct pci_dev {u8 revision;/* PCI revision, low byte of class word */ u8 hdr_type;/* PCI header type (`multi' flag masked out) */ u8 pcie_cap;/* PCI-E capability offset */ -u8 pcie_type;/* PCI-E device/port type */ + u8 pcie_type:4; /* PCI-E device/port type */ + u8 pcie_mpss:3; /* PCI-E Max Payload Size Supported */u8 rom_base_reg;/* which config register controls the ROM */ u8 pin;/* which interrupt pin this device uses */
@@ -617,6 +618,16 @@ struct pci_driver {/* these external functions are only available when PCI support is enabled */ #ifdef CONFIG_PCI +extern void pcie_bus_configure_settings (struct pci_bus *bus,u8 smpss); + +enum pcie_bus_config_types { +PCIE_BUS_PERFORMANCE , +PCIE_BUS_SAFE , +PCIE_BUS_PEER2PEER , +}; + +extern enum pcie_bus_config_types pcie_bus_config; +extern struct bus_type pci_bus_type;/* Do NOT directly access these two variables, unless you are arch specific pci
@@ -796,6 +807,8 @@ int pcix_get_mmrbc(struct pci_dev *dev);int pcix_set_mmrbc (struct pci_dev *dev,int mmrbc);int pcie_get_readrq (struct pci_dev *dev);int pcie_set_readrq (struct pci_dev *dev,int rq); +int pcie_get_mps (struct pci_dev *dev); +int pcie_set_mps (struct pci_dev *dev,int mps);int __pci_reset_function (struct pci_dev *dev);int pci_reset_function (struct pci_dev *dev);void pci_update_resource (struct pci_dev *dev,int resno);
Bjorn Helgaas
maintainerRe: [099/244] PCI: Set PCI-E Max Payload Size on fabric
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
I object to this :) I think the following patches should be omitted from -stable:
[099/244] PCI: Set PCI-E Max Payload Size on fabric [100/244] PCI: export pcie_bus_configure_settings symbol [101/244] PCI: Remove MRRS modification from MPS setting code [212/244] pci: Dont crash when reading mpss from root complex
I've heard rumors that these patches are required to make 3.0 boot on some machines, but I don't really believe it, and I haven't seen the problem reports myself.
Also, these patches introduce an open regression (Avi's e1000e problem). Jon has mooted a patch that we hope will fix the regression, but I'm still not confident that this is all safe for 3.1, much less 3.0-stable.
Quoted 450 lines
------------------
From: Jon Mason <[email protected]>
commit
b03e7495a862b028294f59fc87286d6d78ee7fa1upstream.On a given PCI-E fabric, each device, bridge, and root port can have a different PCI-E maximum payload size. There is a sizable performance boost for having the largest possible maximum payload size on each PCI-E device. However, if improperly configured, fatal bus errors can occur. Thus, it is important to ensure that PCI-E payloads sends by a device are never larger than the MPS setting of all devices on the way to the destination.
This can be achieved two ways:
- A conservative approach is to use the smallest common denominator of the entire tree below a root complex for every device on that fabric.
This means for example that having a 128 bytes MPS USB controller on one leg of a switch will dramatically reduce performances of a video card or 10GE adapter on another leg of that same switch.
It also means that any hierarchy supporting hotplug slots (including expresscard or thunderbolt I suppose, dbl check that) will have to be entirely clamped to 128 bytes since we cannot predict what will be plugged into those slots, and we cannot change the MPS on a "live" system.
- A more optimal way is possible, if it falls within a couple of constraints:
* The top-level host bridge will never generate packets larger than the smallest TLP (or if it can be controlled independently from its MPS at least)
* The device will never generate packets larger than MPS (which can be configured via MRRS)
* No support of direct PCI-E <-> PCI-E transfers between devices without some additional code to specifically deal with that caseThen we can use an approach that basically ignores downstream requests and focuses exclusively on upstream requests. In that case, all we need to care about is that a device MPS is no larger than its parent MPS, which allows us to keep all switches/bridges to the max MPS supported by their parent and eventually the PHB.
In this case, your USB controller would no longer "starve" your 10GE Ethernet and your hotplug slots won't affect your global MPS. Additionally, the hotplugged devices themselves can be configured to a larger MPS up to the value configured in the hotplug bridge.
To choose between the two available options, two PCI kernel boot args have been added to the PCI calls. "pcie_bus_safe" will provide the former behavior, while "
pcie_bus_perf" will perform the latter behavior. By default, the latter behavior is used.NOTE: due to the location of the enablement, each arch will need to add calls to this function. This patch only enables x86.
This patch includes a number of changes recommended by Benjamin Herrenschmidt.
Tested-by [email protected]Signed-off-by Jon Mason <[email protected]>Signed-off-by Jesse Barnes <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
arch/x86/pci/acpi.c | 9 ++drivers/pci/hotplug/pcihp_slot.c| 45 ------------drivers/pci/pci.c| 67 ++++++++++++++++++drivers/pci/probe.c| 145 +++++++++++++++++++++++++++++++++++++++include/linux/pci.h| 15 +++-5 files changed, 236 insertions(+), 45 deletions(-)arch/x86/pci/acpi.c +9
-0@@ -361,6 +361,15 @@ struct pci_bus * __devinit pci_acpi_scan } } + /* After the PCI-E bus has been walked and all devices discovered, + * configure any settings of the fabric that might be necessary. + */ + if (bus) { + struct pci_bus *child; + list_for_each_entry(child, &bus->children, node) + pcie_bus_configure_settings(child, child->self->pcie_mpss); + } + if (!bus) kfree(sd);drivers/pci/hotplug/pcihp_slot.c +1
-44@@ -158,47 +158,6 @@ static void program_hpp_type2(struct pci*/ } -/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */ -static int pci_set_payload (struct pci_dev *dev) -{ - int pos, ppos; - u16 pctl, psz; - u16 dctl, dsz, dcap, dmax; - struct pci_dev *parent; - - parent = dev->bus->self; - pos = pci_find_capability(dev, PCI_CAP_ID_EXP); - if (!pos) - return 0; - - /* Read Device MaxPayload capability and setting */ - pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl); - pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap); - dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; - dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD); - - /* Read Parent MaxPayload setting */ - ppos = pci_find_capability(parent, PCI_CAP_ID_EXP); - if (!ppos) - return 0; - pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl); - psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; - - /* If parent payload > device max payload -> error - * If parent payload > device payload -> set speed - * If parent payload <= device payload -> do nothing - */ - if (psz > dmax) - return -1; - else if (psz > dsz) { - dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz); - pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, - (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) + - (psz << 5)); - } - return 0; -} - void pci_configure_slot(struct pci_dev *dev) { struct pci_dev *cdev;@@ -210,9 +169,7 @@ void pci_configure_slot(struct pci_dev * (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) return; - ret = pci_set_payload(dev); - if (ret) - dev_warn(&dev->dev, "could not set device max payload\n"); + pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss); memset(&hpp, 0, sizeof(hpp)); ret = pci_get_hp_params(dev, &hpp);drivers/pci/pci.c +67
-0@@ -77,6 +77,8 @@ unsigned long pci_cardbus_mem_size = DEF unsigned long pci_hotplug_io_size = DEFAULT_HOTPLUG_IO_SIZE; unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE; +enum pcie_bus_config_types pcie_bus_config =PCIE_BUS_PERFORMANCE ; + /** The default CLS is used if arch didn't set CLS explicitly and not * all pci devices agree on the same value. Arch can override either @@ -3223,6 +3225,67 @@ out: EXPORT_SYMBOL(pcie_set_readrq); /** +* pcie_get_mps - get PCI Express maximum payload size +* @dev: PCI device to query +* +* Returns maximum payload size in bytes +* or appropriate error value. +*/ +int pcie_get_mps (struct pci_dev *dev) +{ + int ret, cap; + u16 ctl; + + cap = pci_pcie_cap(dev); + if (!cap) + return -EINVAL; + + ret = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl); + if (!ret) + ret = 128 << ((ctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5); + + return ret; +} + +/** +* pcie_set_mps - set PCI Express maximum payload size +* @dev: PCI device to query +* @rq: maximum payload size in bytes +* valid values are 128, 256, 512, 1024, 2048, 4096 +* +* If possible sets maximum payload size +*/ +int pcie_set_mps (struct pci_dev *dev,int mps) +{ + int cap, err = -EINVAL; + u16 ctl, v; + + if (mps < 128 || mps > 4096 || !is_power_of_2(mps)) + goto out; + + v = ffs(mps) - 8; + if (v > dev->pcie_mpss) + goto out; + v <<= 5; + + cap = pci_pcie_cap(dev); + if (!cap) + goto out; + + err = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl); + if (err) + goto out; + + if ((ctl & PCI_EXP_DEVCTL_PAYLOAD) != v) { + ctl &= ~PCI_EXP_DEVCTL_PAYLOAD; + ctl |= v; + err = pci_write_config_word(dev, cap + PCI_EXP_DEVCTL, ctl); + } +out: + return err; +} + +/** * pci_select_bars - Make BAR mask from the type of resource * @dev: the PCI device for which BAR mask is made * @flags: resource type mask to be selected @@ -3505,6 +3568,10 @@ static int __init pci_setup(char *str) pci_hotplug_io_size = memparse(str + 9, &str); } else if (!strncmp(str, "hpmemsize=", 10)) { pci_hotplug_mem_size = memparse(str + 10, &str); + } else if (!strncmp(str, "pcie_bus_safe", 13)) { + pcie_bus_config = PCIE_BUS_SAFE; + } else if (!strncmp(str, "pcie_bus_perf", 13)) { + pcie_bus_config = PCIE_BUS_PERFORMANCE; } else { printk(KERN_ERR "PCI: Unknown option `%s'\n", str);drivers/pci/probe.c +145
-0@@ -860,6 +860,8 @@ void set_pcie_port_type(struct pci_dev * pdev->pcie_cap = pos; pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, ®16); pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4; + pci_read_config_word(pdev, pos + PCI_EXP_DEVCAP, ®16); + pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD; } void set_pcie_hotplug_bridge(struct pci_dev *pdev)@@ -1327,6 +1329,149 @@ int pci_scan_slot(struct pci_bus *bus, i return nr; } +static int pcie_find_smpss (struct pci_dev *dev,void *data) +{ + u8 *smpss = data; + + if (!pci_is_pcie(dev)) + return 0; + + /* For PCIE hotplug enabled slots not connected directly to a + * PCI-E root port, there can be problems when hotplugging + * devices. This is due to the possibility of hotplugging a + * device into the fabric with a smaller MPS that the devices + * currently running have configured. Modifying the MPS on the + * running devices could cause a fatal bus error due to an + * incoming frame being larger than the newly configured MPS. + * To work around this, the MPS for the entire fabric must be + * set to the minimum size. Any devices hotplugged into this + * fabric will have the minimum MPS set. If the PCI hotplug + * slot is directly connected to the root port and there are not + * other devices on the fabric (which seems to be the most + * common case), then this is not an issue and MPS discovery + * will occur as normal. + */ + if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) || + dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT)) + *smpss = 0; + + if (*smpss > dev->pcie_mpss) + *smpss = dev->pcie_mpss; + + return 0; +} + +static void pcie_write_mps (struct pci_dev *dev,int mps) +{ + int rc, dev_mpss; + + dev_mpss = 128 << dev->pcie_mpss; + + if (pcie_bus_config == PCIE_BUS_PERFORMANCE) { + if (dev->bus->self) { + dev_dbg(&dev->bus->dev, "Bus MPSS %d\n", + 128 << dev->bus->self->pcie_mpss); + + /* For "MPS Force Max", the assumption is made that + * downstream communication will never be larger than + * the MRRS. So, the MPS only needs to be configured + * for the upstream communication. This being the case, + * walk from the top down and set the MPS of the child + * to that of the parent bus. + */ + mps = 128 << dev->bus->self->pcie_mpss; + if (mps > dev_mpss) + dev_warn(&dev->dev, "MPS configured higher than" + " maximum supported by the device. If" + " a bus issue occurs, try running with" + " pci=pcie_bus_safe.\n"); + } + + dev->pcie_mpss = ffs(mps) - 8; + } + + rc = pcie_set_mps(dev, mps); + if (rc) + dev_err(&dev->dev, "Failed attempting to set the MPS\n"); +} + +static void pcie_write_mrrs (struct pci_dev *dev,int mps) +{ + int rc, mrrs; + + if (pcie_bus_config == PCIE_BUS_PERFORMANCE) { + int dev_mpss = 128 << dev->pcie_mpss; + + /* For Max performance, the MRRS must be set to the largest + * supported value. However, it cannot be configured larger + * than the MPS the device or the bus can support. This assumes + * that the largest MRRS available on the device cannot be + * smaller than the device MPSS. + */ + mrrs = mps < dev_mpss ? mps : dev_mpss; + } else + /* In the "safe" case, configure the MRRS for fairness on the + * bus by making all devices have the same size + */ + mrrs = mps; + + + /* MRRS is a R/W register. Invalid values can be written, but a + * subsiquent read will verify if the value is acceptable or not. + * If the MRRS value provided is not acceptable (e.g., too large), + * shrink the value until it is acceptable to the HW. + */ + while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) { + rc = pcie_set_readrq(dev, mrrs); + if (rc) + dev_err(&dev->dev, "Failed attempting to set the MRRS\n"); + + mrrs /= 2; + } +} + +static int pcie_bus_configure_set (struct pci_dev *dev,void *data) +{ + int mps = 128 << *(u8 *)data; + + if (!pci_is_pcie(dev)) + return 0; + + dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n", + pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev)); + + pcie_write_mps(dev, mps); + pcie_write_mrrs(dev, mps); + + dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n", + pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev)); + + return 0; +} + +/* pcie_bus_configure_mps requires that pci_walk_bus work in a top-down, +* parents then children fashion. If this changes, then this code will not +* work as designed. +*/ +void pcie_bus_configure_settings (struct pci_bus *bus,u8 mpss) +{ + u8 smpss = mpss; + + if (!bus->self) + return; + + if (!pci_is_pcie(bus->self)) + return; + + if (pcie_bus_config == PCIE_BUS_SAFE) { + pcie_find_smpss(bus->self, &smpss); + pci_walk_bus(bus, pcie_find_smpss, &smpss); + } + + pcie_bus_configure_set(bus->self, &smpss); + pci_walk_bus(bus, pcie_bus_configure_set, &smpss); +} + unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus) { unsigned int devfn, pass, max = bus->secondary;include/linux/pci.h +0
-0@@ -251,7 +251,8 @@ struct pci_dev {u8 revision; /* PCI revision, low byte of class word */ u8 hdr_type; /* PCI header type (`multi' flag masked out) */ u8 pcie_cap; /* PCI-E capability offset */
- u8 pcie_type; /* PCI-E device/port type */
+ u8 pcie_type:4; /* PCI-E device/port type */
+ u8 pcie_mpss:3; /* PCI-E Max Payload Size Supported */ u8 rom_base_reg; /* which config register controls the ROM */ u8 pin; /* which interrupt pin this device uses */include/linux/pci.h +12
-1@@ -617,6 +618,16 @@ struct pci_driver { /* these external functions are only available when PCI support is enabled */ #ifdef CONFIG_PCI +extern void pcie_bus_configure_settings (struct pci_bus *bus,u8 smpss); + +enum pcie_bus_config_types { + PCIE_BUS_PERFORMANCE, + PCIE_BUS_SAFE, + PCIE_BUS_PEER2PEER, +}; + +extern enum pcie_bus_config_types pcie_bus_config; + extern struct bus_type pci_bus_type; /* Do NOT directly access these two variables, unless you are arch specific pci@@ -796,6 +807,8 @@ int pcix_get_mmrbc(struct pci_dev *dev); int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc); int pcie_get_readrq(struct pci_dev *dev); int pcie_set_readrq(struct pci_dev *dev, int rq); +int pcie_get_mps (struct pci_dev *dev); +int pcie_set_mps (struct pci_dev *dev,int mps); int __pci_reset_function(struct pci_dev *dev); int pci_reset_function(struct pci_dev *dev); void pci_update_resource(struct pci_dev *dev, int resno); --To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [099/244] PCI: Set PCI-E Max Payload Size on fabric
Quoted 6 lines · Bjorn Helgaas
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
I object to this :) I think the following patches should be omitted from -stable:
Quoted 8 lines
[099/244] PCI: Set PCI-E Max Payload Size on fabric [100/244] PCI: export
pcie_bus_configure_settingssymbol [101/244] PCI: Remove MRRS modification from MPS setting code [212/244] pci: Dont crash when reading mpss from root complexI've heard rumors that these patches are required to make 3.0 boot on some machines, but I don't really believe it, and I haven't seen the problem reports myself.
Would it be acceptable to disable MPS modification by default (as you have been suggesting for 3.1) and have the machines who are having the boot issues pass a boot parm to enable the MPS modification?
Quoted 456 lines
Also, these patches introduce an open regression (Avi's e1000e problem). Jon has mooted a patch that we hope will fix the regression, but I'm still not confident that this is all safe for 3.1, much less 3.0-stable.
Quoted 450 lines
------------------
From: Jon Mason <[email protected]>
commit
b03e7495a862b028294f59fc87286d6d78ee7fa1upstream.On a given PCI-E fabric, each device, bridge, and root port can have a different PCI-E maximum payload size. There is a sizable performance boost for having the largest possible maximum payload size on each PCI-E device. However, if improperly configured, fatal bus errors can occur. Thus, it is important to ensure that PCI-E payloads sends by a device are never larger than the MPS setting of all devices on the way to the destination.
This can be achieved two ways:
- A conservative approach is to use the smallest common denominator of the entire tree below a root complex for every device on that fabric.
This means for example that having a 128 bytes MPS USB controller on one leg of a switch will dramatically reduce performances of a video card or 10GE adapter on another leg of that same switch.
It also means that any hierarchy supporting hotplug slots (including expresscard or thunderbolt I suppose, dbl check that) will have to be entirely clamped to 128 bytes since we cannot predict what will be plugged into those slots, and we cannot change the MPS on a "live" system.
- A more optimal way is possible, if it falls within a couple of constraints:
* The top-level host bridge will never generate packets larger than the smallest TLP (or if it can be controlled independently from its MPS at least)
* The device will never generate packets larger than MPS (which can be configured via MRRS)
* No support of direct PCI-E <-> PCI-E transfers between devices without some additional code to specifically deal with that caseThen we can use an approach that basically ignores downstream requests and focuses exclusively on upstream requests. In that case, all we need to care about is that a device MPS is no larger than its parent MPS, which allows us to keep all switches/bridges to the max MPS supported by their parent and eventually the PHB.
In this case, your USB controller would no longer "starve" your 10GE Ethernet and your hotplug slots won't affect your global MPS. Additionally, the hotplugged devices themselves can be configured to a larger MPS up to the value configured in the hotplug bridge.
To choose between the two available options, two PCI kernel boot args have been added to the PCI calls. "pcie_bus_safe" will provide the former behavior, while "
pcie_bus_perf" will perform the latter behavior. By default, the latter behavior is used.NOTE: due to the location of the enablement, each arch will need to add calls to this function. This patch only enables x86.
This patch includes a number of changes recommended by Benjamin Herrenschmidt.
Tested-by [email protected]Signed-off-by Jon Mason <[email protected]>Signed-off-by Jesse Barnes <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
arch/x86/pci/acpi.c | 9 ++drivers/pci/hotplug/pcihp_slot.c| 45 ------------drivers/pci/pci.c| 67 ++++++++++++++++++drivers/pci/probe.c| 145 +++++++++++++++++++++++++++++++++++++++include/linux/pci.h| 15 +++-5 files changed, 236 insertions(+), 45 deletions(-)arch/x86/pci/acpi.c +9
-0@@ -361,6 +361,15 @@ struct pci_bus * __devinit pci_acpi_scan } } + /* After the PCI-E bus has been walked and all devices discovered, + * configure any settings of the fabric that might be necessary. + */ + if (bus) { + struct pci_bus *child; + list_for_each_entry(child, &bus->children, node) + pcie_bus_configure_settings(child, child->self->pcie_mpss); + } + if (!bus) kfree(sd);drivers/pci/hotplug/pcihp_slot.c +1
-44@@ -158,47 +158,6 @@ static void program_hpp_type2(struct pci*/ } -/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */ -static int pci_set_payload (struct pci_dev *dev) -{ - int pos, ppos; - u16 pctl, psz; - u16 dctl, dsz, dcap, dmax; - struct pci_dev *parent; - - parent = dev->bus->self; - pos = pci_find_capability(dev, PCI_CAP_ID_EXP); - if (!pos) - return 0; - - /* Read Device MaxPayload capability and setting */ - pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl); - pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap); - dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; - dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD); - - /* Read Parent MaxPayload setting */ - ppos = pci_find_capability(parent, PCI_CAP_ID_EXP); - if (!ppos) - return 0; - pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl); - psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; - - /* If parent payload > device max payload -> error - * If parent payload > device payload -> set speed - * If parent payload <= device payload -> do nothing - */ - if (psz > dmax) - return -1; - else if (psz > dsz) { - dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz); - pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, - (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) + - (psz << 5)); - } - return 0; -} - void pci_configure_slot(struct pci_dev *dev) { struct pci_dev *cdev;@@ -210,9 +169,7 @@ void pci_configure_slot(struct pci_dev * (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) return; - ret = pci_set_payload(dev); - if (ret) - dev_warn(&dev->dev, "could not set device max payload\n"); + pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss); memset(&hpp, 0, sizeof(hpp)); ret = pci_get_hp_params(dev, &hpp);drivers/pci/pci.c +67
-0@@ -77,6 +77,8 @@ unsigned long pci_cardbus_mem_size = DEF unsigned long pci_hotplug_io_size = DEFAULT_HOTPLUG_IO_SIZE; unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE; +enum pcie_bus_config_types pcie_bus_config =PCIE_BUS_PERFORMANCE ; + /** The default CLS is used if arch didn't set CLS explicitly and not * all pci devices agree on the same value. Arch can override either @@ -3223,6 +3225,67 @@ out: EXPORT_SYMBOL(pcie_set_readrq); /** +* pcie_get_mps - get PCI Express maximum payload size +* @dev: PCI device to query +* +* Returns maximum payload size in bytes +* or appropriate error value. +*/ +int pcie_get_mps (struct pci_dev *dev) +{ + int ret, cap; + u16 ctl; + + cap = pci_pcie_cap(dev); + if (!cap) + return -EINVAL; + + ret = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl); + if (!ret) + ret = 128 << ((ctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5); + + return ret; +} + +/** +* pcie_set_mps - set PCI Express maximum payload size +* @dev: PCI device to query +* @rq: maximum payload size in bytes +* valid values are 128, 256, 512, 1024, 2048, 4096 +* +* If possible sets maximum payload size +*/ +int pcie_set_mps (struct pci_dev *dev,int mps) +{ + int cap, err = -EINVAL; + u16 ctl, v; + + if (mps < 128 || mps > 4096 || !is_power_of_2(mps)) + goto out; + + v = ffs(mps) - 8; + if (v > dev->pcie_mpss) + goto out; + v <<= 5; + + cap = pci_pcie_cap(dev); + if (!cap) + goto out; + + err = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl); + if (err) + goto out; + + if ((ctl & PCI_EXP_DEVCTL_PAYLOAD) != v) { + ctl &= ~PCI_EXP_DEVCTL_PAYLOAD; + ctl |= v; + err = pci_write_config_word(dev, cap + PCI_EXP_DEVCTL, ctl); + } +out: + return err; +} + +/** * pci_select_bars - Make BAR mask from the type of resource * @dev: the PCI device for which BAR mask is made * @flags: resource type mask to be selected @@ -3505,6 +3568,10 @@ static int __init pci_setup(char *str) pci_hotplug_io_size = memparse(str + 9, &str); } else if (!strncmp(str, "hpmemsize=", 10)) { pci_hotplug_mem_size = memparse(str + 10, &str); + } else if (!strncmp(str, "pcie_bus_safe", 13)) { + pcie_bus_config = PCIE_BUS_SAFE; + } else if (!strncmp(str, "pcie_bus_perf", 13)) { + pcie_bus_config = PCIE_BUS_PERFORMANCE; } else { printk(KERN_ERR "PCI: Unknown option `%s'\n", str);drivers/pci/probe.c +145
-0@@ -860,6 +860,8 @@ void set_pcie_port_type(struct pci_dev * pdev->pcie_cap = pos; pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, ®16); pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4; + pci_read_config_word(pdev, pos + PCI_EXP_DEVCAP, ®16); + pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD; } void set_pcie_hotplug_bridge(struct pci_dev *pdev)@@ -1327,6 +1329,149 @@ int pci_scan_slot(struct pci_bus *bus, i return nr; } +static int pcie_find_smpss (struct pci_dev *dev,void *data) +{ + u8 *smpss = data; + + if (!pci_is_pcie(dev)) + return 0; + + /* For PCIE hotplug enabled slots not connected directly to a + * PCI-E root port, there can be problems when hotplugging + * devices. This is due to the possibility of hotplugging a + * device into the fabric with a smaller MPS that the devices + * currently running have configured. Modifying the MPS on the + * running devices could cause a fatal bus error due to an + * incoming frame being larger than the newly configured MPS. + * To work around this, the MPS for the entire fabric must be + * set to the minimum size. Any devices hotplugged into this + * fabric will have the minimum MPS set. If the PCI hotplug + * slot is directly connected to the root port and there are not + * other devices on the fabric (which seems to be the most + * common case), then this is not an issue and MPS discovery + * will occur as normal. + */ + if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) || + dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT)) + *smpss = 0; + + if (*smpss > dev->pcie_mpss) + *smpss = dev->pcie_mpss; + + return 0; +} + +static void pcie_write_mps (struct pci_dev *dev,int mps) +{ + int rc, dev_mpss; + + dev_mpss = 128 << dev->pcie_mpss; + + if (pcie_bus_config == PCIE_BUS_PERFORMANCE) { + if (dev->bus->self) { + dev_dbg(&dev->bus->dev, "Bus MPSS %d\n", + 128 << dev->bus->self->pcie_mpss); + + /* For "MPS Force Max", the assumption is made that + * downstream communication will never be larger than + * the MRRS. So, the MPS only needs to be configured + * for the upstream communication. This being the case, + * walk from the top down and set the MPS of the child + * to that of the parent bus. + */ + mps = 128 << dev->bus->self->pcie_mpss; + if (mps > dev_mpss) + dev_warn(&dev->dev, "MPS configured higher than" + " maximum supported by the device. If" + " a bus issue occurs, try running with" + " pci=pcie_bus_safe.\n"); + } + + dev->pcie_mpss = ffs(mps) - 8; + } + + rc = pcie_set_mps(dev, mps); + if (rc) + dev_err(&dev->dev, "Failed attempting to set the MPS\n"); +} + +static void pcie_write_mrrs (struct pci_dev *dev,int mps) +{ + int rc, mrrs; + + if (pcie_bus_config == PCIE_BUS_PERFORMANCE) { + int dev_mpss = 128 << dev->pcie_mpss; + + /* For Max performance, the MRRS must be set to the largest + * supported value. However, it cannot be configured larger + * than the MPS the device or the bus can support. This assumes + * that the largest MRRS available on the device cannot be + * smaller than the device MPSS. + */ + mrrs = mps < dev_mpss ? mps : dev_mpss; + } else + /* In the "safe" case, configure the MRRS for fairness on the + * bus by making all devices have the same size + */ + mrrs = mps; + + + /* MRRS is a R/W register. Invalid values can be written, but a + * subsiquent read will verify if the value is acceptable or not. + * If the MRRS value provided is not acceptable (e.g., too large), + * shrink the value until it is acceptable to the HW. + */ + while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) { + rc = pcie_set_readrq(dev, mrrs); + if (rc) + dev_err(&dev->dev, "Failed attempting to set the MRRS\n"); + + mrrs /= 2; + } +} + +static int pcie_bus_configure_set (struct pci_dev *dev,void *data) +{ + int mps = 128 << *(u8 *)data; + + if (!pci_is_pcie(dev)) + return 0; + + dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n", + pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev)); + + pcie_write_mps(dev, mps); + pcie_write_mrrs(dev, mps); + + dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n", + pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev)); + + return 0; +} + +/* pcie_bus_configure_mps requires that pci_walk_bus work in a top-down, +* parents then children fashion. If this changes, then this code will not +* work as designed. +*/ +void pcie_bus_configure_settings (struct pci_bus *bus,u8 mpss) +{ + u8 smpss = mpss; + + if (!bus->self) + return; + + if (!pci_is_pcie(bus->self)) + return; + + if (pcie_bus_config == PCIE_BUS_SAFE) { + pcie_find_smpss(bus->self, &smpss); + pci_walk_bus(bus, pcie_find_smpss, &smpss); + } + + pcie_bus_configure_set(bus->self, &smpss); + pci_walk_bus(bus, pcie_bus_configure_set, &smpss); +} + unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus) { unsigned int devfn, pass, max = bus->secondary;include/linux/pci.h +0
-0@@ -251,7 +251,8 @@ struct pci_dev {u8 revision; /* PCI revision, low byte of class word */ u8 hdr_type; /* PCI header type (`multi' flag masked out) */ u8 pcie_cap; /* PCI-E capability offset */
- u8 pcie_type; /* PCI-E device/port type */
+ u8 pcie_type:4; /* PCI-E device/port type */
+ u8 pcie_mpss:3; /* PCI-E Max Payload Size Supported */ u8 rom_base_reg; /* which config register controls the ROM */ u8 pin; /* which interrupt pin this device uses */include/linux/pci.h +12
-1@@ -617,6 +618,16 @@ struct pci_driver { /* these external functions are only available when PCI support is enabled */ #ifdef CONFIG_PCI +extern void pcie_bus_configure_settings (struct pci_bus *bus,u8 smpss); + +enum pcie_bus_config_types { + PCIE_BUS_PERFORMANCE, + PCIE_BUS_SAFE, + PCIE_BUS_PEER2PEER, +}; + +extern enum pcie_bus_config_types pcie_bus_config; + extern struct bus_type pci_bus_type; /* Do NOT directly access these two variables, unless you are arch specific pci@@ -796,6 +807,8 @@ int pcix_get_mmrbc(struct pci_dev *dev); int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc); int pcie_get_readrq(struct pci_dev *dev); int pcie_set_readrq(struct pci_dev *dev, int rq); +int pcie_get_mps (struct pci_dev *dev); +int pcie_set_mps (struct pci_dev *dev,int mps); int __pci_reset_function(struct pci_dev *dev); int pci_reset_function(struct pci_dev *dev); void pci_update_resource(struct pci_dev *dev, int resno); --To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Bjorn Helgaas
maintainerRe: [099/244] PCI: Set PCI-E Max Payload Size on fabric
Quoted 13 lines · Jon Mason
Quoted 11 lines · Bjorn Helgaas
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
I object to this :) I think the following patches should be omitted from -stable:
[099/244] PCI: Set PCI-E Max Payload Size on fabric [100/244] PCI: export
pcie_bus_configure_settingssymbol [101/244] PCI: Remove MRRS modification from MPS setting code [212/244] pci: Dont crash when reading mpss from root complex
Quoted 7 lines
Quoted 3 lines
I've heard rumors that these patches are required to make 3.0 boot on some machines, but I don't really believe it, and I haven't seen the problem reports myself.
Would it be acceptable to disable MPS modification by default (as you have been suggesting for 3.1) and have the machines who are having the boot issues pass a boot parm to enable the MPS modification?
I'm OK with 3.1 having MPS modification disabled by default, but having a command line switch to enable it.
Should that same thing go in 3.0-stable? I dunno. My first reaction is "No, because I still don't have a concrete problem report that says it fixes anything." I can't tell if these are secret machines, people thinking the 3.1-rcX regressions are a problem in 3.0, or what.
Bjorn
Re: [099/244] PCI: Set PCI-E Max Payload Size on fabric
In reply to Bjorn HelgaasQuoted 6 lines · Bjorn Helgaas
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let us know.
I object to this :) I think the following patches should be omitted from -stable:
Quoted 8 lines
[099/244] PCI: Set PCI-E Max Payload Size on fabric [100/244] PCI: export
pcie_bus_configure_settingssymbol [101/244] PCI: Remove MRRS modification from MPS setting code [212/244] pci: Dont crash when reading mpss from root complexI've heard rumors that these patches are required to make 3.0 boot on some machines, but I don't really believe it, and I haven't seen the problem reports myself.
Ok, I've removed these from the 3.0.5 release, but I really want them in a future 3.0-stable release, so I'll carry them over to the next one and keep trying until it all gets worked out.
As for the bug reports, I've seen them, but I don't know the status of the hardware to be able to have them reported publicly at the moment, sorry.
Quoted 4 lines
Also, these patches introduce an open regression (Avi's e1000e problem). Jon has mooted a patch that we hope will fix the regression, but I'm still not confident that this is all safe for 3.1, much less 3.0-stable.
I'll keep working with Jon on these.
thanks,
greg k-h
PATCH 100/244 PCI: export pcie_bus_configure_settings symbol
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jon Mason <[email protected]>
commit debc3b778508f59696ff188f0feca271dcbfa7d9 upstream.
pcie_bus_configure_settings needs to be exported if the PCI hotplug driver is being compiled as a module.
--- drivers/pci/probe.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/probe.c +1 -0
@@ -1471,6 +1471,7 @@ void pcie_bus_configure_settings(structpcie_bus_configure_set (bus->self, &smpss);pci_walk_bus (bus, pcie_bus_configure_set, &smpss); } +EXPORT_SYMBOL_GPL (pcie_bus_configure_settings);unsigned int __devinit pci_scan_child_bus (struct pci_bus *bus) {
PATCH 101/244 PCI: Remove MRRS modification from MPS setting code
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jon Mason <[email protected]>
commit ed2888e906b56769b4ffabb9c577190438aa68b8 upstream.
Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has massive negative ramifications on some devices. Without knowing which devices have this issue, do not modify from the default value when walking the PCI-E bus in pcie_bus_safe mode. Also, make pcie_bus_safe the default procedure.
References: https://bugzilla.kernel.org/show_bug.cgi?id=42162
--- drivers/pci/pci.c | 2 +- drivers/pci/probe.c | 45 ++++++++++++++++++++++++--------------------- 2 files changed, 25 insertions(+), 22 deletions(-)
drivers/pci/pci.c +1 -1
@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEFunsigned long pci_hotplug_io_size =DEFAULT_HOTPLUG_IO_SIZE ;unsigned long pci_hotplug_mem_size =DEFAULT_HOTPLUG_MEM_SIZE ; -enum pcie_bus_config_types pcie_bus_config =PCIE_BUS_PERFORMANCE ; +enum pcie_bus_config_types pcie_bus_config =PCIE_BUS_SAFE ;/* * The default CLS is used if arch didn't set CLS explicitly and not
drivers/pci/probe.c +24 -21
71 lines not on this page · raw message
PATCH 102/244 isci: fix sata response handling
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Williams <[email protected]>
commit 1a878284473284f9577d44babf16d87152a05c33 upstream.
A bug (likely copy/paste) that has been carried from the original implementation. The unsolicited frame handling structure returns the d2h fis in the isci_request.stp.rsp buffer.
--- drivers/scsi/isci/request.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-)
drivers/scsi/isci/request.c +6 -12
@@ -2399,22 +2399,19 @@ static void isci_task_save_for_upper_lay } } -static void isci_request_process_stp_response (struct sas_task *task, -void *response_buffer) +static void isci_process_stp_response (struct sas_task *task,struct dev_to_host_fis *fis) { -struct dev_to_host_fis *d2h_reg_fis = response_buffer;struct task_status_struct *ts = &task->task_status;struct ata_task_resp *resp = (void *)&ts->buf[0 ]; - resp->frame_len =le16_to_cpu (*(__le16 *)(response_buffer +6 )); -memcpy (&resp->ending_fis[0 ], response_buffer +16 ,24 ); + resp->frame_len =sizeof (*fis); +memcpy (resp->ending_fis, fis,sizeof (*fis)); ts->buf_valid_size =sizeof (*resp); -/** -* If the device fault bit is set in the status register, then +/* If the device fault bit is set in the status register, then * set the sense data and return. */ -if (d2h_reg_fis->status &ATA_DF ) +if (fis->status &ATA_DF ) ts->stat =SAS_PROTO_RESPONSE ;else ts->stat =SAM_STAT_GOOD ;
@@ -2428,7 +2425,6 @@ static void isci_request_io_request_comp {struct sas_task *task =isci_request_access_task (request);struct ssp_response_iu *resp_iu; -void *resp_buf;unsigned long task_flags;struct isci_remote_device *idev =isci_lookup_device (task->dev);enum service_response response =SAS_TASK_UNDELIVERED ;
@@ -2565,9 +2561,7 @@ static void isci_request_io_request_comp task);if (sas_protocol_ata (task->task_proto)) { - resp_buf = &request->stp.rsp; -isci_request_process_stp_response (task, - resp_buf); +isci_process_stp_response (task, &request->stp.rsp); }else if (SAS_PROTOCOL_SSP == task->task_proto) {/* crack the iu response buffer. */
PATCH 103/244 isci: fix 32-bit operation when CONFIG_HIGHMEM64G=n
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Williams <[email protected]>
commit ee33e2b771f9e9e4aaba2bb2ace7b727fe451a8b upstream.
The unsolicited frame control infrastructure requires a table of dma addresses for the hardware to lookup the frame buffer location by an index. The hardware expects the elements of this table to be 64-bit quantities, so we cannot reference these elements as dma_addr_t. All unsolicited frame protocols are affected, particularly SATA-PIO and SMP which prevented direct-attached SATA drives and expander-attached drives to not be discovered.
--- drivers/scsi/isci/unsolicited_frame_control.c | 2 +- drivers/scsi/isci/unsolicited_frame_control.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/isci/unsolicited_frame_control.c +1 -1
@@ -72,7 +72,7 @@ int sci_unsolicited_frame_control_constr*/ buf_len =SCU_MAX_UNSOLICITED_FRAMES *SCU_UNSOLICITED_FRAME_BUFFER_SIZE ; header_len =SCU_MAX_UNSOLICITED_FRAMES *sizeof (struct scu_unsolicited_frame_header ); - size = buf_len + header_len +SCU_MAX_UNSOLICITED_FRAMES *sizeof (dma_addr_t); + size = buf_len + header_len +SCU_MAX_UNSOLICITED_FRAMES *sizeof (uf_control->address_table.array[0 ]);/* * The Unsolicited Frame buffers are set at the start of the UF
drivers/scsi/isci/unsolicited_frame_control.h +1 -1
@@ -214,7 +214,7 @@ struct sci_uf_address_table_array {* starting address of the UF address table. * 64-bit pointers are required by the hardware. */ -dma_addr_t *array; +u64 *array;/** * This field specifies the physical address location for the UF
PATCH 104/244 ASoC: MPC5200: replace of_device with platform_device
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Timur Tabi <[email protected]>
commit 3bdf28feafc52864bd7f17b39deec64833a89d19 upstream.
'struct of_device' no longer exists, and its functionality has been merged into platform_device. Update the MPC5200 audio DMA driver (mpc5200_dma) accordingly. This fixes a build break.
--- sound/soc/fsl/mpc5200_dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/fsl/mpc5200_dma.c +3 -3
@@ -368,7 +368,7 @@ static struct snd_soc_platform_driver mp .pcm_free = &psc_dma_free, }; -static int mpc5200_hpcd_probe (struct of_device *op) +static int mpc5200_hpcd_probe (struct platform_device *op) {phys_addr_t fifo;struct psc_dma *psc_dma;
@@ -486,7 +486,7 @@ out_unmap:return ret; } -static int mpc5200_hpcd_remove (struct of_device *op) +static int mpc5200_hpcd_remove (struct platform_device *op) {struct psc_dma *psc_dma =dev_get_drvdata (&op->dev);
@@ -518,7 +518,7 @@ MODULE_DEVICE_TABLE(of, mpc5200_hpcd_matstatic struct platform_driver mpc5200_hpcd_of_driver = { .probe = mpc5200_hpcd_probe, .remove = mpc5200_hpcd_remove, - .dev = { + .driver = { .owner =THIS_MODULE , .name ="mpc5200-pcm-audio" , .of_match_table = mpc5200_hpcd_match,
PATCH 105/244 hpsa: fix problem that OBDR devices are not detected
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 0b0e1d6cbcc8627970e0399df8f06edd690ec7d9 upstream.
The test to detect OBDR ("One Button Disaster Recovery") cd-rom devices was comparing against uninitialized data.
Fixed by moving the test for the device to where the inquiry data is collected, and uninitialized variable altogether as it wasn't really being used.
--- drivers/scsi/hpsa.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-)
drivers/scsi/hpsa.c +27 -20
@@ -1548,10 +1548,17 @@ static inline void hpsa_set_bus_target_l }static int hpsa_update_device_info (struct ctlr_info *h, -unsigned char scsi3addr[],struct hpsa_scsi_dev_t *this_device) +unsigned char scsi3addr[],struct hpsa_scsi_dev_t *this_device, +unsigned char *is_OBDR_device) { -#define OBDR_TAPE_INQ_SIZE 49 + +#define OBDR_SIG_OFFSET 43 +#define OBDR_TAPE_SIG "$DR-10" +#define OBDR_SIG_LEN (sizeof(OBDR_TAPE_SIG) - 1) +#define OBDR_TAPE_INQ_SIZE (OBDR_SIG_OFFSET + OBDR_SIG_LEN) +unsigned char *inq_buff; +unsigned char *obdr_sig; inq_buff =kzalloc (OBDR_TAPE_INQ_SIZE ,GFP_KERNEL );if (!inq_buff)
@@ -1583,6 +1590,16 @@ static int hpsa_update_device_info(strucelse this_device->raid_level =RAID_UNKNOWN ; +if (is_OBDR_device) { +/* See if this is a One-Button-Disaster-Recovery device +* by looking for "$DR-10" at offset 43 in inquiry data. +*/ + obdr_sig = &inq_buff[OBDR_SIG_OFFSET ]; + *is_OBDR_device = (this_device->devtype ==TYPE_ROM && +strncmp (obdr_sig,OBDR_TAPE_SIG , +OBDR_SIG_LEN ) ==0 ); + } +kfree (inq_buff);return 0 ;
@@ -1716,7 +1733,7 @@ static int add_msa2xxx_enclosure_device(return 0 ; } -if (hpsa_update_device_info (h, scsi3addr, this_device)) +if (hpsa_update_device_info (h, scsi3addr, this_device,NULL ))return 0 ; (*nmsa2xxx_enclosures)++;hpsa_set_bus_target_lun (this_device, bus, target,0 );
@@ -1808,7 +1825,6 @@ static void hpsa_update_scsi_devices(str*/ struct ReportLUNdata *physdev_list =NULL ;struct ReportLUNdata *logdev_list =NULL ; -unsigned char *inq_buff =NULL ;u32 nphysicals =0 ;u32 nlogicals =0 ;u32 ndev_allocated =0 ;
@@ -1824,11 +1840,9 @@ static void hpsa_update_scsi_devices(str GFP_KERNEL); physdev_list =kzalloc (reportlunsize,GFP_KERNEL ); logdev_list =kzalloc (reportlunsize,GFP_KERNEL ); - inq_buff =kmalloc (OBDR_TAPE_INQ_SIZE ,GFP_KERNEL ); tmpdevice =kzalloc (sizeof (*tmpdevice),GFP_KERNEL ); -if (!currentsd || !physdev_list || !logdev_list || - !inq_buff || !tmpdevice) { +if (!currentsd || !physdev_list || !logdev_list || !tmpdevice) {dev_err (&h->pdev->dev,"out of memory\n" ); goto out; }
@@ -1863,7 +1877,7 @@ static void hpsa_update_scsi_devices(str/* adjust our table of devices */ nmsa2xxx_enclosures =0 ;for (i =0 ; i < nphysicals + nlogicals +1 ; i++) { -u8 *lunaddrbytes; +u8 *lunaddrbytes, is_OBDR =0 ;/* Figure out where the LUN ID info is coming from */ lunaddrbytes = figure_lunaddrbytes(h, raid_ctlr_position,
@@ -1874,7 +1888,8 @@ static void hpsa_update_scsi_devices(strcontinue ;/* Get device type, vendor, model, device id */ -if (hpsa_update_device_info (h, lunaddrbytes, tmpdevice)) +if (hpsa_update_device_info (h, lunaddrbytes, tmpdevice, + &is_OBDR))continue ;/* skip it if we can't talk to it. */ figure_bus_target_lun (h, lunaddrbytes, &bus, &target, &lun, tmpdevice);
@@ -1898,7 +1913,7 @@ static void hpsa_update_scsi_devices(strhpsa_set_bus_target_lun (this_device, bus, target, lun);switch (this_device->devtype) { -case TYPE_ROM : { +case TYPE_ROM :/* We don't *really* support actual CD-ROM devices, * just "One Button Disaster Recovery" tape drive * which temporarily pretends to be a CD-ROM drive.
@@ -1906,15 +1921,8 @@ static void hpsa_update_scsi_devices(str* device by checking for "$DR-10" in bytes 43-48 of * the inquiry data. */ -char obdr_sig[7 ]; -#define OBDR_TAPE_SIG "$DR-10" -strncpy (obdr_sig, &inq_buff[43 ],6 ); - obdr_sig[6 ] ='\0' ; -if (strncmp (obdr_sig,OBDR_TAPE_SIG ,6 ) !=0 ) -/* Not OBDR device, ignore it. */ -break ; - } - ncurrent++; +if (is_OBDR) + ncurrent++;break ;case TYPE_DISK :if (i < nphysicals)
@@ -1947,7 +1955,6 @@ out:for (i =0 ; i < ndev_allocated; i++)kfree (currentsd[i]);kfree (currentsd); -kfree (inq_buff);kfree (physdev_list);kfree (logdev_list); }
PATCH 106/244 hpsa: fix physical device lun and target numbering problem
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 01350d05539d1c95ef3568d062d864ab76ae7670 upstream.
If a physical device exposed to the OS by hpsa is replaced (e.g. one hot plug tape drive is replaced by another, or a tape drive is placed into "OBDR" mode in which it acts like a CD-ROM device) and a rescan is initiated, the replaced device will be added to the SCSI midlayer with target and lun numbers set to -1. After that, a panic is likely to ensue. When a physical device is replaced, the lun and target number should be preserved.
--- drivers/scsi/hpsa.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/hpsa.c +10 -0
@@ -676,6 +676,16 @@ static void hpsa_scsi_replace_entry(struBUG_ON (entry <0 || entry >=HPSA_MAX_SCSI_DEVS_PER_HBA ); removed[*nremoved] = h->dev[entry]; (*nremoved)++; + +/* +* New physical devices won't have target/lun assigned yet +* so we need to preserve the values in the slot we are replacing. +*/ +if (new_entry->target ==-1 ) { + new_entry->target = h->dev[entry]->target; + new_entry->lun = h->dev[entry]->lun; + } + h->dev[entry] = new_entry; added[*nadded] = new_entry; (*nadded)++;
PATCH 107/244 qla2xxx: Correct inadvertent loop state transitions during port-update handling.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Vasquez <[email protected]>
commit 58b48576966ed0afd3f63ef17480ec12748a7119 upstream.
Transitioning to a LOOP_UPDATE loop-state could cause the driver to miss normal link/target processing. LOOP_UPDATE is a crufty artifact leftover from at time the driver performed it's own internal command-queuing. Safely remove this state.
--- drivers/scsi/qla2xxx/qla_init.c | 3 --- drivers/scsi/qla2xxx/qla_isr.c | 1 - 2 files changed, 4 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +0 -3
@@ -3822,15 +3822,12 @@ qla2x00_loop_resync(scsi_qla_host_t *vha req = vha->req; rsp = req->rsp; -atomic_set (&vha->loop_state,LOOP_UPDATE );clear_bit (ISP_ABORT_RETRY , &vha->dpc_flags);if (vha->flags.online) {if (!(rval =qla2x00_fw_ready (vha))) {/* Wait at most MAX_TARGET RSCNs for a stable link. */ wait_time =256 ; do { - atomic_set(&vha->loop_state, LOOP_UPDATE); - /* Issue a marker after FW becomes ready. */ qla2x00_marker(vha, req, rsp, 0, 0, MK_SYNC_ALL);
drivers/scsi/qla2xxx/qla_isr.c +0 -1
@@ -736,7 +736,6 @@ skip_rio: vha->flags.rscn_queue_overflow =1 ; } -atomic_set (&vha->loop_state,LOOP_UPDATE );atomic_set (&vha->loop_down_timer,0 ); vha->flags.management_server_logged_in =0 ;
PATCH 108/244 iwlegacy: fix BUG_ON(info->control.rates[0].idx < 0)
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 7c2510120e9b43b0caf32c3786a6ab831f7d9e87 upstream.
When trying to connect to 5GHz we can provide negative index to mac80211 what trigger BUG_ON. Reason of iwl-3945-rs malfunction on 5GHz is unknown and needs further investigation. For now, to do not trigger a bug, correct value and just print WARNING.
Address bug:
https://bugzilla.redhat.com/show_bug.cgi?id=730653
--- drivers/net/wireless/iwlegacy/iwl-3945-rs.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/wireless/iwlegacy/iwl-3945-rs.c +8 -5
@@ -822,12 +822,15 @@ static void iwl3945_rs_get_rate(void *pr out: - rs_sta->last_txrate_idx = index; -if (sband->band ==IEEE80211_BAND_5GHZ ) - info->control.rates[0 ].idx = rs_sta->last_txrate_idx - -IWL_FIRST_OFDM_RATE ; -else +if (sband->band ==IEEE80211_BAND_5GHZ ) { +if (WARN_ON_ONCE (index <IWL_FIRST_OFDM_RATE )) + index =IWL_FIRST_OFDM_RATE ; + rs_sta->last_txrate_idx = index; + info->control.rates[0 ].idx = index -IWL_FIRST_OFDM_RATE ; + }else { + rs_sta->last_txrate_idx = index; info->control.rates[0 ].idx = rs_sta->last_txrate_idx; + }IWL_DEBUG_RATE (priv,"leave: %d\n" , index); }
PATCH 109/244 acpica: ACPI_MAX_SLEEP should be 2 sec, not 20
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Len Brown <[email protected]>
commit b33c25d6a62ac253caabda2b5f43258abff451c0 upstream.
This limit is a workaround for AML that sleeps too long, but the workaround didn't work b/c of a typo.
https://bugzilla.kernel.org/show_bug.cgi?id=13195
--- drivers/acpi/acpica/acconfig.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpica/acconfig.h +1 -1
@@ -121,7 +121,7 @@/* Maximum sleep allowed via Sleep() operator */ -#define ACPI_MAX_SLEEP 20000/* Two seconds */ +#define ACPI_MAX_SLEEP 2000/* Two seconds */ /****************************************************************************** *
PATCH 110/244 ath9k_hw: fix calibration on 5 ghz
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Felix Fietkau <[email protected]>
commit 0e4660cbe51276e86dbdab17228733dbcdb49249 upstream.
ADC calibrations cannot run on 5 GHz with fast clock enabled. They need to be disabled, otherwise they'll hang and IQ mismatch calibration will not be run either.
--- drivers/net/wireless/ath/ath9k/ar9002_calib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ar9002_calib.c +2 -1
@@ -41,7 +41,8 @@ static bool ar9002_hw_is_cal_supported(scase ADC_DC_CAL :/* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */ if (!IS_CHAN_B (chan) && - !(IS_CHAN_2GHZ (chan) &&IS_CHAN_HT20 (chan))) + !((IS_CHAN_2GHZ (chan) ||IS_CHAN_A_FAST_CLOCK (ah, chan)) && +IS_CHAN_HT20 (chan))) supported = true;break ; }
PATCH 111/244 e1000: Fix driver to be used on PA RISC C8000 workstations
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jeff Kirsher <[email protected]>
commit e2faeec2de9e2c73958e6ea6065dde1e8cd6f3a2 upstream.
The checksum field in the EEPROM on HPPA is really not a checksum but a signature (0x16d6). So allow 0x16d6 as the matching checksum on HPPA systems.
This issue is present on longterm/stable kernels, I have verified that this patch is applicable back to at least 2.6.32.y kernels.
v2- changed ifdef to use CONFIG_PARISC instead of __hppa__
--- drivers/net/e1000/e1000_hw.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/e1000/e1000_hw.c +6 -0
@@ -4028,6 +4028,12 @@ s32 e1000_validate_eeprom_checksum(struc checksum += eeprom_data; } +#ifdef CONFIG_PARISC +/* This is a signature and not a checksum on HP c8000 */ +if ((hw->subsystem_vendor_id ==0x103C ) && (eeprom_data ==0x16d6 )) +return E1000_SUCCESS ; + +#endif if (checksum == (u16 )EEPROM_SUM )return E1000_SUCCESS ;else {
PATCH 112/244 ASoC: Fix reporting of partial jack updates
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 747da0f80e566500421bd7760b2e050fea3fde5e upstream.
We need to report the entire jack state to the core jack code, not just the bits that were being updated by the caller, otherwise the status reported by other detection methods will be omitted from the state seen by userspace.
--- sound/soc/soc-jack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-jack.c +1 -1
@@ -105,7 +105,7 @@ void snd_soc_jack_report(struct snd_soc_snd_soc_dapm_sync (dapm); -snd_jack_report (jack->jack, status); +snd_jack_report (jack->jack, jack->status); out:mutex_unlock (&codec->mutex);
PATCH 113/244 ASoC: Blackfin: bf5xx-ad193x: Fix codec device name
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit c5d2e650bd805a00ff9af537d5b5dede598a198c upstream.
Fix the codec_name field of the dai_link to match the actual device name of the codec. Otherwise the card won't be instantiated.
--- sound/soc/blackfin/bf5xx-ad193x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/blackfin/bf5xx-ad193x.c +2 -2
@@ -103,7 +103,7 @@ static struct snd_soc_dai_link bf5xx_ad1 .cpu_dai_name = "bfin-tdm.0", .codec_dai_name ="ad193x-hifi", .platform_name = "bfin-tdm-pcm-audio", - .codec_name = "ad193x.5", + .codec_name = "spi0.5", .ops = &bf5xx_ad193x_ops, }, {
@@ -112,7 +112,7 @@ static struct snd_soc_dai_link bf5xx_ad1 .cpu_dai_name = "bfin-tdm.1", .codec_dai_name ="ad193x-hifi", .platform_name = "bfin-tdm-pcm-audio", - .codec_name = "ad193x.5", + .codec_name = "spi0.5", .ops = &bf5xx_ad193x_ops, }, };
PATCH 114/244 mfd: Fix value of WM8994_CONFIGURE_GPIO
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 8efcc57dedfebc99c3cd39564e3fc47cd1a24b75 upstream.
This needs to be an out of band value for the register and on this device registers are 16 bit so we must shift left one to the 17th bit.
--- include/linux/mfd/wm8994/pdata.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mfd/wm8994/pdata.h +1 -1
@@ -26,7 +26,7 @@ struct wm8994_ldo_pdata {struct regulator_init_data *init_data; }; -#define WM8994_CONFIGURE_GPIO 0x8000 +#define WM8994_CONFIGURE_GPIO 0x10000#define WM8994_DRC_REGS 5#define WM8994_EQ_REGS 20
PATCH 115/244 mfd: Fix initialisation of tps65910 interrupts
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johan Hovold <[email protected]>
commit fa948761e685fb03823b3029e5b6bdb52229d6ce upstream.
Fix regression introduced by commit a2974732ca7614aaf0baf9d6dd3ad893d50ce1c5 (TPS65911: Add new irq definitions) which caused irq_num to be incorrectly set for tps65910.
--- drivers/mfd/tps65910-irq.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/tps65910-irq.c +2 -0
@@ -178,8 +178,10 @@ int tps65910_irq_init(struct tps65910 *tswitch (tps65910_chip_id (tps65910)) {case TPS65910 : tps65910->irq_num =TPS65910_NUM_IRQ ; +break ;case TPS65911 : tps65910->irq_num =TPS65911_NUM_IRQ ; +break ; }/* Register with genirq */
PATCH 116/244 mfd: Make omap-usb-host TLL mode work again
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anand Gadiyar <[email protected]>
commit e600cffe618ff0da29ae1f8b8d3824ce0e2409fc upstream.
This code section seems to have been accidentally copy pasted. It causes incorrect bits to be set up in the TLL_CHANNEL_CONF register and prevents the TLL mode from working correctly.
--- drivers/mfd/omap-usb-host.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/omap-usb-host.c +0 -1
@@ -676,7 +676,6 @@ static void usbhs_omap_tll_init(struct d | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); - reg |= (1 << (i +1 )); }else continue ;
PATCH 117/244 genirq: Make irq_shutdown() symmetric vs. irq_startup again
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit ed585a651681e822089087b426e6ebfb6d3d9873 upstream.
If an irq_chip provides .irq_shutdown(), but neither of .irq_disable() or .irq_mask(), free_irq() crashes when jumping to NULL.
Fix this by only trying .irq_disable() and .irq_mask() if there's no .irq_shutdown() provided.
This revives the symmetry with irq_startup(), which tries .irq_startup(), .irq_enable(), and irq_unmask(), and makes it consistent with the comment for irq_chip.irq_shutdown() in <linux/irq.h>, which says:
* @irq_shutdown: shut down the interrupt (defaults to ->disable if NULL)
This is also how __free_irq() behaved before the big overhaul, cfr. e.g. 3b56f0585fd4c02d047dc406668cb40159b2d340 ("genirq: Remove bogus conditional"), where the core interrupt code always overrode .irq_shutdown() to .irq_disable() if .irq_shutdown() was NULL.
--- kernel/irq/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/irq/chip.c +1 -1
@@ -178,7 +178,7 @@ void irq_shutdown(struct irq_desc *desc) desc->depth =1 ;if (desc->irq_data.chip->irq_shutdown) desc->irq_data.chip->irq_shutdown (&desc->irq_data); -if (desc->irq_data.chip->irq_disable) +else if (desc->irq_data.chip->irq_disable) desc->irq_data.chip->irq_disable (&desc->irq_data);else desc->irq_data.chip->irq_mask (&desc->irq_data);
PATCH 117/244 genirq: Make irq_shutdown() symmetric vs. irq_startup again
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit ed585a651681e822089087b426e6ebfb6d3d9873 upstream.
If an irq_chip provides .irq_shutdown(), but neither of .irq_disable() or .irq_mask(), free_irq() crashes when jumping to NULL.
Fix this by only trying .irq_disable() and .irq_mask() if there's no .irq_shutdown() provided.
This revives the symmetry with irq_startup(), which tries .irq_startup(), .irq_enable(), and irq_unmask(), and makes it consistent with the comment for irq_chip.irq_shutdown() in <linux/irq.h>, which says:
* @irq_shutdown: shut down the interrupt (defaults to ->disable if NULL)
This is also how __free_irq() behaved before the big overhaul, cfr. e.g. 3b56f0585fd4c02d047dc406668cb40159b2d340 ("genirq: Remove bogus conditional"), where the core interrupt code always overrode .irq_shutdown() to .irq_disable() if .irq_shutdown() was NULL.
--- kernel/irq/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/irq/chip.c +1 -1
@@ -178,7 +178,7 @@ void irq_shutdown(struct irq_desc *desc) desc->depth =1 ;if (desc->irq_data.chip->irq_shutdown) desc->irq_data.chip->irq_shutdown (&desc->irq_data); -if (desc->irq_data.chip->irq_disable) +else if (desc->irq_data.chip->irq_disable) desc->irq_data.chip->irq_disable (&desc->irq_data);else desc->irq_data.chip->irq_mask (&desc->irq_data);
PATCH 118/244 rtlwifi: rtl8192su: Fix problem connecting to HT-enabled AP
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: George <[email protected]>
commit 3401dc6eba788ebc7c14ce51018d775b1c263399 upstream.
The driver fails to connect to 802.11n-enabled APs. The patch fixes Bug #42262.
--- drivers/net/wireless/rtlwifi/rtl8192cu/trx.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/wireless/rtlwifi/rtl8192cu/trx.c +6 -5
@@ -549,15 +549,16 @@ void rtl92cu_tx_fill_desc(struct ieee802 (tcb_desc->rts_use_shortpreamble ?1 :0 ) : (tcb_desc->rts_use_shortgi ? 1 : 0)));if (mac->bw_40) { -if (tcb_desc->packet_bw) { +if (rate_flag &IEEE80211_TX_RC_DUP_DATA ) {SET_TX_DESC_DATA_BW (txdesc,1 );SET_TX_DESC_DATA_SC (txdesc,3 ); + }else if (rate_flag &IEEE80211_TX_RC_40_MHZ_WIDTH ){ +SET_TX_DESC_DATA_BW (txdesc,1 ); +SET_TX_DESC_DATA_SC (txdesc, mac->cur_40_prime_sc); }else {SET_TX_DESC_DATA_BW (txdesc,0 ); -if (rate_flag &IEEE80211_TX_RC_DUP_DATA ) -SET_TX_DESC_DATA_SC (txdesc, - mac->cur_40_prime_sc); - } +SET_TX_DESC_DATA_SC (txdesc,0 ); + } }else {SET_TX_DESC_DATA_BW (txdesc,0 );SET_TX_DESC_DATA_SC (txdesc,0 );
PATCH 119/244 rtlwifi: Fix problem when switching connections
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: George <[email protected]>
commit bac2555c6d86387132930af4d14cb47c4dd3f4f7 upstream.
The driver fails to clear encryption keys making it impossible to switch connections.
--- drivers/net/wireless/rtlwifi/core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/rtlwifi/core.c +8 -0
@@ -610,6 +610,11 @@ static void rtl_op_bss_info_changed(stru mac->link_state =MAC80211_NOLINK ;memset (mac->bssid,0 ,6 ); + +/* reset sec info */ +rtl_cam_reset_sec_info (hw); + +rtl_cam_reset_all_entry (hw); mac->vendor =PEER_UNKNOWN ; RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
@@ -1063,6 +1068,9 @@ static int rtl_op_set_key(struct ieee802*or clear all entry here. */ rtl_cam_delete_one_entry (hw, mac_addr, key_idx); + +rtl_cam_reset_sec_info (hw); +break ;default : RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,