3.0.9-stable review
Subsystems (109)
cover 3.0.9-stable review
This is the start of the stable review cycle for the 3.0.9 release. There are 262 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.
Responses should be made by Friday, November 11, 2011, 20:00:00 UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.0.9-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
Documentation/hwspinlock.txt | 18 +-- Documentation/power/runtime_pm.txt | 10 ++ Documentation/stable_kernel_rules.txt | 14 +- MAINTAINERS | 14 +- Makefile | 4 +- arch/arm/mach-ux500/cpu.c | 25 +++- arch/arm/plat-mxc/include/mach/iomux-v3.h | 10 +- arch/powerpc/include/asm/sparsemem.h | 2 +- arch/powerpc/mm/gup.c | 12 -- arch/powerpc/mm/hash_utils_64.c | 6 +- arch/powerpc/mm/hugetlbpage.c | 21 ++- arch/powerpc/mm/mem.c | 3 +- arch/powerpc/mm/mmu_context_hash64.c | 12 +- arch/powerpc/mm/numa.c | 3 +- arch/powerpc/platforms/pseries/dlpar.c | 4 + arch/powerpc/platforms/pseries/eeh.c | 2 +- arch/s390/kernel/ptrace.c | 28 ++-- arch/s390/kvm/kvm-s390.c | 14 ++- arch/s390/mm/gup.c | 14 ++- arch/s390/mm/pgtable.c | 5 +- arch/um/drivers/ubd_kern.c | 31 ++++- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/uv/uv_bau.h | 1 + arch/x86/include/asm/uv/uv_hub.h | 37 +++++- arch/x86/kernel/amd_iommu.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 20 ++- arch/x86/kernel/apic/probe_32.c | 10 +- arch/x86/kernel/apic/x2apic_uv_x.c | 7 +- arch/x86/kernel/kprobes.c | 4 +- arch/x86/mm/gup.c | 10 -- arch/x86/platform/uv/tlb_uv.c | 17 +-- block/genhd.c | 8 + crypto/cryptd.c | 2 +- drivers/acpi/atomicio.c | 2 +- drivers/ata/ata_piix.c | 37 ++++- drivers/base/power/runtime.c | 18 ++- drivers/block/cciss.c | 7 + drivers/block/xen-blkback/blkback.c | 2 +- drivers/bluetooth/ath3k.c | 6 + drivers/bluetooth/btusb.c | 22 +++- drivers/gpu/drm/i915/intel_dp.c | 31 ++++- drivers/gpu/drm/i915/intel_panel.c | 21 ++- drivers/gpu/drm/radeon/atombios_dp.c | 11 ++ drivers/gpu/drm/radeon/evergreen.c | 1 + drivers/gpu/drm/radeon/r100.c | 1 + drivers/gpu/drm/radeon/r600.c | 19 +-- drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_combios.c | 4 +- drivers/gpu/drm/radeon/radeon_connectors.c | 29 ++++- drivers/gpu/drm/radeon/radeon_drv.c | 4 + drivers/gpu/drm/radeon/radeon_irq_kms.c | 48 ++++++- drivers/gpu/drm/radeon/radeon_mode.h | 1 + drivers/gpu/drm/radeon/rs600.c | 1 + drivers/hid/Kconfig | 3 +- drivers/hid/hid-apple.c | 27 ++++ drivers/hid/hid-core.c | 17 ++ drivers/hid/hid-ids.h | 17 ++ drivers/hid/hid-multitouch.c | 5 + drivers/hid/usbhid/hid-quirks.c | 1 + drivers/hwmon/coretemp.c | 3 +- drivers/hwmon/w83627ehf.c | 12 ++- drivers/hwspinlock/hwspinlock_core.c | 45 +++--- drivers/leds/led-class.c | 7 +- drivers/md/raid5.c | 2 +- drivers/media/dvb/dvb-usb/dib0700_core.c | 81 +++++++++- drivers/media/dvb/frontends/dib0070.c | 37 ++++- drivers/media/dvb/frontends/dib0090.c | 70 ++++++++-- drivers/media/dvb/frontends/dib7000m.c | 27 +++- drivers/media/dvb/frontends/dib7000p.c | 32 ++++- drivers/media/dvb/frontends/dib8000.c | 72 ++++++++-- drivers/media/dvb/frontends/dib9000.c | 164 ++++++++++++++++++--- drivers/media/dvb/frontends/dibx000_common.c | 76 ++++++++-- drivers/media/dvb/frontends/dibx000_common.h | 1 + drivers/media/video/cx23885/cx23885-dvb.c | 2 +- drivers/media/video/uvc/uvc_driver.c | 2 +- drivers/media/video/uvc/uvc_video.c | 10 +- drivers/media/video/uvc/uvcvideo.h | 2 +- drivers/mmc/core/core.c | 10 +- drivers/mmc/core/core.h | 1 + drivers/mmc/core/mmc.c | 3 + drivers/mmc/core/sd.c | 1 + drivers/mmc/core/sdio.c | 1 + drivers/mtd/mtdchar.c | 1 + drivers/mtd/nand/nand_base.c | 27 ++-- drivers/mtd/nand/pxa3xx_nand.c | 14 +- drivers/mtd/redboot.c | 3 + drivers/net/bonding/bond_main.c | 7 +- drivers/net/enic/enic_main.c | 8 +- drivers/net/macvlan.c | 2 +- drivers/net/netconsole.c | 5 + drivers/net/phy/dp83640.c | 9 +- drivers/net/rionet.c | 4 +- drivers/net/tg3.c | 2 +- drivers/net/usb/asix.c | 7 +- drivers/net/usb/cdc_ncm.c | 47 +++++- drivers/net/usb/ipheth.c | 5 + drivers/net/usb/rtl8150.c | 1 - drivers/net/wireless/ath/ath9k/ani.c | 5 - drivers/net/wireless/ath/ath9k/ar9003_calib.c | 3 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 4 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 12 +- drivers/net/wireless/ath/ath9k/ar9485_initvals.h | 10 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 1 + drivers/net/wireless/ath/ath9k/hw.c | 4 + drivers/net/wireless/ath/ath9k/recv.c | 5 +- drivers/net/wireless/iwlwifi/iwl-agn-ucode.c | 9 +- drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +- drivers/net/wireless/iwlwifi/iwl-core.c | 4 +- drivers/net/wireless/iwlwifi/iwl-hcmd.c | 2 +- drivers/net/wireless/iwlwifi/iwl-rx.c | 2 +- drivers/net/wireless/iwlwifi/iwl-tx.c | 2 +- drivers/net/wireless/wl12xx/scan.c | 19 ++- drivers/net/xen-netback/interface.c | 4 +- drivers/pci/quirks.c | 28 ++-- drivers/pci/xen-pcifront.c | 5 +- drivers/platform/x86/samsung-laptop.c | 39 +++++- drivers/platform/x86/wmi.c | 6 +- drivers/power/ds2780_battery.c | 86 +++++++----- drivers/s390/cio/ccwgroup.c | 42 +++--- drivers/scsi/device_handler/scsi_dh.c | 10 +- drivers/scsi/hosts.c | 9 +- drivers/scsi/hpsa.c | 7 + drivers/scsi/ipr.c | 2 +- drivers/scsi/isci/isci.h | 2 +- drivers/scsi/isci/port_config.c | 2 +- drivers/scsi/isci/request.c | 49 +++---- drivers/scsi/isci/request.h | 3 - drivers/scsi/isci/sas.h | 2 - drivers/scsi/libsas/sas_expander.c | 2 + drivers/scsi/megaraid/megaraid_sas_base.c | 3 +- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 15 ++- drivers/scsi/scsi_lib.c | 9 + drivers/scsi/scsi_scan.c | 1 + drivers/scsi/st.c | 4 +- drivers/staging/hv/hyperv_storage.h | 1 + drivers/staging/hv/storvsc_drv.c | 2 + drivers/staging/quatech_usb2/quatech_usb2.c | 9 +- drivers/staging/serqt_usb2/serqt_usb2.c | 3 - drivers/target/loopback/tcm_loop.c | 18 +++ drivers/target/target_core_alua.c | 20 +++ drivers/tty/pty.c | 26 ++-- drivers/tty/serial/crisv10.c | 4 +- drivers/tty/serial/jsm/jsm.h | 7 - drivers/tty/serial/jsm/jsm_driver.c | 1 - drivers/tty/serial/jsm/jsm_neo.c | 29 ++-- drivers/tty/serial/jsm/jsm_tty.c | 94 ++---------- drivers/tty/serial/pxa.c | 20 +++ drivers/tty/serial/serial_core.c | 2 + drivers/tty/tty_io.c | 48 +++++-- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/devio.c | 27 +++- drivers/usb/core/driver.c | 7 +- drivers/usb/core/hcd.c | 2 + drivers/usb/core/quirks.c | 24 +++ drivers/usb/gadget/printer.c | 2 +- drivers/usb/host/ehci-dbg.c | 2 +- drivers/usb/host/ehci-hcd.c | 32 ++++- drivers/usb/host/ehci-hub.c | 12 ++ drivers/usb/host/ehci-pci.c | 5 + drivers/usb/host/ehci-sched.c | 30 +++- drivers/usb/host/ehci.h | 17 ++ drivers/usb/host/fhci-sched.c | 19 ++- drivers/usb/host/isp1760-hcd.c | 3 + drivers/usb/host/ohci-hub.c | 5 +- drivers/usb/host/xhci-hub.c | 22 ++- drivers/usb/host/xhci-mem.c | 54 ++++--- drivers/usb/host/xhci-pci.c | 3 + drivers/usb/host/xhci-ring.c | 82 +++++++---- drivers/usb/host/xhci.c | 6 + drivers/usb/host/xhci.h | 3 + drivers/usb/mon/mon_bin.c | 2 +- drivers/usb/serial/ftdi_sio.c | 5 + drivers/usb/serial/ftdi_sio_ids.h | 13 ++- drivers/usb/serial/option.c | 170 ++++++++++++++-------- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 5 + drivers/usb/serial/qcserial.c | 3 + drivers/usb/storage/transport.c | 34 +++-- drivers/usb/storage/usb.c | 16 ++- drivers/video/carminefb.c | 6 +- drivers/video/fbmem.c | 3 - drivers/video/fbsysfs.c | 3 + drivers/video/sh_mobile_hdmi.c | 47 ++++--- drivers/video/via/via_modesetting.h | 5 + drivers/video/via/viafbdev.c | 16 ++- drivers/w1/slaves/w1_ds2780.c | 48 +++++-- drivers/w1/slaves/w1_ds2780.h | 2 + drivers/xen/events.c | 2 +- drivers/xen/swiotlb-xen.c | 7 +- fs/binfmt_elf.c | 11 ++- fs/block_dev.c | 13 +- fs/cifs/connect.c | 4 +- fs/cifs/inode.c | 19 ++- fs/eventpoll.c | 25 +++- fs/ext4/ext4.h | 4 +- fs/ext4/inode.c | 3 - fs/ext4/namei.c | 8 +- fs/ext4/page-io.c | 18 ++- fs/ext4/xattr.c | 6 + fs/hppfs/hppfs.c | 1 + fs/namei.c | 55 +++++-- fs/namespace.c | 3 +- fs/nfs/super.c | 2 +- fs/nfs/write.c | 43 ++---- fs/nfsd/nfs4proc.c | 6 +- fs/nfsd/nfs4recover.c | 2 +- fs/nfsd/nfs4state.c | 30 +++-- fs/nfsd/nfs4xdr.c | 12 ++ fs/nfsd/state.h | 6 - fs/nfsd/vfs.c | 3 +- fs/nfsd/vfs.h | 1 + fs/proc/base.c | 10 +- fs/proc/task_mmu.c | 3 + fs/quota/quota.c | 2 +- fs/stat.c | 5 +- fs/statfs.c | 2 +- include/drm/drm_dp_helper.h | 3 + include/linux/ext2_fs.h | 4 +- include/linux/ext3_fs.h | 4 +- include/linux/interrupt.h | 3 + include/linux/io-mapping.h | 4 + include/linux/jiffies.h | 2 +- include/linux/mm.h | 67 ++++----- include/linux/mm_types.h | 22 +++- include/linux/namei.h | 2 + include/linux/phy.h | 2 +- include/linux/skbuff.h | 7 +- include/linux/tty.h | 4 +- include/linux/usb/hcd.h | 2 +- include/linux/vmalloc.h | 1 + include/net/flow.h | 25 +++- kernel/irq/pm.c | 48 +++++- kernel/kmod.c | 4 +- kernel/power/suspend.c | 2 +- kernel/signal.c | 4 +- kernel/time.c | 2 +- kernel/trace/trace.c | 4 +- lib/kobject_uevent.c | 2 +- lib/nlattr.c | 1 + mm/huge_memory.c | 37 ++++-- mm/internal.h | 46 ++++++ mm/memory.c | 2 +- mm/swap.c | 83 +++++++---- mm/vmalloc.c | 65 ++++++-- net/bridge/br_device.c | 3 - net/bridge/br_if.c | 9 +- net/bridge/br_netlink.c | 1 + net/bridge/br_private.h | 1 + net/caif/caif_dev.c | 5 +- net/can/bcm.c | 53 +++---- net/core/dev.c | 1 + net/core/flow.c | 31 ++-- net/core/sock.c | 1 + net/core/timestamping.c | 12 ++- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_ipv4.c | 11 +- net/ipv4/xfrm4_policy.c | 14 +- net/ipv6/tcp_ipv6.c | 11 +- net/l2tp/l2tp_core.c | 4 +- net/mac80211/cfg.c | 2 +- net/mac80211/ieee80211_i.h | 2 + net/mac80211/mlme.c | 18 ++- net/mac80211/status.c | 2 +- net/mac80211/work.c | 9 +- net/packet/af_packet.c | 5 +- net/sunrpc/auth_unix.c | 3 + scripts/kconfig/menu.c | 7 +- sound/pci/hda/patch_conexant.c | 30 ++++- sound/pci/hda/patch_realtek.c | 14 +- sound/pci/hda/patch_sigmatel.c | 56 +++----- sound/soc/codecs/ak4535.c | 10 +- sound/soc/codecs/ak4642.c | 22 ++-- sound/soc/codecs/wm8711.c | 4 +- sound/soc/codecs/wm8741.c | 4 +- sound/soc/codecs/wm8904.c | 2 +- sound/soc/codecs/wm8940.c | 2 + sound/soc/codecs/wm8962.c | 38 +++-- sound/soc/codecs/wm8994.c | 2 +- sound/usb/misc/ua101.c | 28 +++- tools/perf/util/probe-event.c | 4 +- 280 files changed, 2892 insertions(+), 1239 deletions(-)
PATCH 1/262 CIFS: Fix incorrect max RFC1002 write size value
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 94443f43404239c2a6dc4252a7cb9e77f5b1eb6e upstream.
..the length field has only 17 bits.
--- fs/cifs/connect.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/connect.c +2 -2
@@ -2767,10 +2767,10 @@ void cifs_setup_cifs_sb(struct smb_vol */* * When the server doesn't allow large posix writes, only allow a wsize of -* 128k minus the size of the WRITE_AND_X header. That allows for a write up +* 2^17-1 minus the size of the WRITE_AND_X header. That allows for a write up * to the maximum size described by RFC1002. */ -#define CIFS_MAX_RFC1002_WSIZE (128 * 1024 - sizeof(WRITE_REQ) + 4) +#define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)/* * The default wsize is 1M. find_get_pages seems to return a maximum of 256
PATCH 2/262 CIFS: Fix DFS handling in cifs_get_file_info
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 42274bb22afc3e877ae5abed787b0b09d7dede52 upstream.
We should call cifs_all_info_to_fattr in rc == 0 case only.
--- fs/cifs/inode.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
fs/cifs/inode.c +12 -7
@@ -562,7 +562,16 @@ int cifs_get_file_info(struct file *filp xid =GetXid (); rc =CIFSSMBQFileInfo (xid, tcon, cfile->netfid, &find_data); -if (rc == -EOPNOTSUPP || rc == -EINVAL ) { +switch (rc) { +case 0 : +cifs_all_info_to_fattr (&fattr, &find_data, cifs_sb, false); +break ; +case -EREMOTE : +cifs_create_dfs_fattr (&fattr, inode->i_sb); + rc =0 ; +break ; +case -EOPNOTSUPP : +case -EINVAL :/* * FIXME: legacy server -- fall back to path-based call? * for now, just skip revalidating and mark inode for
@@ -570,18 +579,14 @@ int cifs_get_file_info(struct file *filp*/ rc =0 ;CIFS_I (inode)->time =0 ; +default : goto cgfi_exit; - }else if (rc == -EREMOTE ) { -cifs_create_dfs_fattr (&fattr, inode->i_sb); - rc =0 ; - }else if (rc) - goto cgfi_exit; + }/* * don't bother with SFU junk here -- just mark inode as needing * revalidation. */ -cifs_all_info_to_fattr (&fattr, &find_data, cifs_sb, false); fattr.cf_uniqueid =CIFS_I (inode)->uniqueid; fattr.cf_flags |=CIFS_FATTR_NEED_REVAL ;cifs_fattr_to_inode (inode, &fattr);
PATCH 3/262 cris: fix a build error in drivers/tty/serial/crisv10.c
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
commit 2f7861de111bb8e33e6ab9f9607583c6fbc00132 upstream.
This patch fixes the following build error:
drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs
v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig
drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs
v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig
drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs
v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig"if_ser0" is a typo, it should be "if_serial_0".
--- drivers/tty/serial/crisv10.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/crisv10.c +2 -2
@@ -4450,7 +4450,7 @@ static int __init rs_init(void) #if defined(CONFIG_ETRAX_RS485) #if defined(CONFIG_ETRAX_RS485_ON_PA) - if (cris_io_interface_allocate_pins(if_ser0, 'a', rs485_pa_bit, + if (cris_io_interface_allocate_pins(if_serial_0, 'a', rs485_pa_bit, rs485_pa_bit)) { printk(KERN_CRIT "ETRAX100LX serial: Could not allocate " "RS485 pin\n");
@@ -4459,7 +4459,7 @@ static int __init rs_init(void) }#endif #if defined(CONFIG_ETRAX_RS485_ON_PORT_G ) -if (cris_io_interface_allocate_pins (if_ser0,'g' , rs485_pa_bit, +if (cris_io_interface_allocate_pins (if_serial_0,'g' , rs485_pa_bit, rs485_port_g_bit)) {printk (KERN_CRIT "ETRAX100LX serial: Could not allocate " "RS485 pin\n" );
PATCH 4/262 TTY: drop driver reference in tty_open fail path
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <[email protected]>
commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream.
When tty_driver_lookup_tty fails in tty_open, we forget to drop a reference to the tty driver. This was added by commit 4a2b5fddd5 (Move tty lookup/reopen to caller).
Fix that by adding tty_driver_kref_put to the fail path.
I will refactor the code later. This is for the ease of backporting to stable.
Introduced-in: v2.6.28-rc2
--- drivers/tty/tty_io.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/tty_io.c +1 -0
@@ -1872,6 +1872,7 @@ got_driver:if (IS_ERR (tty)) {tty_unlock ();mutex_unlock (&tty_mutex); +tty_driver_kref_put (driver);return PTR_ERR (tty); } }
PATCH 5/262 TTY: make tty_add_file non-failing
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <[email protected]>
commit fa90e1c935472281de314e6d7c9a37db9cbc2e4e upstream.
If tty_add_file fails at the point it is now, we have to revert all the changes we did to the tty. It means either decrease all refcounts if this was a tty reopen or delete the tty if it was newly allocated.
There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7 (TTY: fix fail path in tty_open). But instead it introduced a NULL dereference. It's because tty_release dereferences filp->private_data, but that one is set even in our tty_add_file. And when tty_add_file fails, it's still NULL/garbage. Hence tty_release cannot be called there.
To circumvent the original leak (and the current NULL deref) we split tty_add_file into two functions, making the latter non-failing. In that case we may do the former early in open, where handling failures is easy. The latter stays as it is now. So there is no change in functionality.
The original bug (leak) was introduced by f573bd176 (tty: Remove __GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this.
Later, we may split tty_release into more functions and call only some of them in this fail path instead. (If at all possible.)
Introduced-in: v2.6.37-rc2
--- drivers/tty/pty.c | 16 +++++++++++----- drivers/tty/tty_io.c | 47 +++++++++++++++++++++++++++++++++++------------ include/linux/tty.h | 4 +++- 3 files changed, 49 insertions(+), 18 deletions(-)
drivers/tty/pty.c +11 -5
@@ -670,12 +670,18 @@ static int ptmx_open(struct inode *inodenonseekable_open (inode, filp); + retval =tty_alloc_file (filp); +if (retval) +return retval; +/* find a device that is not in use. */ tty_lock (); index =devpts_new_index (inode);tty_unlock (); -if (index <0 ) -return index; +if (index <0 ) { + retval = index; + goto err_file; + }mutex_lock (&tty_mutex);tty_lock ();
@@ -689,9 +695,7 @@ static int ptmx_open(struct inode *inodeset_bit (TTY_PTY_LOCK , &tty->flags);/* LOCK THE SLAVE */ - retval =tty_add_file (tty, filp); -if (retval) - goto out; +tty_add_file (tty, filp); retval =devpts_pty_new (inode, tty->link);if (retval)
@@ -710,6 +714,8 @@ out2: out:devpts_kill_index (inode, index);tty_unlock (); +err_file: +tty_free_file (filp);return retval; }
drivers/tty/tty_io.c +35 -12
111 lines not on this page · raw message
include/linux/tty.h +3 -1
@@ -472,7 +472,9 @@ extern void proc_clear_tty(struct task_sextern struct tty_struct *get_current_tty (void );extern void tty_default_fops (struct file_operations *fops);extern struct tty_struct *alloc_tty_struct (void ); -extern int tty_add_file (struct tty_struct *tty,struct file *file); +extern int tty_alloc_file (struct file *file); +extern void tty_add_file (struct tty_struct *tty,struct file *file); +extern void tty_free_file (struct file *file);extern void free_tty_struct (struct tty_struct *tty);extern void initialize_tty_struct (struct tty_struct *tty,struct tty_driver *driver,int idx);
PATCH 6/262 TTY: pty, release tty in all ptmx_open fail paths
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <[email protected]>
commit 1177c0efc04d032644895b8d757f55b433912596 upstream.
Mistakenly, commit 64ba3dc3143d (tty: never hold BTM while getting tty_mutex) switched one fail path in ptmx_open to not free the newly allocated tty.
Fix that by jumping to the appropriate place. And rename the labels so that it's clear what is going on there.
Introduced-in: v2.6.36-rc2
--- drivers/tty/pty.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/tty/pty.c +5 -5
@@ -699,15 +699,15 @@ static int ptmx_open(struct inode *inode retval =devpts_pty_new (inode, tty->link);if (retval) - goto out1; + goto err_release; retval = ptm_driver->ops->open (tty, filp);if (retval) - goto out2; -out1: + goto err_release; +tty_unlock (); -return retval; -out2: +return 0 ; +err_release:tty_unlock ();tty_release (inode, filp);return retval;
PATCH 7/262 USB: for usb_autopm_get_interface_async -EINPROGRESS is not an error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Wylder <[email protected]>
commit c5a48592d874ddef8c7880311581eccf0eb30c3b upstream.
A return value of -EINPROGRESS from pm_runtime_get indicates that the device is already resuming due to a previous call. Internally, usb_autopm_get_interface_async doesn't treat this as an error and increments the usage count, but passes the error status along to the caller. The logical assumption of the caller is that any negative return value reflects the device not resuming and the pm_usage_cnt not being incremented. Since the usage count is being incremented and the device is resuming, return success (0) instead.
--- drivers/usb/core/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/driver.c +1 -1
@@ -1583,7 +1583,7 @@ int usb_autopm_get_interface_async(strucdev_vdbg (&intf->dev,"%s: cnt %d -> %d\n" , __func__,atomic_read (&intf->dev.power.usage_count), status); -if (status >0 ) +if (status >0 || status == -EINPROGRESS ) status =0 ;return status; }
PATCH 8/262 staging: serqt_usb2: remove ssu100 from supported devices
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bill Pemberton <[email protected]>
commit 7cbf3c7cd59288fb5e9f31815c74773549668d43 upstream.
The serqt_usb2 driver will not work properly with the ssu100 device even though it claims to support it. The ssu100 is supported by the ssu100 driver in mainline so there is no need to have it claimed by serqt_usb2.
--- drivers/staging/serqt_usb2/serqt_usb2.c | 3 --- 1 file changed, 3 deletions(-)
drivers/staging/serqt_usb2/serqt_usb2.c +0 -3
@@ -24,7 +24,6 @@ static int debug;#define DRIVER_DESC "Quatech USB to Serial Driver"#define USB_VENDOR_ID_QUATECH 0x061d/* Quatech VID */ -#define QUATECH_SSU100 0xC020/* SSU100 */ #define QUATECH_SSU200 0xC030/* SSU200 */ #define QUATECH_DSU100 0xC040/* DSU100 */ #define QUATECH_DSU200 0xC050/* DSU200 */
@@ -127,7 +126,6 @@ static int debug;#define RS232_MODE 0x00static const struct usb_device_id serqt_id_table[] = { - {USB_DEVICE (USB_VENDOR_ID_QUATECH ,QUATECH_SSU100 )}, {USB_DEVICE (USB_VENDOR_ID_QUATECH ,QUATECH_SSU200 )}, {USB_DEVICE (USB_VENDOR_ID_QUATECH ,QUATECH_DSU100 )}, {USB_DEVICE (USB_VENDOR_ID_QUATECH ,QUATECH_DSU200 )},
@@ -775,7 +773,6 @@ static int qt_startup(struct usb_serial }switch (serial->dev->descriptor.idProduct) { -case QUATECH_SSU100 :case QUATECH_DSU100 :case QUATECH_QSU100 :case QUATECH_ESU100A :
PATCH 9/262 staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kautuk Consul <[email protected]>
commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream.
If the usermode app does an ioctl over this serial device by using TIOCMIWAIT, then the code will wait by setting the current task state to TASK_INTERRUPTIBLE and then calling schedule(). This will be woken up by the qt2_process_modem_status on URB completion when the port_extra->shadowMSR is set to the new modem status.
However, this could result in a lost wakeup scenario due to a race in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion for new modem status in qt2_process_modem_status.
Due to this, the usermode app's task will continue to sleep despite a change in the modem status.
--- drivers/staging/quatech_usb2/quatech_usb2.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/staging/quatech_usb2/quatech_usb2.c +7 -2
@@ -916,9 +916,10 @@ static int qt2_ioctl(struct tty_struct *dbg ("%s() port %d, cmd == TIOCMIWAIT enter" , __func__, port->number); prev_msr_value = port_extra->shadowMSR &QT2_SERIAL_MSR_MASK ; +barrier (); +__set_current_state (TASK_INTERRUPTIBLE );while (1 ) {add_wait_queue (&port_extra->wait, &wait); -set_current_state (TASK_INTERRUPTIBLE );schedule ();dbg ("%s(): port %d, cmd == TIOCMIWAIT here\n" , __func__, port->number);
@@ -926,9 +927,12 @@ static int qt2_ioctl(struct tty_struct */* see if a signal woke us up */ if (signal_pending (current))return -ERESTARTSYS ; +set_current_state (TASK_INTERRUPTIBLE ); msr_value = port_extra->shadowMSR &QT2_SERIAL_MSR_MASK ; -if (msr_value == prev_msr_value) +if (msr_value == prev_msr_value) { +__set_current_state (TASK_RUNNING );return -EIO ;/* no change - error */ + } if ((arg & TIOCM_RNG && ((prev_msr_value & QT2_SERIAL_MSR_RI) == (msr_value & QT2_SERIAL_MSR_RI))) ||
@@ -941,6 +945,7 @@ static int qt2_ioctl(struct tty_struct * (arg & TIOCM_CTS && ((prev_msr_value & QT2_SERIAL_MSR_CTS) == (msr_value & QT2_SERIAL_MSR_CTS)))) { +__set_current_state (TASK_RUNNING );return 0 ; } }/* end inifinite while */
PATCH 10/262 Staging: hv: Add support for >2 TB LUN in storage driver.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Sterling <[email protected]>
commit cf55f4a8b6243b42fb91c56d1421db0d36d60f96 upstream.
If a LUN larger than 2 TB is attached to a Linux VM on Hyper-V, we currently report a maximum size of 2 TB. This patch resolves the issue in hv_storvsc. Thanks to Robert Scheck <[email protected]> for reporting the issue.
--- drivers/staging/hv/hyperv_storage.h | 1 + drivers/staging/hv/storvsc_drv.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/staging/hv/hyperv_storage.h +1 -0
@@ -218,6 +218,7 @@ struct vstor_packet {#define STORVSC_MAX_LUNS_PER_TARGET 64#define STORVSC_MAX_TARGETS 1#define STORVSC_MAX_CHANNELS 1 +#define STORVSC_MAX_CMD_LEN 16struct hv_storvsc_request ;
drivers/staging/hv/storvsc_drv.c +2 -0
@@ -729,6 +729,8 @@ static int storvsc_probe(struct hv_devic host->max_id =STORVSC_MAX_TARGETS ;/* max # of channels */ host->max_channel =STORVSC_MAX_CHANNELS -1 ; +/* max cmd length */ + host->max_cmd_len =STORVSC_MAX_CMD_LEN ;/* Register the HBA and start the scsi bus scan */ ret =scsi_add_host (host, &device->device);
PATCH 11/262 USB: qcserial: Add support for Sierra Wireless MC8355/Gobi 3000
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Hartmann <[email protected]>
commit 68c79e5756903229fa96826a2493c2265a3b395f upstream.
Simple patch to make qcserial recognize the USB id of the Sierra Wireless MC8355 which is based on the Gobi 3000 chip.
Both UMTS and GPS work fine.
--- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/qcserial.c +1 -0
@@ -83,6 +83,7 @@ static const struct usb_device_id id_tab {USB_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */ {USB_DEVICE(0x05c6, 0x9204)}, /* Gobi 2000 QDL device */ {USB_DEVICE(0x05c6, 0x9205)}, /* Gobi 2000 Modem device */ + {USB_DEVICE(0x1199, 0x9013)}, /* Sierra Wireless Gobi 3000 Modem device (MC8355) */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, id_table);
PATCH 12/262 USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module"
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rigbert Hamisch <[email protected]>
commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream.
add device ID for "HP un2430 Mobile Broadband Module"
--- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/qcserial.c +1 -0
@@ -28,6 +28,7 @@ static const struct usb_device_id id_tab {USB_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ {USB_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */ {USB_DEVICE(0x03f0, 0x201d)}, /* HP un2400 Gobi QDL Device */ + {USB_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */ {USB_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */ {USB_DEVICE(0x04da, 0x250c)}, /* Panasonic Gobi QDL device */ {USB_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */
PATCH 13/262 serial: pxa: work around for errata #20
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Folkesson <[email protected]>
commit e44aabd649c80e8be16ede3ed3cbff6fb2561ca9 upstream.
Errata E20: UART: Character Timeout interrupt remains set under certain software conditions.
Implication: The software servicing the UART can be trapped in an infinite loop.
--- drivers/tty/serial/pxa.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/tty/serial/pxa.c +20 -0
@@ -100,6 +100,16 @@ static inline void receive_chars(structint max_count =256 ; do { + /* work around Errata #20 according to + * Intel(R) PXA27x Processor Family + * Specification Update (May 2005) + * + * Step 2 + * Disable the Reciever Time Out Interrupt via IER[RTOEI] + */ + up->ier &= ~UART_IER_RTOIE; + serial_out(up, UART_IER, up->ier); + ch = serial_in(up, UART_RX); flag = TTY_NORMAL; up->port.icount.rx++;
@@ -156,6 +166,16 @@ static inline void receive_chars(struct *status =serial_in (up,UART_LSR ); }while ((*status &UART_LSR_DR ) && (max_count-- >0 ));tty_flip_buffer_push (tty); + +/* work around Errata #20 according to +* Intel(R) PXA27x Processor Family +* Specification Update (May 2005) +* +* Step 6: +* No more data in FIFO: Re-enable RTO interrupt via IER[RTOIE] +*/ + up->ier |=UART_IER_RTOIE ; +serial_out (up,UART_IER , up->ier); }static void transmit_chars (struct uart_pxa_port *up)
PATCH 14/262 serial-core: power up uart port early before we do set_termios when resuming
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ning Jiang <[email protected]>
commit 94abc56f4d90f289ea32a0a11d3577fcd8cb28fb upstream.
The following patch removed uart_change_pm() in uart_resume_port():
commit 5933a161abcb8d83a2c145177f48027c3c0a8995
Author: Yin Kangkai <[email protected]>
serial-core: reset the console speed on resume
It will break the pxa serial driver when the system resumes from suspend mode as it will try to set baud rate divider register in set_termios but with clock off. The register value can not be set correctly on some platform if the clock is disabled. The pxa driver will check the value and report the following warning:
------------[ cut here ]------------ WARNING: at drivers/tty/serial/pxa.c:545 serial_pxa_set_termios+0x1dc/0x250() Modules linked in: [<c0281f30>] (unwind_backtrace+0x0/0xf0) from [<c029341c>] (warn_slowpath_common+0x4c/0x64) [<c029341c>] (warn_slowpath_common+0x4c/0x64) from [<c029344c>] (warn_slowpath_null+0x18/0x1c) [<c029344c>] (warn_slowpath_null+0x18/0x1c) from [<c044b1e4>] (serial_pxa_set_termios+0x1dc/0x250) [<c044b1e4>] (serial_pxa_set_termios+0x1dc/0x250) from [<c044a840>] (uart_resume_port+0x128/0x2dc) [<c044a840>] (uart_resume_port+0x128/0x2dc) from [<c044bbe0>] (serial_pxa_resume+0x18/0x24) [<c044bbe0>] (serial_pxa_resume+0x18/0x24) from [<c0454d34>] (platform_pm_resume+0x40/0x4c) [<c0454d34>] (platform_pm_resume+0x40/0x4c) from [<c0457ebc>] (pm_op+0x68/0xb4) [<c0457ebc>] (pm_op+0x68/0xb4) from [<c0458368>] (device_resume+0xb0/0xec) [<c0458368>] (device_resume+0xb0/0xec) from [<c04584c8>] (dpm_resume+0xe0/0x194) [<c04584c8>] (dpm_resume+0xe0/0x194) from [<c0458588>] (dpm_resume_end+0xc/0x18) [<c0458588>] (dpm_resume_end+0xc/0x18) from [<c02c518c>] (suspend_devices_and_enter+0x16c/0x1ac) [<c02c518c>] (suspend_devices_and_enter+0x16c/0x1ac) from [<c02c5278>] (enter_state+0xac/0xdc) [<c02c5278>] (enter_state+0xac/0xdc) from [<c02c48ec>] (state_store+0xa0/0xbc) [<c02c48ec>] (state_store+0xa0/0xbc) from [<c0408f7c>] (kobj_attr_store+0x18/0x1c) [<c0408f7c>] (kobj_attr_store+0x18/0x1c) from [<c034a6a4>] (sysfs_write_file+0x108/0x140) [<c034a6a4>] (sysfs_write_file+0x108/0x140) from [<c02fb798>] (vfs_write+0xac/0x134) [<c02fb798>] (vfs_write+0xac/0x134) from [<c02fb8cc>] (sys_write+0x3c/0x68) [<c02fb8cc>] (sys_write+0x3c/0x68) from [<c027c700>] (ret_fast_syscall+0x0/0x2c) ---[ end trace 88289eceb4675b04 ]---
This patch fix the problem by adding the power on opertion back for uart console when console_suspend_enabled is true.
--- drivers/tty/serial/serial_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/serial_core.c +2 -0
@@ -2003,6 +2003,8 @@ int uart_resume_port(struct uart_driverif (port->tty && port->tty->termios && termios.c_cflag ==0 ) termios = *(port->tty->termios); +if (console_suspend_enabled) +uart_change_pm (state,0 ); uport->ops->set_termios (uport, &termios,NULL );if (console_suspend_enabled)console_start (uport->cons);
PATCH 15/262 EHCI : introduce a common ehci_setup
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu CASTET <[email protected]>
commit 2093c6b49c8f1dc581d8953aca71297d4cace55e upstream.
This allow to clean duplicated code in most of SOC driver.
--- drivers/usb/host/ehci-hcd.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/usb/host/ehci-hcd.c +29 -0
@@ -761,6 +761,35 @@ static int ehci_run (struct usb_hcd *hcdreturn 0 ; } +static int __maybe_unused ehci_setup (struct usb_hcd *hcd) +{ +struct ehci_hcd *ehci =hcd_to_ehci (hcd); +int retval; + + ehci->regs = (void __iomem *)ehci->caps + +HC_LENGTH (ehci,ehci_readl (ehci, &ehci->caps->hc_capbase)); +dbg_hcs_params (ehci,"reset" ); +dbg_hcc_params (ehci,"reset" ); + +/* cache this readonly data; minimize chip reads */ + ehci->hcs_params =ehci_readl (ehci, &ehci->caps->hcs_params); + + ehci->sbrn =HCD_USB2 ; + + retval =ehci_halt (ehci); +if (retval) +return retval; + +/* data structure init */ + retval =ehci_init (hcd); +if (retval) +return retval; + +ehci_reset (ehci); + +return 0 ; +} +/*-------------------------------------------------------------------------*/ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
PATCH 16/262 USB: fix ehci alignment error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harro Haan <[email protected]>
commit 276532ba9666b36974cbe16f303fc8be99c9da17 upstream.
The Kirkwood gave an unaligned memory access error on line 742 of drivers/usb/host/echi-hcd.c:
"ehci->last_periodic_enable = ktime_get_real();"
--- include/linux/usb/hcd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/usb/hcd.h +1 -1
@@ -178,7 +178,7 @@ struct usb_hcd {* this structure. */ unsigned long hcd_priv[0] - __attribute__ ((aligned(sizeof(unsigned long)))); + __attribute__ ((aligned(sizeof(s64)))); };/* 2.4 does this a bit differently ... */
PATCH 17/262 EHCI: workaround for MosChip controller bug
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 68aa95d5d4de31c9348c1628ffa85c805305ebc5 upstream.
This patch (as1489) works around a hardware bug in MosChip EHCI controllers. Evidently when one of these controllers increments the frame-index register, it changes the three low-order bits (the microframe counter) before changing the higher order bits (the frame counter). If the register is read at just the wrong time, the value obtained is too low by 8.
When the appropriate quirk flag is set, we work around this problem by reading the frame-index register a second time if the first value's three low-order bits are all 0. This gives the hardware a chance to finish updating the register, yielding the correct value.
--- drivers/usb/host/ehci-dbg.c | 2 +- drivers/usb/host/ehci-hcd.c | 3 +-- drivers/usb/host/ehci-pci.c | 5 +++++ drivers/usb/host/ehci-sched.c | 30 +++++++++++++++++++++++++----- drivers/usb/host/ehci.h | 17 +++++++++++++++++ 5 files changed, 49 insertions(+), 8 deletions(-)
drivers/usb/host/ehci-dbg.c +1 -1
@@ -808,7 +808,7 @@ static ssize_t fill_registers_buffer(str next += temp; temp =scnprintf (next, size,"uframe %04x\n" , -ehci_readl (ehci, &ehci->regs->frame_index)); +ehci_read_frame_index (ehci)); size -= temp; next += temp;
drivers/usb/host/ehci-hcd.c +1 -2
@@ -1188,8 +1188,7 @@ ehci_endpoint_reset(struct usb_hcd *hcd,static int ehci_get_frame (struct usb_hcd *hcd) {struct ehci_hcd *ehci =hcd_to_ehci (hcd); -return (ehci_readl (ehci, &ehci->regs->frame_index) >>3 ) % - ehci->periodic_size; +return (ehci_read_frame_index (ehci) >>3 ) % ehci->periodic_size; }/*-------------------------------------------------------------------------*/
drivers/usb/host/ehci-pci.c +5 -0
@@ -224,6 +224,11 @@ static int ehci_pci_setup(struct usb_hcdpci_dev_put (p_smbus); }break ; +case PCI_VENDOR_ID_NETMOS : +/* MosChip frame-index-register bug */ +ehci_info (ehci,"applying MosChip frame-index workaround\n" ); + ehci->frame_index_bug =1 ; +break ; }/* optional debug port, normally in the first BAR */
drivers/usb/host/ehci-sched.c +25 -5
@@ -36,6 +36,27 @@static int ehci_get_frame (struct usb_hcd *hcd); +#ifdef CONFIG_PCI + +static unsigned ehci_read_frame_index (struct ehci_hcd *ehci) +{ +unsigned uf; + +/* +* The MosChip MCS9990 controller updates its microframe counter +* a little before the frame counter, and occasionally we will read +* the invalid intermediate value. Avoid problems by checking the +* microframe number (the low-order 3 bits); if they are 0 then +* re-read the register to get the correct value. +*/ + uf =ehci_readl (ehci, &ehci->regs->frame_index); +if (unlikely (ehci->frame_index_bug && ((uf &7 ) ==0 ))) + uf =ehci_readl (ehci, &ehci->regs->frame_index); +return uf; +} + +#endif +/*-------------------------------------------------------------------------*/ /*
@@ -482,7 +503,7 @@ static int enable_periodic (struct ehci_ehci_to_hcd (ehci)->state =HC_STATE_RUNNING ;/* make sure ehci_work scans these */ - ehci->next_uframe =ehci_readl (ehci, &ehci->regs->frame_index) + ehci->next_uframe =ehci_read_frame_index (ehci) % (ehci->periodic_size <<3 );if (unlikely (ehci->broken_periodic)) ehci->last_periodic_enable =ktime_get_real ();
@@ -1412,7 +1433,7 @@ iso_stream_schedule ( goto fail; } - now =ehci_readl (ehci, &ehci->regs->frame_index) & (mod -1 ); + now =ehci_read_frame_index (ehci) & (mod -1 );/* Typical case: reuse current schedule, stream is still active. * Hopefully there are no gaps from the host falling behind
@@ -2279,7 +2300,7 @@ scan_periodic (struct ehci_hcd *ehci)*/ now_uframe = ehci->next_uframe;if (HC_IS_RUNNING (ehci_to_hcd (ehci)->state)) { - clock =ehci_readl (ehci, &ehci->regs->frame_index); + clock =ehci_read_frame_index (ehci); clock_frame = (clock >>3 ) & (ehci->periodic_size -1 ); }else { clock = now_uframe + mod -1 ;
@@ -2458,8 +2479,7 @@ restart: || ehci->periodic_sched == 0)break ; ehci->next_uframe = now_uframe; - now =ehci_readl (ehci, &ehci->regs->frame_index) & - (mod -1 ); + now =ehci_read_frame_index (ehci) & (mod -1 );if (now_uframe == now)break ;
drivers/usb/host/ehci.h +17 -0
@@ -137,6 +137,7 @@ struct ehci_hcd { /* one per controlle unsigned fs_i_thresh:1; /* Intel iso scheduling */ unsigned use_dummy_qh:1; /* AMD Frame List table quirk*/ unsigned has_synopsys_hc_bug:1; /* Synopsys HC */ + unsigned frame_index_bug:1; /* MosChip (AKA NetMos) *//* required for usb32 quirk */ #define OHCI_CTRL_HCFS (3 << 6)
@@ -735,6 +736,22 @@ static inline u32 hc32_to_cpup (const st }#endif + +/*-------------------------------------------------------------------------*/ + +#ifdef CONFIG_PCI + +/* For working around the MosChip frame-index-register bug */ +static unsigned ehci_read_frame_index (struct ehci_hcd *ehci); + +#else + +static inline unsigned ehci_read_frame_index (struct ehci_hcd *ehci) +{ +return ehci_readl (ehci, &ehci->regs->frame_index); +} + +#endif /*-------------------------------------------------------------------------*/
PATCH 18/262 xhci-mem.c: Check for ring->first_seg != NULL
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kautuk Consul <[email protected]>
commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream.
There are 2 situations wherein the xhci_ring* might not get freed:
- When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and we goto the fail: label in xhci_ring_alloc. In this case, the ring will not get kfreed.
- When the num_segs argument to xhci_ring_alloc is passed as 0 and we try to free the rung after that.
( This doesn't really happen as of now in the code but we seem to
be entertaining num_segs=0 in xhci_ring_alloc )
This should be backported to kernels as old as 2.6.31.
--- drivers/usb/host/xhci-mem.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/usb/host/xhci-mem.c +12 -10
@@ -112,18 +112,20 @@ void xhci_ring_free(struct xhci_hcd *xhcstruct xhci_segment *seg;struct xhci_segment *first_seg; -if (!ring || !ring->first_seg) +if (!ring)return ; - first_seg = ring->first_seg; - seg = first_seg->next; -xhci_dbg (xhci,"Freeing ring at %p\n" , ring); -while (seg != first_seg) { -struct xhci_segment *next = seg->next; -xhci_segment_free (xhci, seg); - seg = next; +if (ring->first_seg) { + first_seg = ring->first_seg; + seg = first_seg->next; +xhci_dbg (xhci,"Freeing ring at %p\n" , ring); +while (seg != first_seg) { +struct xhci_segment *next = seg->next; +xhci_segment_free (xhci, seg); + seg = next; + } +xhci_segment_free (xhci, first_seg); + ring->first_seg =NULL ; } -xhci_segment_free (xhci, first_seg); - ring->first_seg =NULL ;kfree (ring); }
PATCH 19/262 xHCI: AMD isoc link TRB chain bit quirk
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andiry Xu <[email protected]>
commit 7e393a834b41001174a8fb3ae3bc23a749467760 upstream.
Setting the chain (CH) bit in the link TRB of isochronous transfer rings is required by AMD 0.96 xHCI host controller to successfully transverse multi-TRB TD that span through different memory segments.
When a Missed Service Error event occurs, if the chain bit is not set in the link TRB and the host skips TDs which just across a link TRB, the host may falsely recognize the link TRB as a normal TRB. You can see this may cause big trouble - the host does not jump to the right address which is pointed by the link TRB, but continue fetching the memory which is after the link TRB address, which may not even belong to the host, and the result cannot be predicted.
This causes some big problems. Without the former patch I sent: "xHCI:
prevent infinite loop when processing MSE event", the system may hang. With that patch applied, system does not hang, but the host still access wrong memory address and isoc transfer will fail. With this patch, isochronous transfer works as expected.
This patch should be applied to kernels as old as 2.6.36, which was when the first isochronous support was added for the xHCI host controller.
--- drivers/usb/host/xhci-mem.c | 32 ++++++++++++++----------- drivers/usb/host/xhci-pci.c | 3 ++ drivers/usb/host/xhci-ring.c | 53 +++++++++++++++++++++++-------------------- drivers/usb/host/xhci.h | 1 4 files changed, 51 insertions(+), 38 deletions(-)
drivers/usb/host/xhci-mem.c +18 -14
@@ -81,7 +81,7 @@ static void xhci_segment_free(struct xhc* related flags, such as End TRB, Toggle Cycle, and no snoop. */ static void xhci_link_segments (struct xhci_hcd *xhci,struct xhci_segment *prev, -struct xhci_segment *next,bool link_trbs) +struct xhci_segment *next,bool link_trbs,bool isoc) {u32 val;
@@ -97,7 +97,9 @@ static void xhci_link_segments(struct xh val &= ~TRB_TYPE_BITMASK ; val |=TRB_TYPE (TRB_LINK );/* Always set the chain bit with 0.95 hardware */ -if (xhci_link_trb_quirk (xhci)) +/* Set chain bit for isoc rings on AMD 0.96 host */ +if (xhci_link_trb_quirk (xhci) || + (isoc && (xhci->quirks & XHCI_AMD_0x96_HOST))) val |=TRB_CHAIN ; prev->trbs[TRBS_PER_SEGMENT -1 ].link.control =cpu_to_le32 (val); }
@@ -154,7 +156,7 @@ static void xhci_initialize_ring_info(st* See section 4.9.1 and figures 15 and 16. */ static struct xhci_ring *xhci_ring_alloc (struct xhci_hcd *xhci, -unsigned int num_segs,bool link_trbs,gfp_t flags) +unsigned int num_segs,bool link_trbs,bool isoc,gfp_t flags) {struct xhci_ring *ring;struct xhci_segment *prev;
@@ -180,12 +182,12 @@ static struct xhci_ring *xhci_ring_alloc next =xhci_segment_alloc (xhci, flags);if (!next) goto fail; -xhci_link_segments (xhci, prev, next, link_trbs); +xhci_link_segments (xhci, prev, next, link_trbs, isoc); prev = next; num_segs--; } -xhci_link_segments (xhci, prev, ring->first_seg, link_trbs); +xhci_link_segments (xhci, prev, ring->first_seg, link_trbs, isoc);if (link_trbs) {/* See section 4.9.2.1 and 6.4.4.1 */
@@ -231,14 +233,14 @@ void xhci_free_or_cache_endpoint_ring(st* pointers to the beginning of the ring. */ static void xhci_reinit_cached_ring (struct xhci_hcd *xhci, -struct xhci_ring *ring) +struct xhci_ring *ring,bool isoc) {struct xhci_segment *seg = ring->first_seg;do {memset (seg->trbs,0 ,sizeof (union xhci_trb )*TRBS_PER_SEGMENT );/* All endpoint rings have link TRBs */ -xhci_link_segments (xhci, seg, seg->next,1 ); +xhci_link_segments (xhci, seg, seg->next,1 , isoc); seg = seg->next; }while (seg != ring->first_seg);xhci_initialize_ring_info (ring);
@@ -542,7 +544,7 @@ struct xhci_stream_info *xhci_alloc_stre*/ for (cur_stream =1 ; cur_stream < num_streams; cur_stream++) { stream_info->stream_rings[cur_stream] = -xhci_ring_alloc (xhci,1 , true, mem_flags); +xhci_ring_alloc (xhci,1 , true, false, mem_flags); cur_ring = stream_info->stream_rings[cur_stream];if (!cur_ring) goto cleanup_rings;
@@ -767,7 +769,7 @@ int xhci_alloc_virt_device(struct xhci_h }/* Allocate endpoint 0 ring */ - dev->eps[0 ].ring =xhci_ring_alloc (xhci,1 , true, flags); + dev->eps[0 ].ring =xhci_ring_alloc (xhci,1 , true, false, flags);if (!dev->eps[0 ].ring) goto fail;
@@ -1177,10 +1179,10 @@ int xhci_endpoint_init(struct xhci_hcd **/ if (usb_endpoint_xfer_isoc (&ep->desc)) virt_dev->eps[ep_index].new_ring = -xhci_ring_alloc (xhci,8 , true, mem_flags); +xhci_ring_alloc (xhci,8 , true, true, mem_flags);else virt_dev->eps[ep_index].new_ring = -xhci_ring_alloc (xhci,1 , true, mem_flags); +xhci_ring_alloc (xhci,1 , true, false, mem_flags);if (!virt_dev->eps[ep_index].new_ring) {/* Attempt to use the ring cache */ if (virt_dev->num_rings_cached ==0 )
@@ -1189,7 +1191,8 @@ int xhci_endpoint_init(struct xhci_hcd * virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] =NULL ; virt_dev->num_rings_cached--; -xhci_reinit_cached_ring (xhci, virt_dev->eps[ep_index].new_ring); +xhci_reinit_cached_ring (xhci, virt_dev->eps[ep_index].new_ring, +usb_endpoint_xfer_isoc (&ep->desc) ? true : false); } virt_dev->eps[ep_index].skip = false; ep_ring = virt_dev->eps[ep_index].new_ring;
@@ -2003,7 +2006,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, goto fail;/* Set up the command ring to have one segments for now. */ - xhci->cmd_ring =xhci_ring_alloc (xhci,1 , true, flags); + xhci->cmd_ring =xhci_ring_alloc (xhci,1 , true, false, flags);if (!xhci->cmd_ring) goto fail;xhci_dbg (xhci,"Allocated command ring at %p\n" , xhci->cmd_ring);
@@ -2034,7 +2037,8 @@ int xhci_mem_init(struct xhci_hcd *xhci,* the event ring segment table (ERST). Section 4.9.3. */ xhci_dbg (xhci,"// Allocating event ring\n" ); - xhci->event_ring =xhci_ring_alloc (xhci,ERST_NUM_SEGS , false, flags); + xhci->event_ring =xhci_ring_alloc (xhci,ERST_NUM_SEGS , false, false, + flags);if (!xhci->event_ring) goto fail;if (xhci_check_trb_in_td_math (xhci, flags) <0 )
drivers/usb/host/xhci-pci.c +3 -0
@@ -128,6 +128,9 @@ static int xhci_pci_setup(struct usb_hcdif (pdev->vendor ==PCI_VENDOR_ID_NEC ) xhci->quirks |=XHCI_NEC_HOST ; +if (pdev->vendor ==PCI_VENDOR_ID_AMD && xhci->hci_version ==0x96 ) + xhci->quirks |= XHCI_AMD_0x96_HOST; +/* AMD PLL quirk */ if (pdev->vendor ==PCI_VENDOR_ID_AMD &&usb_amd_find_chipset_info ()) xhci->quirks |=XHCI_AMD_PLL_FIX ;
drivers/usb/host/xhci-ring.c +29 -24
183 lines not on this page · raw message
drivers/usb/host/xhci.h +1 -0
@@ -1311,6 +1311,7 @@ struct xhci_hcd {#define XHCI_EP_LIMIT_QUIRK (1 << 5)#define XHCI_BROKEN_MSI (1 << 6)#define XHCI_RESET_ON_RESUME (1 << 7) +#define XHCI_AMD_0x96_HOST (1 << 9)unsigned int num_active_eps;unsigned int limit_active_eps;/* There are two roothubs to keep track of bus suspend info for */
PATCH 20/262 drm/i915: Wrap DP EDID fetch functions to enable eDP panel power
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Packard <[email protected]>
commit 8c241fef3e6f69f3f675678ae03599ece3f562e2 upstream.
Talking to the eDP DDC channel requires that the panel be powered up. Wrap both the EDID and modes fetch code with calls to turn the vdd power on and back off.
--- drivers/gpu/drm/i915/intel_dp.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_dp.c +28 -3
@@ -1658,6 +1658,31 @@ g4x_dp_detect(struct intel_dp *intel_dp)return status; } +static struct edid * +intel_dp_get_edid (struct drm_connector *connector,struct i2c_adapter *adapter) +{ +struct intel_dp *intel_dp =intel_attached_dp (connector); +struct edid *edid; + +ironlake_edp_panel_vdd_on (intel_dp); + edid =drm_get_edid (connector, adapter); +ironlake_edp_panel_vdd_off (intel_dp); +return edid; +} + +static int +intel_dp_get_edid_modes (struct drm_connector *connector,struct i2c_adapter *adapter) +{ +struct intel_dp *intel_dp =intel_attached_dp (connector); +int ret; + +ironlake_edp_panel_vdd_on (intel_dp); + ret =intel_ddc_get_modes (connector, adapter); +ironlake_edp_panel_vdd_off (intel_dp); +return ret; +} + +/** * Uses CRT_HOTPLUG_EN and CRT_HOTPLUG_STAT to detect DP connection. *
@@ -1684,7 +1709,7 @@ intel_dp_detect(struct drm_connector *coif (intel_dp->force_audio) { intel_dp->has_audio = intel_dp->force_audio >0 ; }else { - edid =drm_get_edid (connector, &intel_dp->adapter); + edid =intel_dp_get_edid (connector, &intel_dp->adapter);if (edid) { intel_dp->has_audio =drm_detect_monitor_audio (edid); connector->display_info.raw_edid =NULL ;
@@ -1705,7 +1730,7 @@ static int intel_dp_get_modes(struct drm/* We should parse the EDID data and find out if it has an audio sink */ - ret =intel_ddc_get_modes (connector, &intel_dp->adapter); + ret =intel_dp_get_edid_modes (connector, &intel_dp->adapter);if (ret) {if (is_edp (intel_dp) && !dev_priv->panel_fixed_mode) {struct drm_display_mode *newmode;
@@ -1741,7 +1766,7 @@ intel_dp_detect_audio(struct drm_connectstruct edid *edid;bool has_audio = false; - edid =drm_get_edid (connector, &intel_dp->adapter); + edid =intel_dp_get_edid (connector, &intel_dp->adapter);if (edid) { has_audio =drm_detect_monitor_audio (edid);
PATCH 21/262 drm/i915/panel: Always record the backlight level again (but cleverly)
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f52c619a590fa75276c07dfcaf380dee53e4ea4c upstream.
The commit 47356eb67285014527a5ab87543ba1fae3d1e10a introduced a mechanism to record the backlight level only at disabling time, but it also introduced a regression. Since intel_lvds_enable() may be called without disabling (e.g. intel_lvds_commit() calls it unconditionally), the backlight gets back to the last recorded value. For example, this happens when you dim the backlight, close the lid and open the lid, then the backlight suddenly goes to the brightest.
This patch fixes the bug by recording the backlight level always when changed via intel_panel_set_backlight(). And, intel_panel_{enable|disable}_backlight() call the internal function not to update the recorded level wrongly.
--- drivers/gpu/drm/i915/intel_panel.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/intel_panel.c +13 -8
@@ -226,7 +226,7 @@ static void intel_pch_panel_set_backlighI915_WRITE (BLC_PWM_CPU_CTL , val | level); } -void intel_panel_set_backlight (struct drm_device *dev,u32 level) +static void intel_panel_actually_set_backlight (struct drm_device *dev,u32 level) {struct drm_i915_private *dev_priv = dev->dev_private;u32 tmp;
@@ -254,16 +254,21 @@ void intel_panel_set_backlight(struct drI915_WRITE (BLC_PWM_CTL , tmp | level); } -void intel_panel_disable_backlight (struct drm_device *dev) +void intel_panel_set_backlight (struct drm_device *dev,u32 level) {struct drm_i915_private *dev_priv = dev->dev_private; -if (dev_priv->backlight_enabled) { - dev_priv->backlight_level =intel_panel_get_backlight (dev); - dev_priv->backlight_enabled = false; - } + dev_priv->backlight_level = level; +if (dev_priv->backlight_enabled) +intel_panel_actually_set_backlight (dev, level); +} + +void intel_panel_disable_backlight (struct drm_device *dev) +{ +struct drm_i915_private *dev_priv = dev->dev_private; -intel_panel_set_backlight (dev,0 ); + dev_priv->backlight_enabled = false; +intel_panel_actually_set_backlight (dev,0 ); }void intel_panel_enable_backlight (struct drm_device *dev)
@@ -273,8 +278,8 @@ void intel_panel_enable_backlight(structif (dev_priv->backlight_level ==0 ) dev_priv->backlight_level =intel_panel_get_max_backlight (dev); -intel_panel_set_backlight (dev, dev_priv->backlight_level); dev_priv->backlight_enabled = true; +intel_panel_actually_set_backlight (dev, dev_priv->backlight_level); }void intel_panel_setup_backlight (struct drm_device *dev)
PATCH 22/262 drm/radeon/kms: bail early in dvi_detect for digital only connectors
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5f0a26128d66ef81613fe923d5c288942844ccdc upstream.
DVI-D and HDMI-A are digital only, so there's no need to attempt analog load detect. Also, skip bail before the !force check, or we fail to get a disconnect events. The next patches in the series attempt to fix disconnect events for connectors with analog support (DVI-I, HDMI-B, DVI-A).
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=41561
--- drivers/gpu/drm/radeon/radeon_connectors.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/radeon/radeon_connectors.c +5 -0
@@ -950,6 +950,11 @@ radeon_dvi_detect(struct drm_connector *if ((ret == connector_status_connected) && (radeon_connector->use_digital == true)) goto out; +/* DVI-D and HDMI-A are digital only */ +if ((connector->connector_type ==DRM_MODE_CONNECTOR_DVID ) || + (connector->connector_type ==DRM_MODE_CONNECTOR_HDMIA )) + goto out; +if (!force) { ret = connector->status; goto out;
PATCH 23/262 drm/radeon/kms: handle !force case in connector detect more gracefully
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 upstream.
When force == false, we don't do load detection in the connector detect functions. Unforunately, we also return the previous connector state so we never get disconnect events for DVI-I, DVI-A, or VGA. Save whether we detected the monitor via load detection previously and use that to determine whether we return the previous state or not.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=41561
--- drivers/gpu/drm/radeon/radeon_connectors.c | 23 ++++++++++++++++++++--- drivers/gpu/drm/radeon/radeon_mode.h | 1 + 2 files changed, 21 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/radeon_connectors.c +20 -3
@@ -715,6 +715,7 @@ radeon_vga_detect(struct drm_connector * dret =radeon_ddc_probe (radeon_connector, radeon_connector->requires_extended_probe);if (dret) { + radeon_connector->detected_by_load = false;if (radeon_connector->edid) {kfree (radeon_connector->edid); radeon_connector->edid =NULL ;
@@ -741,12 +742,21 @@ radeon_vga_detect(struct drm_connector * }else {/* if we aren't forcing don't do destructive polling */ -if (!force) -return connector->status; +if (!force) { +/* only return the previous status if we last +* detected a monitor via load. +*/ +if (radeon_connector->detected_by_load) +return connector->status; +else +return ret; + }if (radeon_connector->dac_load_detect && encoder) { encoder_funcs = encoder->helper_private; ret = encoder_funcs->detect (encoder, connector); +if (ret == connector_status_connected) + radeon_connector->detected_by_load = true; } }
@@ -888,6 +898,7 @@ radeon_dvi_detect(struct drm_connector * dret =radeon_ddc_probe (radeon_connector, radeon_connector->requires_extended_probe);if (dret) { + radeon_connector->detected_by_load = false;if (radeon_connector->edid) {kfree (radeon_connector->edid); radeon_connector->edid =NULL ;
@@ -955,8 +966,13 @@ radeon_dvi_detect(struct drm_connector * (connector->connector_type == DRM_MODE_CONNECTOR_HDMIA)) goto out; +/* if we aren't forcing don't do destructive polling */ if (!force) { - ret = connector->status; +/* only return the previous status if we last +* detected a monitor via load. +*/ +if (radeon_connector->detected_by_load) + ret = connector->status; goto out; }
@@ -980,6 +996,7 @@ radeon_dvi_detect(struct drm_connector * ret = encoder_funcs->detect (encoder, connector);if (ret == connector_status_connected) { radeon_connector->use_digital = false; + radeon_connector->detected_by_load = true; } }break ;
drivers/gpu/drm/radeon/radeon_mode.h +1 -0
@@ -447,6 +447,7 @@ struct radeon_connector {struct edid *edid;void *con_priv;bool dac_load_detect; +bool detected_by_load;/* if the connection status was determined by load */ uint16_t connector_object_id;struct radeon_hpd hpd;struct radeon_router router;
PATCH 24/262 drm/radeon/kms: Fix I2C mask definitions
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
commit 286e0c94f9c3f292cb38a977fbbde3433347a868 upstream.
Commit 9b9fe724 accidentally used RADEON_GPIO_EN_* where RADEON_GPIO_MASK_* was intended. This caused improper initialization of I2C buses, mostly visible when setting i2c_algo_bit.bit_test=1. Using the right constants fixes the problem.
--- drivers/gpu/drm/radeon/radeon_combios.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_combios.c +2 -2
@@ -620,8 +620,8 @@ static struct radeon_i2c_bus_rec combios i2c.y_data_mask =0x80 ; }else {/* default masks for ddc pads */ - i2c.mask_clk_mask =RADEON_GPIO_EN_1 ; - i2c.mask_data_mask =RADEON_GPIO_EN_0 ; + i2c.mask_clk_mask =RADEON_GPIO_MASK_1 ; + i2c.mask_data_mask =RADEON_GPIO_MASK_0 ; i2c.a_clk_mask =RADEON_GPIO_A_1 ; i2c.a_data_mask =RADEON_GPIO_A_0 ; i2c.en_clk_mask =RADEON_GPIO_EN_1 ;
PATCH 25/262 mmc: core: Fix hangs related to insert/remove of cards
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
commit 7f7e4129c23f0419257184dff6fec89d2d5a8964 upstream.
During a rescan operation mmc_attach(sd|mmc|sdio) functions are called. The error handling in these function can trigger a detach of the bus, which also meant a power off. This is not notified by the rescan operation which then continues to the next attach function.
If a power off has been done, the framework must never send any new commands to the host driver, without first doing a new power up. This will most likely trigger any host driver to hang.
Moving power off out of detach and instead handle power off separately when it is actually needed, solves the issue.
--- drivers/mmc/core/core.c | 10 +++++----- drivers/mmc/core/core.h | 1 + drivers/mmc/core/mmc.c | 1 + drivers/mmc/core/sd.c | 1 + drivers/mmc/core/sdio.c | 1 + 5 files changed, 9 insertions(+), 5 deletions(-)
drivers/mmc/core/core.c +5 -5
@@ -1057,7 +1057,7 @@ static void mmc_power_up(struct mmc_hostmmc_host_clk_release (host); } -static void mmc_power_off (struct mmc_host *host) +void mmc_power_off (struct mmc_host *host) {mmc_host_clk_hold (host);
@@ -1147,8 +1147,7 @@ void mmc_attach_bus(struct mmc_host *hos }/* -* Remove the current bus handler from a host. Assumes that there are -* no interesting cards left, so the bus is powered down. +* Remove the current bus handler from a host. */ void mmc_detach_bus (struct mmc_host *host) {
@@ -1165,8 +1164,6 @@ void mmc_detach_bus(struct mmc_host *hosspin_unlock_irqrestore (&host->lock, flags); -mmc_power_off (host); -mmc_bus_put (host); }
@@ -1675,6 +1672,7 @@ void mmc_stop_host(struct mmc_host *hostmmc_claim_host (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host);mmc_bus_put (host);return ;
@@ -1796,6 +1794,7 @@ int mmc_suspend_host(struct mmc_host *ho host->bus_ops->remove (host);mmc_claim_host (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host); host->pm_flags =0 ; err =0 ;
@@ -1883,6 +1882,7 @@ int mmc_pm_notify(struct notifier_block host->bus_ops->remove (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host); host->pm_flags =0 ;break ;
drivers/mmc/core/core.h +1 -0
@@ -43,6 +43,7 @@ int mmc_set_signal_voltage(struct mmc_ho bool cmd11);void mmc_set_timing (struct mmc_host *host,unsigned int timing);void mmc_set_driver_type (struct mmc_host *host,unsigned int drv_type); +void mmc_power_off (struct mmc_host *host);static inline void mmc_delay (unsigned int ms) {
drivers/mmc/core/mmc.c +1 -0
@@ -891,6 +891,7 @@ static void mmc_detect(struct mmc_host *mmc_claim_host (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host); } }
drivers/mmc/core/sd.c +1 -0
@@ -1008,6 +1008,7 @@ static void mmc_sd_detect(struct mmc_hosmmc_claim_host (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host); } }
drivers/mmc/core/sdio.c +1 -0
@@ -597,6 +597,7 @@ out:mmc_claim_host (host);mmc_detach_bus (host); +mmc_power_off (host);mmc_release_host (host); } }
PATCH 26/262 mmc: core: ext_csd.raw_* used in comparison but never set
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Warkentin <[email protected]>
commit 5238acbe36dd5100fb6b035a995ae5fc89dd0708 upstream.
f39b2dd9d ("mmc: core: Bus width testing needs to handle suspend/resume") added code to only compare read-only ext_csd fields in bus width testing code, yet it's comparing some fields that are never set.
The affected fields are ext_csd.raw_erased_mem_count and ext_csd.raw_partition_support.
--- drivers/mmc/core/mmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/core/mmc.c +2 -0
@@ -359,6 +359,7 @@ static int mmc_read_ext_csd(struct mmc_c* card has the Enhanced area enabled. If so, export enhanced * area offset and size to user by adding sysfs interface. */ + card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT ];if ((ext_csd[EXT_CSD_PARTITION_SUPPORT ] &0x2 ) && (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE ] &0x1 )) { u8 hc_erase_grp_sz =
@@ -405,6 +406,7 @@ static int mmc_read_ext_csd(struct mmc_cif (card->ext_csd.rev >=5 ) card->ext_csd.rel_param = ext_csd[EXT_CSD_WR_REL_PARAM ]; + card->ext_csd.raw_erased_mem_count = ext_csd[EXT_CSD_ERASED_MEM_CONT ];if (ext_csd[EXT_CSD_ERASED_MEM_CONT ]) card->erased_byte =0xFF ;else
PATCH 27/262 PCI quirk: mmc: Always check for lower base frequency quirk for Ricoh 1180:e823
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit 3e309cdf07c930f29a4e0f233e47d399bea34c68 upstream.
Commit 15bed0f2f added a quirk for the e823 Ricoh card reader to lower the base frequency. However, the quirk first checks to see if the proprietary MMC controller is disabled, and returns if so. On some devices, such as the Lenovo X220, the MMC controller is already disabled by firmware it seems, but the frequency change is still needed so sdhci-pci can talk to the cards. Since the MMC controller is disabled, the frequency fixup was never being run on these machines.
This moves the e823 check above the MMC controller check so that it always gets run.
This fixes https://bugzilla.redhat.com/show_bug.cgi?id=722509
--- drivers/pci/quirks.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/pci/quirks.c +14 -14
@@ -2745,20 +2745,6 @@ static void ricoh_mmc_fixup_r5c832(struc/* disable must be done via function #0 */ if (PCI_FUNC (dev->devfn))return ; - -pci_read_config_byte (dev,0xCB , &disable); - -if (disable &0x02 ) -return ; - -pci_read_config_byte (dev,0xCA , &write_enable); -pci_write_config_byte (dev,0xCA ,0x57 ); -pci_write_config_byte (dev,0xCB , disable |0x02 ); -pci_write_config_byte (dev,0xCA , write_enable); - -dev_notice (&dev->dev,"proprietary Ricoh MMC controller disabled (via firewire function)\n" ); -dev_notice (&dev->dev,"MMC cards are now supported by standard SDHCI controller\n" ); -/* * RICOH 0xe823 SD/MMC card reader fails to recognize * certain types of SD/MMC cards. Lowering the SD base
@@ -2781,6 +2767,20 @@ static void ricoh_mmc_fixup_r5c832(strucdev_notice (&dev->dev,"MMC controller base frequency changed to 50Mhz.\n" ); } + +pci_read_config_byte (dev,0xCB , &disable); + +if (disable &0x02 ) +return ; + +pci_read_config_byte (dev,0xCA , &write_enable); +pci_write_config_byte (dev,0xCA ,0x57 ); +pci_write_config_byte (dev,0xCB , disable |0x02 ); +pci_write_config_byte (dev,0xCA , write_enable); + +dev_notice (&dev->dev,"proprietary Ricoh MMC controller disabled (via firewire function)\n" ); +dev_notice (&dev->dev,"MMC cards are now supported by standard SDHCI controller\n" ); + }DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_RICOH ,PCI_DEVICE_ID_RICOH_R5C832 , ricoh_mmc_fixup_r5c832);DECLARE_PCI_FIXUP_RESUME_EARLY (PCI_VENDOR_ID_RICOH ,PCI_DEVICE_ID_RICOH_R5C832 , ricoh_mmc_fixup_r5c832);
PATCH 28/262 megaraid_sas: Fix instance access in megasas_reset_timer
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: adam radford <[email protected]>
commit f575c5d3ebdca3b0482847d8fcba971767754a9e upstream.
The following patch for megaraid_sas will fix a potential bad pointer access in megasas_reset_timer(), when a MegaRAID 9265/9285 or 9360/9380 gets a timeout. megasas_build_io_fusion() sets SCp.ptr to be a struct megasas_cmd_fusion *, but then megasas_reset_timer() was casting SCp.ptr to be a struct megasas_cmd *, then trying to access cmd->instance, which is invalid.
Just loading instance from scmd->device->host->hostdata in megasas_reset_timer() fixes the issue.
--- drivers/scsi/megaraid/megaraid_sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/megaraid/megaraid_sas_base.c +1 -2
@@ -1906,7 +1906,6 @@ static int megasas_generic_reset(structstatic enum blk_eh_timer_return megasas_reset_timer (struct scsi_cmnd *scmd) { -struct megasas_cmd *cmd = (struct megasas_cmd *)scmd->SCp.ptr;struct megasas_instance *instance;unsigned long flags;
@@ -1915,7 +1914,7 @@ blk_eh_timer_return megasas_reset_timer(return BLK_EH_NOT_HANDLED ; } - instance = cmd->instance; + instance = (struct megasas_instance *)scmd->device->host->hostdata;if (!(instance->flag &MEGASAS_FW_BUSY )) {/* FW is busy, throttle IO */ spin_lock_irqsave (instance->host->host_lock, flags);
PATCH 29/262 ipr: Always initiate hard reset in kdump kernel
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream.
During kdump testing I noticed timeouts when initialising each IPR adapter. While the driver has logic to detect an adapter in an indeterminate state, it wasn't triggering and each adapter went through a 5 minute timeout before finally going operational.
Some analysis showed the needs_hard_reset flag wasn't getting set. We can check the reset_devices kernel parameter which is set by kdump and force a full reset. This fixes the problem.
--- drivers/scsi/ipr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ipr.c +1 -1
@@ -8812,7 +8812,7 @@ static int __devinit ipr_probe_ioa(struc uproc =readl (ioa_cfg->regs.sense_uproc_interrupt_reg32);if ((mask &IPR_PCII_HRRQ_UPDATED ) ==0 || (uproc &IPR_UPROCI_RESET_ALERT )) ioa_cfg->needs_hard_reset =1 ; -if (interrupts &IPR_PCII_ERROR_INTERRUPTS ) +if ((interrupts &IPR_PCII_ERROR_INTERRUPTS ) || reset_devices) ioa_cfg->needs_hard_reset =1 ;if (interrupts &IPR_PCII_IOA_UNIT_CHECKED ) ioa_cfg->ioa_unit_checked =1 ;
PATCH 30/262 libsas: set sas_address and device type of rphy
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream.
Libsas forget to set the sas_address and device type of rphy lead to file under /sys/class/sas_x show wrong value, fix that.
--- drivers/scsi/libsas/sas_expander.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/libsas/sas_expander.c +2 -0
@@ -199,6 +199,8 @@ static void sas_set_ex_phy(struct domain phy->virtual = dr->virtual; phy->last_da_index =-1 ; + phy->phy->identify.sas_address =SAS_ADDR (phy->attached_sas_addr); + phy->phy->identify.device_type = phy->attached_dev_type; phy->phy->identify.initiator_port_protocols = phy->attached_iproto; phy->phy->identify.target_port_protocols = phy->attached_tproto; phy->phy->identify.phy_identifier = phy_id;
PATCH 31/262 isci: fix support for large smp requests
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 54b5e3a4bfa3452bc10cd4da672099ccc46b8c09 upstream.
Kill the local smp response buffer.
Besides being unnecessary, it is too small (currently truncates responses to 60 bytes). The mid-layer will have already allocated a sufficiently sized buffer, just kmap and copy into it directly.
--- drivers/scsi/isci/isci.h | 2 - drivers/scsi/isci/request.c | 49 +++++++++++++++++--------------------------- drivers/scsi/isci/request.h | 3 -- drivers/scsi/isci/sas.h | 2 - 4 files changed, 21 insertions(+), 35 deletions(-)
drivers/scsi/isci/isci.h +1 -1
@@ -97,7 +97,7 @@#define SCU_MAX_COMPLETION_QUEUE_SHIFT (ilog2(SCU_MAX_COMPLETION_QUEUE_ENTRIES))#define SCU_ABSOLUTE_MAX_UNSOLICITED_FRAMES (4096) -#define SCU_UNSOLICITED_FRAME_BUFFER_SIZE (1024) +#define SCU_UNSOLICITED_FRAME_BUFFER_SIZE (1024U)#define SCU_INVALID_FRAME_INDEX (0xFFFF)#define SCU_IO_REQUEST_MAX_SGE_SIZE (0x00FFFFFF)
drivers/scsi/isci/request.c +20 -29
79 lines not on this page · raw message
drivers/scsi/isci/request.h +0 -3
@@ -174,9 +174,6 @@ struct isci_request { }; } ssp;struct { -struct smp_resp rsp; - } smp; -struct {struct isci_stp_request req;struct host_to_dev_fis cmd;struct dev_to_host_fis rsp;
drivers/scsi/isci/sas.h +0 -2
@@ -204,8 +204,6 @@ struct smp_req {u8 req_data[0 ]; } __packed; -#define SMP_RESP_HDR_SZ 4 -/* * struct sci_sas_address - This structure depicts how a SAS address is * represented by SCI.
PATCH 32/262 isci: fix missed unlock in apc_agent_timeout()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Skirvin <[email protected]>
commit 983d3fdd332742167d0482c06fd29cf4b8a687c0 upstream.
Needed to jump to scic_lock unlock.
Also spotted by coccicheck.
--- drivers/scsi/isci/port_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/isci/port_config.c +1 -1
@@ -678,7 +678,7 @@ static void apc_agent_timeout(unsigned l configure_phy_mask = ~port_agent->phy_configured_mask & port_agent->phy_ready_mask;if (!configure_phy_mask) -return ; + goto done;for (index =0 ; index <SCI_MAX_PHYS ; index++) {if ((configure_phy_mask & (1 << index)) ==0 )
PATCH 33/262 ALSA: hda - Remove bad code for IDT 92HD83 family patch
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Chin <[email protected]>
commit 6c5c04e509b7000617b09d4301f0b9b6d171d1e6 upstream.
The purpose of this patch is to remove a section of "bad" code that assigns the last DAC to ports E or F in order to support notebooks with docking in earlier days, around ALSA 1.0.19 - 21. This is not necessary now and actually breaks some configurations that use these ports as other devices. This have been tested on several different configurations to make sure that it is working for different combinations.
--- sound/pci/hda/patch_sigmatel.c | 18 ------------------ 1 file changed, 18 deletions(-)
sound/pci/hda/patch_sigmatel.c +0 -18
@@ -5425,9 +5425,7 @@ static void stac92hd8x_fill_auto_spec(ststatic int patch_stac92hd83xxx (struct hda_codec *codec) {struct sigmatel_spec *spec; -hda_nid_t conn[STAC92HD83_DAC_COUNT +1 ];int err; -int num_dacs; spec =kzalloc (sizeof (*spec),GFP_KERNEL );if (spec ==NULL )
@@ -5522,22 +5520,6 @@ again:return err; } -/* docking output support */ - num_dacs =snd_hda_get_connections (codec,0xF , - conn,STAC92HD83_DAC_COUNT +1 ) -1 ; -/* skip non-DAC connections */ -while (num_dacs >=0 && - (get_wcaps_type (get_wcaps (codec, conn[num_dacs])) - !=AC_WID_AUD_OUT )) - num_dacs--; -/* set port E and F to select the last DAC */ -if (num_dacs >=0 ) { -snd_hda_codec_write_cache (codec,0xE ,0 , -AC_VERB_SET_CONNECT_SEL , num_dacs); -snd_hda_codec_write_cache (codec,0xF ,0 , -AC_VERB_SET_CONNECT_SEL , num_dacs); - } - codec->proc_widget_hook = stac92hd_proc_hook;return 0 ;
PATCH 34/262 ALSA: HDA: Add new revision for ALC662
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <[email protected]>
commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream.
The revision 0x100300 was found for ALC662. It seems to work well with patch_alc662.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -20126,6 +20126,8 @@ static const struct hda_codec_preset snd .patch = patch_alc882 }, { .id = 0x10ec0662, .rev = 0x100101, .name = "ALC662 rev1", .patch = patch_alc662 }, + { .id = 0x10ec0662, .rev = 0x100300, .name = "ALC662 rev3", + .patch = patch_alc662 }, { .id = 0x10ec0663, .name = "ALC663", .patch = patch_alc662 }, { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 }, { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
PATCH 35/262 target: Fix REPORT TARGET PORT GROUPS handling with small allocation length
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e upstream.
This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS containing a smaller allocation length than the payload requires causing memory writes beyond the end of the buffer. This patch checks for the minimum 4 byte length for the response payload length, and also checks upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target port group and Target port descriptor list is able to fit into the remaining allocation length.
If the response payload exceeds the allocation length length, then rd_len is still increments to indicate to the initiator that the payload has been truncated.
--- drivers/target/target_core_alua.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/target/target_core_alua.c +20 -0
@@ -60,11 +60,31 @@ int core_emulate_report_target_port_grouunsigned char *buf = (unsigned char *)T_TASK (cmd)->t_task_buf;u32 rd_len =0 , off =4 ;/* Skip over RESERVED area to first Target port group descriptor */ +/* +* Need at least 4 bytes of response data or else we can't +* even fit the return data length. +*/ +if (cmd->data_length <4 ) { +pr_warn ("REPORT TARGET PORT GROUPS allocation length %u" +" too small\n" , cmd->data_length); +return -EINVAL ; + }spin_lock (&T10_ALUA (su_dev)->tg_pt_gps_lock);list_for_each_entry (tg_pt_gp, &T10_ALUA (su_dev)->tg_pt_gps_list, tg_pt_gp_list) {/* +* Check if the Target port group and Target port descriptor list +* based on tg_pt_gp_members count will fit into the response payload. +* Otherwise, bump rd_len to let the initiator know we have exceeded +* the allocation length and the response is truncated. +*/ +if ((off +8 + (tg_pt_gp->tg_pt_gp_members *4 )) > + cmd->data_length) { + rd_len +=8 + (tg_pt_gp->tg_pt_gp_members *4 ); +continue ; + } +/* * PREF: Preferred target port bit, determine if this * bit should be set for port group. */
PATCH 36/262 x86: uv2: Workaround for UV2 Hub bug (system global address format)
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Steiner <[email protected]>
commit 6a469e4665bc158599de55d64388861d0a9f10f4 upstream.
This is a workaround for a UV2 hub bug that affects the format of system global addresses.
The GRU API for UV2 was inadvertently broken by a hardware change. The format of the physical address used for TLB dropins and for addresses used with instructions running in unmapped mode has changed. This change was not documented and became apparent only when diags failed running on system simulators.
For UV1, TLB and GRU instruction physical addresses are identical to socket physical addresses (although high NASID bits must be OR'ed into the address).
For UV2, socket physical addresses need to be converted. The NODE portion of the physical address needs to be shifted so that the low bit is in bit 39 or bit 40, depending on an MMR value.
It is not yet clear if this bug will be fixed in a silicon respin. If it is fixed, the hub revision will be incremented & the workaround disabled.
--- arch/x86/include/asm/uv/uv_bau.h | 1 + arch/x86/include/asm/uv/uv_hub.h | 37 ++++++++++++++++++++++++++++++++++--- arch/x86/kernel/apic/x2apic_uv_x.c | 7 +++++-- arch/x86/platform/uv/tlb_uv.c | 17 ++++++----------- 4 files changed, 46 insertions(+), 16 deletions(-)
arch/x86/include/asm/uv/uv_bau.h +1 -0
@@ -55,6 +55,7 @@#define UV_BAU_TUNABLES_DIR "sgi_uv"#define UV_BAU_TUNABLES_FILE "bau_tunables"#define WHITESPACE " \t\n" +#define uv_mmask ((1UL << uv_hub_info->m_val) - 1)#define uv_physnodeaddr (x) ((__pa((unsigned long)(x)) & uv_mmask))#define cpubit_isset (cpu, bau_local_cpumask) \ test_bit((cpu), (bau_local_cpumask).bits)
arch/x86/include/asm/uv/uv_hub.h +34 -3
@@ -46,6 +46,13 @@* PNODE - the low N bits of the GNODE. The PNODE is the most useful variant * of the nasid for socket usage. * +* GPA - (global physical address) a socket physical address converted +* so that it can be used by the GRU as a global address. Socket +* physical addresses 1) need additional NASID (node) bits added +* to the high end of the address, and 2) unaliased if the +* partition does not have a physical address 0. In addition, on +* UV2 rev 1, GPAs need the gnode left shifted to bits 39 or 40. +* * * NumaLink Global Physical Address Format: * +--------------------------------+---------------------+
@@ -141,6 +148,8 @@ struct uv_hub_info_s {unsigned int gnode_extra;unsigned char hub_revision;unsigned char apic_pnode_shift; +unsigned char m_shift; +unsigned char n_lshift;unsigned long gnode_upper;unsigned long lowmem_remap_top;unsigned long lowmem_remap_base;
@@ -177,6 +186,16 @@ static inline int is_uv2_hub(void)return uv_hub_info->hub_revision >=UV2_HUB_REVISION_BASE ; } +static inline int is_uv2_1_hub (void ) +{ +return uv_hub_info->hub_revision ==UV2_HUB_REVISION_BASE ; +} + +static inline int is_uv2_2_hub (void ) +{ +return uv_hub_info->hub_revision ==UV2_HUB_REVISION_BASE +1 ; +} + union uvh_apicid { unsigned long v; struct uvh_apicid_s {
@@ -276,7 +295,10 @@ static inline unsigned long uv_soc_phys_ {if (paddr < uv_hub_info->lowmem_remap_top) paddr |= uv_hub_info->lowmem_remap_base; -return paddr | uv_hub_info->gnode_upper; + paddr |= uv_hub_info->gnode_upper; + paddr = ((paddr << uv_hub_info->m_shift) >> uv_hub_info->m_shift) | + ((paddr >> uv_hub_info->m_val) << uv_hub_info->n_lshift); +return paddr; }
@@ -300,16 +322,19 @@ static inline unsigned long uv_gpa_to_sounsigned long remap_base = uv_hub_info->lowmem_remap_base;unsigned long remap_top = uv_hub_info->lowmem_remap_top; + gpa = ((gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift) | + ((gpa >> uv_hub_info->n_lshift) << uv_hub_info->m_val); + gpa = gpa & uv_hub_info->gpa_mask;if (paddr >= remap_base && paddr < remap_base + remap_top) paddr -= remap_base;return paddr; } -/* gnode -> pnode */ +/* gpa -> pnode */ static inline unsigned long uv_gpa_to_gnode (unsigned long gpa) { -return gpa >> uv_hub_info->m_val; +return gpa >> uv_hub_info->n_lshift; }/* gpa -> pnode */
@@ -320,6 +345,12 @@ static inline int uv_gpa_to_pnode(unsignreturn uv_gpa_to_gnode (gpa) & n_mask; } +/* gpa -> node offset*/ +static inline unsigned long uv_gpa_to_offset (unsigned long gpa) +{ +return (gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift; +} +/* pnode, offset --> socket virtual */ static inline void *uv_pnode_offset_to_vaddr (int pnode,unsigned long offset) {
arch/x86/kernel/apic/x2apic_uv_x.c +5 -2
@@ -832,6 +832,10 @@ void __init uv_system_init(void)uv_cpu_hub_info (cpu)->apic_pnode_shift = uvh_apicid.s.pnode_shift;uv_cpu_hub_info (cpu)->hub_revision = uv_hub_info->hub_revision; +uv_cpu_hub_info (cpu)->m_shift =64 - m_val; +uv_cpu_hub_info (cpu)->n_lshift =is_uv2_1_hub () ? + (m_val ==40 ?40 :39 ) : m_val; + pnode =uv_apicid_to_pnode (apicid); blade =boot_pnode_to_blade (pnode); lcpu = uv_blade_info[blade].nr_possible_cpus;
@@ -862,8 +866,7 @@ void __init uv_system_init(void)if (uv_node_to_blade[nid] >=0 )continue ; paddr =node_start_pfn (nid) <<PAGE_SHIFT ; - paddr =uv_soc_phys_ram_to_gpa (paddr); - pnode = (paddr >> m_val) & pnode_mask; + pnode =uv_gpa_to_pnode (uv_soc_phys_ram_to_gpa (paddr)); blade =boot_pnode_to_blade (pnode); uv_node_to_blade[nid] = blade; }
arch/x86/platform/uv/tlb_uv.c +6 -11
@@ -115,9 +115,6 @@ early_param("nobau", setup_nobau);/* base pnode in this partition */ static int uv_base_pnode__read_mostly ; -/* position of pnode (which is nasid>>1): */ -static int uv_nshift__read_mostly ; -static unsigned long uv_mmask__read_mostly ; static DEFINE_PER_CPU(struct ptc_stats, ptcstats); static DEFINE_PER_CPU(struct bau_control, bau_control);
@@ -1426,7 +1423,7 @@ static void activation_descriptor_init(i {int i;int cpu; -unsigned long pa; +unsigned long gpa;unsigned long m;unsigned long n;size_t dsize;
@@ -1442,9 +1439,9 @@ static void activation_descriptor_init(i bau_desc =kmalloc_node (dsize,GFP_KERNEL , node);BUG_ON (!bau_desc); - pa =uv_gpa (bau_desc);/* need the real nasid*/ - n = pa >> uv_nshift; - m = pa & uv_mmask; + gpa =uv_gpa (bau_desc); + n =uv_gpa_to_gnode (gpa); + m =uv_gpa_to_offset (gpa);/* the 14-bit pnode */ write_mmr_descriptor_base (pnode, (n <<UV_DESC_PSHIFT | m));
@@ -1516,9 +1513,9 @@ static void pq_init(int node, int pnode) bcp->queue_last = pqp + (DEST_Q_SIZE -1 ); }/* -* need the pnode of where the memory was really allocated +* need the gnode of where the memory was really allocated */ - pn =uv_gpa (pqp) >> uv_nshift; + pn =uv_gpa_to_gnode (uv_gpa (pqp)); first =uv_physnodeaddr (pqp); pn_first = ((unsigned long )pn <<UV_PAYLOADQ_PNODE_SHIFT ) | first; last =uv_physnodeaddr (pqp + (DEST_Q_SIZE -1 ));
@@ -1812,8 +1809,6 @@ static int __init uv_bau_init(void)zalloc_cpumask_var_node (mask,GFP_KERNEL ,cpu_to_node (cur_cpu)); } - uv_nshift = uv_hub_info->m_val; - uv_mmask = (1UL << uv_hub_info->m_val) -1 ; nuvhubs =uv_num_possible_blades ();spin_lock_init (&disable_lock); congested_cycles =usec_2_cycles (congested_respns_us);
PATCH 37/262 x86: Fix compilation bug in kprobes twobyte_is_boostable
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Stone <[email protected]>
commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream.
When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I noticed a warning about the asm operand for test_bit in kprobes' can_boost. I discovered that this caused only the first long of twobyte_is_boostable[] to be output.
Jakub filed and fixed gcc PR50571 to correct the warning and this output issue. But to solve it for less current gcc, we can make kprobes' twobyte_is_boostable[] non-const, and it won't be optimized out.
Before:
CC arch/x86/kernel/kprobes.o
In file included from include/linux/bitops.h:22:0,
from include/linux/kernel.h:17,
from [...]/arch/x86/include/asm/percpu.h:44,
from [...]/arch/x86/include/asm/current.h:5,
from [...]/arch/x86/include/asm/processor.h:15,
from [...]/arch/x86/include/asm/atomic.h:6,
from include/linux/atomic.h:4,
from include/linux/mutex.h:18,
from include/linux/notifier.h:13,
from include/linux/kprobes.h:34,
from arch/x86/kernel/kprobes.c:43: [...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’:
[...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input
without lvalue in asm operand 1 is deprecated [enabled by default]
$ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
551: 0f a3 05 00 00 00 00 bt %eax,0x0
554: R_386_32 .rodata.cst4$ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
arch/x86/kernel/kprobes.o: file format elf32-i386
Contents of section .data:
0000 48000000 00000000 00000000 00000000 H...............
Contents of section .rodata.cst4:
0000 4c030000 L...
Only a single long of twobyte_is_boostable[] is in the object file.
After, without the const on twobyte_is_boostable:
$ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
551: 0f a3 05 20 00 00 00 bt %eax,0x20
554: R_386_32 .data$ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
arch/x86/kernel/kprobes.o: file format elf32-i386
Contents of section .data:
0000 48000000 00000000 00000000 00000000 H............... 0010 00000000 00000000 00000000 00000000 ................ 0020 4c030000 0f000200 ffff0000 ffcff0c0 L............... 0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77 ....;.......&..w
Now all 32 bytes are output into .data instead.
--- arch/x86/kernel/kprobes.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kernel/kprobes.c +3 -1
@@ -75,8 +75,10 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kpr/* * Undefined/reserved opcodes, conditional jump, Opcode Extension * Groups, and some special opcodes can not boost. +* This is non-const to keep gcc from statically optimizing it out, as +* variable_test_bit makes gcc think only *(unsigned long*) is used. */ -static const u32 twobyte_is_boostable[256 /32 ] = { +static u32 twobyte_is_boostable[256 /32 ] = {/* 0 1 2 3 4 5 6 7 8 9 a b c d e f */ /* ---------------------------------------------- */ W(0x00, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0) | /* 00 */
PATCH 38/262 epoll: fix spurious lockdep warnings
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nelson Elhage <[email protected]>
commit d8805e633e054c816c47cb6e727c81f156d9253d upstream.
epoll can acquire recursively acquire ep->mtx on multiple "struct eventpoll"s at once in the case where one epoll fd is monitoring another epoll fd. This is perfectly OK, since we're careful about the lock ordering, but it causes spurious lockdep warnings. Annotate the recursion using mutex_lock_nested, and add a comment explaining the nesting rules for good measure.
Recent versions of systemd are triggering this, and it can also be demonstrated with the following trivial test program:
--------------------8<--------------------
int main(void) {
int e1, e2;
struct epoll_event evt = {
.events = EPOLLIN
};
e1 = epoll_create1(0);
e2 = epoll_create1(0);
epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);
return 0;
}
--------------------8<--------------------
--- fs/eventpoll.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
fs/eventpoll.c +18 -7
@@ -70,6 +70,15 @@* simultaneous inserts (A into B and B into A) from racing and * constructing a cycle without either insert observing that it is * going to. +* It is necessary to acquire multiple "ep->mtx"es at once in the +* case when one epoll fd is added to another. In this case, we +* always acquire the locks in the order of nesting (i.e. after +* epoll_ctl(e1, EPOLL_CTL_ADD, e2), e1->mtx will always be acquired +* before e2->mtx). Since we disallow cycles of epoll file +* descriptors, this ensures that the mutexes are well-ordered. In +* order to communicate this nesting to lockdep, when walking a tree +* of epoll file descriptors, we use the current recursion depth as +* the lockdep subkey. * It is possible to drop the "ep->mtx" and to use the global * mutex "epmutex" (together with "ep->lock") to have it working, * but having "ep->mtx" will make the interface more scalable.
@@ -464,13 +473,15 @@ static void ep_unregister_pollwait(struc* @ep: Pointer to the epoll private data structure. * @sproc: Pointer to the scan callback. * @priv: Private opaque data passed to the @sproc callback. +* @depth: The current depth of recursive f_op->poll calls. * * Returns: The same integer error code returned by the @sproc callback. */ static int ep_scan_ready_list (struct eventpoll *ep,int (*sproc)(struct eventpoll *,struct list_head *,void *), -void *priv) +void *priv, +int depth) {int error, pwake =0 ;unsigned long flags;
@@ -481,7 +492,7 @@ static int ep_scan_ready_list(struct eve* We need to lock this because we could be hit by * eventpoll_release_file() and epoll_ctl(). */ -mutex_lock (&ep->mtx); +mutex_lock_nested (&ep->mtx, depth);/* * Steal the ready list, and re-init the original one to the
@@ -670,7 +681,7 @@ static int ep_read_events_proc(struct evstatic int ep_poll_readyevents_proc (void *priv,void *cookie,int call_nests) { -return ep_scan_ready_list (priv, ep_read_events_proc,NULL ); +return ep_scan_ready_list (priv, ep_read_events_proc,NULL , call_nests +1 ); }static unsigned int ep_eventpoll_poll (struct file *file,poll_table *wait)
@@ -737,7 +748,7 @@ void eventpoll_release_file(struct file ep = epi->ep;list_del_init (&epi->fllink); -mutex_lock (&ep->mtx); +mutex_lock_nested (&ep->mtx,0 );ep_remove (ep, epi);mutex_unlock (&ep->mtx); }
@@ -1134,7 +1145,7 @@ static int ep_send_events(struct eventpo esed.maxevents = maxevents; esed.events = events; -return ep_scan_ready_list (ep, ep_send_events_proc, &esed); +return ep_scan_ready_list (ep, ep_send_events_proc, &esed,0 ); }static inline struct timespec ep_set_mstimeout (long ms)
@@ -1267,7 +1278,7 @@ static int ep_loop_check_proc(void *privstruct rb_node *rbp;struct epitem *epi; -mutex_lock (&ep->mtx); +mutex_lock_nested (&ep->mtx, call_nests +1 );for (rbp =rb_first (&ep->rbr); rbp; rbp =rb_next (rbp)) { epi = rb_entry(rbp, struct epitem, rbn);if (unlikely (is_file_epoll (epi->ffd.file))) {
@@ -1409,7 +1420,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in } -mutex_lock (&ep->mtx); +mutex_lock_nested (&ep->mtx,0 );/* * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
PATCH 39/262 leds: save the delay values after a successful call to blink_set()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Ospite <[email protected]>
commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d upstream.
When calling the hardware blinking function implemented by blink_set(), the delay_on and delay_off values are not preserved across calls.
Fix that and make the "timer" trigger work as expected when hardware blinking is available.
BEFORE the fix:
$ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 0 0 $ echo 100 > delay_off $ cat delay_on delay_off 0 0
AFTER the fix:
$ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 100 0 $ echo 100 > delay_off $ cat delay_on delay_off 100 100
--- drivers/leds/led-class.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/leds/led-class.c +4 -1
@@ -268,8 +268,11 @@ void led_blink_set(struct led_classdev * unsigned long *delay_off) {if (led_cdev->blink_set && - !led_cdev->blink_set (led_cdev, delay_on, delay_off)) + !led_cdev->blink_set (led_cdev, delay_on, delay_off)) { + led_cdev->blink_delay_on = *delay_on; + led_cdev->blink_delay_off = *delay_off;return ; + }/* blink with 1 Hz as default if nothing specified */ if (!*delay_on && !*delay_off)
PATCH 40/262 leds: turn the blink_timer off before starting to blink
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Ospite <[email protected]>
commit 488bc35bf40df89d37486c1826b178a2fba36ce7 upstream.
Depending on the implementation of the hardware blinking function in blink_set(), the led can support hardware blinking for some values of delay_on and delay_off and fall-back to software blinking for some other values.
Turning off the blink_timer unconditionally before starting to blink make sure that a sequence like:
OFF
hardware blinking
software blinking
hardware blinking
does not leave the software blinking timer active.
--- drivers/leds/led-class.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/leds/led-class.c +2 -0
@@ -267,6 +267,8 @@ void led_blink_set(struct led_classdev *unsigned long *delay_on, unsigned long *delay_off) { + del_timer_sync(&led_cdev->blink_timer); +if (led_cdev->blink_set && !led_cdev->blink_set (led_cdev, delay_on, delay_off)) { led_cdev->blink_delay_on = *delay_on;
PATCH 41/262 usbmon vs. tcpdump: fix dropped packet count
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Stezenbach <[email protected]>
commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream.
Report the number of dropped packets instead of zero when using the binary usbmon interface with tcpdump.
# tcpdump -i usbmon1 -w dump tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes ^C2155 packets captured 2155 packets received by filter 1019 packets dropped by kernel
--- drivers/usb/mon/mon_bin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/mon/mon_bin.c +1 -1
@@ -1101,7 +1101,7 @@ static long mon_bin_ioctl(struct file *f nevents =mon_bin_queued (rp); sp = (struct mon_bin_stats __user *)arg; -if (put_user (rp->cnt_lost, &sp->dropped)) +if (put_user (ndropped, &sp->dropped))return -EFAULT ;if (put_user (nevents, &sp->queued))return -EFAULT ;
PATCH 42/262 USB: storage: Use normalized sense when emulating autosense
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luben Tuikov <[email protected]>
commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream.
This patch solves two things:
1) Enables autosense emulation code to correctly interpret descriptor format sense data, and
2) Fixes a bug whereby the autosense emulation code would overwrite descriptor format sense data with SENSE KEY HARDWARE ERROR in fixed format, to incorrectly look like this:
Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] Sense Key : Recovered Error [current] [descriptor] Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex): Oct 21 14:11:07 localhost kernel: 72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00 Oct 21 14:11:07 localhost kernel: 00 4f 00 c2 00 50 Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] ASC=0x4 ASCQ=0x1d
--- drivers/usb/storage/transport.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/usb/storage/transport.c +19 -15
@@ -691,6 +691,9 @@ void usb_stor_invoke_transport(struct scint temp_result;struct scsi_eh_save ses;int sense_size =US_SENSE_SIZE ; +struct scsi_sense_hdr sshdr; +const u8 *scdd; +u8 fm_ili;/* device supports and needs bigger sense buffer */ if (us->fflags &US_FL_SANE_SENSE )
@@ -774,32 +777,30 @@ Retry_Sense: srb->sense_buffer[7 ] = (US_SENSE_SIZE -8 ); } +scsi_normalize_sense (srb->sense_buffer,SCSI_SENSE_BUFFERSIZE , + &sshdr); +US_DEBUGP ("-- Result from auto-sense is %d\n" , temp_result);US_DEBUGP ("-- code: 0x%x, key: 0x%x, ASC: 0x%x, ASCQ: 0x%x\n" , - srb->sense_buffer[0 ], - srb->sense_buffer[2 ] &0xf , - srb->sense_buffer[12 ], - srb->sense_buffer[13 ]); + sshdr.response_code, sshdr.sense_key, + sshdr.asc, sshdr.ascq);#ifdef CONFIG_USB_STORAGE_DEBUG -usb_stor_show_sense ( - srb->sense_buffer[2 ] &0xf , - srb->sense_buffer[12 ], - srb->sense_buffer[13 ]); +usb_stor_show_sense (sshdr.sense_key, sshdr.asc, sshdr.ascq);#endif /* set the result so the higher layers expect this data */ srb->result =SAM_STAT_CHECK_CONDITION ; + scdd =scsi_sense_desc_find (srb->sense_buffer, +SCSI_SENSE_BUFFERSIZE ,4 ); + fm_ili = (scdd ? scdd[3 ] : srb->sense_buffer[2 ]) &0xA0 ; +/* We often get empty sense data. This could indicate that * everything worked or that there was an unspecified * problem. We have to decide which. */ -if (/* Filemark 0, ignore EOM, ILI 0, no sense */ - (srb->sense_buffer[2 ] &0xaf ) ==0 && -/* No ASC or ASCQ */ - srb->sense_buffer[12 ] ==0 && - srb->sense_buffer[13 ] ==0 ) { - +if (sshdr.sense_key ==0 && sshdr.asc ==0 && sshdr.ascq ==0 && + fm_ili ==0 ) {/* If things are really okay, then let's show that. * Zero out the sense buffer so the higher layers * won't realize we did an unsolicited auto-sense.
@@ -814,7 +815,10 @@ Retry_Sense:*/ }else { srb->result =DID_ERROR <<16 ; - srb->sense_buffer[2 ] =HARDWARE_ERROR ; +if ((sshdr.response_code &0x72 ) ==0x72 ) + srb->sense_buffer[1 ] =HARDWARE_ERROR ; +else + srb->sense_buffer[2 ] =HARDWARE_ERROR ; } } }
PATCH 43/262 USB: Fix runtime wakeup on OHCI
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Garrett <[email protected]>
commit a8b43c00ef06aec49b9fe0a5bad8a6a320e4d27b upstream.
At least some OHCI hardware (such as the MCP89) fails to flag any change in the host status register or the port status registers when receiving a remote wakeup while in D3 state. This results in the controller being resumed but no device state change being noticed, at which point the controller is put back to sleep again. Since there doesn't seem to be any reliable way to identify the state change, just unconditionally resume the hub. It'll be put back to sleep in the near future anyway if there are no active devices attached to it.
--- drivers/usb/host/ohci-hub.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/usb/host/ohci-hub.c +1 -4
@@ -356,10 +356,7 @@ static void ohci_finish_controller_resummsleep (20 ); } -/* Does the root hub have a port wakeup pending? */ -if (ohci_readl (ohci, &ohci->regs->intrstatus) & - (OHCI_INTR_RD |OHCI_INTR_RHSC )) -usb_hcd_resume_root_hub (hcd); +usb_hcd_resume_root_hub (hcd); }/* Carry out polling-, autostop-, and autoresume-related state changes */
PATCH 44/262 USB: g_printer: fix bug in unregistration
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Godehardt <[email protected]>
commit 8582d86143c690c68cc42f996def466a035bee34 upstream.
The allocated chardevice region range is only 1 device but on unregister it currently tries to deregister 2.
Found this while doing a insmod/rmmod/insmod/rm... of the module which seemed to eat major numbers.
--- drivers/usb/gadget/printer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/printer.c +1 -1
@@ -1602,7 +1602,7 @@ cleanup(void)if (status)ERROR (dev,"usb_gadget_unregister_driver %x\n" , status); -unregister_chrdev_region (g_printer_devno,2 ); +unregister_chrdev_region (g_printer_devno,1 );class_destroy (usb_gadget_class);mutex_unlock (&usb_printer_gadget.lock_printer_io); }
PATCH 45/262 usb/core/devio.c: Check for printer class specific request
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Dellweg <[email protected]>
commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream.
In the usb printer class specific request get_device_id the value of wIndex is (interface << 8 | altsetting) instead of just interface. This enables the detection of some printers with libusb.
--- drivers/usb/core/devio.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/usb/core/devio.c +18 -3
@@ -607,9 +607,10 @@ static int findintfep(struct usb_device }static int check_ctrlrecip (struct dev_state *ps,unsigned int requesttype, -unsigned int index) +unsigned int request,unsigned int index) {int ret =0 ; +struct usb_host_interface *alt_setting;if (ps->dev->state !=USB_STATE_UNAUTHENTICATED && ps->dev->state != USB_STATE_ADDRESS
@@ -618,6 +619,19 @@ static int check_ctrlrecip(struct dev_stif (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))return 0 ; +/* +* check for the special corner case 'get_device_id' in the printer +* class specification, where wIndex is (interface << 8 | altsetting) +* instead of just interface +*/ +if (requesttype ==0xa1 && request ==0 ) { + alt_setting =usb_find_alt_setting (ps->dev->actconfig, + index >>8 , index &0xff ); +if (alt_setting + && alt_setting->desc.bInterfaceClass ==USB_CLASS_PRINTER ) + index >>=8 ; + } + index &=0xff ;switch (requesttype &USB_RECIP_MASK ) {case USB_RECIP_ENDPOINT :
@@ -770,7 +784,8 @@ static int proc_control(struct dev_stateif (copy_from_user (&ctrl, arg,sizeof (ctrl)))return -EFAULT ; - ret =check_ctrlrecip (ps, ctrl.bRequestType, ctrl.wIndex); + ret =check_ctrlrecip (ps, ctrl.bRequestType, ctrl.bRequest, + ctrl.wIndex);if (ret)return ret; wLength = ctrl.wLength;/* To suppress 64k PAGE_SIZE warning */
@@ -1100,7 +1115,7 @@ static int proc_do_submiturb(struct dev_kfree (dr);return -EINVAL ; } - ret =check_ctrlrecip (ps, dr->bRequestType, + ret =check_ctrlrecip (ps, dr->bRequestType, dr->bRequest,le16_to_cpup (&dr->wIndex));if (ret) {kfree (dr);
PATCH 46/262 USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Hallyn <[email protected]>
commit aec01c5895051849ed842dc5b8794017a7751f28 upstream.
Alan Stern points out that after spin_unlock(&ps->lock) there is no guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is called after the spin_unlock(), the pid passed to it must be pinned.
--- drivers/usb/core/devio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/core/devio.c +4 -2
@@ -407,7 +407,7 @@ static void async_completed(struct urb * sinfo.si_errno = as->status; sinfo.si_code =SI_ASYNCIO ; sinfo.si_addr = as->userurb; - pid = as->pid; + pid =get_pid (as->pid); uid = as->uid; euid = as->euid; secid = as->secid;
@@ -422,9 +422,11 @@ static void async_completed(struct urb *cancel_bulk_urbs (ps, as->bulk_addr);spin_unlock (&ps->lock); -if (signr) +if (signr) {kill_pid_info_as_uid (sinfo.si_signo, &sinfo, pid, uid, euid, secid); +put_pid (pid); + }wake_up (&ps->wait); }
PATCH 47/262 usb: cdc-acm: Owen SI-30 support
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Pershin <[email protected]>
commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream.
here is the patch to support Owen SI-30 device.
This is a pulse counter controller.
http://www.owen.ru/en/catalog/93788515
usb-drivers output:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 P: Vendor=03eb ProdID=0030 Rev=01.01 C: #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm
This patch is installed on my home system which receives data from this controller connected to cold water counter.
--- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/class/cdc-acm.c +3 -0
@@ -1534,6 +1534,9 @@ static const struct usb_device_id acm_id { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */ { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */ + /* Support for Owen devices */ + { USB_DEVICE(0x03eb, 0x0030), }, /* Owen SI30 */ +/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */ /* Support Lego NXT using pbLua firmware */
PATCH 48/262 USB: add RESET_RESUME for webcams shown to be quirky
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 2394d67e446bf616a0885167d5f0d397bdacfdfc upstream.
The new runtime PM code has shown that many webcams suffer from a race condition that may crash them upon resume. Runtime PM is especially prone to show the problem because it retains power to the cameras at all times. However system suspension may also crash the devices and retain power to the devices.
The only way to solve this problem without races is in usbcore with the RESET_RESUME quirk.
--- drivers/usb/core/quirks.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/usb/core/quirks.c +21 -0
@@ -38,6 +38,24 @@ static const struct usb_device_id usb_qu/* Creative SB Audigy 2 NX */ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Logitech Webcam C200 */ + { USB_DEVICE(0x046d, 0x0802), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Webcam C250 */ + { USB_DEVICE(0x046d, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Webcam B/C500 */ + { USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Webcam Pro 9000 */ + { USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Webcam C310 */ + { USB_DEVICE(0x046d, 0x081b), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Webcam C270 */ + { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Logitech Harmony 700-series */ { USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT },
@@ -69,6 +87,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x06a3, 0x0006), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Guillemot Webcam Hercules Dualpix Exchange*/ + { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME }, + /* M-Systems Flash Disk Pioneers */ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
PATCH 49/262 USB: add quirk for Logitech C300 web cam
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Levell <[email protected]>
commit 5b253d88cc6c65a23cefc457a5a4ef139913c5fc upstream.
My webcam is a Logitech C300 and I get "chipmunk"ed squeaky sound. The following trivial patch fixes it.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -44,6 +44,9 @@ static const struct usb_device_id usb_qu/* Logitech Webcam C250 */ { USB_DEVICE(0x046d, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Logitech Webcam C300 */ + { USB_DEVICE(0x046d, 0x0805), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Logitech Webcam B/C500 */ { USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME },
PATCH 50/262 USB: pl2303: add id for SMART device
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Benoit <[email protected]>
commit 598f0b703506da841d3459dc0c48506be14d1778 upstream.
Add vendor and product ID for the SMART USB to serial adapter. These were meant to be used with their SMART Board whiteboards, but can be re-purposed for other tasks. Tested and working (at at least 9600 bps).
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 5 +++++ 2 files changed, 6 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -92,6 +92,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) }, { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) }, { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) }, + { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { } /* Terminating entry */ };
drivers/usb/serial/pl2303.h +5 -0
@@ -148,3 +148,8 @@/* WinChipHead USB->RS 232 adapter */ #define WINCHIPHEAD_VENDOR_ID 0x4348#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523 + +/* SMART USB Serial Adapter */ +#define SMART_VENDOR_ID 0x0b8c +#define SMART_PRODUCT_ID 0x2303 +
PATCH 51/262 USB: ftdi_sio: add PID for Sony Ericsson Urban
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hakan Kvist <[email protected]>
commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream.
Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -206,6 +206,8 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_XF_640_PID) }, { USB_DEVICE(FTDI_VID, FTDI_XF_642_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DSS20_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_URBAN_0_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_URBAN_1_PID) }, { USB_DEVICE(FTDI_NF_RIC_VID, FTDI_NF_RIC_PID) }, { USB_DEVICE(FTDI_VID, FTDI_VNHCPCUSB_D_PID) }, { USB_DEVICE(FTDI_VID, FTDI_MTXORB_0_PID) },
drivers/usb/serial/ftdi_sio_ids.h +4 -2
@@ -420,9 +420,11 @@#define PROTEGO_SPECIAL_4 0xFC73/* special/unknown device */ /* -* DSS-20 Sync Station for Sony Ericsson P800 +* Sony Ericsson product ids */ -#define FTDI_DSS20_PID 0xFC82 +#define FTDI_DSS20_PID 0xFC82/* DSS-20 Sync Station for Sony Ericsson P800 */ +#define FTDI_URBAN_0_PID 0xFC8A/* Sony Ericsson Urban, uart #0 */ +#define FTDI_URBAN_1_PID 0xFC8B/* Sony Ericsson Urban, uart #1 */ /* www.irtrans.de device */ #define FTDI_IRTRANS_PID 0xFC60/* Product Id */
PATCH 52/262 USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Stuge <[email protected]>
commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream.
Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard, and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger Interface Board. The ICDI board can also be used stand-alone, for other boards and chips than the kit it came with. The ICDI has both old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm pitch connector.
Tested with EK-LM3S9B90, where the BD-ICDI board is included.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 3 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -746,6 +746,8 @@ static struct usb_device_id id_table_com .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -54,6 +54,7 @@/* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */ #define LMI_LM3S_DEVEL_BOARD_PID 0xbcd8#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9 +#define LMI_LM3S_ICDI_BOARD_PID 0xbcda#define FTDI_TURTELIZER_PID 0xBDC8/* JTAG/RS-232 adapter by egnite GmbH */
PATCH 53/262 USB: option: convert interface blacklisting to bitfields
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit b4626c10928c13ee73b013dcbc23676333e79b59 upstream.
It's cleaner than the array stuff, and we're about to add a bunch more blacklist entries. Second, there are devices that need both the sendsetup and the reserved interface blacklists, which the current code can't accommodate.
--- drivers/usb/serial/option.c | 53 +++++++++++++++++++++----------------------- 1 file changed, 26 insertions(+), 27 deletions(-)
drivers/usb/serial/option.c +26 -27
@@ -475,31 +475,24 @@ enum option_blacklist_reason {OPTION_BLACKLIST_RESERVED_IF =2 }; +#define MAX_BL_NUM 8struct option_blacklist_info { -const u32 infolen;/* number of interface numbers on blacklist */ -const u8 *ifaceinfo;/* pointer to the array holding the numbers */ -enum option_blacklist_reason reason; +/* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */ +const unsigned long sendsetup; +/* bitfield of interface numbers for OPTION_BLACKLIST_RESERVED_IF */ +const unsigned long reserved; }; -static const u8 four_g_w14_no_sendsetup[] = {0 ,1 };static const struct option_blacklist_info four_g_w14_blacklist = { - .infolen =ARRAY_SIZE (four_g_w14_no_sendsetup), - .ifaceinfo = four_g_w14_no_sendsetup, - .reason =OPTION_BLACKLIST_SENDSETUP + .sendsetup =BIT (0 ) |BIT (1 ), }; -static const u8 alcatel_x200_no_sendsetup[] = {0 ,1 };static const struct option_blacklist_info alcatel_x200_blacklist = { - .infolen =ARRAY_SIZE (alcatel_x200_no_sendsetup), - .ifaceinfo = alcatel_x200_no_sendsetup, - .reason =OPTION_BLACKLIST_SENDSETUP + .sendsetup =BIT (0 ) |BIT (1 ), }; -static const u8 zte_k3765_z_no_sendsetup[] = {0 ,1 ,2 };static const struct option_blacklist_info zte_k3765_z_blacklist = { - .infolen =ARRAY_SIZE (zte_k3765_z_no_sendsetup), - .ifaceinfo = zte_k3765_z_no_sendsetup, - .reason =OPTION_BLACKLIST_SENDSETUP + .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), };static const struct usb_device_id option_ids[] = {
@@ -1255,21 +1248,28 @@ static int option_probe(struct usb_seriareturn 0 ; } -static enum option_blacklist_reason is_blacklisted (const u8 ifnum, -const struct option_blacklist_info *blacklist) +static bool is_blacklisted (const u8 ifnum,enum option_blacklist_reason reason, +const struct option_blacklist_info *blacklist) { -const u8 *info; -int i; +unsigned long num; +const unsigned long *intf_list;if (blacklist) { - info = blacklist->ifaceinfo; +if (reason ==OPTION_BLACKLIST_SENDSETUP ) + intf_list = &blacklist->sendsetup; +else if (reason ==OPTION_BLACKLIST_RESERVED_IF ) + intf_list = &blacklist->reserved; +else { +BUG_ON (reason); +return false; + } -for (i =0 ; i < blacklist->infolen; i++) { -if (info[i] == ifnum) -return blacklist->reason; +for_each_set_bit (num, intf_list,MAX_BL_NUM +1 ) { +if (num == ifnum) +return true; } } -return OPTION_BLACKLIST_NONE ; +return false; }static void option_instat_callback (struct urb *urb)
@@ -1343,9 +1343,8 @@ static int option_send_setup(struct usb_int val =0 ;dbg ("%s" , __func__); -if (is_blacklisted (ifNum, - (struct option_blacklist_info *) intfdata->private) - ==OPTION_BLACKLIST_SENDSETUP ) { +if (is_blacklisted (ifNum,OPTION_BLACKLIST_SENDSETUP , + (struct option_blacklist_info *) intfdata->private)) {dbg ("No send_setup on blacklisted interface #%d\n" , ifNum);return -EIO ; }
PATCH 54/262 USB: option: convert Huawei K3765, K4505, K4605 reservered interface to blacklist
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 0d905fd5ece4ab65e8407c450077744e1c8f661b upstream.
That's what the blacklist is for...
--- drivers/usb/serial/option.c | 79 +++++++++++++++++++++++--------------------- 1 file changed, 43 insertions(+), 36 deletions(-)
drivers/usb/serial/option.c +43 -36
@@ -495,6 +495,10 @@ static const struct option_blacklist_inf .sendsetup = BIT(0) | BIT(1) | BIT(2), }; +static const struct option_blacklist_info huawei_cdc12_blacklist = { + .reserved =BIT (1 ) |BIT (2 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -592,12 +596,15 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
@@ -1207,10 +1214,35 @@ static void __exit option_exit(void)module_init (option_init);module_exit (option_exit); +static bool is_blacklisted (const u8 ifnum,enum option_blacklist_reason reason, +const struct option_blacklist_info *blacklist) +{ +unsigned long num; +const unsigned long *intf_list; + +if (blacklist) { +if (reason ==OPTION_BLACKLIST_SENDSETUP ) + intf_list = &blacklist->sendsetup; +else if (reason ==OPTION_BLACKLIST_RESERVED_IF ) + intf_list = &blacklist->reserved; +else { +BUG_ON (reason); +return false; + } + +for_each_set_bit (num, intf_list,MAX_BL_NUM +1 ) { +if (num == ifnum) +return true; + } + } +return false; +} +static int option_probe (struct usb_serial *serial,const struct usb_device_id *id) {struct usb_wwan_intf_private *data; +/* D-Link DWM 652 still exposes CD-Rom emulation interface in modem mode */ if (serial->dev->descriptor.idVendor == DLINK_VENDOR_ID && serial->dev->descriptor.idProduct == DLINK_PRODUCT_DWM_652 &&
@@ -1223,14 +1255,14 @@ static int option_probe(struct usb_seria serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)return -ENODEV ; -/* Don't bind network interfaces on Huawei K3765, K4505 & K4605 */ -if (serial->dev->descriptor.idVendor ==HUAWEI_VENDOR_ID && - (serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K3765 || - serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4505 || - serial->dev->descriptor.idProduct ==HUAWEI_PRODUCT_K4605 ) && - (serial->interface->cur_altsetting->desc.bInterfaceNumber ==1 || - serial->interface->cur_altsetting->desc.bInterfaceNumber ==2 )) -return -ENODEV ; +/* Don't bind reserved interfaces (like network ones) which often have +* the same class/subclass/protocol as the serial interfaces. Look at +* the Windows driver .INF files for reserved interface numbers. +*/ +if (is_blacklisted ( + serial->interface->cur_altsetting->desc.bInterfaceNumber, +OPTION_BLACKLIST_RESERVED_IF , + (const struct option_blacklist_info *) id->driver_info))/* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */ if (serial->dev->descriptor.idVendor == SAMSUNG_VENDOR_ID &&
@@ -1239,7 +1271,6 @@ static int option_probe(struct usb_seriareturn -ENODEV ; data = serial->private =kzalloc (sizeof (struct usb_wwan_intf_private ),GFP_KERNEL ); -if (!data)return -ENOMEM ; data->send_setup = option_send_setup;
@@ -1248,30 +1279,6 @@ static int option_probe(struct usb_seriareturn 0 ; } -static bool is_blacklisted (const u8 ifnum,enum option_blacklist_reason reason, -const struct option_blacklist_info *blacklist) -{ -unsigned long num; -const unsigned long *intf_list; - -if (blacklist) { -if (reason ==OPTION_BLACKLIST_SENDSETUP ) - intf_list = &blacklist->sendsetup; -else if (reason ==OPTION_BLACKLIST_RESERVED_IF ) - intf_list = &blacklist->reserved; -else { -BUG_ON (reason); -return false; - } - -for_each_set_bit (num, intf_list,MAX_BL_NUM +1 ) { -if (num == ifnum) -return true; - } - } -return false; -} -static void option_instat_callback (struct urb *urb) {int err;
PATCH 55/262 USB: option: add ZTE product 0x0037 to sendsetup blacklist
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit eb05ce567a81c592c58f4bdb96eb91ce96661c30 upstream.
--- drivers/usb/serial/option.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +6 -1
@@ -491,6 +491,10 @@ static const struct option_blacklist_inf .sendsetup = BIT(0) | BIT(1), }; +static const struct option_blacklist_info zte_0037_blacklist = { + .sendsetup =BIT (0 ) |BIT (1 ), +}; +static const struct option_blacklist_info zte_k3765_z_blacklist = { .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), };
@@ -743,7 +747,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_0037_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) },
PATCH 56/262 USB: option: add various ZTE device network interfaces to the blacklist
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit c58a76cdd7ab5a945a44fd2d64f6faf40323f95b upstream.
IDs found in the Windows driver's ZTEusbnet.inf file from the ZTE MF100 drivers (O2 UK). Also fixes the ZTE MF626 device since it really is distinct from the 4G Systems stick and apparently needs the net interface blacklisted too, while there's no indication (yet) that the 4G Systems stick does.
--- drivers/usb/serial/option.c | 63 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 49 insertions(+), 14 deletions(-)
drivers/usb/serial/option.c +49 -14
@@ -497,12 +497,34 @@ static const struct option_blacklist_infstatic const struct option_blacklist_info zte_k3765_z_blacklist = { .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), + .reserved =BIT (4 ), };static const struct option_blacklist_info huawei_cdc12_blacklist = { .reserved =BIT (1 ) |BIT (2 ), }; +static const struct option_blacklist_info net_intf1_blacklist = { + .reserved =BIT (1 ), +}; + +static const struct option_blacklist_info net_intf3_blacklist = { + .reserved =BIT (3 ), +}; + +static const struct option_blacklist_info net_intf4_blacklist = { + .reserved =BIT (4 ), +}; + +static const struct option_blacklist_info net_intf5_blacklist = { + .reserved =BIT (5 ), +}; + +static const struct option_blacklist_info zte_mf626_blacklist = { + .sendsetup =BIT (0 ) |BIT (1 ), + .reserved =BIT (4 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -709,7 +731,8 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0004, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0005, 0xff, 0xff, 0xff) },
@@ -724,26 +747,30 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000f, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0010, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0022, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },/* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&four_g_w14_blacklist }, + 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mf626_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) },
@@ -752,24 +779,30 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },/* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
@@ -784,11 +817,13 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0083, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0087, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
PATCH 57/262 MAINTANERS: update Qualcomm Atheros addresses
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Luis R. Rodriguez" <[email protected]>
commit fe8e084455f273b32cc57a5fbaf6c22ef984d657 upstream.
Qualcomm ate up Atheros, all of the old e-mail addresses no longer work and e-mails sent to it will bounce. Update the addresses to the new shiny Qualcomm Atheros (QCA) ones.
--- MAINTAINERS | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
MAINTAINERS +7 -7
@@ -1221,7 +1221,7 @@ F: Documentation/aoe/ F: drivers/block/aoe/ ATHEROS ATH GENERIC UTILITIES -M: "Luis R. Rodriguez" <[email protected]> +M: "Luis R. Rodriguez" <[email protected]> L: [email protected] S: Supported F: drivers/net/wireless/ath/*
@@ -1229,7 +1229,7 @@ F: drivers/net/wireless/ath/* ATHEROS ATH5K WIRELESS DRIVER M: Jiri Slaby <[email protected]> M: Nick Kossifidis <[email protected]> -M: "Luis R. Rodriguez" <[email protected]> +M: "Luis R. Rodriguez" <[email protected]> M: Bob Copeland <[email protected]> L: [email protected] L: [email protected]
@@ -1238,10 +1238,10 @@ S: Maintained F: drivers/net/wireless/ath/ath5k/ ATHEROS ATH9K WIRELESS DRIVER -M: "Luis R. Rodriguez" <[email protected]> -M: Jouni Malinen <[email protected]> -M: Vasanthakumar Thiagarajan <[email protected]> -M: Senthil Balasubramanian <[email protected]> +M: "Luis R. Rodriguez" <[email protected]> +M: Jouni Malinen <[email protected]> +M: Vasanthakumar Thiagarajan <[email protected]> +M: Senthil Balasubramanian <[email protected]> L: [email protected] L: [email protected] W: http://wireless.kernel.org/en/users/Drivers/ath9k
@@ -1269,7 +1269,7 @@ F: drivers/input/misc/ati_remote2.c ATLX ETHERNET DRIVERS M: Jay Cliburn <[email protected]> M: Chris Snook <[email protected]> -M: Jie Yang <[email protected]> +M: Jie Yang <[email protected]> L: [email protected] W: http://sourceforge.net/projects/atl1 W: http://atl1.sourceforge.net
PATCH 58/262 ath9k_hw: Fix descriptor status of TxOpExceeded
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit 2a15b394f8e46dd3e2ab365ab41cfa701d92fa77 upstream.
--- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_mac.c +2 -2
@@ -255,8 +255,6 @@ static int ar9003_hw_proc_txdesc(structreturn -EIO ; } -if (status & AR_TxOpExceeded) - ts->ts_status |=ATH9K_TXERR_XTXOP ; ts->ts_rateindex =MS (status, AR_FinalTxIdx); ts->ts_seqnum =MS (status, AR_SeqNum); ts->tid =MS (status, AR_TxTid);
@@ -267,6 +265,8 @@ static int ar9003_hw_proc_txdesc(struct ts->ts_status =0 ; ts->ts_flags =0 ; +if (status & AR_TxOpExceeded) + ts->ts_status |=ATH9K_TXERR_XTXOP ; status =ACCESS_ONCE (ads->status2); ts->ts_rssi_ctl0 =MS (status, AR_TxRSSIAnt00); ts->ts_rssi_ctl1 =MS (status, AR_TxRSSIAnt01);
PATCH 59/262 ath9k_hw: Fix magnitude/phase coeff correction
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit e9c10469cf3c71bc1c6b0f01319161e277d6ac9b upstream.
Do the magnitude/phase coeff correction only if the outlier is detected. Updating wrong magnitude/phase coeff factor impacts not only tx gain setting but also leads to poor performance in congested networks. In the clear environment the impact is very minimal because the outlier happens very rarely according to the past experiment. It occured less than once every 1000 calibrations.
--- drivers/net/wireless/ath/ath9k/ar9003_calib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ar9003_calib.c +2 -1
@@ -643,8 +643,9 @@ static void ar9003_hw_detect_outlier(int outlier_idx = max_idx; else outlier_idx = min_idx; + + mp_coeff[outlier_idx] = mp_avg; } - mp_coeff[outlier_idx] = mp_avg; } static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
PATCH 60/262 ath9k_htc: add AVM FRITZ!WLAN 11N v2 support
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Luis R. Rodriguez" <[email protected]>
commit 8c34559b4a6df32e4af1b073397fa4dc189a5485 upstream.
This was reported and tested by Martin Walter over at AVM GmbH Berlin. This also applies to 3.0.1 so sendint to stable.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +1 -0
@@ -37,6 +37,7 @@ static struct usb_device_id ath9k_hif_us { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */ { USB_DEVICE(0x040D, 0x3801) }, /* VIA */ { USB_DEVICE(0x0cf3, 0xb003) }, /* Ubiquiti WifiStation Ext */ + { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */ { USB_DEVICE(0x0cf3, 0x7015), .driver_info = AR9287_USB }, /* Atheros */
PATCH 61/262 ath9k_hw: Fix number of GPIO pins for AR9287/9300
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit 6321eb0977b011ac61dfca36e7c69b2c4325b104 upstream.
this patch fixes the assumption of maximum number of GPIO pins present in AR9287/AR9300. this fix is essential as we might encounter some functionality issues involved in accessing the status of GPIO pins which are all incorrectly assumed to be not within the range of max_num_gpio of AR9300/AR9287 chipsets
--- drivers/net/wireless/ath/ath9k/hw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath9k/hw.c +4 -0
@@ -1931,6 +1931,10 @@ int ath9k_hw_fill_cap_info(struct ath_hw pCap->num_gpio_pins =AR9271_NUM_GPIO ; else if (AR_DEVID_7010(ah)) pCap->num_gpio_pins = AR7010_NUM_GPIO; + else if (AR_SREV_9300_20_OR_LATER(ah)) + pCap->num_gpio_pins = AR9300_NUM_GPIO; + else if (AR_SREV_9287_11_OR_LATER(ah)) + pCap->num_gpio_pins = AR9287_NUM_GPIO; else if (AR_SREV_9285_12_OR_LATER(ah)) pCap->num_gpio_pins = AR9285_NUM_GPIO; else if (AR_SREV_9280_20_OR_LATER(ah))
PATCH 62/262 ath9k: disable unnecessary PHY error reporting
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit ac06697c79bad09e44a8b1d52104014016fb90de upstream.
PHY errors relevant for ANI are always tracked by hardware counters, the bits that allow them to pass through the rx filter are independent of that. Enabling PHY errors in the rx filter often creates lots of useless DMA traffic and might be responsible for some of the rx dma stop failure warnings.
--- drivers/net/wireless/ath/ath9k/ani.c | 5 ----- drivers/net/wireless/ath/ath9k/recv.c | 5 +---- 2 files changed, 1 insertion(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/ani.c +0 -5
@@ -502,9 +502,6 @@ static void ath9k_ani_reset_old(struct aath9k_hw_ani_control (ah,ATH9K_ANI_CCK_WEAK_SIGNAL_THR ,ATH9K_ANI_CCK_WEAK_SIG_THR ); -ath9k_hw_setrxfilter (ah,ath9k_hw_getrxfilter (ah) | -ATH9K_RX_FILTER_PHYERR ); -ath9k_ani_restart (ah);return ; }
@@ -525,8 +522,6 @@ static void ath9k_ani_reset_old(struct aath9k_hw_ani_control (ah,ATH9K_ANI_FIRSTEP_LEVEL , aniState->firstepLevel); -ath9k_hw_setrxfilter (ah,ath9k_hw_getrxfilter (ah) & - ~ATH9K_RX_FILTER_PHYERR );ath9k_ani_restart (ah);ENABLE_REGWRITE_BUFFER (ah);
drivers/net/wireless/ath/ath9k/recv.c +1 -4
@@ -423,12 +423,9 @@ void ath_rx_cleanup(struct ath_softc *scu32 ath_calcrxfilter (struct ath_softc *sc) { -#define RX_FILTER_PRESERVE (ATH9K_RX_FILTER_PHYERR | ATH9K_RX_FILTER_PHYRADAR) -u32 rfilt; - rfilt = (ath9k_hw_getrxfilter (sc->sc_ah) &RX_FILTER_PRESERVE ) - |ATH9K_RX_FILTER_UCAST |ATH9K_RX_FILTER_BCAST + rfilt =ATH9K_RX_FILTER_UCAST |ATH9K_RX_FILTER_BCAST |ATH9K_RX_FILTER_MCAST ;if (sc->rx.rxfilter &FIF_PROBE_REQ )
PATCH 63/262 HID: ACRUX - fix enabling force feedback support
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Kolzun <[email protected]>
commit 364b936fc38dec7653c690d710e10657af235a36 upstream.
The config option needs to be a 'bool' and not a tristate, otheriwse force feedback support never makes it into the module.
--- drivers/hid/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/Kconfig +1 -1
@@ -69,7 +69,7 @@ config HID_ACRUX Say Y here if you want to enable support for ACRUX game controllers. config HID_ACRUX_FF - tristate "ACRUX force feedback support" + bool "ACRUX force feedback support" depends on HID_ACRUX select INPUT_FF_MEMLESS ---help---
PATCH 64/262 QE/FHCI: fixed the CONTROL bug
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Huang <[email protected]>
commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream.
For USB CONTROL transaction, when the data length is zero, the IN package is needed to finish this transaction in status stage.
--- drivers/usb/host/fhci-sched.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/usb/host/fhci-sched.c +15 -4
@@ -1,7 +1,7 @@/* * Freescale QUICC Engine USB Host Controller Driver * -* Copyright (c) Freescale Semicondutor, Inc. 2006. +* Copyright (c) Freescale Semicondutor, Inc. 2006, 2011. * Shlomi Gridish <[email protected]> * Jerry Huang <[email protected]> * Copyright (c) Logic Product Development, Inc. 2007
@@ -810,9 +810,11 @@ void fhci_queue_urb(struct fhci_hcd *fhc ed->dev_addr =usb_pipedevice (urb->pipe); ed->max_pkt_size =usb_maxpacket (urb->dev, urb->pipe,usb_pipeout (urb->pipe)); +/* setup stage */ td =fhci_td_fill (fhci, urb, urb_priv, ed, cnt++,FHCI_TA_SETUP ,USB_TD_TOGGLE_DATA0 , urb->setup_packet,8 ,0 ,0 , true); +/* data stage */ if (data_len >0 ) { td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++, usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
@@ -820,9 +822,18 @@ void fhci_queue_urb(struct fhci_hcd *fhcUSB_TD_TOGGLE_DATA1 , data, data_len,0 ,0 , true); } - td =fhci_td_fill (fhci, urb, urb_priv, ed, cnt++, -usb_pipeout (urb->pipe) ?FHCI_TA_IN :FHCI_TA_OUT , -USB_TD_TOGGLE_DATA1 , data,0 ,0 ,0 , true); + +/* status stage */ +if (data_len >0 ) + td =fhci_td_fill (fhci, urb, urb_priv, ed, cnt++, + (usb_pipeout (urb->pipe) ?FHCI_TA_IN : +FHCI_TA_OUT ), +USB_TD_TOGGLE_DATA1 , data,0 ,0 ,0 , true); +else + td =fhci_td_fill (fhci, urb, urb_priv, ed, cnt++, +FHCI_TA_IN , +USB_TD_TOGGLE_DATA1 , data,0 ,0 ,0 , true); + urb_state =US_CTRL_SETUP ;break ;case FHCI_TF_ISO :
PATCH 65/262 Update email address for stable patch submission
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit 5fa224295f0e0358c8bc0e5390702338df889def upstream.
The [email protected] email address has been replaced with the [email protected] mailing list. Change the stable kernel rules to reference the new list instead of the semi-defunct email alias.
--- Documentation/stable_kernel_rules.txt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
Documentation/stable_kernel_rules.txt +7 -7
@@ -24,10 +24,10 @@ Rules on what kind of patches are accept Procedure for submitting patches to the -stable tree: - Send the patch, after verifying that it follows the above rules, to - [email protected]. You must note the upstream commit ID in the changelog - of your submission. + [email protected]. You must note the upstream commit ID in the + changelog of your submission. - To have the patch automatically included in the stable tree, add the tag - Cc: [email protected] + Cc: [email protected] in the sign-off area. Once the patch is merged it will be applied to the stable tree without anything else needing to be done by the author or subsystem maintainer.
@@ -35,10 +35,10 @@ Procedure for submitting patches to the cherry-picked than this can be specified in the following format in the sign-off area: - Cc: <[email protected]> # .32.x: a1f84a3: sched: Check for idle - Cc: <[email protected]> # .32.x: 1b9508f: sched: Rate-limit newidle - Cc: <[email protected]> # .32.x: fd21073: sched: Fix affinity logic - Cc: <[email protected]> # .32.x + Cc: <[email protected]> # .32.x: a1f84a3: sched: Check for idle + Cc: <[email protected]> # .32.x: 1b9508f: sched: Rate-limit newidle + Cc: <[email protected]> # .32.x: fd21073: sched: Fix affinity logic + Cc: <[email protected]> # .32.x Signed-off-by: Ingo Molnar <[email protected]> The tag sequence has the meaning of:
PATCH 66/262 xen-pcifront: Update warning comment to use e820_host option.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit 917e3e65c35459d52f0d0b890aa5df0cad07a051 upstream.
With Xen changeset 23428 "libxl: Add 'e820_host' option to config file" the E820 as seen from the host can now be passed into the guest. This means that a PV guest can now:
- Use the correct PCI I/O gap. Before these patches, Linux guest would boot up and would tell:
[ 0.000000] Allocating PCI resources starting at 40000000 (gap: 40000000:c0000000) while in actuality the PCI I/O gap should have been: [ 0.000000] Allocating PCI resources starting at b0000000 (gap: b0000000:4c000000)
- The PV domain with PCI devices was limited to 3GB. It now can be booted with 4GB, 8GB, or whatever number you want. The PCI devices will now _not_ conflict with System RAM. Meaning the drivers can load.
--- drivers/pci/xen-pcifront.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/xen-pcifront.c +2 -3
@@ -400,9 +400,8 @@ static int pcifront_claim_resource(strucdev_info (&pdev->xdev->dev,"claiming resource %s/%d\n" ,pci_name (dev), i);if (pci_claim_resource (dev, i)) { -dev_err (&pdev->xdev->dev,"Could not claim " -"resource %s/%d! Device offline. Try " -"giving less than 4GB to domain.\n" , +dev_err (&pdev->xdev->dev,"Could not claim resource %s/%d! " +"Device offline. Try using e820_host=1 in the guest config.\n" ,pci_name (dev), i); } }
PATCH 67/262 xen-swiotlb: Fix wrong panic.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream.
Propagate the baremetal git commit "swiotlb: fix wrong panic" (fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version. wherein swiotlb's map_page wrongly calls panic() when it can't find a buffer fit for device's dma mask. It should return an error instead.
Devices with an odd dma mask (i.e. under 4G) like b44 network card hit this bug (the system crashes):
http://marc.info/?l=linux-kernel&m=129648943830106&w=2
If xen-swiotlb returns an error, b44 driver can use the own bouncing mechanism.
--- drivers/xen/swiotlb-xen.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/swiotlb-xen.c +4 -3
@@ -278,9 +278,10 @@ dma_addr_t xen_swiotlb_map_page(struct d/* * Ensure that the address returned is DMA'ble */ -if (!dma_capable (dev, dev_addr, size)) -panic ("map_single: bounce buffer is not DMA'ble" ); - +if (!dma_capable (dev, dev_addr, size)) { +swiotlb_tbl_unmap_single (dev, map, size, dir); + dev_addr =0 ; + }return dev_addr; }EXPORT_SYMBOL_GPL (xen_swiotlb_map_page);
PATCH 68/262 kobj_uevent: Ignore if some listeners cannot handle message
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.
kobject_uevent() uses a multicast socket and should ignore if one of listeners cannot handle messages or nobody is listening at all.
Easily reproducible when a process in system is cloned with CLONE_NEWNET flag.
(See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)
--- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/kobject_uevent.c +1 -1
@@ -282,7 +282,7 @@ int kobject_uevent_env(struct kobject *k kobj_bcast_filter, kobj);/* ENOBUFS should be handled in userspace */ -if (retval == -ENOBUFS ) +if (retval == -ENOBUFS || retval == -ESRCH ) retval =0 ; }else retval = -ENOMEM ;
PATCH 69/262 caif: Fix BUG() with network namespaces
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 08613e4626c06ca408fc55071f6aedee36986a87 upstream.
The caif code will register its own pernet_operations, and then register a netdevice_notifier. Each time the netdevice_notifier is triggered, it'll do some stuff... including a lookup of its own pernet stuff with net_generic().
If the net_generic() call ever returns NULL, the caif code will BUG(). That doesn't seem *so* unreasonable, I suppose — it does seem like it should never happen.
However, it *does* happen. When we clone a network namespace, setup_net() runs through all the pernet_operations one at a time. It gets to loopback before it gets to caif. And loopback_net_init() registers a netdevice... while caif hasn't been initialised. So the caif netdevice notifier triggers, and immediately goes BUG().
We could imagine a complex and overengineered solution to this generic class of problems, but this patch takes the simple approach. It just makes caif_device_notify() *not* go looking for its pernet data structures if the device it's being notified about isn't a caif device in the first place.
--- net/caif/caif_dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/caif/caif_dev.c +3 -2
@@ -209,8 +209,7 @@ static int caif_device_notify(struct notenum cfcnfg_phy_preference pref;enum cfcnfg_phy_type phy_type;struct cfcnfg *cfg; -struct caif_device_entry_list *caifdevs = -caif_device_list (dev_net (dev)); +struct caif_device_entry_list *caifdevs;if (dev->type !=ARPHRD_CAIF )return 0 ;
@@ -219,6 +218,8 @@ static int caif_device_notify(struct notif (cfg ==NULL )return 0 ; + caifdevs =caif_device_list (dev_net (dev)); +switch (what) {case NETDEV_REGISTER : caifd =caif_device_alloc (dev);
PATCH 70/262 platform: samsung_laptop: add dmi information for Samsung R700 laptops
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Beller <[email protected]>
commit f87d02996f05ec1789ceecce9ec839f629b7aa80 upstream.
My DMI model is this:
Quoted 1 line
dmesg |grep DMI
[ 0.000000] DMI present. [ 0.000000] DMI: SAMSUNG ELECTRONICS CO., LTD. SR700/SR700, BIOS
04SR 02/20/2008
adding dmi information of Samsung R700 laptops This adds the dmi information of Samsungs R700 laptops.
--- drivers/platform/x86/samsung-laptop.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/samsung-laptop.c +9 -0
@@ -631,6 +631,15 @@ static struct dmi_system_id __initdata s .callback = dmi_check_cb, }, { + .ident = "R700", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"SAMSUNG ELECTRONICS CO., LTD." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"SR700" ), + DMI_MATCH(DMI_BOARD_NAME, "SR700"), + }, + .callback = dmi_check_cb, + }, + { .ident ="R530/R730" , .matches = { DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
PATCH 71/262 Platform: samsung_laptop: add support for X520 machines.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommaso Massimi <[email protected]>
commit 7500eeb08a179e61a4219288c21407d63d1e9c64 upstream.
my samsung laptop would be very happy if you add these lines to the file drivers/platform/x86/samsung-laptop.c
--- drivers/platform/x86/samsung-laptop.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/samsung-laptop.c +9 -0
@@ -685,6 +685,15 @@ static struct dmi_system_id __initdata s }, .callback = dmi_check_cb, }, + { + .ident = "X520", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "X520"), + DMI_MATCH(DMI_BOARD_NAME, "X520"), + }, + .callback = dmi_check_cb, + }, { }, }; MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
PATCH 72/262 Platform: samsung_laptop: samsung backlight for R528/R728
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Smelov Andrey <[email protected]>
commit 093ed561648d43263c009ea88abab21a31cd4f1d upstream.
patch works for me, but I need to add "acpi_backlight=vendor" to kernel params
--- drivers/platform/x86/samsung-laptop.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/samsung-laptop.c +9 -0
@@ -694,6 +694,15 @@ static struct dmi_system_id __initdata s }, .callback = dmi_check_cb, }, + { + .ident = "R528/R728", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "R528/R728"), + DMI_MATCH(DMI_BOARD_NAME, "R528/R728"), + }, + .callback = dmi_check_cb, + }, { }, }; MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
PATCH 73/262 platform: samsung_laptop: fix samsung brightness min/max calculations
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Stubbs <[email protected]>
commit bee460be8c691c544e84ed678280ace6153104c6 upstream.
The min_brightness value of the sabi_config is incorrectly used in brightness calculations. For the config where min_brightness = 1 and max_brightness = 8, the user visible range should be 0 to 7 with hardware being set in the range of 1 to 8. What is actually happening is that the user visible range is 0 to 8 with hardware being set in the range of -1 to 7.
This patch fixes the above issue as well as a miscalculation that would occur in the case of min_brightness > 1.
--- drivers/platform/x86/samsung-laptop.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/platform/x86/samsung-laptop.c +6 -3
@@ -370,15 +370,17 @@ static u8 read_brightness(void) &sretval);if (!retval) { user_brightness = sretval.retval[0 ]; -if (user_brightness !=0 ) +if (user_brightness > sabi_config->min_brightness) user_brightness -= sabi_config->min_brightness; +else + user_brightness =0 ; }return user_brightness; }static void set_brightness (u8 user_brightness) { -u8 user_level = user_brightness - sabi_config->min_brightness; +u8 user_level = user_brightness + sabi_config->min_brightness;sabi_set_command (sabi_config->commands.set_brightness, user_level); }
@@ -819,7 +821,8 @@ static int __init samsung_init(void)/* create a backlight device to talk to this one */ memset (&props,0 ,sizeof (struct backlight_properties )); props.type =BACKLIGHT_PLATFORM ; - props.max_brightness = sabi_config->max_brightness; + props.max_brightness = sabi_config->max_brightness - + sabi_config->min_brightness; backlight_device =backlight_device_register ("samsung" , &sdev->dev,NULL , &backlight_ops, &props);
PATCH 74/262 Platform: Fix error path in samsung-laptop init
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Herrmann <[email protected]>
commit a7ea19926ffba86f373f6050a106cd162dbb9a78 upstream.
samsung_init() should not return success if not all devices are initialized. Otherwise, samsung_exit() will dereference sdev NULL pointers and others.
--- drivers/platform/x86/samsung-laptop.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/platform/x86/samsung-laptop.c +1 -2
@@ -789,7 +789,7 @@ static int __init samsung_init(void) sabi_iface =ioremap_nocache (ifaceP,16 );if (!sabi_iface) {pr_err ("Can't remap %x\n" , ifaceP); - goto exit; + goto error_no_signature; }if (debug) {printk (KERN_DEBUG "ifaceP = 0x%08x\n" , ifaceP);
@@ -841,7 +841,6 @@ static int __init samsung_init(void)if (retval) goto error_file_create; -exit:return 0 ; error_file_create:
PATCH 75/262 kmod: prevent kmod_loop_msg overflow in __request_module()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream.
Due to post-increment in condition of kmod_loop_msg in __request_module(), the system log can be spammed by much more than 5 instances of the 'runaway loop' message if the number of events triggering it makes the kmod_loop_msg to overflow.
Fix that by making sure we never increment it past the threshold.
--- kernel/kmod.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/kmod.c +3 -1
@@ -114,10 +114,12 @@ int __request_module(bool wait, const chatomic_inc (&kmod_concurrent);if (atomic_read (&kmod_concurrent) > max_modprobes) {/* We may be blaming an innocent here, but unlikely */ -if (kmod_loop_msg++ <5 ) +if (kmod_loop_msg <5 ) {printk (KERN_ERR "request_module: runaway loop modprobe %s\n" , module_name); + kmod_loop_msg++; + }atomic_dec (&kmod_concurrent);return -ENOMEM ; }
PATCH 76/262 Revert "NFS: Ensure that writeback_single_inode() calls write_inode() when syncing"
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 59b7c05fffba030e5d9e72324691e2f99aa69b79 upstream.
This reverts commit b80c3cb628f0ebc241b02e38dd028969fb8026a2.
The reverted commit was rendered obsolete by a VFS fix: commit 5547e8aac6f71505d621a612de2fca0dd988b439 (writeback: Update dirty flags in two steps). We now no longer need to worry about writeback_single_inode() missing our marking the inode for COMMIT in 'do_writepages()' call.
Reverting this patch, fixes a performance regression in which the inode would continuously get queued to the dirty list, causing the writeback code to unnecessarily try to send a COMMIT.
--- fs/nfs/write.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/write.c +2 -1
@@ -428,7 +428,6 @@ static void nfs_mark_request_dirty(struct nfs_page *req) {__set_page_dirty_nobuffers (req->wb_page); -__mark_inode_dirty (req->wb_page->mapping->host,I_DIRTY_DATASYNC ); }#if defined(CONFIG_NFS_V3 ) || defined(CONFIG_NFS_V4 )
@@ -762,6 +761,8 @@ int nfs_updatepage(struct file *file, st status =nfs_writepage_setup (ctx, page, offset, count);if (status <0 )nfs_set_pageerror (page); +else +__set_page_dirty_nobuffers (page);dprintk ("NFS: nfs_updatepage returns %d (isize %lld)\n" , status, (long long )i_size_read (inode));
PATCH 77/262 nfs: dont redirty inode when ncommit == 0 in nfs_commit_unstable_pages
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 upstream.
commit 420e3646 allowed the kernel to reduce the number of unnecessary commit calls by skipping the commit when there are a large number of outstanding pages.
However, the current test in nfs_commit_unstable_pages does not handle the edge condition properly. When ncommit == 0, then that means that the kernel doesn't need to do anything more for the inode. The current test though in the WB_SYNC_NONE case will return true, and the inode will end up being marked dirty. Once that happens the inode will never be clean until there's a WB_SYNC_ALL flush.
Fix this by immediately returning from nfs_commit_unstable_pages when ncommit == 0.
Mike noticed this problem initially in RHEL5 (2.6.18-based kernel) which has a backported version of 420e3646. The inode cache there was growing very large. The inode cache was unable to be shrunk since the inodes were all marked dirty. Calling sync() would essentially "fix" the problem -- the WB_SYNC_ALL flush would result in the inodes all being marked clean.
What I'm not clear on is how big a problem this is in mainline kernels as the writeback code there is very different. Either way, it seems incorrect to re-mark the inode dirty in this case.
--- fs/nfs/write.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/nfs/write.c +4 -0
@@ -1526,6 +1526,10 @@ static int nfs_commit_unstable_pages(strint flags =FLUSH_SYNC ;int ret =0 ; +/* no commits means nothing needs to be done */ +if (!nfsi->ncommit) +return ret; +if (wbc->sync_mode ==WB_SYNC_NONE ) {/* Don't commit yet if this is a non-blocking flush and there * are a lot of outstanding writes for this mapping.
PATCH 78/262 ata_piix: make DVD Drive recognisable on systems with Intel Sandybridge chipsets(v2)
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit 5e5a4f5d5a08c9c504fe956391ac3dae2c66556d upstream.
This quirk patch fixes one kind of bug inside some Intel Sandybridge chipsets, see reports from
https://bugzilla.kernel.org/show_bug.cgi?id=40592.
Many guys also have reported the problem before:
https://bugs.launchpad.net/bugs/737388 https://bugs.launchpad.net/bugs/794642 https://bugs.launchpad.net/bugs/782389 ......
With help from Tejun, the problem is found to be caused by 32bit PIO mode, so introduce the quirk patch to disable 32bit PIO on SATA piix for some Sandybridge CPT chipsets.
Seth also tested the patch on all five affected chipsets (pci device ID: 0x1c00, 0x1c01, 0x1d00, 0x1e00, 0x1e01), and found the patch does fix the problem.
--- drivers/ata/ata_piix.c | 37 ++++++++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-)
drivers/ata/ata_piix.c +32 -5
@@ -113,6 +113,8 @@ enum {PIIX_PATA_FLAGS =ATA_FLAG_SLAVE_POSS ,PIIX_SATA_FLAGS =ATA_FLAG_SATA |PIIX_FLAG_CHECKINTR , +PIIX_FLAG_PIO16 = (1 <<30 ),/*support 16bit PIO only*/ +PIIX_80C_PRI = (1 <<5 ) | (1 <<4 ), PIIX_80C_SEC = (1 << 7) | (1 << 6),
@@ -147,6 +149,7 @@ enum piix_controller_ids { ich8m_apple_sata,/* locks up on second port enable */ tolapai_sata, piix_pata_vmw,/* PIIX4 for VMware, spurious DMA_ERR */ + ich8_sata_snb, }; struct piix_map_db {
@@ -177,6 +180,7 @@ static int piix_sidpr_scr_write(struct astatic int piix_sidpr_set_lpm (struct ata_link *link,enum ata_lpm_policy policy,unsigned hints);static bool piix_irq_check (struct ata_port *ap); +static int piix_port_start (struct ata_port *ap);#ifdef CONFIG_PM static int piix_pci_device_suspend (struct pci_dev *pdev,pm_message_t mesg);static int piix_pci_device_resume (struct pci_dev *pdev);
@@ -298,21 +302,21 @@ static const struct pci_device_id piix_p/* SATA Controller IDE (PCH) */ { 0x8086, 0x3b2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },/* SATA Controller IDE (CPT) */ - { 0x8086, 0x1c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata }, + { 0x8086, 0x1c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (CPT) */ - { 0x8086, 0x1c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata }, + { 0x8086, 0x1c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (CPT) */ { 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },/* SATA Controller IDE (CPT) */ { 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },/* SATA Controller IDE (PBG) */ - { 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata }, + { 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (PBG) */ { 0x8086, 0x1d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },/* SATA Controller IDE (Panther Point) */ - { 0x8086, 0x1e00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata }, + { 0x8086, 0x1e00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (Panther Point) */ - { 0x8086, 0x1e01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata }, + { 0x8086, 0x1e01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (Panther Point) */ { 0x8086, 0x1e08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, /* SATA Controller IDE (Panther Point) */
@@ -338,6 +342,7 @@ static struct scsi_host_template piix_shstatic struct ata_port_operations piix_sata_ops = { .inherits = &ata_bmdma32_port_ops, .sff_irq_check = piix_irq_check, + .port_start = piix_port_start, };static struct ata_port_operations piix_pata_ops = {
@@ -478,6 +483,7 @@ static const struct piix_map_db *piix_ma [ich8_2port_sata] = &ich8_2port_map_db, [ich8m_apple_sata] = &ich8m_apple_map_db, [tolapai_sata] = &tolapai_map_db, + [ich8_sata_snb] = &ich8_map_db, };static struct ata_port_info piix_port_info[] = {
@@ -606,6 +612,19 @@ static struct ata_port_info piix_port_in .port_ops = &piix_vmw_ops, }, +/* +* some Sandybridge chipsets have broken 32 mode up to now, +* see https://bugzilla.kernel.org/show_bug.cgi?id=40592 +*/ + [ich8_sata_snb] = + { + .flags = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR | PIIX_FLAG_PIO16, + .pio_mask = ATA_PIO4, + .mwdma_mask = ATA_MWDMA2, + .udma_mask = ATA_UDMA6, + .port_ops = &piix_sata_ops, + }, + };static struct pci_bits piix_enable_bits[] = {
@@ -649,6 +668,14 @@ static const struct ich_laptop ich_lapto { 0, } }; +static int piix_port_start (struct ata_port *ap) +{ +if (!(ap->flags &PIIX_FLAG_PIO16 )) + ap->pflags |=ATA_PFLAG_PIO32 |ATA_PFLAG_PIO32CHANGE ; + +return ata_bmdma_port_start (ap); +} +/** * ich_pata_cable_detect - Probe host controller cable detect info * @ap: Port for which cable detect info is desired
PATCH 79/262 rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <[email protected]>
commit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream.
Renato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7 "rtnetlink: handle rtnl_link netlink notifications manually" was merged we no longer send a netlink message when a networking device is moved from one network namespace to another.
Fix this by adding the missing manual notification in dev_change_net_namespaces.
Since all network devices that are processed by dev_change_net_namspaces are in the initialized state the complicated tests that guard the manual rtmsg_ifinfo calls in rollback_registered and register_netdevice are unnecessary and we can just perform a plain notification.
--- net/core/dev.c | 1 + 1 file changed, 1 insertion(+)
net/core/dev.c +1 -0
@@ -6105,6 +6105,7 @@ int dev_change_net_namespace(struct net_*/ call_netdevice_notifiers (NETDEV_UNREGISTER , dev);call_netdevice_notifiers (NETDEV_UNREGISTER_BATCH , dev); +rtmsg_ifinfo (RTM_DELLINK , dev, ~0U );/* * Flush the unicast and multicast chains
PATCH 80/262 dp83640: free packet queues on remove
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <[email protected]>
commit 8b3408f8ee994973869d8ba32c5bf482bc4ddca4 upstream.
If the PHY should disappear (for example, on an USB Ethernet MAC), then the driver would leak any undelivered time stamp packets. This commit fixes the issue by calling the appropriate functions to free any packets left in the transmit and receive queues.
The driver first appeared in v3.0.
--- drivers/net/phy/dp83640.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/phy/dp83640.c +7 -0
@@ -875,6 +875,7 @@ static void dp83640_remove(struct phy_destruct dp83640_clock *clock;struct list_head *this, *next;struct dp83640_private *tmp, *dp83640 = phydev->priv; +struct sk_buff *skb;if (phydev->addr ==BROADCAST_ADDR )return ;
@@ -882,6 +883,12 @@ static void dp83640_remove(struct phy_deenable_status_frames (phydev, false);cancel_work_sync (&dp83640->ts_work); +while ((skb =skb_dequeue (&dp83640->rx_queue)) !=NULL ) +kfree_skb (skb); + +while ((skb =skb_dequeue (&dp83640->tx_queue)) !=NULL ) +skb_complete_tx_timestamp (skb,NULL ); + clock =dp83640_clock_get (dp83640->clock);if (dp83640 == clock->chosen) {
PATCH 81/262 mac80211: fix offchannel TX cookie matching
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 28a1bcdb57d50f3038a255741ecc83e391e5282e upstream.
When I introduced in-kernel off-channel TX I introduced a bug -- the work can't be canceled again because the code clear the skb pointer. Fix this by keeping track separately of whether TX status has already been reported.
--- net/mac80211/cfg.c | 2 +- net/mac80211/ieee80211_i.h | 1 + net/mac80211/status.c | 2 +- net/mac80211/work.c | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-)
net/mac80211/cfg.c +1 -1
@@ -1798,7 +1798,7 @@ ieee80211_offchan_tx_done(struct ieee802* so in that case userspace will have to deal with it. */ -if (wk->offchan_tx.wait && wk->offchan_tx.frame) +if (wk->offchan_tx.wait && !wk->offchan_tx.status)cfg80211_mgmt_tx_status (wk->sdata->dev, (unsigned long ) wk->offchan_tx.frame, wk->ie, wk->ie_len, false,GFP_KERNEL );
net/mac80211/ieee80211_i.h +1 -0
@@ -328,6 +328,7 @@ struct ieee80211_work {struct {struct sk_buff *frame;u32 wait; +bool status; } offchan_tx; };
net/mac80211/status.c +1 -1
@@ -336,7 +336,7 @@ void ieee80211_tx_status(struct ieee8021continue ;if (wk->offchan_tx.frame != skb)continue ; - wk->offchan_tx.frame =NULL ; + wk->offchan_tx.status = true;break ; }rcu_read_unlock ();
net/mac80211/work.c +1 -1
@@ -553,7 +553,7 @@ ieee80211_offchannel_tx(struct ieee80211/* * After this, offchan_tx.frame remains but now is no * longer a valid pointer -- we still need it as the -* cookie for canceling this work. +* cookie for canceling this work/status matching. */ ieee80211_tx_skb (wk->sdata, wk->offchan_tx.frame);
PATCH 82/262 net: hold sock reference while processing tx timestamps
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <[email protected]>
commit da92b194cc36b5dc1fbd85206aeeffd80bee0c39 upstream.
The pair of functions,
* skb_clone_tx_timestamp()
* skb_complete_tx_timestamp()
were designed to allow timestamping in PHY devices. The first function, called during the MAC driver's hard_xmit method, identifies PTP protocol packets, clones them, and gives them to the PHY device driver. The PHY driver may hold onto the packet and deliver it at a later time using the second function, which adds the packet to the socket's error queue.
As pointed out by Johannes, nothing prevents the socket from disappearing while the cloned packet is sitting in the PHY driver awaiting a timestamp. This patch fixes the issue by taking a reference on the socket for each such packet. In addition, the comments regarding the usage of these function are expanded to highlight the rule that PHY drivers must use skb_complete_tx_timestamp() to release the packet, in order to release the socket reference, too.
These functions first appeared in v2.6.36.
--- include/linux/phy.h | 2 +- include/linux/skbuff.h | 7 ++++++- net/core/timestamping.c | 12 ++++++++++-- 3 files changed, 17 insertions(+), 4 deletions(-)
include/linux/phy.h +1 -1
@@ -418,7 +418,7 @@ struct phy_driver {/* * Requests a Tx timestamp for 'skb'. The phy driver promises -* to deliver it to the socket's error queue as soon as a +* to deliver it using skb_complete_tx_timestamp() as soon as a * timestamp becomes available. One of the PTP_CLASS_ values * is passed in 'type'. */
include/linux/skbuff.h +6 -1
@@ -1996,8 +1996,13 @@ static inline bool skb_defer_rx_timestam/** * skb_complete_tx_timestamp() - deliver cloned skb with tx timestamps * +* PHY drivers may accept clones of transmitted packets for +* timestamping via their phy_driver.txtstamp method. These drivers +* must call this function to return the skb back to the stack, with +* or without a timestamp. +* * @skb: clone of the the original outgoing packet -* @hwtstamps: hardware time stamps +* @hwtstamps: hardware time stamps, may be NULL if not available * */ void skb_complete_tx_timestamp(struct sk_buff *skb,
net/core/timestamping.c +10 -2
@@ -57,9 +57,13 @@ void skb_clone_tx_timestamp(struct sk_bucase PTP_CLASS_V2_VLAN : phydev = skb->dev->phydev;if (likely (phydev->drv->txtstamp)) { +if (!atomic_inc_not_zero (&sk->sk_refcnt)) +return ; clone =skb_clone (skb,GFP_ATOMIC ); -if (!clone) +if (!clone) { +sock_put (sk);return ; + } clone->sk = sk; phydev->drv->txtstamp (phydev, clone, type); }
@@ -76,8 +80,11 @@ void skb_complete_tx_timestamp(struct skstruct sock_exterr_skb *serr;int err; -if (!hwtstamps) +if (!hwtstamps) { +sock_put (sk); +kfree_skb (skb);return ; + } *skb_hwtstamps (skb) = *hwtstamps; serr =SKB_EXT_ERR (skb);
@@ -86,6 +93,7 @@ void skb_complete_tx_timestamp(struct sk serr->ee.ee_origin =SO_EE_ORIGIN_TIMESTAMPING ; skb->sk =NULL ; err =sock_queue_err_skb (sk, skb); +sock_put (sk);if (err)kfree_skb (skb); }
PATCH 83/262 wl12xx: fix forced passive scans
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luciano Coelho <[email protected]>
commit 6cd9d21a0c1e2648c07c32c66bb25795ad3208aa upstream.
We were using incorrect max and min dwell times during forced passive scans because we were still using the active scan states to scan (passively) the channels that were not marked as passive.
Instead of doing passive scans in active states, we now skip active states and scan for all channels in passive states.
--- drivers/net/wireless/wl12xx/scan.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/wireless/wl12xx/scan.c +13 -6
@@ -83,14 +83,18 @@ static int wl1271_get_scan_channels(strufor (i =0 , j =0 ; i < req->n_channels && j <WL1271_SCAN_MAX_CHANNELS ; i++) { - flags = req->channels[i]->flags;if (!test_bit (i, wl->scan.scanned_ch) && !(flags &IEEE80211_CHAN_DISABLED ) && - ((!!(flags &IEEE80211_CHAN_PASSIVE_SCAN )) == passive) && - (req->channels[i]->band == band)) { - + (req->channels[i]->band == band) && +/* +* In passive scans, we scan all remaining +* channels, even if not marked as such. +* In active scans, we only scan channels not +* marked as passive. +*/ + (passive || !(flags &IEEE80211_CHAN_PASSIVE_SCAN ))) {wl1271_debug (DEBUG_SCAN ,"band %d, center_freq %d " , req->channels[i]->band, req->channels[i]->center_freq);
@@ -142,6 +146,10 @@ static int wl1271_scan_send(struct wl127int ret;u16 scan_options =0 ; +/* skip active scans if we don't have SSIDs */ +if (!passive && wl->scan.req->n_ssids ==0 ) +return WL1271_NOTHING_TO_SCAN ; + cmd =kzalloc (sizeof (*cmd),GFP_KERNEL ); trigger =kzalloc (sizeof (*trigger),GFP_KERNEL );if (!cmd || !trigger) {
@@ -152,8 +160,7 @@ static int wl1271_scan_send(struct wl127/* We always use high priority scans */ scan_options =WL1271_SCAN_OPT_PRIORITY_HIGH ; -/* No SSIDs means that we have a forced passive scan */ -if (passive || wl->scan.req->n_ssids ==0 ) +if (passive) scan_options |=WL1271_SCAN_OPT_PASSIVE ; cmd->params.scan_options =cpu_to_le16 (scan_options);
PATCH 84/262 time: Change jiffies_to_clock_t() argument type to unsigned long
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: hank <[email protected]>
commit cbbc719fccdb8cbd87350a05c0d33167c9b79365 upstream.
The parameter's origin type is long. On an i386 architecture, it can easily be larger than 0x80000000, causing this function to convert it to a sign-extended u64 type.
Change the type to unsigned long so we get the correct result.
--- include/linux/jiffies.h | 2 +- kernel/time.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/jiffies.h +1 -1
@@ -303,7 +303,7 @@ extern void jiffies_to_timespec(const unextern unsigned long timeval_to_jiffies (const struct timeval *value);extern void jiffies_to_timeval (const unsigned long jiffies,struct timeval *value); -extern clock_t jiffies_to_clock_t (long x); +extern clock_t jiffies_to_clock_t (unsigned long x);extern unsigned long clock_t_to_jiffies (unsigned long x);extern u64 jiffies_64_to_clock_t (u64 x);extern u64 nsec_to_clock_t (u64 x);
kernel/time.c +1 -1
@@ -575,7 +575,7 @@ EXPORT_SYMBOL(jiffies_to_timeval);/* * Convert jiffies/jiffies_64 to clock_t and back. */ -clock_t jiffies_to_clock_t (long x) +clock_t jiffies_to_clock_t (unsigned long x) {#if (TICK_NSEC % (NSEC_PER_SEC /USER_HZ )) ==0 # if HZ <USER_HZ
PATCH 85/262 apic, i386/bigsmp: Fix false warnings regarding logical APIC ID mismatches
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
commit 838312be46f3abfbdc175f81c3e54a857994476d upstream.
These warnings (generally one per CPU) are a result of initializing x86_cpu_to_logical_apicid while apic_default is still in use, but the check in setup_local_APIC() being done when apic_bigsmp was already used as an override in default_setup_apic_routing():
Overriding APIC driver with bigsmp Enabling APIC mode: Physflat. Using 5 I/O APICs
------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 ... CPU 1 irqstacks, hard=f1c9a000 soft=f1c9c000 Booting Node 0, Processors #1 smpboot cpu 1: start_ip = 9e000 Initializing CPU#1 ------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 setup_local_APIC+0x137/0x46b() Hardware name: ... CPU1 logical APIC ID: 2 != 8 ...
Fix this (for the time being, i.e. until x86_32_early_logical_apicid() will get removed again, as Tejun says ought to be possible) by overriding the previously stored values at the point where the APIC driver gets overridden.
v2: Move this and the pre-existing override logic into
arch/x86/kernel/apic/bigsmp_32.c.
--- arch/x86/include/asm/apic.h | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 20 ++++++++++++++++---- arch/x86/kernel/apic/probe_32.c | 10 ++-------- 3 files changed, 19 insertions(+), 13 deletions(-)
arch/x86/include/asm/apic.h +1 -1
@@ -495,7 +495,7 @@ static inline void default_wait_for_initreturn ; } -extern struct apic *generic_bigsmp_probe (void ); +extern void generic_bigsmp_probe (void );#ifdef CONFIG_X86_LOCAL_APIC
arch/x86/kernel/apic/bigsmp_32.c +16 -4
@@ -255,12 +255,24 @@ static struct apic apic_bigsmp = { .x86_32_early_logical_apicid = bigsmp_early_logical_apicid, }; -struct apic *__init generic_bigsmp_probe (void ) +void __init generic_bigsmp_probe (void ) { -if (probe_bigsmp ()) -return &apic_bigsmp; +unsigned int cpu; -return NULL ; +if (!probe_bigsmp ()) +return ; + + apic = &apic_bigsmp; + +for_each_possible_cpu (cpu) { +if (early_per_cpu (x86_cpu_to_logical_apicid, + cpu) ==BAD_APICID ) +continue ; +early_per_cpu (x86_cpu_to_logical_apicid, cpu) = +bigsmp_early_logical_apicid (cpu); + } + +pr_info ("Overriding APIC driver with %s\n" , apic_bigsmp.name); }apic_driver (apic_bigsmp);
arch/x86/kernel/apic/probe_32.c +2 -8
@@ -200,14 +200,8 @@ void __init default_setup_apic_routing(v* - we find more than 8 CPUs in acpi LAPIC listing with xAPIC support */ -if (!cmdline_apic && apic == &apic_default) { -struct apic *bigsmp =generic_bigsmp_probe (); -if (bigsmp) { - apic = bigsmp; -printk (KERN_INFO "Overriding APIC driver with %s\n" , - apic->name); - } - } +if (!cmdline_apic && apic == &apic_default) +generic_bigsmp_probe ();#endif if (apic->setup_apic_routing)
PATCH 86/262 md/raid5: fix bug that could result in reads from a failed device.
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 355840e7a7e56bb2834fd3b0da64da5465f8aeaa upstream.
This bug was introduced in 415e72d034c50520ddb7ff79e7d1792c1306f0c9 which was in 2.6.36.
There is a small window of time between when a device fails and when it is removed from the array. During this time we might still read from it, but we won't write to it - so it is possible that we could read stale data.
We didn't need the test of 'Faulty' before because the test on In_sync is sufficient. Since we started allowing reads from the early part of non-In_sync devices we need a test on Faulty too.
This is suitable for any kernel from 2.6.36 onwards, though the patch might need a bit of tweaking in 3.0 and earlier.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -3369,7 +3369,7 @@ static void handle_stripe6(struct stripe/* Not in-sync */ ; else if (test_bit(In_sync, &rdev->flags)) set_bit(R5_Insync, &dev->flags); - else { + else if (!test_bit(Faulty, &rdev->flags)) {/* in sync if before recovery_offset */ if (sh->sector +STRIPE_SECTORS <= rdev->recovery_offset)set_bit (R5_Insync, &dev->flags);
PATCH 87/262 perf probe: Fix to show correct error string
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
commit 44a56040a0037a845d5fa218dffde464579f0cab upstream.
Fix perf probe to show correct error string when it fails to delete an event. The write(2) returns -1 if failed, and errno stores real error number.
--- tools/perf/util/probe-event.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/probe-event.c +3 -1
@@ -1869,8 +1869,10 @@ static int __del_trace_probe_event(int fpr_debug ("Writing event: %s\n" , buf); ret =write (fd, buf,strlen (buf)); -if (ret <0 ) +if (ret <0 ) { + ret = -errno; goto error; + }printf ("Remove event: %s\n" , ent->s);return 0 ;
PATCH 88/262 tracing: Fix returning of duplicate data after EOF in trace_pipe_raw
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 436fc280261dcfce5af38f08b89287750dc91cd2 upstream.
The trace_pipe_raw handler holds a cached page from the time the file is opened to the time it is closed. The cached page is used to handle the case of the user space buffer being smaller than what was read from the ring buffer. The left over buffer is held in the cache so that the next read will continue where the data left off.
After EOF is returned (no more data in the buffer), the index of the cached page is set to zero. If a user app reads the page again after EOF, the check in the buffer will see that the cached page is less than page size and will return the cached page again. This will cause reading the trace_pipe_raw again after EOF to return duplicate data, making the output look like the time went backwards but instead data is just repeated.
The fix is to not reset the index right after all data is read from the cache, but to reset it after all data is read and more data exists in the ring buffer.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -3704,8 +3704,6 @@ tracing_buffers_read(struct file *filp,if (info->read <PAGE_SIZE ) goto read; - info->read =0 ; -trace_access_lock (info->cpu); ret = ring_buffer_read_page(info->tr->buffer, &info->spare,
@@ -3715,6 +3713,8 @@ tracing_buffers_read(struct file *filp,if (ret <0 )return 0 ; + info->read =0 ; + read: size =PAGE_SIZE - info->read;if (size > count)
PATCH 89/262 genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Campbell <[email protected]>
commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream.
This adds a mechanism to resume selected IRQs during syscore_resume instead of dpm_resume_noirq.
Under Xen we need to resume IRQs associated with IPIs early enough that the resched IPI is unmasked and we can therefore schedule ourselves out of the stop_machine where the suspend/resume takes place.
This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME".
--- drivers/xen/events.c | 2 - include/linux/interrupt.h | 3 ++ kernel/irq/pm.c | 48 +++++++++++++++++++++++++++++++++++++++------- 3 files changed, 45 insertions(+), 8 deletions(-)
drivers/xen/events.c +1 -1
@@ -1026,7 +1026,7 @@ int bind_ipi_to_irqhandler(enum ipi_vectif (irq <0 )return irq; - irqflags |=IRQF_NO_SUSPEND |IRQF_FORCE_RESUME ; + irqflags |=IRQF_NO_SUSPEND |IRQF_FORCE_RESUME |IRQF_EARLY_RESUME ; retval =request_irq (irq, handler, irqflags, devname, dev_id);if (retval !=0 ) {unbind_from_irq (irq);
include/linux/interrupt.h +3 -0
@@ -59,6 +59,8 @@* IRQF_NO_SUSPEND - Do not disable this IRQ during suspend * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set * IRQF_NO_THREAD - Interrupt cannot be threaded +* IRQF_EARLY_RESUME - Resume IRQ early during syscore instead of at device +* resume time. */ #define IRQF_DISABLED 0x00000020#define IRQF_SAMPLE_RANDOM 0x00000040
@@ -72,6 +74,7 @@#define IRQF_NO_SUSPEND 0x00004000#define IRQF_FORCE_RESUME 0x00008000#define IRQF_NO_THREAD 0x00010000 +#define IRQF_EARLY_RESUME 0x00020000#define IRQF_TIMER (__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)
kernel/irq/pm.c +41 -7
72 lines not on this page · raw message
PATCH 90/262 nfs: dont try to migrate pages with active requests
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 2da956523526e440ef4f4dd174e26f5ac06fe011 upstream.
nfs_find_and_lock_request will take a reference to the nfs_page and will then put it if the req is already locked. It's possible though that the reference will be the last one. That put then can kick off a whole series of reference puts:
nfs_page
nfs_open_context
dentry
inode
If the inode ends up being deleted, then the VFS will call truncate_inode_pages. That function will try to take the page lock, but it was already locked when migrate_page was called. The code deadlocks.
Fix this by simply refusing the migration request if PagePrivate is already set, indicating that the page is already associated with an active read or write request.
We've had a customer test a backported version of this patch and the preliminary results seem good.
--- fs/nfs/write.c | 36 +++++++++++------------------------- 1 file changed, 11 insertions(+), 25 deletions(-)
fs/nfs/write.c +11 -25
@@ -1664,34 +1664,20 @@ out_error:int nfs_migrate_page (struct address_space *mapping,struct page *newpage,struct page *page) { -struct nfs_page *req; -int ret; +/* +* If PagePrivate is set, then the page is currently associated with +* an in-progress read or write request. Don't try to migrate it. +* +* FIXME: we could do this in principle, but we'll need a way to ensure +* that we can safely release the inode reference while holding +* the page lock. +*/ +if (PagePrivate (page)) +return -EBUSY ;nfs_fscache_release_page (page,GFP_KERNEL ); - req =nfs_find_and_lock_request (page, false); - ret =PTR_ERR (req); -if (IS_ERR (req)) - goto out; - - ret =migrate_page (mapping, newpage, page); -if (!req) - goto out; -if (ret) - goto out_unlock; -page_cache_get (newpage); -spin_lock (&mapping->host->i_lock); - req->wb_page = newpage; -SetPagePrivate (newpage); -set_page_private (newpage, (unsigned long )req); -ClearPagePrivate (page); -set_page_private (page,0 ); -spin_unlock (&mapping->host->i_lock); -page_cache_release (page); -out_unlock: -nfs_clear_page_tag_locked (req); -out: -return ret; +return migrate_page (mapping, newpage, page); }#endif
PATCH 91/262 nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernd Schubert <[email protected]>
commit 832023bffb4b493f230be901f681020caf3ed1f8 upstream.
Fan Yong <[email protected]> noticed setting FMODE_32bithash wouldn't work with nfsd v4, as nfsd4_readdir() checks for 32 bit cookies. However, according to RFC 3530 cookies have a 64 bit type and cookies are also defined as u64 in 'struct nfsd4_readdir'. So remove the test for >32-bit values.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -682,7 +682,7 @@ nfsd4_readdir(struct svc_rqst *rqstp, st readdir->rd_bmval[1 ] &=nfsd_suppattrs1 (cstate->minorversion); readdir->rd_bmval[2 ] &=nfsd_suppattrs2 (cstate->minorversion); -if ((cookie > ~(u32 )0 ) || (cookie ==1 ) || (cookie ==2 ) || +if ((cookie ==1 ) || (cookie ==2 ) || (cookie ==0 &&memcmp (readdir->rd_verf.data, zeroverf.data,NFS4_VERIFIER_SIZE )))return nfserr_bad_cookie;
PATCH 92/262 nfsd4: stop using nfserr_resource for transitory errors
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 3e77246393c0a433247631a1f0e9ec98d3d78a1c upstream.
The server is returning nfserr_resource for both permanent errors and for errors (like allocation failures) that might be resolved by retrying later. Save nfserr_resource for the former and use delay/jukebox for the latter.
--- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 2 +- fs/nfsd/nfs4state.c | 14 +++++++------- 3 files changed, 9 insertions(+), 9 deletions(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -921,7 +921,7 @@ _nfsd4_verify(struct svc_rqst *rqstp, st count =4 + (verify->ve_attrlen >>2 ); buf =kmalloc (count <<2 ,GFP_KERNEL );if (!buf) -return nfserr_resource; +return nfserr_jukebox; status = nfsd4_encode_fattr(&cstate->current_fh, cstate->current_fh.fh_export,
fs/nfsd/nfs4recover.c +1 -1
@@ -88,7 +88,7 @@ nfs4_make_rec_clidname(char *dname, strustruct xdr_netobj cksum;struct hash_desc desc;struct scatterlist sg; -__be32 status = nfserr_resource; +__be32 status = nfserr_jukebox;dprintk ("NFSD: nfs4_make_rec_clidname for %.*s\n" , clname->len, clname->data);
fs/nfsd/nfs4state.c +7 -7
@@ -1903,7 +1903,7 @@ nfsd4_setclientid(struct svc_rqst *rqstp* of 5 bullet points, labeled as CASE0 - CASE4 below. */ unconf =find_unconfirmed_client_by_str (dname, strhashval); - status = nfserr_resource; + status = nfserr_jukebox;if (!conf) {/* * RFC 3530 14.2.33 CASE 4:
@@ -2440,7 +2440,7 @@ renew:if (open->op_stateowner ==NULL ) { sop =alloc_init_open_stateowner (strhashval, clp, open);if (sop ==NULL ) -return nfserr_resource; +return nfserr_jukebox; open->op_stateowner = sop; }list_del_init (&sop->so_close_lru);
@@ -2576,7 +2576,7 @@ nfs4_new_open(struct svc_rqst *rqstp, st stp =nfs4_alloc_stateid ();if (stp ==NULL ) -return nfserr_resource; +return nfserr_jukebox; status =nfs4_get_vfs_file (rqstp, fp, cur_fh, open);if (status) {
@@ -2807,7 +2807,7 @@ nfsd4_process_open2(struct svc_rqst *rqs status = nfserr_bad_stateid;if (open->op_claim_type ==NFS4_OPEN_CLAIM_DELEGATE_CUR ) goto out; - status = nfserr_resource; + status = nfserr_jukebox; fp =alloc_init_file (ino);if (fp ==NULL ) goto out;
@@ -3840,7 +3840,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc/* XXX: Do we need to check for duplicate stateowners on * the same file, or should they just be allowed (and * create new stateids)? */ - status = nfserr_resource; + status = nfserr_jukebox; lock_sop =alloc_init_lock_stateowner (strhashval, open_sop->so_client, open_stp, lock);if (lock_sop ==NULL )
@@ -3924,9 +3924,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struccase (EDEADLK ): status = nfserr_deadlock;break ; -default : +default :dprintk ("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n" ,err); - status = nfserr_resource; + status =nfserrno (err);break ; } out:
PATCH 93/262 nfsd4: fix seqid_mutating_error
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 576163005de286bbd418fcb99cfd0971523a0c6d upstream.
The set of errors here does *not* agree with the set of errors specified in the rfc!
While we're there, turn this macros into a function, for the usual reasons, and move it to the one place where it's actually used.
--- fs/nfsd/nfs4xdr.c | 12 ++++++++++++ fs/nfsd/state.h | 6 ------ 2 files changed, 12 insertions(+), 6 deletions(-)
fs/nfsd/nfs4xdr.c +12 -0
@@ -1548,6 +1548,18 @@ static void write_cinfo(__be32 **p, stru \ save = resp->p; +static bool seqid_mutating_err (__be32 err) +{ +/* rfc 3530 section 8.1.5: */ +return err != nfserr_stale_clientid && + err != nfserr_stale_stateid && + err != nfserr_bad_stateid && + err != nfserr_bad_seqid && + err != nfserr_bad_xdr && + err != nfserr_resource && + err != nfserr_nofilehandle; +} +/* * Routine for encoding the result of a "seqid-mutating" NFSv4 operation. This * is where sequence id's are incremented, and the replay cache is filled.
fs/nfsd/state.h +0 -6
@@ -447,12 +447,6 @@ struct nfs4_stateid {#define WR_STATE 0x00000020#define CLOSE_STATE 0x00000040 -#define seqid_mutating_err (err) \ - (((err) != nfserr_stale_clientid) && \ - ((err) != nfserr_bad_seqid) && \ - ((err) != nfserr_stale_stateid) && \ - ((err) != nfserr_bad_stateid)) -struct nfsd4_compound_state ; extern __be32 nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
PATCH 94/262 nfsd4: permit read opens of executable-only files
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit a043226bc140a2c1dde162246d68a67e5043e6b2 upstream.
A client that wants to execute a file must be able to read it. Read opens over nfs are therefore implicitly allowed for executable files even when those files are not readable.
NFSv2/v3 get this right by using a passed-in NFSD_MAY_OWNER_OVERRIDE on read requests, but NFSv4 has gotten this wrong ever since dc730e173785e29b297aa605786c94adaffe2544 "nfsd4: fix owner-override on open", when we realized that the file owner shouldn't override permissions on non-reclaim NFSv4 opens.
So we can't use NFSD_MAY_OWNER_OVERRIDE to tell nfsd_permission to allow reads of executable files.
So, do the same thing we do whenever we encounter another weird NFS permission nit: define yet another NFSD_MAY_* flag.
The industry's future standardization on 128-bit processors will be motivated primarily by the need for integers with enough bits for all the NFSD_MAY_* flags.
--- fs/nfsd/nfs4proc.c | 2 ++ fs/nfsd/vfs.c | 3 ++- fs/nfsd/vfs.h | 1 + 3 files changed, 5 insertions(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +2 -0
@@ -156,6 +156,8 @@ do_open_permission(struct svc_rqst *rqst !(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))return nfserr_inval; + accmode |=NFSD_MAY_READ_IF_EXEC ; +if (open->op_share_access &NFS4_SHARE_ACCESS_READ ) accmode |=NFSD_MAY_READ ;if (open->op_share_access &NFS4_SHARE_ACCESS_WRITE )
fs/nfsd/vfs.c +2 -1
@@ -2114,7 +2114,8 @@ nfsd_permission(struct svc_rqst *rqstp,/* Allow read access to binaries even when mode 111 */ if (err == -EACCES &&S_ISREG (inode->i_mode) && - acc == (NFSD_MAY_READ |NFSD_MAY_OWNER_OVERRIDE )) + (acc == (NFSD_MAY_READ |NFSD_MAY_OWNER_OVERRIDE ) || + acc == (NFSD_MAY_READ |NFSD_MAY_READ_IF_EXEC ))) err =inode_permission (inode,MAY_EXEC );return err?nfserrno (err) :0 ;
fs/nfsd/vfs.h +1 -0
@@ -25,6 +25,7 @@#define NFSD_MAY_BYPASS_GSS_ON_ROOT 256#define NFSD_MAY_NOT_BREAK_LEASE 512#define NFSD_MAY_BYPASS_GSS 1024 +#define NFSD_MAY_READ_IF_EXEC 2048#define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE)#define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC)
PATCH 95/262 nfsd4: fix open downgrade, again
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 3d02fa29dec920c597dd7b7db608a4bc71f088ce upstream.
Yet another open-management regression:
- nfs4_file_downgrade() doesn't remove the BOTH access bit on downgrade, so the server's idea of the stateid's access gets out of sync with the client's. If we want to keep an O_RDWR open in this case, we should do that in the file_put_access logic rather than here.
- We forgot to convert v4 access to an open mode here.
This logic has proven too hard to get right. In the future we may consider:
- reexamining the lock/openowner relationship (locks probably don't really need to take their own references here).
- adding open upgrade/downgrade support to the vfs.
- removing the atomic operations. They're redundant as long as this is all under some other lock.
Also, maybe some kind of additional static checking would help catch O_/NFS4_SHARE_ACCESS confusion.
--- fs/nfsd/nfs4state.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/nfsd/nfs4state.c +11 -3
@@ -188,8 +188,15 @@ static void nfs4_file_put_fd(struct nfs4static void __nfs4_file_put_access (struct nfs4_file *fp,int oflag) {if (atomic_dec_and_test (&fp->fi_access[oflag])) { -nfs4_file_put_fd (fp,O_RDWR );nfs4_file_put_fd (fp, oflag); +/* +* It's also safe to get rid of the RDWR open *if* +* we no longer have need of the other kind of access +* or if we already have the other kind of open: +*/ +if (fp->fi_fds[1 -oflag] + ||atomic_read (&fp->fi_access[1 - oflag]) ==0 ) +nfs4_file_put_fd (fp,O_RDWR ); } }
@@ -3381,8 +3388,9 @@ static inline void nfs4_file_downgrade(sint i;for (i =1 ; i <4 ; i++) { -if (test_bit (i, &stp->st_access_bmap) && !(i & to_access)) { -nfs4_file_put_access (stp->st_file, i); +if (test_bit (i, &stp->st_access_bmap) + && ((i & to_access) != i)) { +nfs4_file_put_access (stp->st_file,nfs4_access_to_omode (i));__clear_bit (i, &stp->st_access_bmap); } }
PATCH 96/262 nfsd4: ignore WANT bits in open downgrade
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit c30e92df30d7d5fe65262fbce5d1b7de675fe34e upstream.
We don't use WANT bits yet--and sending them can probably trigger a BUG() further down.
--- fs/nfsd/nfs4state.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfsd/nfs4state.c +2 -0
@@ -3421,6 +3421,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqif (!access_valid (od->od_share_access, cstate->minorversion) || !deny_valid (od->od_share_deny))return nfserr_inval; +/* We don't yet support WANT bits: */ + od->od_share_access &=NFS4_SHARE_ACCESS_MASK ;nfs4_lock_state (); if ((status = nfs4_preprocess_seqid_op(cstate,
PATCH 97/262 hppfs: missing include
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit d6b722aa383a467a43d09ee38e866981abba08ab upstream.
--- fs/hppfs/hppfs.c | 1 + 1 file changed, 1 insertion(+)
fs/hppfs/hppfs.c +1 -0
@@ -16,6 +16,7 @@#include <linux/statfs.h> #include <linux/types.h> #include <linux/pid_namespace.h> +#include <linux/namei.h> #include <asm/uaccess.h> #include "os.h"
PATCH 98/262 vfs: add "device" tag to /proc/self/mountstats
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan Schumaker <[email protected]>
commit a877ee03ac010ded434b77f7831f43cbb1fcc60f upstream.
nfsiostat was failing to find mounted filesystems on kernels after 2.6.38 because of changes to show_vfsstat() by commit c7f404b40a3665d9f4e9a927cc5c1ee0479ed8f9. This patch adds back the "device" tag before the nfs server entry so scripts can parse the mountstats file correctly.
--- fs/namespace.c | 1 + 1 file changed, 1 insertion(+)
fs/namespace.c +1 -0
@@ -1109,6 +1109,7 @@ static int show_vfsstat(struct seq_file/* device */ if (mnt->mnt_sb->s_op->show_devname) { +seq_puts (m,"device " ); err = mnt->mnt_sb->s_op->show_devname (m, mnt); }else {if (mnt->mnt_devname) {
PATCH 99/262 io-mapping: ensure io_mapping_map_atomic _is_ atomic
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit 24dd85ff723f142093f44244764b9b5c152235b8 upstream.
For the !HAVE_ATOMIC_IOMAP case the stub functions did not call pagefault_disable/_enable. The i915 driver relies on the map actually being atomic, otherwise it can deadlock with it's own pagefault handler in the gtt pwrite fastpath.
This is exercised by gem_mmap_gtt from the intel-gpu-toosl gem testsuite.
v2: Chris Wilson noted the lack of an include.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38115
--- include/linux/io-mapping.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/io-mapping.h +4 -0
@@ -117,6 +117,8 @@ io_mapping_unmap(void __iomem *vaddr)#else +#include <linux/uaccess.h> +/* this struct isn't actually defined anywhere */ struct io_mapping ;
@@ -138,12 +140,14 @@ static inline void __iomem * io_mapping_map_atomic_wc(struct io_mapping *mapping, unsigned long offset) { +pagefault_disable ();return ((char __force __iomem *) mapping) + offset; }static inline void io_mapping_unmap_atomic (void __iomem *vaddr) { +pagefault_enable (); }/* Non-atomic map/unmap */
PATCH 100/262 ASoC: wm8940: Properly set codec->dapm.bias_level
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream.
--- sound/soc/codecs/wm8940.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/wm8940.c +2 -0
@@ -472,6 +472,8 @@ static int wm8940_set_bias_level(structbreak ; } + codec->dapm.bias_level = level; +return ret; }
PATCH 101/262 ASoC: wm8741: Fix setting interface format for DSP modes
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 3a340104fad6ecbea5ad6792a2ea855f0507a6e0 upstream.
According to the datasheet:
Format Control (05h)
BITS[3:2]
FMT[1:0] Audio data format selection
00 = right justified mode
01 = left justified mode
10 = I2S mode
11 = DSP mode
BIT[4] LRP Polarity selec for LRCLK/DSP mode select
0 = normal LRCLK poalrity/DSP mode A 1 = inverted LRCLK poarity/DSP mode B
For SND_SOC_DAIFMT_DSP_A, we should set 0x000C instead of 0x0003. For SND_SOC_DAIFMT_DSP_B, we should set 0x001C instead of 0x0013.
--- sound/soc/codecs/wm8741.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/wm8741.c +2 -2
@@ -337,10 +337,10 @@ static int wm8741_set_dai_fmt(struct snd iface |=0x0004 ;break ;case SND_SOC_DAIFMT_DSP_A : - iface |=0x0003 ; + iface |=0x000C ;break ;case SND_SOC_DAIFMT_DSP_B : - iface |=0x0013 ; + iface |=0x001C ;break ;default :return -EINVAL ;
PATCH 102/262 ASoC: ak4642: fixup cache register table
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
commit 19b115e523208a926813751aac8934cf3fc6085e upstream.
ak4642 register was 8bit, but cache table was defined as 16bit. ak4642 doesn't work correctry without this patch.
--- sound/soc/codecs/ak4642.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
sound/soc/codecs/ak4642.c +11 -11
@@ -162,17 +162,17 @@ struct ak4642_priv {/* * ak4642 register cache */ -static const u16 ak4642_reg[AK4642_CACHEREGNUM ] = { -0x0000 ,0x0000 ,0x0001 ,0x0000 , -0x0002 ,0x0000 ,0x0000 ,0x0000 , -0x00e1 ,0x00e1 ,0x0018 ,0x0000 , -0x00e1 ,0x0018 ,0x0011 ,0x0008 , -0x0000 ,0x0000 ,0x0000 ,0x0000 , -0x0000 ,0x0000 ,0x0000 ,0x0000 , -0x0000 ,0x0000 ,0x0000 ,0x0000 , -0x0000 ,0x0000 ,0x0000 ,0x0000 , -0x0000 ,0x0000 ,0x0000 ,0x0000 , -0x0000 , +static const u8 ak4642_reg[AK4642_CACHEREGNUM ] = { +0x00 ,0x00 ,0x01 ,0x00 , +0x02 ,0x00 ,0x00 ,0x00 , +0xe1 ,0xe1 ,0x18 ,0x00 , +0xe1 ,0x18 ,0x11 ,0x08 , +0x00 ,0x00 ,0x00 ,0x00 , +0x00 ,0x00 ,0x00 ,0x00 , +0x00 ,0x00 ,0x00 ,0x00 , +0x00 ,0x00 ,0x00 ,0x00 , +0x00 ,0x00 ,0x00 ,0x00 , +0x00 , };/*
PATCH 103/262 ASoC: ak4535: fixup cache register table
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 7c04241acbdaf97f1448dcccd27ea0fcd1a57684 upstream.
ak4535_reg should be 8bit, but cache table is defined as 16bit.
--- sound/soc/codecs/ak4535.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/codecs/ak4535.c +5 -5
@@ -40,11 +40,11 @@ struct ak4535_priv {/* * ak4535 register cache */ -static const u16 ak4535_reg[AK4535_CACHEREGNUM ] = { -0x0000 ,0x0080 ,0x0000 ,0x0003 , -0x0002 ,0x0000 ,0x0011 ,0x0001 , -0x0000 ,0x0040 ,0x0036 ,0x0010 , -0x0000 ,0x0000 ,0x0057 ,0x0000 , +static const u8 ak4535_reg[AK4535_CACHEREGNUM ] = { +0x00 ,0x80 ,0x00 ,0x03 , +0x02 ,0x00 ,0x11 ,0x01 , +0x00 ,0x40 ,0x36 ,0x10 , +0x00 ,0x00 ,0x57 ,0x00 , };/*
PATCH 104/262 ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 35024f4922f7b271e7529673413889aa3d51c5fc upstream.
--- sound/soc/codecs/wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8994.c +1 -1
@@ -1266,7 +1266,7 @@ SND_SOC_DAPM_MUX("AIF2DAC Mux", SND_SOC_SND_SOC_DAPM_MUX ("AIF2ADC Mux" ,SND_SOC_NOPM ,0 ,0 , &aif2adc_mux),SND_SOC_DAPM_AIF_IN ("AIF3DACDAT" ,"AIF3 Playback" ,0 ,SND_SOC_NOPM ,0 ,0 ), -SND_SOC_DAPM_AIF_IN ("AIF3ADCDAT" ,"AIF3 Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ), +SND_SOC_DAPM_AIF_OUT ("AIF3ADCDAT" ,"AIF3 Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ), SND_SOC_DAPM_SUPPLY("TOCLK", WM8994_CLOCKING_1, 4, 0, NULL, 0),
PATCH 105/262 ASoC: Remove direct register cache accesses from WM8962 driver
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 38f3f31a0a797bdbcc0cdb12553bbecc2f9a91c4 upstream.
Also fix return values for speaker switch updates.
--- sound/soc/codecs/wm8962.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
sound/soc/codecs/wm8962.c +11 -10
@@ -2018,7 +2018,6 @@ static int wm8962_put_spk_sw(struct snd_ struct snd_ctl_elem_value *ucontrol) {struct snd_soc_codec *codec =snd_kcontrol_chip (kcontrol); -u16 *reg_cache = codec->reg_cache;int ret;/* Apply the update (if any) */
@@ -2027,16 +2026,19 @@ static int wm8962_put_spk_sw(struct snd_return 0 ;/* If the left PGA is enabled hit that VU bit... */ -if (reg_cache[WM8962_PWR_MGMT_2 ] &WM8962_SPKOUTL_PGA_ENA ) -return snd_soc_write (codec,WM8962_SPKOUTL_VOLUME , - reg_cache[WM8962_SPKOUTL_VOLUME ]); + ret =snd_soc_read (codec,WM8962_PWR_MGMT_2 ); +if (ret &WM8962_SPKOUTL_PGA_ENA ) { +snd_soc_write (codec,WM8962_SPKOUTL_VOLUME , +snd_soc_read (codec,WM8962_SPKOUTL_VOLUME )); +return 1 ; + }/* ...otherwise the right. The VU is stereo. */ -if (reg_cache[WM8962_PWR_MGMT_2 ] &WM8962_SPKOUTR_PGA_ENA ) -return snd_soc_write (codec,WM8962_SPKOUTR_VOLUME , - reg_cache[WM8962_SPKOUTR_VOLUME ]); +if (ret &WM8962_SPKOUTR_PGA_ENA ) +snd_soc_write (codec,WM8962_SPKOUTR_VOLUME , +snd_soc_read (codec,WM8962_SPKOUTR_VOLUME )); -return 0 ; +return 1 ; }static const char *cap_hpf_mode_text[] = {
@@ -2336,7 +2338,6 @@ static int out_pga_event(struct snd_soc_ struct snd_kcontrol *kcontrol, int event) {struct snd_soc_codec *codec = w->codec; -u16 *reg_cache = codec->reg_cache;int reg;switch (w->shift) {
@@ -2359,7 +2360,7 @@ static int out_pga_event(struct snd_soc_switch (event) {case SND_SOC_DAPM_POST_PMU : -return snd_soc_write (codec, reg, reg_cache[reg]); +return snd_soc_write (codec, reg,snd_soc_read (codec, reg));default :BUG ();return -EINVAL ;
PATCH 106/262 ASoC: Fix a bug in WM8962 DSP_A and DSP_B settings
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Susan Gao <[email protected]>
commit fbc7c62a3ff831aef24894b7982cd1adb2b7e070 upstream.
--- sound/soc/codecs/wm8962.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/wm8962.c +2 -2
@@ -3028,9 +3028,9 @@ static int wm8962_set_dai_fmt(struct sndint aif0 =0 ;switch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) { -case SND_SOC_DAIFMT_DSP_A : - aif0 |=WM8962_LRCLK_INV ;case SND_SOC_DAIFMT_DSP_B : + aif0 |=WM8962_LRCLK_INV |3 ; +case SND_SOC_DAIFMT_DSP_A : aif0 |=3 ;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {
PATCH 107/262 KVM: s390: check cpu_id prior to using it
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carsten Otte <[email protected]>
commit 4d47555a80495657161a7e71ec3014ff2021e450 upstream.
We use the cpu id provided by userspace as array index here. Thus we clearly need to check it first. Ooops.
--- arch/s390/kvm/kvm-s390.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
arch/s390/kvm/kvm-s390.c +10 -4
@@ -301,11 +301,17 @@ int kvm_arch_vcpu_setup(struct kvm_vcpustruct kvm_vcpu *kvm_arch_vcpu_create (struct kvm *kvm,unsigned int id) { -struct kvm_vcpu *vcpu =kzalloc (sizeof (struct kvm_vcpu ),GFP_KERNEL ); -int rc = -ENOMEM ; +struct kvm_vcpu *vcpu; +int rc = -EINVAL ; +if (id >=KVM_MAX_VCPUS ) + goto out; + + rc = -ENOMEM ; + + vcpu =kzalloc (sizeof (struct kvm_vcpu ),GFP_KERNEL );if (!vcpu) - goto out_nomem; + goto out; vcpu->arch.sie_block = (struct kvm_s390_sie_block *)get_zeroed_page (GFP_KERNEL );
@@ -341,7 +347,7 @@ out_free_sie_block:free_page ((unsigned long )(vcpu->arch.sie_block)); out_free_cpu:kfree (vcpu); -out_nomem: +out:return ERR_PTR (rc); }
PATCH 108/262 user per registers vs. ptrace single stepping
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit a45aff5285871bf7be1781d9462d3fdbb6c913f9 upstream.
git commit 5e9a2692 "[S390] ptrace cleanup" introduced a regression for the case when both a user PER set (e.g. a storage alteration trace) and PTRACE_SINGLESTEP are active. The new code will overrule the user PER set with a instruction-fetch PER set over the whole address space for ptrace single stepping. The inferior process will be stopped after each instruction with an instruction fetch event. Any other events that may have occurred concurrently are not reported (e.g. storage alteration event) because the control bits for them are not set. The solution is to merge the PER control bits of the user PER set with the PER_EVENT_IFETCH control bit for PTRACE_SINGLESTEP.
--- arch/s390/kernel/ptrace.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
arch/s390/kernel/ptrace.c +15 -13
@@ -47,29 +47,31 @@ enum s390_regset {void update_per_regs (struct task_struct *task) { -static const struct per_regs per_single_step = { - .control =PER_EVENT_IFETCH , - .start =0 , - .end =PSW_ADDR_INSN , - };struct pt_regs *regs =task_pt_regs (task);struct thread_struct *thread = &task->thread; -const struct per_regs *new; -struct per_regs old; +struct per_regs old, new; -/* TIF_SINGLE_STEP overrides the user specified PER registers. */ - new =test_tsk_thread_flag (task,TIF_SINGLE_STEP ) ? - &per_single_step : &thread->per_user; +/* Copy user specified PER registers */ + new.control = thread->per_user.control; + new.start = thread->per_user.start; + new.end = thread->per_user.end; + +/* merge TIF_SINGLE_STEP into user specified PER registers. */ +if (test_tsk_thread_flag (task,TIF_SINGLE_STEP )) { + new.control |=PER_EVENT_IFETCH ; + new.start =0 ; + new.end =PSW_ADDR_INSN ; + }/* Take care of the PER enablement bit in the PSW. */ -if (!(new->control &PER_EVENT_MASK )) { +if (!(new.control &PER_EVENT_MASK )) { regs->psw.mask &= ~PSW_MASK_PER ;return ; } regs->psw.mask |=PSW_MASK_PER ;__ctl_store (old,9 ,11 ); -if (memcmp (new, &old,sizeof (struct per_regs )) !=0 ) -__ctl_load (*new,9 ,11 ); +if (memcmp (&new, &old,sizeof (struct per_regs )) !=0 ) +__ctl_load (new,9 ,11 ); }void user_enable_single_step (struct task_struct *task)
PATCH 109/262 memory leak with RCU_TABLE_FREE
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit e73b7fffe487c315fd1a4fa22282e3362b440a06 upstream.
The rcu page table free code uses a couple of bits in the page table pointer passed to tlb_remove_table to discern the different page table types. __tlb_remove_table extracts the type with an incorrect mask which leads to memory leaks. The correct mask is ((FRAG_MASK << 4) | FRAG_MASK).
--- arch/s390/mm/pgtable.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/s390/mm/pgtable.c +3 -2
@@ -291,8 +291,9 @@ void page_table_free_rcu(struct mmu_gathvoid __tlb_remove_table (void *_table) { -void *table = (void *)((unsigned long ) _table &PAGE_MASK ); -unsigned type = (unsigned long ) _table & ~PAGE_MASK ; +const unsigned long mask = (FRAG_MASK <<4 ) |FRAG_MASK ; +void *table = (void *)((unsigned long ) _table & ~mask); +unsigned type = (unsigned long ) _table & mask;if (type)__page_table_free_rcu (table, type);
PATCH 110/262 ccwgroup: move attributes to attribute group
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
commit dbdf1afcaaabe83dea15a3cb9b9013e73ae3b1ad upstream.
Put sysfs attributes of ccwgroup devices in an attribute group to ensure that these attributes are actually present when userspace is notified via uevents.
--- drivers/s390/cio/ccwgroup.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-)
drivers/s390/cio/ccwgroup.c +22 -20
@@ -87,6 +87,12 @@ static void __ccwgroup_remove_cdev_refs( } } +static ssize_t ccwgroup_online_store (struct device *dev, +struct device_attribute *attr, +const char *buf,size_t count); +static ssize_t ccwgroup_online_show (struct device *dev, +struct device_attribute *attr, +char *buf);/* * Provide an 'ungroup' attribute so the user can remove group devices no * longer needed or accidentially created. Saves memory :)
@@ -134,6 +140,20 @@ out: } static DEVICE_ATTR(ungroup, 0200, NULL, ccwgroup_ungroup_store); +static DEVICE_ATTR(online, 0644, ccwgroup_online_show, ccwgroup_online_store); + +static struct attribute *ccwgroup_attrs[] = { + &dev_attr_online.attr, + &dev_attr_ungroup.attr, +NULL , +}; +static struct attribute_group ccwgroup_attr_group = { + .attrs = ccwgroup_attrs, +}; +static const struct attribute_group *ccwgroup_attr_groups[] = { + &ccwgroup_attr_group, +NULL , +};static void ccwgroup_release (struct device *dev)
@@ -293,25 +313,17 @@ int ccwgroup_create_from_string(struct d }dev_set_name (&gdev->dev,"%s" ,dev_name (&gdev->cdev[0 ]->dev)); - + gdev->dev.groups = ccwgroup_attr_groups; rc =device_add (&gdev->dev);if (rc) goto error;get_device (&gdev->dev); - rc =device_create_file (&gdev->dev, &dev_attr_ungroup); - -if (rc) { -device_unregister (&gdev->dev); - goto error; - } - rc =__ccwgroup_create_symlinks (gdev);if (!rc) {mutex_unlock (&gdev->reg_mutex);put_device (&gdev->dev);return 0 ; } -device_remove_file (&gdev->dev, &dev_attr_ungroup);device_unregister (&gdev->dev); error:for (i =0 ; i < num_devices; i++)
@@ -423,7 +435,7 @@ ccwgroup_online_store (struct device *deint ret;if (!dev->driver) -return -ENODEV ; +return -EINVAL ; gdev =to_ccwgroupdev (dev); gdrv =to_ccwgroupdrv (dev->driver);
@@ -456,8 +468,6 @@ ccwgroup_online_show (struct device *devreturn sprintf (buf, online ?"1\n" :"0\n" ); } -static DEVICE_ATTR(online, 0644, ccwgroup_online_show, ccwgroup_online_store); -static int ccwgroup_probe (struct device *dev) {
@@ -469,12 +479,7 @@ ccwgroup_probe (struct device *dev) gdev =to_ccwgroupdev (dev); gdrv =to_ccwgroupdrv (dev->driver); -if ((ret =device_create_file (dev, &dev_attr_online))) -return ret; - ret = gdrv->probe ? gdrv->probe (gdev) : -ENODEV ; -if (ret) -device_remove_file (dev, &dev_attr_online);return ret; }
@@ -485,9 +490,6 @@ ccwgroup_remove (struct device *dev)struct ccwgroup_device *gdev;struct ccwgroup_driver *gdrv; -device_remove_file (dev, &dev_attr_online); -device_remove_file (dev, &dev_attr_ungroup); -if (!dev->driver)return 0 ;
PATCH 111/262 WMI: properly cleanup devices to avoid crashes
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 023b9565972a4a5e0f01b9aa32680af6e9b5c388 upstream.
We need to remove devices that we destroy from the list, otherwise we'll crash if there are more than one "_WDG" methods in DSDT.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=32052
--- drivers/platform/x86/wmi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/wmi.c +5 -1
@@ -754,9 +754,13 @@ static void wmi_free_devices(void)struct wmi_block *wblock, *next;/* Delete devices for all the GUIDs */ -list_for_each_entry_safe (wblock, next, &wmi_block_list, list) +list_for_each_entry_safe (wblock, next, &wmi_block_list, list) { +list_del (&wblock->list);if (wblock->dev.class)device_unregister (&wblock->dev); +else +kfree (wblock); + } }static bool guid_already_parsed (const char *guid_string)
PATCH 112/262 iommu/amd: Fix wrong shift direction
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit fcd0861db1cf4e6ed99f60a815b7b72c2ed36ea4 upstream.
The shift direction was wrong because the function takes a page number and i is the address is the loop.
--- arch/x86/kernel/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/amd_iommu.c +1 -1
@@ -1203,7 +1203,7 @@ static int alloc_new_range(struct dma_opif (!pte || !IOMMU_PTE_PRESENT (*pte))continue ; -dma_ops_reserve_addresses (dma_dom, i <<PAGE_SHIFT ,1 ); +dma_ops_reserve_addresses (dma_dom, i >>PAGE_SHIFT ,1 ); }update_domain (&dma_dom->domain);
PATCH 113/262 carminefb: Fix module parameters permissions
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream.
The third parameter of module_param is supposed to be an octal value. The missing leading "0" causes the following:
$ ls -l /sys/module/carminefb/parameters/ total 0 -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_displays -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode_str
After fixing the perm parameter, we get the expected:
$ ls -l /sys/module/carminefb/parameters/ total 0 -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_displays -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode_str
--- drivers/video/carminefb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/video/carminefb.c +3 -3
@@ -32,11 +32,11 @@#define CARMINEFB_DEFAULT_VIDEO_MODE 1static unsigned int fb_mode =CARMINEFB_DEFAULT_VIDEO_MODE ; -module_param (fb_mode, uint,444 ); +module_param (fb_mode, uint,0444 );MODULE_PARM_DESC (fb_mode,"Initial video mode as integer." );static char *fb_mode_str; -module_param (fb_mode_str, charp,444 ); +module_param (fb_mode_str, charp,0444 );MODULE_PARM_DESC (fb_mode_str,"Initial video mode in characters." );/*
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(fb_mode_str, "Initial v* 0b010 Display 1 */ static int fb_displays =CARMINE_USE_DISPLAY0 |CARMINE_USE_DISPLAY1 ; -module_param (fb_displays, int,444 ); +module_param (fb_displays, int,0444 );MODULE_PARM_DESC (fb_displays,"Bit mode, which displays are used" );struct carmine_hw {
PATCH 114/262 fb: avoid possible deadlock caused by fb_set_suspend
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herton Ronaldo Krzesinski <[email protected]>
commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream.
A lock ordering issue can cause deadlocks: in framebuffer/console code, all needed struct fb_info locks are taken before acquire_console_sem(), in places which need to take console semaphore.
But fb_set_suspend is always called with console semaphore held, and inside it we call lock_fb_info which gets the fb_info lock, inverse locking order of what the rest of the code does. This causes a real deadlock issue, when we write to state fb sysfs attribute (which calls fb_set_suspend) while a framebuffer is being unregistered by remove_conflicting_framebuffers, as can be shown by following show blocked state trace on a test program which loads i915 and runs another forked processes writing to state attribute:
Test process with semaphore held and trying to get fb_info lock:
..
fb-test2 D 0000000000000000 0 237 228 0x00000000
ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0 ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530 00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0
Call Trace: [<ffffffff8141287a>] __mutex_lock_slowpath+0x11a/0x1e0 [<ffffffff814142f2>] ? _raw_spin_lock_irq+0x22/0x40 [<ffffffff814123d3>] mutex_lock+0x23/0x50 [<ffffffff8125dfc5>] lock_fb_info+0x25/0x60 [<ffffffff8125e3f0>] fb_set_suspend+0x20/0x80 [<ffffffff81263e2f>] store_fbstate+0x4f/0x70 [<ffffffff812e7f70>] dev_attr_store+0x20/0x30 [<ffffffff811c46b4>] sysfs_write_file+0xd4/0x160 [<ffffffff81155a26>] vfs_write+0xc6/0x190 [<ffffffff81155d51>] sys_write+0x51/0x90 [<ffffffff8100c012>] system_call_fastpath+0x16/0x1b
..
modprobe process stalled because has the fb_info lock (got inside unregister_framebuffer) but waiting for the semaphore held by the test process which is waiting to get the fb_info lock:
..
modprobe D 0000000000000000 0 230 218 0x00000000
ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001 ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20 00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0
Call Trace: [<ffffffff81411fe5>] schedule_timeout+0x215/0x310 [<ffffffff81058051>] ? get_parent_ip+0x11/0x50 [<ffffffff814130dd>] __down+0x6d/0xb0 [<ffffffff81089f71>] down+0x41/0x50 [<ffffffff810629ac>] acquire_console_sem+0x2c/0x50 [<ffffffff812ca53d>] unbind_con_driver+0xad/0x2d0 [<ffffffff8126f5f7>] fbcon_event_notify+0x457/0x890 [<ffffffff814144ff>] ? _raw_spin_unlock_irqrestore+0x1f/0x50 [<ffffffff81058051>] ? get_parent_ip+0x11/0x50 [<ffffffff8141836d>] notifier_call_chain+0x4d/0x70 [<ffffffff8108a3b8>] __blocking_notifier_call_chain+0x58/0x80 [<ffffffff8108a3f6>] blocking_notifier_call_chain+0x16/0x20 [<ffffffff8125dabb>] fb_notifier_call_chain+0x1b/0x20 [<ffffffff8125e6ac>] unregister_framebuffer+0x7c/0x130 [<ffffffff8125e8b3>] remove_conflicting_framebuffers+0x153/0x180 [<ffffffff8125eef3>] register_framebuffer+0x93/0x2c0 [<ffffffffa0331112>] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper] [<ffffffffa03314a3>] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper] [<ffffffffa03318dd>] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper] [<ffffffffa037b588>] intel_fbdev_init+0xa8/0x160 [i915] [<ffffffffa0343d74>] i915_driver_load+0x854/0x12b0 [i915] [<ffffffffa02f0e7e>] drm_get_pci_dev+0x19e/0x360 [drm] [<ffffffff8141821d>] ? sub_preempt_count+0x9d/0xd0 [<ffffffffa0386f91>] i915_pci_probe+0x15/0x17 [i915] [<ffffffff8124481f>] local_pci_probe+0x5f/0xd0 [<ffffffff81244f89>] pci_device_probe+0x119/0x120 [<ffffffff812eccaa>] ? driver_sysfs_add+0x7a/0xb0 [<ffffffff812ed003>] driver_probe_device+0xa3/0x290 [<ffffffff812ed1f0>] ? __driver_attach+0x0/0xb0 [<ffffffff812ed29b>] __driver_attach+0xab/0xb0 [<ffffffff812ed1f0>] ? __driver_attach+0x0/0xb0 [<ffffffff812ebd3e>] bus_for_each_dev+0x5e/0x90 [<ffffffff812ecc2e>] driver_attach+0x1e/0x20 [<ffffffff812ec6f2>] bus_add_driver+0xe2/0x320 [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915] [<ffffffff812ed536>] driver_register+0x76/0x140 [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915] [<ffffffff81245216>] __pci_register_driver+0x56/0xd0 [<ffffffffa02f1264>] drm_pci_init+0xe4/0xf0 [drm] [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915] [<ffffffffa02e84a8>] drm_init+0x58/0x70 [drm] [<ffffffffa03aa094>] i915_init+0x94/0x96 [i915] [<ffffffff81002194>] do_one_initcall+0x44/0x190 [<ffffffff810a066b>] sys_init_module+0xcb/0x210 [<ffffffff8100c012>] system_call_fastpath+0x16/0x1b
..
fb-test2 which reproduces above is available on kernel.org bug #26232. To solve this issue, avoid calling lock_fb_info inside fb_set_suspend, and move it out to where needed (callers of fb_set_suspend must call lock_fb_info before if needed). So far, the only place which needs to call lock_fb_info is store_fbstate, all other places which calls fb_set_suspend are suspend/resume hooks that should not need the lock as they should be run only when processes are already frozen in suspend/resume.
References: https://bugzilla.kernel.org/show_bug.cgi?id=26232
--- drivers/video/fbmem.c | 3 --- drivers/video/fbsysfs.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/video/fbmem.c +0 -3
@@ -1738,8 +1738,6 @@ void fb_set_suspend(struct fb_info *info {struct fb_event event; -if (!lock_fb_info (info)) -return ; event.info = info;if (state) {fb_notifier_call_chain (FB_EVENT_SUSPEND , &event);
@@ -1748,7 +1746,6 @@ void fb_set_suspend(struct fb_info *info info->state =FBINFO_STATE_RUNNING ;fb_notifier_call_chain (FB_EVENT_RESUME , &event); } -unlock_fb_info (info); }/**
drivers/video/fbsysfs.c +3 -0
@@ -399,9 +399,12 @@ static ssize_t store_fbstate(struct devi state =simple_strtoul (buf, &last,0 ); +if (!lock_fb_info (fb_info)) +return -ENODEV ;console_lock ();fb_set_suspend (fb_info, (int )state);console_unlock (); +unlock_fb_info (fb_info);return count; }
PATCH 115/262 fb: sh-mobile: Fix deadlock risk between lock_fb_info() and console_lock()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <[email protected]>
commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream.
Following on Herton's patch "fb: avoid possible deadlock caused by fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend() to its callers, correct sh-mobile's locking around call to fb_set_suspend() and the same sort of deaklocks with console_lock() due to order of taking the lock.
console_lock() must be taken while fb_info is already locked and fb_info must be locked while calling fb_set_suspend().
--- drivers/video/sh_mobile_hdmi.c | 47 ++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 21 deletions(-)
drivers/video/sh_mobile_hdmi.c +26 -21
@@ -1111,6 +1111,7 @@ static long sh_hdmi_clk_configure(structstatic void sh_hdmi_edid_work_fn (struct work_struct *work) { struct sh_hdmi *hdmi = container_of(work, struct sh_hdmi, edid_work.work); +struct fb_info *info;struct sh_mobile_hdmi_info *pdata = hdmi->dev->platform_data;struct sh_mobile_lcdc_chan *ch;int ret;
@@ -1123,8 +1124,9 @@ static void sh_hdmi_edid_work_fn(structmutex_lock (&hdmi->mutex); + info = hdmi->info; +if (hdmi->hp_state ==HDMI_HOTPLUG_CONNECTED ) { -struct fb_info *info = hdmi->info;unsigned long parent_rate =0 , hdmi_rate; ret =sh_hdmi_read_edid (hdmi, &hdmi_rate, &parent_rate);
@@ -1148,42 +1150,45 @@ static void sh_hdmi_edid_work_fn(struct ch = info->par; -console_lock (); +if (lock_fb_info (info)) { +console_lock (); -/* HDMI plug in */ -if (!sh_hdmi_must_reconfigure (hdmi) && - info->state ==FBINFO_STATE_RUNNING ) { -/* -* First activation with the default monitor - just turn -* on, if we run a resume here, the logo disappears -*/ -if (lock_fb_info (info)) { +/* HDMI plug in */ +if (!sh_hdmi_must_reconfigure (hdmi) && + info->state ==FBINFO_STATE_RUNNING ) { +/* +* First activation with the default monitor - just turn +* on, if we run a resume here, the logo disappears +*/ info->var.width = hdmi->var.width; info->var.height = hdmi->var.height;sh_hdmi_display_on (hdmi, info); -unlock_fb_info (info); + }else { +/* New monitor or have to wake up */ +fb_set_suspend (info,0 ); } - }else { -/* New monitor or have to wake up */ -fb_set_suspend (info,0 ); - } -console_unlock (); +console_unlock (); +unlock_fb_info (info); + } }else { ret =0 ; -if (!hdmi->info) +if (!info) goto out; hdmi->monspec.modedb_len =0 ;fb_destroy_modedb (hdmi->monspec.modedb); hdmi->monspec.modedb =NULL ; -console_lock (); +if (lock_fb_info (info)) { +console_lock (); -/* HDMI disconnect */ -fb_set_suspend (hdmi->info,1 ); +/* HDMI disconnect */ +fb_set_suspend (info,1 ); -console_unlock (); +console_unlock (); +unlock_fb_info (info); + } } out:
PATCH 116/262 viafb: use display information in info not in var for panning
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Tobias Schandinat <[email protected]>
commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream.
As Laurent pointed out we must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual.
--- drivers/video/via/viafbdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/video/via/viafbdev.c +3 -2
@@ -348,8 +348,9 @@ static int viafb_pan_display(struct fb_v struct fb_info *info) {struct viafb_par *viapar = info->par; -u32 vram_addr = (var->yoffset * var->xres_virtual + var->xoffset) - * (var->bits_per_pixel /8 ) + viapar->vram_addr; +u32 vram_addr = viapar->vram_addr + + var->yoffset * info->fix.line_length + + var->xoffset * info->var.bits_per_pixel /8 ;DEBUG_MSG (KERN_DEBUG "viafb_pan_display, address = %d\n" , vram_addr);if (!viafb_dual_fb) {
PATCH 117/262 viafb: improve pitch handling
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Tobias Schandinat <[email protected]>
commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream.
This patch adds checks for minimum and maximum pitch size to prevent invalid settings which could otherwise crash the machine. Also the alignment is done in a slightly more readable way.
--- drivers/video/via/via_modesetting.h | 5 +++++ drivers/video/via/viafbdev.c | 11 ++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)
drivers/video/via/via_modesetting.h +5 -0
@@ -28,6 +28,11 @@#include <linux/types.h> + +#define VIA_PITCH_SIZE (1<<3) +#define VIA_PITCH_MAX 0x3FF8 + +void via_set_primary_address (u32 addr);void via_set_secondary_address (u32 addr);void via_set_primary_pitch (u32 pitch);
drivers/video/via/viafbdev.c +8 -3
@@ -151,7 +151,8 @@ static void viafb_update_fix(struct fb_i info->fix.visual = bpp ==8 ?FB_VISUAL_PSEUDOCOLOR :FB_VISUAL_TRUECOLOR ; - info->fix.line_length = (info->var.xres_virtual * bpp /8 +7 ) & ~7 ; + info->fix.line_length =ALIGN (info->var.xres_virtual * bpp /8 , +VIA_PITCH_SIZE ); } static void viafb_setup_fixinfo(struct fb_fix_screeninfo *fix,
@@ -238,8 +239,12 @@ static int viafb_check_var(struct fb_var depth =24 ;viafb_fill_var_color_info (var, depth); - line = (var->xres_virtual * var->bits_per_pixel /8 +7 ) & ~7 ; -if (line * var->yres_virtual > ppar->memsize) +if (var->xres_virtual < var->xres) + var->xres_virtual = var->xres; + + line =ALIGN (var->xres_virtual * var->bits_per_pixel /8 , +VIA_PITCH_SIZE ); +if (line >VIA_PITCH_MAX || line * var->yres_virtual > ppar->memsize)return -EINVAL ;/* Based on var passed in to calculate the refresh,
PATCH 118/262 uvcvideo: Set alternate setting 0 on resume if the bus has been reset
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit d59a7b1dbce8b972ec2dc9fcaaae0bfa23687423 upstream.
If the bus has been reset on resume, set the alternate setting to 0. This should be the default value, but some devices crash or otherwise misbehave if they don't receive a SET_INTERFACE request before any other video control request.
Microdia's 0c45:6437 camera has been found to require this change or it will stop sending video data after resume.
uvc_video.c]
--- drivers/media/video/uvc/uvc_driver.c | 2 +- drivers/media/video/uvc/uvc_video.c | 10 +++++++++- drivers/media/video/uvc/uvcvideo.h | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-)
drivers/media/video/uvc/uvc_driver.c +1 -1
@@ -1960,7 +1960,7 @@ static int __uvc_resume(struct usb_interlist_for_each_entry (stream, &dev->streams, list) {if (stream->intf == intf) -return uvc_video_resume (stream); +return uvc_video_resume (stream, reset); } uvc_trace(UVC_TRACE_SUSPEND, "Resume: video streaming USB interface "
drivers/media/video/uvc/uvc_video.c +9 -1
@@ -1104,10 +1104,18 @@ int uvc_video_suspend(struct uvc_streami* buffers, making sure userspace applications are notified of the problem * instead of waiting forever. */ -int uvc_video_resume (struct uvc_streaming *stream) +int uvc_video_resume (struct uvc_streaming *stream,int reset) {int ret; +/* If the bus has been reset on resume, set the alternate setting to 0. +* This should be the default value, but some devices crash or otherwise +* misbehave if they don't receive a SET_INTERFACE request before any +* other video control request. +*/ +if (reset) +usb_set_interface (stream->dev->udev, stream->intfnum,0 ); + stream->frozen =0 ; ret =uvc_commit_video (stream, &stream->ctrl);
drivers/media/video/uvc/uvcvideo.h +1 -1
@@ -639,7 +639,7 @@ extern void uvc_mc_cleanup_entity(struct/* Video */ extern int uvc_video_init (struct uvc_streaming *stream);extern int uvc_video_suspend (struct uvc_streaming *stream); -extern int uvc_video_resume (struct uvc_streaming *stream); +extern int uvc_video_resume (struct uvc_streaming *stream,int reset);extern int uvc_video_enable (struct uvc_streaming *stream,int enable);extern int uvc_probe_video (struct uvc_streaming *stream,struct uvc_streaming_control *probe);
PATCH 119/262 DiBcom: protect the I2C bufer access
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Boettcher <[email protected]>
commit 79fcce3230b140f7675f8529ee53fe2f9644f902 upstream.
This patch protects the I2C buffer access in order to manage concurrent access. This protection is done using mutex.
Furthermore, for the dib9000, if a pid filtering command is received during the tuning, this pid filtering command is delayed to avoid any concurrent access issue.
--- drivers/media/dvb/frontends/dib0070.c | 37 ++++-- drivers/media/dvb/frontends/dib0090.c | 70 +++++++++-- drivers/media/dvb/frontends/dib7000m.c | 27 ++++ drivers/media/dvb/frontends/dib7000p.c | 32 ++++- drivers/media/dvb/frontends/dib8000.c | 72 ++++++++++- drivers/media/dvb/frontends/dib9000.c | 164 +++++++++++++++++++++++---- drivers/media/dvb/frontends/dibx000_common.c | 76 ++++++++++-- drivers/media/dvb/frontends/dibx000_common.h | 1 8 files changed, 412 insertions(+), 67 deletions(-)
drivers/media/dvb/frontends/dib0070.c +30 -7
@@ -27,6 +27,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/i2c.h> +#include <linux/mutex.h> #include "dvb_frontend.h"
@@ -78,10 +79,18 @@ struct dib0070_state {struct i2c_msg msg[2 ];u8 i2c_write_buffer[3 ];u8 i2c_read_buffer[2 ]; +struct mutex i2c_buffer_lock; }; -static uint16_t dib0070_read_reg (struct dib0070_state *state,u8 reg) +static u16 dib0070_read_reg (struct dib0070_state *state,u8 reg) { +u16 ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return 0 ; + } + state->i2c_write_buffer[0 ] = reg;memset (state->msg,0 ,2 *sizeof (struct i2c_msg ));
@@ -96,13 +105,23 @@ static uint16_t dib0070_read_reg(structif (i2c_transfer (state->i2c, state->msg,2 ) !=2 ) {printk (KERN_WARNING "DiB0070 I2C read failed\n" ); -return 0 ; - } -return (state->i2c_read_buffer[0 ] <<8 ) | state->i2c_read_buffer[1 ]; + ret =0 ; + }else + ret = (state->i2c_read_buffer[0 ] <<8 ) + | state->i2c_read_buffer[1 ]; + +mutex_unlock (&state->i2c_buffer_lock); +return ret; }static int dib0070_write_reg (struct dib0070_state *state,u8 reg,u16 val) { +int ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return -EINVAL ; + } state->i2c_write_buffer[0 ] = reg; state->i2c_write_buffer[1 ] = val >>8 ; state->i2c_write_buffer[2 ] = val &0xff ;
@@ -115,9 +134,12 @@ static int dib0070_write_reg(struct dib0if (i2c_transfer (state->i2c, state->msg,1 ) !=1 ) {printk (KERN_WARNING "DiB0070 I2C write failed\n" ); -return -EREMOTEIO ; - } -return 0 ; + ret = -EREMOTEIO ; + }else + ret =0 ; + +mutex_unlock (&state->i2c_buffer_lock); +return ret; }#define HARD_RESET (state) do { \
@@ -734,6 +756,7 @@ struct dvb_frontend *dib0070_attach(stru state->cfg = cfg; state->i2c = i2c; state->fe = fe; +mutex_init (&state->i2c_buffer_lock); fe->tuner_priv = state;if (dib0070_reset (fe) !=0 )
drivers/media/dvb/frontends/dib0090.c +58 -12
141 lines not on this page · raw message
drivers/media/dvb/frontends/dib7000m.c +25 -2
@@ -11,6 +11,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/i2c.h> +#include <linux/mutex.h> #include "dvb_frontend.h"
@@ -55,6 +56,7 @@ struct dib7000m_state {struct i2c_msg msg[2 ];u8 i2c_write_buffer[4 ];u8 i2c_read_buffer[2 ]; +struct mutex i2c_buffer_lock; };enum dib7000m_power_mode {
@@ -69,6 +71,13 @@ enum dib7000m_power_mode {static u16 dib7000m_read_word (struct dib7000m_state *state,u16 reg) { +u16 ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return 0 ; + } + state->i2c_write_buffer[0 ] = (reg >>8 ) |0x80 ; state->i2c_write_buffer[1 ] = reg &0xff ;
@@ -85,11 +94,21 @@ static u16 dib7000m_read_word(struct dibif (i2c_transfer (state->i2c_adap, state->msg,2 ) !=2 )dprintk ("i2c read error on %d" ,reg); -return (state->i2c_read_buffer[0 ] <<8 ) | state->i2c_read_buffer[1 ]; + ret = (state->i2c_read_buffer[0 ] <<8 ) | state->i2c_read_buffer[1 ]; +mutex_unlock (&state->i2c_buffer_lock); + +return ret; }static int dib7000m_write_word (struct dib7000m_state *state,u16 reg,u16 val) { +int ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return -EINVAL ; + } + state->i2c_write_buffer[0 ] = (reg >>8 ) &0xff ; state->i2c_write_buffer[1 ] = reg &0xff ; state->i2c_write_buffer[2 ] = (val >>8 ) &0xff ;
@@ -101,7 +120,10 @@ static int dib7000m_write_word(struct di state->msg[0 ].buf = state->i2c_write_buffer; state->msg[0 ].len =4 ; -return i2c_transfer (state->i2c_adap, state->msg,1 ) !=1 ? -EREMOTEIO :0 ; + ret = (i2c_transfer (state->i2c_adap, state->msg,1 ) !=1 ? + -EREMOTEIO :0 ); +mutex_unlock (&state->i2c_buffer_lock); +return ret; }static void dib7000m_write_tab (struct dib7000m_state *state,u16 *buf) {
@@ -1385,6 +1407,7 @@ struct dvb_frontend * dib7000m_attach(st demod = &st->demod; demod->demodulator_priv = st;memcpy (&st->demod.ops, &dib7000m_ops,sizeof (struct dvb_frontend_ops )); +mutex_init (&st->i2c_buffer_lock); st->timf_default = cfg->bw->timf;
drivers/media/dvb/frontends/dib7000p.c +28 -4
@@ -10,6 +10,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/i2c.h> +#include <linux/mutex.h> #include "dvb_math.h" #include "dvb_frontend.h"
@@ -68,6 +69,7 @@ struct dib7000p_state {struct i2c_msg msg[2 ];u8 i2c_write_buffer[4 ];u8 i2c_read_buffer[2 ]; +struct mutex i2c_buffer_lock; };enum dib7000p_power_mode {
@@ -81,6 +83,13 @@ static int dib7090_set_diversity_in(strustatic u16 dib7000p_read_word (struct dib7000p_state *state,u16 reg) { +u16 ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return 0 ; + } + state->i2c_write_buffer[0 ] = reg >>8 ; state->i2c_write_buffer[1 ] = reg &0xff ;
@@ -97,11 +106,20 @@ static u16 dib7000p_read_word(struct dibif (i2c_transfer (state->i2c_adap, state->msg,2 ) !=2 )dprintk ("i2c read error on %d" , reg); -return (state->i2c_read_buffer[0 ] <<8 ) | state->i2c_read_buffer[1 ]; + ret = (state->i2c_read_buffer[0 ] <<8 ) | state->i2c_read_buffer[1 ]; +mutex_unlock (&state->i2c_buffer_lock); +return ret; }static int dib7000p_write_word (struct dib7000p_state *state,u16 reg,u16 val) { +int ret; + +if (mutex_lock_interruptible (&state->i2c_buffer_lock) <0 ) { +dprintk ("could not acquire lock" ); +return -EINVAL ; + } + state->i2c_write_buffer[0 ] = (reg >>8 ) &0xff ; state->i2c_write_buffer[1 ] = reg &0xff ; state->i2c_write_buffer[2 ] = (val >>8 ) &0xff ;
@@ -113,7 +131,10 @@ static int dib7000p_write_word(struct di state->msg[0 ].buf = state->i2c_write_buffer; state->msg[0 ].len =4 ; -return i2c_transfer (state->i2c_adap, state->msg,1 ) !=1 ? -EREMOTEIO :0 ; + ret = (i2c_transfer (state->i2c_adap, state->msg,1 ) !=1 ? + -EREMOTEIO :0 ); +mutex_unlock (&state->i2c_buffer_lock); +return ret; }static void dib7000p_write_tab (struct dib7000p_state *state,u16 * buf)
@@ -1646,6 +1667,7 @@ int dib7000p_i2c_enumeration(struct i2c_return -ENOMEM ; dpst->i2c_adap = i2c; +mutex_init (&dpst->i2c_buffer_lock);for (k = no_of_demods -1 ; k >=0 ; k--) { dpst->cfg = cfg[k];
@@ -2324,6 +2346,7 @@ struct dvb_frontend *dib7000p_attach(str demod = &st->demod; demod->demodulator_priv = st;memcpy (&st->demod.ops, &dib7000p_ops,sizeof (struct dvb_frontend_ops )); +mutex_init (&st->i2c_buffer_lock);dib7000p_write_word (st,1287 ,0x0003 );/* sram lead in, rdy */
@@ -2333,8 +2356,9 @@ struct dvb_frontend *dib7000p_attach(str st->version =dib7000p_read_word (st,897 );/* FIXME: make sure the dev.parent field is initialized, or else -request_firmware() will hit an OOPS (this should be moved somewhere -more common) */ +request_firmware() will hit an OOPS (this should be moved somewhere +more common) */ + st->i2c_master.gated_tuner_i2c_adap.dev.parent = i2c_adap->dev.parent;dibx000_init_i2c_master (&st->i2c_master,DIB7000P , st->i2c_adap, st->i2c_addr);
drivers/media/dvb/frontends/dib8000.c +61 -11
161 lines not on this page · raw message
drivers/media/dvb/frontends/dib9000.c +145 -19
334 lines not on this page · raw message
drivers/media/dvb/frontends/dibx000_common.c +64 -12
155 lines not on this page · raw message
drivers/media/dvb/frontends/dibx000_common.h +1 -0
@@ -33,6 +33,7 @@ struct dibx000_i2c_master {struct i2c_msg msg[34 ];u8 i2c_write_buffer[8 ];u8 i2c_read_buffer[2 ]; +struct mutex i2c_buffer_lock; }; extern int dibx000_init_i2c_master(struct dibx000_i2c_master *mst,
PATCH 120/262 dib0700: protect the dib0700 buffer access
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Grenie <[email protected]>
commit bff469f4167fdabfe15294f375577d7eadbaa1bb upstream.
This patch protects the common buffer access inside the dib0700 in order to manage concurrent access. This protection is done using mutex.
--- drivers/media/dvb/dvb-usb/dib0700_core.c | 81 +++++++++++++++++++++++++++---- 1 file changed, 72 insertions(+), 9 deletions(-)
drivers/media/dvb/dvb-usb/dib0700_core.c +72 -9
@@ -30,6 +30,11 @@ int dib0700_get_version(struct dvb_usb_dstruct dib0700_state *st = d->priv;int ret; +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } + ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), REQUEST_GET_VERSION, USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
@@ -46,6 +51,7 @@ int dib0700_get_version(struct dvb_usb_dif (fwtype !=NULL ) *fwtype = (st->buf[12 ] <<24 ) | (st->buf[13 ] <<16 ) | (st->buf[14 ] <<8 ) | st->buf[15 ]; +mutex_unlock (&d->usb_mutex);return ret; }
@@ -108,7 +114,12 @@ int dib0700_ctrl_rd(struct dvb_usb_devicint dib0700_set_gpio (struct dvb_usb_device *d,enum dib07x0_gpios gpio,u8 gpio_dir,u8 gpio_val) {struct dib0700_state *st = d->priv; -s16 ret; +int ret; + +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } st->buf[0 ] =REQUEST_SET_GPIO ; st->buf[1 ] = gpio;
@@ -116,6 +127,7 @@ int dib0700_set_gpio(struct dvb_usb_devi ret =dib0700_ctrl_wr (d, st->buf,3 ); +mutex_unlock (&d->usb_mutex);return ret; }
@@ -125,6 +137,11 @@ static int dib0700_set_usb_xfer_len(struint ret;if (st->fw_version >=0x10201 ) { +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } + st->buf[0 ] =REQUEST_SET_USB_XFER_LEN ; st->buf[1 ] = (nb_ts_packets >>8 ) &0xff ; st->buf[2 ] = nb_ts_packets &0xff ;
@@ -132,6 +149,7 @@ static int dib0700_set_usb_xfer_len(strudeb_info ("set the USB xfer len to %i Ts packet\n" , nb_ts_packets); ret =dib0700_ctrl_wr (d, st->buf,3 ); +mutex_unlock (&d->usb_mutex); }else {deb_info ("this firmware does not allow to change the USB xfer len\n" ); ret = -EIO ;
@@ -208,6 +226,10 @@ static int dib0700_i2c_xfer_new(struct i }else {/* Write request */ +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } st->buf[0 ] =REQUEST_NEW_I2C_WRITE ; st->buf[1 ] = msg[i].addr <<1 ; st->buf[2] = (en_start << 7) | (en_stop << 6) |
@@ -227,6 +249,7 @@ static int dib0700_i2c_xfer_new(struct iUSB_TYPE_VENDOR |USB_DIR_OUT ,0 ,0 , st->buf, msg[i].len +4 , USB_CTRL_GET_TIMEOUT); +mutex_unlock (&d->usb_mutex);if (result <0 ) {deb_info ("i2c write error (status = %d)\n" , result);break ;
@@ -249,6 +272,10 @@ static int dib0700_i2c_xfer_legacy(strucif (mutex_lock_interruptible (&d->i2c_mutex) <0 )return -EAGAIN ; +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + }for (i =0 ; i < num; i++) {/* fill in the address */
@@ -279,6 +306,7 @@ static int dib0700_i2c_xfer_legacy(strucbreak ; } } +mutex_unlock (&d->usb_mutex);mutex_unlock (&d->i2c_mutex);return i;
@@ -337,7 +365,12 @@ static int dib0700_set_clock(struct dvb_ u16 pll_loopdiv, u16 free_div, u16 dsuScaler) { struct dib0700_state *st = d->priv; -s16 ret; +int ret; + +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } st->buf[0 ] =REQUEST_SET_CLOCK ; st->buf[1] = (en_pll << 7) | (pll_src << 6) |
@@ -352,6 +385,7 @@ static int dib0700_set_clock(struct dvb_ st->buf[9 ] = dsuScaler &0xff ;/* LSB */ ret =dib0700_ctrl_wr (d, st->buf,10 ); +mutex_unlock (&d->usb_mutex);return ret; }
@@ -360,10 +394,16 @@ int dib0700_set_i2c_speed(struct dvb_usb {struct dib0700_state *st = d->priv;u16 divider; +int ret;if (scl_kHz ==0 )return -EINVAL ; +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } + st->buf[0 ] =REQUEST_SET_I2C_PARAM ; divider = (u16) (30000 / scl_kHz); st->buf[1 ] =0 ;
@@ -379,7 +419,11 @@ int dib0700_set_i2c_speed(struct dvb_usbdeb_info ("setting I2C speed: %04x %04x %04x (%d kHz)." , (st->buf[2 ] <<8 ) | (st->buf[3 ]), (st->buf[4 ] <<8 ) | st->buf[5 ], (st->buf[6 ] <<8 ) | st->buf[7 ], scl_kHz); -return dib0700_ctrl_wr (d, st->buf,8 ); + + ret =dib0700_ctrl_wr (d, st->buf,8 ); +mutex_unlock (&d->usb_mutex); + +return ret; }
@@ -515,6 +559,11 @@ int dib0700_streaming_ctrl(struct dvb_us } } +if (mutex_lock_interruptible (&adap->dev->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } + st->buf[0 ] =REQUEST_ENABLE_VIDEO ;/* this bit gives a kind of command, * rather than enabling something or not */
@@ -548,7 +597,10 @@ int dib0700_streaming_ctrl(struct dvb_usdeb_info ("data for streaming: %x %x\n" , st->buf[1 ], st->buf[2 ]); -return dib0700_ctrl_wr (adap->dev, st->buf,4 ); + ret =dib0700_ctrl_wr (adap->dev, st->buf,4 ); +mutex_unlock (&adap->dev->usb_mutex); + +return ret; }int dib0700_change_protocol (struct rc_dev *rc,u64 rc_type)
@@ -557,6 +609,11 @@ int dib0700_change_protocol(struct rc_destruct dib0700_state *st = d->priv;int new_proto, ret; +if (mutex_lock_interruptible (&d->usb_mutex) <0 ) { +deb_info ("could not acquire lock" ); +return 0 ; + } + st->buf[0 ] =REQUEST_SET_RC ; st->buf[1 ] =0 ; st->buf[2 ] =0 ;
@@ -567,23 +624,29 @@ int dib0700_change_protocol(struct rc_deelse if (rc_type ==RC_TYPE_NEC ) new_proto =0 ;else if (rc_type ==RC_TYPE_RC6 ) { -if (st->fw_version <0x10200 ) -return -EINVAL ; +if (st->fw_version <0x10200 ) { + ret = -EINVAL ; + goto out; + } new_proto =2 ; - }else -return -EINVAL ; + }else { + ret = -EINVAL ; + goto out; + } st->buf[1 ] = new_proto; ret =dib0700_ctrl_wr (d, st->buf,3 );if (ret <0 ) {err ("ir protocol setup failed" ); -return ret; + goto out; } d->props.rc.core.protocol = rc_type; +out: +mutex_unlock (&d->usb_mutex);return ret; }
PATCH 121/262 tuner_xc2028: Allow selection of the frequency adjustment code for XC3028
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 9bed77ee2fb46b74782d0d9d14b92e9d07f3df6e upstream.
This device is not using the proper demod IF. Instead of using the IF macro, it is specifying a IF frequency. This doesn't work, as xc3028 needs to load an specific SCODE for the tuner. In this case, there's no IF table for 5 MHz.
--- drivers/media/video/cx23885/cx23885-dvb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/video/cx23885/cx23885-dvb.c +1 -1
@@ -843,7 +843,7 @@ static int dvb_register(struct cx23885_tstatic struct xc2028_ctrl ctl = { .fname =XC3028L_DEFAULT_FIRMWARE , .max_len =64 , - .demod =5000 , + .demod =XC3028_FE_DIBCOM52 ,/* This is true for all demods with v36 firmware? */ .type =XC2028_D2633 ,
PATCH 122/262 /proc/self/numa_maps: restore "huge" tag for hugetlb vmas
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <[email protected]>
commit fc360bd9cdcf875639a77f07fafec26699c546f3 upstream.
The display of the "huge" tag was accidentally removed in 29ea2f698 ("mm:
use walk_page_range() instead of custom page table walking code").
--- fs/proc/task_mmu.c | 3 +++ 1 file changed, 3 insertions(+)
fs/proc/task_mmu.c +3 -0
@@ -1039,6 +1039,9 @@ static int show_numa_map(struct seq_fileseq_printf (m," stack" ); } +if (is_vm_hugetlb_page (vma)) +seq_printf (m," huge" ); +walk_page_range (vma->vm_start, vma->vm_end, &walk);if (!md->pages)
PATCH 123/262 plat-mxc: iomux-v3.h: implicitly enable pull-up/down when thats desired
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Fertser <[email protected]>
commit 6571534b600b8ca1936ff5630b9e0947f21faf16 upstream.
To configure pads during the initialisation a set of special constants
is used, e.g.
#define MX25_PAD_FEC_MDIO__FEC_MDIO IOMUX_PAD(0x3c4, 0x1cc, 0x10, 0, 0, PAD_CTL_HYS | PAD_CTL_PUS_22K_UP)
The problem is that no pull-up/down is getting activated unless both PAD_CTL_PUE (pull-up enable) and PAD_CTL_PKE (pull/keeper module enable) set. This is clearly stated in the i.MX25 datasheet and is confirmed by the measurements on hardware. This leads to some rather hard to understand bugs such as misdetecting an absent ethernet PHY (a real bug i had), unstable data transfer etc. This might affect mx25, mx35, mx50, mx51 and mx53 SoCs.
It's reasonable to expect that if the pullup value is specified, the intention was to have it actually active, so we implicitly add the needed bits.
--- arch/arm/plat-mxc/include/mach/iomux-v3.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm/plat-mxc/include/mach/iomux-v3.h +5 -5
@@ -89,11 +89,11 @@ typedef u64 iomux_v3_cfg_t;#define PAD_CTL_HYS (1 << 8)#define PAD_CTL_PKE (1 << 7) -#define PAD_CTL_PUE (1 << 6) -#define PAD_CTL_PUS_100K_DOWN (0 << 4) -#define PAD_CTL_PUS_47K_UP (1 << 4) -#define PAD_CTL_PUS_100K_UP (2 << 4) -#define PAD_CTL_PUS_22K_UP (3 << 4) +#define PAD_CTL_PUE (1 << 6 | PAD_CTL_PKE) +#define PAD_CTL_PUS_100K_DOWN (0 << 4 | PAD_CTL_PUE) +#define PAD_CTL_PUS_47K_UP (1 << 4 | PAD_CTL_PUE) +#define PAD_CTL_PUS_100K_UP (2 << 4 | PAD_CTL_PUE) +#define PAD_CTL_PUS_22K_UP (3 << 4 | PAD_CTL_PUE)#define PAD_CTL_ODE (1 << 3)
PATCH 124/262 ARM: mach-ux500: unlock I&D l2x0 caches before init
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 1bf6d2c1bb23533af6930581cc39b74685bc29de upstream.
Apparently U8500 U-Boot versions may leave the l2x0 locked down before executing the kernel. Make sure we unlock it before we initialize the l2x0. This fixes a performance problem reported by Jan Rinze.
The l2x0 core has been modified to unlock the l2x0 by default, but it will not touch the locking registers if the l2x0 was already enabled, as on the ux500, so we need this quirk to make sure it is properly turned off.
--- arch/arm/mach-ux500/cpu.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
arch/arm/mach-ux500/cpu.c +24 -1
@@ -99,7 +99,27 @@ static void ux500_l2x0_inv_all(void)ux500_cache_sync (); } -static int ux500_l2x0_init (void ) +static int __init ux500_l2x0_unlock (void ) +{ +int i; + +/* +* Unlock Data and Instruction Lock if locked. Ux500 U-Boot versions +* apparently locks both caches before jumping to the kernel. The +* l2x0 core will not touch the unlock registers if the l2x0 is +* already enabled, so we do it right here instead. The PL310 has +* 8 sets of registers, one per possible CPU. +*/ +for (i =0 ; i <8 ; i++) { +writel_relaxed (0x0 , l2x0_base +L2X0_LOCKDOWN_WAY_D_BASE + + i *L2X0_LOCKDOWN_STRIDE ); +writel_relaxed (0x0 , l2x0_base +L2X0_LOCKDOWN_WAY_I_BASE + + i *L2X0_LOCKDOWN_STRIDE ); + } +return 0 ; +} + +static int __init ux500_l2x0_init (void ) {if (cpu_is_u5500 ()) l2x0_base =__io_address (U5500_L2CC_BASE );
@@ -108,6 +128,9 @@ static int ux500_l2x0_init(void)else ux500_unknown_soc (); +/* Unlock before init */ +ux500_l2x0_unlock (); +/* 64KB way size, 8 way associativity, force WA */ l2x0_init (l2x0_base,0x3e060000 ,0xc0000fff );
PATCH 125/262 mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mitsuo Hayasaka <[email protected]>
commit f5252e009d5b87071a919221e4f6624184005368 upstream.
The /proc/vmallocinfo shows information about vmalloc allocations in vmlist that is a linklist of vm_struct. It, however, may access pages field of vm_struct where a page was not allocated. This results in a null pointer access and leads to a kernel panic.
Why this happens: In __vmalloc_node_range() called from vmalloc(), newly allocated vm_struct is added to vmlist at __get_vm_area_node() and then, some fields of vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In other words, it is added to vmlist before it is fully initialized. At the same time, when the /proc/vmallocinfo is read, it accesses the pages field of vm_struct according to the nr_pages field at show_numa_info(). Thus, a null pointer access happens.
The patch adds the newly allocated vm_struct to the vmlist *after* it is fully initialized. So, it can avoid accessing the pages field with unallocated page when show_numa_info() is called.
--- include/linux/vmalloc.h | 1 mm/vmalloc.c | 65 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 49 insertions(+), 17 deletions(-)
include/linux/vmalloc.h +1 -0
@@ -13,6 +13,7 @@ struct vm_area_struct; /* vma defining#define VM_MAP 0x00000004/* vmap()ed pages */ #define VM_USERMAP 0x00000008/* suitable for remap_vmalloc_range */ #define VM_VPAGES 0x00000010/* buffer for pages was vmalloc'ed */ +#define VM_UNLIST 0x00000020/* vm_struct is not listed in vmlist */ /* bits [20..32] reserved for arch specific ioremap internals */ /*
mm/vmalloc.c +48 -17
110 lines not on this page · raw message
PATCH 126/262 ALSA: hda - Fix ADC input-amp handling for Cx20549 codec
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6b45214277bec2193ad3ccb8d7aa6100b5a0f1a9 upstream.
It seems that Conexant CX20549 chip handle only a single input-amp even though the audio-input widget has multiple sources. This has been never clear, and I implemented in the current way based on the debug information I got at the early time -- the device reacts individual input-amp values for different sources. This is true for another Conexant codec, but it's not applied to CX20549 actually.
This patch changes the auto-parser code to handle a single input-amp per audio-in widget for CX20549. After applying this, you'll see only a single "Capture" volume control instead of separate "Mic" or "Line" captures when the device is set up to use a single ADC.
We haven't tested 20551 and 20561 codecs yet. If these show the similar behavior like 20549, they need to set spec->single_adc_amp=1, too.
--- sound/pci/hda/patch_conexant.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-)
sound/pci/hda/patch_conexant.c +28 -2
@@ -136,6 +136,7 @@ struct conexant_spec { unsigned int thinkpad:1; unsigned int hp_laptop:1; unsigned int asus:1; + unsigned int single_adc_amp:1; unsigned int adc_switching:1;
@@ -4205,6 +4206,8 @@ static int cx_auto_add_capture_volume(stint idx =get_input_connection (codec, adc_nid, nid);if (idx <0 )continue ; +if (spec->single_adc_amp) + idx =0 ;return cx_auto_add_volume_idx (codec, label, pfx, cidx, adc_nid,HDA_INPUT , idx); }
@@ -4245,14 +4248,21 @@ static int cx_auto_build_input_controls(struct hda_input_mux *imux = &spec->private_imux;const char *prev_label;int input_conn[HDA_MAX_NUM_INPUTS ]; -int i, err, cidx; +int i, j, err, cidx;int multi_connection; +if (!imux->num_items) +return 0 ; + multi_connection =0 ;for (i =0 ; i < imux->num_items; i++) { cidx =get_input_connection (codec, spec->imux_info[i].adc, spec->imux_info[i].pin); - input_conn[i] = (spec->imux_info[i].adc <<8 ) | cidx; +if (cidx <0 ) +continue ; + input_conn[i] = spec->imux_info[i].adc; +if (!spec->single_adc_amp) + input_conn[i] |= cidx <<8 ;if (i >0 && input_conn[i] != input_conn[0 ]) multi_connection =1 ; }
@@ -4281,6 +4291,15 @@ static int cx_auto_build_input_controls( err =cx_auto_add_capture_volume (codec, nid,"Capture" ,"" , cidx); }else { +bool dup_found = false; +for (j =0 ; j < i; j++) { +if (input_conn[j] == input_conn[i]) { + dup_found = true; +break ; + } + } +if (dup_found) +continue ; err =cx_auto_add_capture_volume (codec, nid, label," Capture" , cidx); }
@@ -4357,6 +4376,13 @@ static int patch_conexant_auto(struct hdreturn -ENOMEM ; codec->spec = spec; codec->pin_amp_workaround =1 ; + +switch (codec->vendor_id) { +case 0x14f15045 : + spec->single_adc_amp =1 ; +break ; + } + err =cx_auto_search_adcs (codec);if (err <0 )return err;
PATCH 127/262 um: fix ubd cow size
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 8535639810e578960233ad39def3ac2157b0c3ec upstream.
ubd_file_size() cannot use ubd_dev->cow.file because at this time ubd_dev->cow.file is not initialized.
Therefore, ubd_file_size() will always report a wrong disk size when COW files are used.
Reading from /dev/ubd* would crash the kernel.
We have to read the correct disk size from the COW file's backing file.
--- arch/um/drivers/ubd_kern.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
arch/um/drivers/ubd_kern.c +30 -1
@@ -513,8 +513,37 @@ __uml_exitcall(kill_io_thread);static inline int ubd_file_size (struct ubd *ubd_dev,__u64 *size_out) {char *file; +int fd; +int err; - file = ubd_dev->cow.file ? ubd_dev->cow.file : ubd_dev->file; +__u32 version; +__u32 align; +char *backing_file; +time_t mtime; +unsigned long long size; +int sector_size; +int bitmap_offset; + +if (ubd_dev->file && ubd_dev->cow.file) { + file = ubd_dev->cow.file; + + goto out; + } + + fd =os_open_file (ubd_dev->file, global_openflags,0 ); +if (fd <0 ) +return fd; + + err =read_cow_header (file_reader, &fd, &version, &backing_file, \ + &mtime, &size, §or_size, &align, &bitmap_offset); +os_close_file (fd); + +if (err == -EINVAL ) + file = ubd_dev->file; +else + file = backing_file; + +out:return os_file_size (file, size_out); }
PATCH 128/262 readlinkat: ensure we return ENOENT for the empty pathname for normal lookups
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Whitcroft <[email protected]>
commit 1fa1e7f615f4d3ae436fa319af6e4eebdd4026a8 upstream.
Since the commit below which added O_PATH support to the *at() calls, the error return for readlink/readlinkat for the empty pathname has switched from ENOENT to EINVAL:
commit 65cfc6722361570bfe255698d9cd4dccaf47570d
Author: Al Viro <[email protected]>
Date: Sun Mar 13 15:56:26 2011 -0400
readlinkat(), fchownat() and fstatat() with empty relative pathnames
This is both unexpected for userspace and makes readlink/readlinkat inconsistant with all other interfaces; and inconsistant with our stated return for these pathnames.
As the readlinkat call does not have a flags parameter we cannot use the AT_EMPTY_PATH approach used in the other calls. Therefore expose whether the original path is infact entry via a new user_path_at_empty() path lookup function. Use this to determine whether to default to EINVAL or ENOENT for failures.
Addresses http://bugs.launchpad.net/bugs/817187
--- fs/namei.c | 18 +++++++++++++----- fs/stat.c | 5 +++-- include/linux/namei.h | 1 + 3 files changed, 17 insertions(+), 7 deletions(-)
fs/namei.c +13 -5
@@ -136,7 +136,7 @@ static int do_getname(const char __userreturn retval; } -static char *getname_flags (const char __user * filename,int flags) +static char *getname_flags (const char __user *filename,int flags,int *empty) {char *tmp, *result;
@@ -147,6 +147,8 @@ static char *getname_flags(const char __ result = tmp;if (retval <0 ) { +if (retval == -ENOENT && empty) + *empty =1 ;if (retval != -ENOENT || !(flags &LOOKUP_EMPTY )) {__putname (tmp); result =ERR_PTR (retval);
@@ -159,7 +161,7 @@ static char *getname_flags(const char __char *getname (const char __user * filename) { -return getname_flags (filename,0 ); +return getname_flags (filename,0 ,0 ); }#ifdef CONFIG_AUDITSYSCALL
@@ -1747,11 +1749,11 @@ struct dentry *lookup_one_len(const charreturn __lookup_hash (&this, base,NULL ); } -int user_path_at (int dfd,const char __user *name,unsigned flags, -struct path *path) +int user_path_at_empty (int dfd,const char __user *name,unsigned flags, +struct path *path,int *empty) {struct nameidata nd; -char *tmp =getname_flags (name, flags); +char *tmp =getname_flags (name, flags, empty);int err =PTR_ERR (tmp);if (!IS_ERR (tmp)) {
@@ -1765,6 +1767,12 @@ int user_path_at(int dfd, const char __ureturn err; } +int user_path_at (int dfd,const char __user *name,unsigned flags, +struct path *path) +{ +return user_path_at_empty (dfd, name, flags, path,0 ); +} +static int user_path_parent (int dfd,const char __user *path,struct nameidata *nd,char **name) {
fs/stat.c +3 -2
@@ -296,15 +296,16 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, co {struct path path;int error; +int empty =0 ;if (bufsiz <=0 )return -EINVAL ; - error =user_path_at (dfd, pathname,LOOKUP_EMPTY , &path); + error =user_path_at_empty (dfd, pathname,LOOKUP_EMPTY , &path, &empty);if (!error) {struct inode *inode = path.dentry->d_inode; - error = -EINVAL ; + error = empty ? -ENOENT : -EINVAL ;if (inode->i_op->readlink) { error =security_inode_readlink (path.dentry);if (!error) {
include/linux/namei.h +1 -0
@@ -67,6 +67,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LA#define LOOKUP_EMPTY 0x4000extern int user_path_at (int ,const char __user *,unsigned ,struct path *); +extern int user_path_at_empty (int ,const char __user *,unsigned ,struct path *,int *empty);#define user_path (name, path) user_path_at(AT_FDCWD, name, LOOKUP_FOLLOW, path)#define user_lpath (name, path) user_path_at(AT_FDCWD, name, 0, path)
PATCH 129/262 VFS: Fix automount for negative autofs dentries
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 5a30d8a2b8ddd5102c440c7e5a7c8e1fd729c818 upstream.
[ backport for 3.0.x: LOOKUP_PARENT => LOOKUP_CONTINUE by Chuck Ebbert <[email protected]> ]
Autofs may set the DCACHE_NEED_AUTOMOUNT flag on negative dentries. These need attention from the automounter daemon regardless of the LOOKUP_FOLLOW flag.
--- fs/namei.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
fs/namei.c +15 -9
@@ -781,19 +781,25 @@ static int follow_automount(struct pathif ((flags &LOOKUP_NO_AUTOMOUNT ) && !(flags &LOOKUP_CONTINUE ))return -EISDIR ;/* we actually want to stop here */ -/* We want to mount if someone is trying to open/create a file of any -* type under the mountpoint, wants to traverse through the mountpoint -* or wants to open the mounted directory. -* +/* * We don't want to mount if someone's just doing a stat and they've * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and * appended a '/' to the name. */ -if (!(flags &LOOKUP_FOLLOW ) && - !(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | -LOOKUP_OPEN |LOOKUP_CREATE ))) -return -EISDIR ; - +if (!(flags &LOOKUP_FOLLOW )) { +/* We do, however, want to mount if someone wants to open or +* create a file of any type under the mountpoint, wants to +* traverse through the mountpoint or wants to open the mounted +* directory. +* Also, autofs may mark negative dentries as being automount +* points. These will need the attentions of the daemon to +* instantiate them before they can be used. +*/ +if (!(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | +LOOKUP_OPEN |LOOKUP_CREATE )) && + path->dentry->d_inode) +return -EISDIR ; + } current->total_link_count++;if (current->total_link_count >=40 )return -ELOOP ;
PATCH 130/262 vfs: automount should ignore LOOKUP_FOLLOW
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 0ec26fd0698285b31248e34bf1abb022c00f23d6 upstream.
Prior to 2.6.38 automount would not trigger on either stat(2) or lstat(2) on the automount point.
After 2.6.38, with the introduction of the ->d_automount() infrastructure, stat(2) and others would start triggering automount while lstat(2), etc. still would not. This is a regression and a userspace ABI change.
Problem originally reported here:
http://thread.gmane.org/gmane.linux.kernel.autofs/6098
It appears that there was an attempt at fixing various userspace tools to not trigger the automount. But since the stat system call is rather common it is impossible to "fix" all userspace.
This patch reverts the original behavior, which is to not trigger on stat(2) and other symlink following syscalls.
[ It's not really clear what the right behavior is. Apparently Solaris
does the "automount on stat, leave alone on lstat". And some programs can get unhappy when "stat+open+fstat" ends up giving a different result from the fstat than from the initial stat.
But the change in 2.6.38 resulted in problems for some people, so we're going back to old behavior. Maybe we can re-visit this discussion at some future date - Linus ]
--- fs/namei.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-)
fs/namei.c +15 -18
@@ -781,25 +781,22 @@ static int follow_automount(struct pathif ((flags &LOOKUP_NO_AUTOMOUNT ) && !(flags &LOOKUP_CONTINUE ))return -EISDIR ;/* we actually want to stop here */ -/* -* We don't want to mount if someone's just doing a stat and they've -* set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and -* appended a '/' to the name. +/* We don't want to mount if someone's just doing a stat - +* unless they're stat'ing a directory and appended a '/' to +* the name. +* +* We do, however, want to mount if someone wants to open or +* create a file of any type under the mountpoint, wants to +* traverse through the mountpoint or wants to open the +* mounted directory. Also, autofs may mark negative dentries +* as being automount points. These will need the attentions +* of the daemon to instantiate them before they can be used. */ -if (!(flags &LOOKUP_FOLLOW )) { -/* We do, however, want to mount if someone wants to open or -* create a file of any type under the mountpoint, wants to -* traverse through the mountpoint or wants to open the mounted -* directory. -* Also, autofs may mark negative dentries as being automount -* points. These will need the attentions of the daemon to -* instantiate them before they can be used. -*/ -if (!(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | -LOOKUP_OPEN |LOOKUP_CREATE )) && - path->dentry->d_inode) -return -EISDIR ; - } +if (!(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | +LOOKUP_OPEN |LOOKUP_CREATE )) && + path->dentry->d_inode) +return -EISDIR ; + current->total_link_count++;if (current->total_link_count >=40 )return -ELOOP ;
PATCH 131/262 VFS: Fix the remaining automounter semantics regressions
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 815d405ceff0d6964683f033e18b9b23a88fba87 upstream.
The concensus seems to be that system calls such as stat() etc should not trigger an automount. Neither should the l* versions.
This patch therefore adds a LOOKUP_AUTOMOUNT flag to tag those lookups that _should_ trigger an automount on the last path element.
[ Edited to leave out the cases that are already covered by LOOKUP_OPEN,
LOOKUP_DIRECTORY and LOOKUP_CREATE - all of which also fundamentally
force automounting for their own reasons - Linus ]
--- fs/namespace.c | 2 +- fs/nfs/super.c | 2 +- fs/quota/quota.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
fs/namespace.c +1 -1
@@ -1758,7 +1758,7 @@ static int do_loopback(struct path *pathreturn err;if (!old_name || !*old_name)return -EINVAL ; - err =kern_path (old_name,LOOKUP_FOLLOW , &old_path); + err =kern_path (old_name,LOOKUP_FOLLOW |LOOKUP_AUTOMOUNT , &old_path);if (err)return err;
fs/nfs/super.c +1 -1
@@ -2793,7 +2793,7 @@ static struct dentry *nfs_follow_remote_ goto out_put_mnt_ns; ret =vfs_path_lookup (root_mnt->mnt_root, root_mnt, - export_path,LOOKUP_FOLLOW , nd); + export_path,LOOKUP_FOLLOW |LOOKUP_AUTOMOUNT , nd);nfs_referral_loop_unprotect ();put_mnt_ns (ns_private);
fs/quota/quota.c +1 -1
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int,* resolution (think about autofs) and thus deadlocks could arise. */ if (cmds ==Q_QUOTAON ) { - ret =user_path_at (AT_FDCWD , addr,LOOKUP_FOLLOW , &path); + ret =user_path_at (AT_FDCWD , addr,LOOKUP_FOLLOW |LOOKUP_AUTOMOUNT , &path);if (ret) pathp =ERR_PTR (ret);else
PATCH 132/262 vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
Since we've now turned around and made LOOKUP_FOLLOW *not* force an automount, we want to add the ability to force an automount event on lookup even if we don't happen to have one of the other flags that force it implicitly (LOOKUP_OPEN, LOOKUP_DIRECTORY, LOOKUP_PARENT..)
Most cases will never want to use this, since you'd normally want to delay automounting as long as possible, which usually implies LOOKUP_OPEN (when we open a file or directory, we really cannot avoid the automount any more).
But Trond argued sufficiently forcefully that at a minimum bind mounting a file and quotactl will want to force the automount lookup. Some other cases (like nfs_follow_remote_path()) could use it too, although LOOKUP_DIRECTORY would work there as well.
This commit just adds the flag and logic, no users yet, though. It also doesn't actually touch the LOOKUP_NO_AUTOMOUNT flag that is related, and was made irrelevant by the same change that made us not follow on LOOKUP_FOLLOW.
--- fs/namei.c | 2 +- include/linux/namei.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
fs/namei.c +1 -1
@@ -793,7 +793,7 @@ static int follow_automount(struct path* of the daemon to instantiate them before they can be used. */ if (!(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | -LOOKUP_OPEN |LOOKUP_CREATE )) && +LOOKUP_OPEN |LOOKUP_CREATE |LOOKUP_AUTOMOUNT )) && path->dentry->d_inode)return -EISDIR ;
include/linux/namei.h +1 -0
@@ -49,6 +49,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LA#define LOOKUP_FOLLOW 0x0001#define LOOKUP_DIRECTORY 0x0002#define LOOKUP_CONTINUE 0x0004 +#define LOOKUP_AUTOMOUNT 0x0008#define LOOKUP_PARENT 0x0010#define LOOKUP_REVAL 0x0020
Re: [132/262] vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let me know.
I was going to say we need commits 815d405ceff0d6964683f033e18b9b23a88fba87 and b6c8069d3577481390b3f24a8434ad72a3235594 but I see those patches are present in stable-queue repo along with 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a.
This last commit is, as Linux points out, open to question, although if it was an autofs mount point that status is not really useful to the user. OTOH for other fs (that use automounting) the status of the file system containing the mount point might be useful but possibly misleading. IMHO I'd include this commit as well.
Quoted 64 lines
------------------
From: Linus Torvalds <[email protected]>
Since we've now turned around and made
LOOKUP_FOLLOW*not* force an automount, we want to add the ability to force an automount event on lookup even if we don't happen to have one of the other flags that force it implicitly (LOOKUP_OPEN,LOOKUP_DIRECTORY,LOOKUP_PARENT..)Most cases will never want to use this, since you'd normally want to delay automounting as long as possible, which usually implies
LOOKUP_OPEN(when we open a file or directory, we really cannot avoid the automount any more).But Trond argued sufficiently forcefully that at a minimum bind mounting a file and quotactl will want to force the automount lookup. Some other cases (like
nfs_follow_remote_path()) could use it too, althoughLOOKUP_DIRECTORYwould work there as well.This commit just adds the flag and logic, no users yet, though. It also doesn't actually touch the
LOOKUP_NO_AUTOMOUNTflag that is related, and was made irrelevant by the same change that made us not follow onLOOKUP_FOLLOW.Cc Trond Myklebust <[email protected]>Cc Ian Kent <[email protected]>Cc Jeff Layton <[email protected]>Cc Miklos Szeredi <[email protected]>Cc David Howells <[email protected]>Cc Al Viro <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Miklos Szeredi <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- fs/namei.c | 2 +- include/linux/namei.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)fs/namei.c +1
-1@@ -793,7 +793,7 @@ static int follow_automount(struct path* of the daemon to instantiate them before they can be used. */ if (!(flags & (LOOKUP_CONTINUE |LOOKUP_DIRECTORY | -LOOKUP_OPEN |LOOKUP_CREATE )) && +LOOKUP_OPEN |LOOKUP_CREATE |LOOKUP_AUTOMOUNT )) && path->dentry->d_inode)return -EISDIR ;include/linux/namei.h +1
-0@@ -49,6 +49,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LA#define LOOKUP_FOLLOW 0x0001#define LOOKUP_DIRECTORY 0x0002#define LOOKUP_CONTINUE 0x0004 +#define LOOKUP_AUTOMOUNT 0x0008#define LOOKUP_PARENT 0x0010#define LOOKUP_REVAL 0x0020
Re: [132/262] vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag
Quoted 9 lines · Ian Kent
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let me know.
I was going to say we need commits
815d405ceff0d6964683f033e18b9b23a88fba87andb6c8069d3577481390b3f24a8434ad72a3235594but I see those patches are present in stable-queue repo along with5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a.
Quoted 5 lines
This last commit is, as Linux points out, open to question, although if it was an autofs mount point that status is not really useful to the user. OTOH for other fs (that use automounting) the status of the file system containing the mount point might be useful but possibly misleading. IMHO I'd include this commit as well.
So I don't need to do anything different here from what I am doing?
confused,
greg k-h
Re: [132/262] vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag
Quoted 10 lines · Greg KH
Quoted 9 lines · Ian Kent
Quoted 1 line · Greg KH
3.0-stable review patch. If anyone has any objections, please let me know.
I was going to say we need commits
815d405ceff0d6964683f033e18b9b23a88fba87andb6c8069d3577481390b3f24a8434ad72a3235594but I see those patches are present in stable-queue repo along with5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a.
Quoted 7 lines
Quoted 5 lines
This last commit is, as Linux points out, open to question, although if it was an autofs mount point that status is not really useful to the user. OTOH for other fs (that use automounting) the status of the file system containing the mount point might be useful but possibly misleading. IMHO I'd include this commit as well.
So I don't need to do anything different here from what I am doing?
That's right, assuming the (three) commits I referred to above are in fact going in along with the three patches here. I assume they are since they are in the stable-queue repo.
That last paragraph just says that the third commit I referred to is optional but recommended IMO.
Ian
PATCH 133/262 ptrace: dont clear GROUP_STOP_SIGMASK on double-stop
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[This does not correspond to any specific patch in the upstream tree as it was fixed accidentally by rewriting the code in the 3.1 release]
https://bugzilla.redhat.com/show_bug.cgi?id=740121
1. Luke Macken triggered WARN_ON(!(group_stop & GROUP_STOP_SIGMASK)) in do_signal_stop().
This is because do_signal_stop() clears GROUP_STOP_SIGMASK part unconditionally but doesn't update it if task_is_stopped().
2. Looking at this problem I noticed that WARN_ON_ONCE(!ptrace) is not right, a stopped-but-resumed tracee can clone the untraced thread in the SIGNAL_STOP_STOPPED group, the new thread can start another group-stop.
Remove this warning, we need more fixes to make it true.
--- kernel/signal.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
kernel/signal.c +1 -3
@@ -1894,21 +1894,19 @@ static int do_signal_stop(int signr)*/ if (!(sig->flags &SIGNAL_STOP_STOPPED )) sig->group_exit_code = signr; -else -WARN_ON_ONCE (!task_ptrace (current)); current->group_stop &= ~GROUP_STOP_SIGMASK ; current->group_stop |= signr | gstop; sig->group_stop_count =1 ;for (t =next_thread (current); t != current; t =next_thread (t)) { - t->group_stop &= ~GROUP_STOP_SIGMASK ;/* * Setting state to TASK_STOPPED for a group * stop is always done with the siglock held, * so this check has no races. */ if (!(t->flags &PF_EXITING ) && !task_is_stopped (t)) { + t->group_stop &= ~GROUP_STOP_SIGMASK ; t->group_stop |= signr | gstop; sig->group_stop_count++;signal_wake_up (t,0 );
PATCH 134/262 jsm: remove buggy write queue
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 9d898966c4a07e4a5092215b5a2829d0ef02baa2 upstream.
jsm uses a write queue that copies from uart_core circular buffer. This copying however has some bugs, like not wrapping the head counter. Since this write queue is also a circular buffer, the consumer function is ready to use the uart_core circular buffer directly.
This buggy copying function was making some bytes be dropped when transmitting to a raw tty, doing something like this.
[root@hostname ~]$ cat /dev/ttyn1 > cascardo/dump &
[1] 2658
[root@hostname ~]$ cat /proc/tty/drivers > /dev/ttyn0 [root@hostname ~]$ cat /proc/tty/drivers
/dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaster jsm /dev/ttyn 250 0-31 serial serial /dev/ttyS 4 64-95 serial hvc /dev/hvc 229 0-7 system pty_slave /dev/pts 136 0-1048575 pty:slave pty_master /dev/ptm 128 0-1048575 pty:master unknown /dev/tty 4 1-63 console [root@hostname ~]$ cat cascardo/dump /dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaste[root@hostname ~]$
This patch drops the driver write queue entirely, using the circular buffer from uart_core only.
--- drivers/tty/serial/jsm/jsm.h | 7 -- drivers/tty/serial/jsm/jsm_driver.c | 1 drivers/tty/serial/jsm/jsm_neo.c | 29 +++++------ drivers/tty/serial/jsm/jsm_tty.c | 94 ++++-------------------------------- 4 files changed, 28 insertions(+), 103 deletions(-)
drivers/tty/serial/jsm/jsm.h +0 -7
@@ -183,10 +183,8 @@ struct jsm_board/* Our Read/Error/Write queue sizes */ #define RQUEUEMASK 0x1FFF/* 8 K - 1 */ #define EQUEUEMASK 0x1FFF/* 8 K - 1 */ -#define WQUEUEMASK 0x0FFF/* 4 K - 1 */ #define RQUEUESIZE (RQUEUEMASK + 1)#define EQUEUESIZE RQUEUESIZE -#define WQUEUESIZE (WQUEUEMASK + 1)/************************************************************************
@@ -226,10 +224,6 @@ struct jsm_channel {u16 ch_e_head;/* Head location of the error queue */ u16 ch_e_tail;/* Tail location of the error queue */ -u8 *ch_wqueue;/* Our write queue buffer - malloc'ed */ -u16 ch_w_head;/* Head location of the write queue */ -u16 ch_w_tail;/* Tail location of the write queue */ -u64 ch_rxcount;/* total of data received so far */ u64 ch_txcount;/* total of data transmitted so far */
@@ -378,7 +372,6 @@ extern int jsm_debug;* Prototypes for non-static functions used in more than one module * *************************************************************************/ -int jsm_tty_write (struct uart_port *port);int jsm_tty_init (struct jsm_board *);int jsm_uart_port_init (struct jsm_board *);int jsm_remove_uart_port (struct jsm_board *);
drivers/tty/serial/jsm/jsm_driver.c +0 -1
@@ -211,7 +211,6 @@ static void __devexit jsm_remove_one(strif (brd->channels[i]) {kfree (brd->channels[i]->ch_rqueue);kfree (brd->channels[i]->ch_equeue); -kfree (brd->channels[i]->ch_wqueue);kfree (brd->channels[i]); } }
drivers/tty/serial/jsm/jsm_neo.c +15 -14
@@ -496,12 +496,15 @@ static void neo_copy_data_from_queue_to_int s;int qlen;u32 len_written =0 ; +struct circ_buf *circ;if (!ch)return ; + circ = &ch->uart_port.state->xmit; +/* No data to write to the UART */ -if (ch->ch_w_tail == ch->ch_w_head) +if (uart_circ_empty (circ))return ;/* If port is "stopped", don't send any data to the UART */
@@ -517,11 +520,10 @@ static void neo_copy_data_from_queue_to_if (ch->ch_cached_lsr &UART_LSR_THRE ) { ch->ch_cached_lsr &= ~(UART_LSR_THRE ); -writeb (ch->ch_wqueue[ch->ch_w_tail], &ch->ch_neo_uart->txrx); +writeb (circ->buf[circ->tail], &ch->ch_neo_uart->txrx);jsm_printk (WRITE ,INFO , &ch->ch_bd->pci_dev, -"Tx data: %x\n" , ch->ch_wqueue[ch->ch_w_head]); - ch->ch_w_tail++; - ch->ch_w_tail &=WQUEUEMASK ; +"Tx data: %x\n" , circ->buf[circ->head]); + circ->tail = (circ->tail +1 ) & (UART_XMIT_SIZE -1 ); ch->ch_txcount++; }return ;
@@ -536,36 +538,36 @@ static void neo_copy_data_from_queue_to_ n =UART_17158_TX_FIFOSIZE - ch->ch_t_tlevel;/* cache head and tail of queue */ - head = ch->ch_w_head &WQUEUEMASK ; - tail = ch->ch_w_tail &WQUEUEMASK ; - qlen = (head - tail) &WQUEUEMASK ; + head = circ->head & (UART_XMIT_SIZE -1 ); + tail = circ->tail & (UART_XMIT_SIZE -1 ); + qlen =uart_circ_chars_pending (circ);/* Find minimum of the FIFO space, versus queue length */ n =min (n, qlen);while (n >0 ) { - s = ((head >= tail) ? head :WQUEUESIZE ) - tail; + s = ((head >= tail) ? head :UART_XMIT_SIZE ) - tail; s =min (s, n);if (s <=0 )break ; -memcpy_toio (&ch->ch_neo_uart->txrxburst, ch->ch_wqueue + tail, s); +memcpy_toio (&ch->ch_neo_uart->txrxburst, circ->buf + tail, s);/* Add and flip queue if needed */ - tail = (tail + s) &WQUEUEMASK ; + tail = (tail + s) & (UART_XMIT_SIZE -1 ); n -= s; ch->ch_txcount += s; len_written += s; }/* Update the final tail */ - ch->ch_w_tail = tail &WQUEUEMASK ; + circ->tail = tail & (UART_XMIT_SIZE -1 );if (len_written >= ch->ch_t_tlevel) ch->ch_flags &= ~(CH_TX_FIFO_EMPTY |CH_TX_FIFO_LWM ); -if (!jsm_tty_write (&ch->uart_port)) +if (uart_circ_empty (circ))uart_write_wakeup (&ch->uart_port); }
@@ -946,7 +948,6 @@ static void neo_param(struct jsm_channelif ((ch->ch_c_cflag & (CBAUD )) ==0 ) { ch->ch_r_head = ch->ch_r_tail =0 ; ch->ch_e_head = ch->ch_e_tail =0 ; - ch->ch_w_head = ch->ch_w_tail =0 ;neo_flush_uart_write (ch);neo_flush_uart_read (ch);
drivers/tty/serial/jsm/jsm_tty.c +13 -81
115 lines not on this page · raw message
PATCH 135/262 bonding: use local function pointer of bond->recv_probe in bond_handle_frame
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mitsuo Hayasaka <[email protected]>
[ Upstream commit 4d97480b1806e883eb1c7889d4e7a87e936e06d9 ]
The bond->recv_probe is called in bond_handle_frame() when a packet is received, but bond_close() sets it to NULL. So, a panic occurs when both functions work in parallel.
Why this happen:
After null pointer check of bond->recv_probe, an sk_buff is duplicated and bond->recv_probe is called in bond_handle_frame. So, a panic occurs when bond_close() is called between the check and call of bond->recv_probe.
Patch:
This patch uses a local function pointer of bond->recv_probe in bond_handle_frame(). So, it can avoid the null pointer dereference.
--- drivers/net/bonding/bond_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_main.c +5 -2
@@ -1500,6 +1500,8 @@ static rx_handler_result_t bond_handle_fstruct sk_buff *skb = *pskb;struct slave *slave;struct bonding *bond; +void (*recv_probe)(struct sk_buff *,struct bonding *, +struct slave *); skb =skb_share_check (skb,GFP_ATOMIC );if (unlikely (!skb))
@@ -1513,11 +1515,12 @@ static rx_handler_result_t bond_handle_fif (bond->params.arp_interval) slave->dev->last_rx = jiffies; -if (bond->recv_probe) { + recv_probe =ACCESS_ONCE (bond->recv_probe); +if (recv_probe) {struct sk_buff *nskb =skb_clone (skb,GFP_ATOMIC );if (likely (nskb)) { - bond->recv_probe (nskb, bond, slave); +recv_probe (nskb, bond, slave);dev_kfree_skb (nskb); } }
PATCH 136/262 bridge: fix hang on removal of bridge via netlink
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <[email protected]>
[ Upstream commit 1ce5cce895309862d2c35d922816adebe094fe4a ]
Need to cleanup bridge device timers and ports when being bridge device is being removed via netlink.
This fixes the problem of observed when doing:
ip link add br0 type bridge
ip link set dev eth1 master br0
ip link set br0 up
ip link del br0
which would cause br0 to hang in unregister_netdev because of leftover reference count.
--- net/bridge/br_if.c | 9 +++++---- net/bridge/br_netlink.c | 1 + net/bridge/br_private.h | 1 + 3 files changed, 7 insertions(+), 4 deletions(-)
net/bridge/br_if.c +5 -4
@@ -161,9 +161,10 @@ static void del_nbp(struct net_bridge_pocall_rcu (&p->rcu, destroy_nbp_rcu); } -/* called with RTNL */ -static void del_br (struct net_bridge *br,struct list_head *head) +/* Delete bridge device */ +void br_dev_delete (struct net_device *dev,struct list_head *head) { +struct net_bridge *br =netdev_priv (dev);struct net_bridge_port *p, *n;list_for_each_entry_safe (p, n, &br->port_list, list) {
@@ -268,7 +269,7 @@ int br_del_bridge(struct net *net, const }else -del_br (netdev_priv (dev),NULL ); +br_dev_delete (dev,NULL );rtnl_unlock ();return ret;
@@ -445,7 +446,7 @@ void __net_exit br_net_exit(struct net *rtnl_lock ();for_each_netdev (net, dev)if (dev->priv_flags &IFF_EBRIDGE ) -del_br (netdev_priv (dev), &list); +br_dev_delete (dev, &list);unregister_netdevice_many (&list);rtnl_unlock ();
net/bridge/br_netlink.c +1 -0
@@ -208,6 +208,7 @@ static struct rtnl_link_ops br_link_ops .priv_size = sizeof(struct net_bridge), .setup = br_dev_setup, .validate = br_validate, + .dellink = br_dev_delete, };int __init br_netlink_init (void )
net/bridge/br_private.h +1 -0
@@ -294,6 +294,7 @@ static inline int br_is_root_bridge(cons/* br_device.c */ extern void br_dev_setup (struct net_device *dev); +extern void br_dev_delete (struct net_device *dev,struct list_head *list);extern netdev_tx_t br_dev_xmit (struct sk_buff *skb,struct net_device *dev);#ifdef CONFIG_NET_POLL_CONTROLLER
PATCH 137/262 can bcm: fix tx_setup off-by-one errors
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit aabdcb0b553b9c9547b1a506b34d55a764745870 ]
This patch fixes two off-by-one errors that canceled each other out. Checking for the same condition two times in bcm_tx_timeout_tsklet() reduced the count of frames to be sent by one. This did not show up the first time tx_setup is invoked as an additional frame is sent due to TX_ANNONCE. Invoking a second tx_setup on the same item led to a reduced (by 1) number of sent frames.
--- net/can/bcm.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/can/bcm.c +7 -6
@@ -364,9 +364,6 @@ static void bcm_tx_timeout_tsklet(unsignbcm_send_to_user (op, &msg_head,NULL ,0 ); } - } - -if (op->kt_ival1.tv64 && (op->count >0 )) {/* send (next) frame */ bcm_can_tx (op);
@@ -969,8 +966,9 @@ static int bcm_tx_setup(struct bcm_msg_h/* spec: send can_frame when starting timer */ op->flags |=TX_ANNOUNCE ; -if (op->kt_ival1.tv64 && (op->count >0 )) { -/* op->count-- is done in bcm_tx_timeout_handler */ +/* only start timer when having more frames than sent below */ +if (op->kt_ival1.tv64 && (op->count >1 )) { +/* op->count-- is done in bcm_tx_timeout_tsklet */ hrtimer_start (&op->timer, op->kt_ival1,HRTIMER_MODE_REL ); }else
@@ -978,8 +976,11 @@ static int bcm_tx_setup(struct bcm_msg_h HRTIMER_MODE_REL); } -if (op->flags &TX_ANNOUNCE ) +if (op->flags &TX_ANNOUNCE ) {bcm_can_tx (op); +if (op->kt_ival1.tv64 && (op->count >0 )) + op->count--; + }return msg_head->nframes *CFSIZ +MHSIZ ; }
PATCH 138/262 ipv4: fix ipsec forward performance regression
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
[ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ]
There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable). It makes xfrm4_fill_dst() modify wrong data structure.
--- net/ipv4/xfrm4_policy.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/ipv4/xfrm4_policy.c +7 -7
@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_dsstruct rtable *rt = (struct rtable *)xdst->route;const struct flowi4 *fl4 = &fl->u.ip4; - rt->rt_key_dst = fl4->daddr; - rt->rt_key_src = fl4->saddr; - rt->rt_key_tos = fl4->flowi4_tos; - rt->rt_route_iif = fl4->flowi4_iif; - rt->rt_iif = fl4->flowi4_iif; - rt->rt_oif = fl4->flowi4_oif; - rt->rt_mark = fl4->flowi4_mark; + xdst->u.rt.rt_key_dst = fl4->daddr; + xdst->u.rt.rt_key_src = fl4->saddr; + xdst->u.rt.rt_key_tos = fl4->flowi4_tos; + xdst->u.rt.rt_route_iif = fl4->flowi4_iif; + xdst->u.rt.rt_iif = fl4->flowi4_iif; + xdst->u.rt.rt_oif = fl4->flowi4_oif; + xdst->u.rt.rt_mark = fl4->flowi4_mark; xdst->u.dst.dev = dev;dev_hold (dev);
PATCH 139/262 l2tp: fix a potential skb leak in l2tp_xmit_skb()
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 835acf5da239b91edb9f7ebe36516999e156e6ee ]
l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error.
--- net/l2tp/l2tp_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/l2tp/l2tp_core.c +3 -1
@@ -1045,8 +1045,10 @@ int l2tp_xmit_skb(struct l2tp_session *s headroom =NET_SKB_PAD +sizeof (struct iphdr ) + uhlen + hdr_len; old_headroom =skb_headroom (skb); -if (skb_cow_head (skb, headroom)) +if (skb_cow_head (skb, headroom)) { +dev_kfree_skb (skb); goto abort; + } new_headroom =skb_headroom (skb);skb_orphan (skb);
PATCH 140/262 macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ward <[email protected]>
[ Upstream commit cb2d0f3e968bff7c6d262aca3e3ab8d4184e69b2 ]
Packets should always be forwarded to the lowerdev using dev_forward_skb. vlan->forward is for packets being forwarded directly to another macvlan/ macvtap device (used for multicast in bridge mode).
--- drivers/net/macvlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/macvlan.c +1 -1
@@ -239,7 +239,7 @@ static int macvlan_queue_xmit(struct sk_ dest =macvlan_hash_lookup (port, eth->h_dest);if (dest && dest->mode ==MACVLAN_MODE_BRIDGE ) {/* send to lowerdev first for its network taps */ - vlan->forward (vlan->lowerdev, skb); +dev_forward_skb (vlan->lowerdev, skb);return NET_XMIT_SUCCESS ; }
PATCH 141/262 netconsole: enable netconsole can make net_device refcnt incorrent
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao feng <[email protected]>
[ Upstream commit d5123480b1d6f7d1a5fe1a13520cef88fb5d4c84 ]
There is no check if netconsole is enabled current. so when exec echo 1 > enabled;
the reference of net_device will increment always.
--- drivers/net/netconsole.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/netconsole.c +5 -0
@@ -307,6 +307,11 @@ static ssize_t store_enabled(struct netcreturn err;if (enabled <0 || enabled >1 )return -EINVAL ; +if (enabled == nt->enabled) { +printk (KERN_INFO "netconsole: network logging has already %s\n" , + nt->enabled ?"started" :"stopped" ); +return -EINVAL ; + }if (enabled) {/* 1 */
PATCH 142/262 tcp: properly handle md5sig_pool references
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
[ Upstream commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 ]
tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers only hold one reference to md5sig_pool. but tcp_v4_md5_do_add() increases use count of md5sig_pool for each peer. This patch makes tcp_v4_md5_do_add() only increases use count for the first tcp md5sig peer.
--- net/ipv4/tcp_ipv4.c | 11 +++++++---- net/ipv6/tcp_ipv6.c | 8 +++++--- 2 files changed, 12 insertions(+), 7 deletions(-)
net/ipv4/tcp_ipv4.c +7 -4
@@ -909,18 +909,21 @@ int tcp_v4_md5_do_add(struct sock *sk, _ }sk_nocaps_add (sk,NETIF_F_GSO_MASK ); } -if (tcp_alloc_md5sig_pool (sk) ==NULL ) { + + md5sig = tp->md5sig_info; +if (md5sig->entries4 ==0 && +tcp_alloc_md5sig_pool (sk) ==NULL ) {kfree (newkey);return -ENOMEM ; } - md5sig = tp->md5sig_info;if (md5sig->alloced4 == md5sig->entries4) { keys =kmalloc ((sizeof (*keys) * (md5sig->entries4 +1 )),GFP_ATOMIC );if (!keys) {kfree (newkey); -tcp_free_md5sig_pool (); +if (md5sig->entries4 ==0 ) +tcp_free_md5sig_pool ();return -ENOMEM ; }
@@ -964,6 +967,7 @@ int tcp_v4_md5_do_del(struct sock *sk, _kfree (tp->md5sig_info->keys4); tp->md5sig_info->keys4 =NULL ; tp->md5sig_info->alloced4 =0 ; +tcp_free_md5sig_pool (); }else if (tp->md5sig_info->entries4 != i) {/* Need to do some manipulation */ memmove(&tp->md5sig_info->keys4[i],
@@ -971,7 +975,6 @@ int tcp_v4_md5_do_del(struct sock *sk, _ (tp->md5sig_info->entries4 - i) * sizeof(struct tcp4_md5sig_key)); } -tcp_free_md5sig_pool ();return 0 ; } }
net/ipv6/tcp_ipv6.c +5 -3
@@ -605,7 +605,8 @@ static int tcp_v6_md5_do_add(struct sock }sk_nocaps_add (sk,NETIF_F_GSO_MASK ); } -if (tcp_alloc_md5sig_pool (sk) ==NULL ) { +if (tp->md5sig_info->entries6 ==0 && +tcp_alloc_md5sig_pool (sk) ==NULL ) {kfree (newkey);return -ENOMEM ; }
@@ -614,8 +615,9 @@ static int tcp_v6_md5_do_add(struct sock (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);if (!keys) { -tcp_free_md5sig_pool ();kfree (newkey); +if (tp->md5sig_info->entries6 ==0 ) +tcp_free_md5sig_pool ();return -ENOMEM ; }
@@ -661,6 +663,7 @@ static int tcp_v6_md5_do_del(struct sockkfree (tp->md5sig_info->keys6); tp->md5sig_info->keys6 =NULL ; tp->md5sig_info->alloced6 =0 ; +tcp_free_md5sig_pool (); }else {/* shrink the database */ if (tp->md5sig_info->entries6 != i)
@@ -669,7 +672,6 @@ static int tcp_v6_md5_do_del(struct sock (tp->md5sig_info->entries6 - i) * sizeof (tp->md5sig_info->keys6[0])); } -tcp_free_md5sig_pool ();return 0 ; } }
PATCH 143/262 tcp: properly update lost_cnt_hint during shifting
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
[ Upstream commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f ]
lost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb. lost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint; When shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture, the skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false, tcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not need to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to lost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost(). So tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true.
--- net/ipv4/tcp_input.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv4/tcp_input.c +1 -3
@@ -1380,9 +1380,7 @@ static int tcp_shifted_skb(struct sock *BUG_ON (!pcount); -/* Tweak before seqno plays */ -if (!tcp_is_fack (tp) &&tcp_is_sack (tp) && tp->lost_skb_hint && - !before (TCP_SKB_CB (tp->lost_skb_hint)->seq,TCP_SKB_CB (skb)->seq)) +if (skb == tp->lost_skb_hint) tp->lost_cnt_hint += pcount;TCP_SKB_CB (prev)->end_seq += shifted;
PATCH 144/262 tg3: negate USE_PHYLIB flag check
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit e730c82347b9dc75914da998c44c3f348965db41 ]
USE_PHYLIB flag in tg3_remove_one() is being checked incorrectly. This results tg3_phy_fini->phy_disconnect is never called and when tg3 module is removed.
In my case this resulted in panics in phy_state_machine calling function phydev->adjust_link.
So correct this check.
--- drivers/net/tg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tg3.c +1 -1
@@ -15278,7 +15278,7 @@ static void __devexit tg3_remove_one(strcancel_work_sync (&tp->reset_task); -if (!tg3_flag (tp,USE_PHYLIB )) { +if (tg3_flag (tp,USE_PHYLIB )) {tg3_phy_fini (tp);tg3_mdio_fini (tp); }
PATCH 145/262 ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
[ Upstream commit 676a1184e8afd4fed7948232df1ff91517400859 ]
ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently shared with new socket created for connection.
--- net/ipv6/tcp_ipv6.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/tcp_ipv6.c +3 -0
@@ -1409,6 +1409,8 @@ static struct sock * tcp_v6_syn_recv_soc newtp->af_specific = &tcp_sock_ipv6_mapped_specific;#endif + newnp->ipv6_ac_list =NULL ; + newnp->ipv6_fl_list =NULL ; newnp->pktoptions =NULL ; newnp->opt =NULL ; newnp->mcast_oif =inet6_iif (skb);
@@ -1473,6 +1475,7 @@ static struct sock * tcp_v6_syn_recv_socFirst: no IPv4 options. */ newinet->inet_opt =NULL ; + newnp->ipv6_ac_list =NULL ; newnp->ipv6_fl_list =NULL ;/* Clone RX bits */
PATCH 146/262 make PACKET_STATISTICS getsockopt report consistently between ring and non-ring
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d ]
This is a minor change.
Up until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS, ...) would return total and dropped packets since its last invocation. The introduction of socket queue overflow reporting [1] changed drop rate calculation in the normal packet socket path, but not when using a packet ring. As a result, the getsockopt now returns different statistics depending on the reception method used. With a ring, it still returns the count since the last call, as counts are incremented in tpacket_rcv and reset in getsockopt. Without a ring, it returns 0 if no drops occurred since the last getsockopt and the total drops over the lifespan of the socket otherwise. The culprit is this line in packet_rcv, executed on a drop:
drop_n_acct:
po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
As it shows, the new drop number it taken from the socket drop counter, which is not reset at getsockopt. I put together a small example that demonstrates the issue [2]. It runs for 10 seconds and overflows the queue/ring on every odd second. The reported drop rates are:
ring: 16, 0, 16, 0, 16, ...
non-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74.
Note how the even ring counts monotonically increase. Because the getsockopt adds tp_drops to tp_packets, total counts are similarly reported cumulatively. Long story short, reinstating the original code, as the below patch does, fixes the issue at the cost of additional per-packet cycles. Another solution that does not introduce per-packet overhead is be to keep the current data path, record the value of sk_drops at getsockopt() at call N in a new field in struct packetsock and subtract that when reporting at call N+1. I'll be happy to code that, instead, it's just more messy.
[1] http://patchwork.ozlabs.org/patch/35665/
[2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c
--- net/packet/af_packet.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/packet/af_packet.c +4 -1
@@ -654,7 +654,10 @@ static int packet_rcv(struct sk_buff *skreturn 0 ; drop_n_acct: - po->stats.tp_drops =atomic_inc_return (&sk->sk_drops); +spin_lock (&sk->sk_receive_queue.lock); + po->stats.tp_drops++; +atomic_inc (&sk->sk_drops); +spin_unlock (&sk->sk_receive_queue.lock); drop_n_restore:if (skb_head != skb->data &&skb_shared (skb)) {
PATCH 147/262 net: xen-netback: correctly restart Tx after a VM restore/migrate
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Vrabel <[email protected]>
[ Upstream commit d0e5d83284dac15c015bb48115b6780f5a6413cd ]
If a VM is saved and restored (or migrated) the netback driver will no longer process any Tx packets from the frontend. xenvif_up() does not schedule the processing of any pending Tx requests from the front end because the carrier is off. Without this initial kick the frontend just adds Tx requests to the ring without raising an event (until the ring is full).
This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net:
xen-netback: convert to hw_features) which reordered the calls to xenvif_up() and netif_carrier_on() in xenvif_connect().
--- drivers/net/xen-netback/interface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/xen-netback/interface.c +2 -2
@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, uxenvif_get (vif);rtnl_lock (); -if (netif_running (vif->dev)) -xenvif_up (vif);if (!vif->can_sg && vif->dev->mtu >ETH_DATA_LEN )dev_set_mtu (vif->dev,ETH_DATA_LEN );netdev_update_features (vif->dev);netif_carrier_on (vif->dev); +if (netif_running (vif->dev)) +xenvif_up (vif);rtnl_unlock ();return 0 ;
PATCH 148/262 mm: thp: tail page refcounting fix
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <[email protected]>
commit 70b50f94f1644e2aa7cb374819cfd93f3c28d725 upstream.
Michel while working on the working set estimation code, noticed that calling get_page_unless_zero() on a random pfn_to_page(random_pfn) wasn't safe, if the pfn ended up being a tail page of a transparent hugepage under splitting by __split_huge_page_refcount().
He then found the problem could also theoretically materialize with page_cache_get_speculative() during the speculative radix tree lookups that uses get_page_unless_zero() in SMP if the radix tree page is freed and reallocated and get_user_pages is called on it before page_cache_get_speculative has a chance to call get_page_unless_zero().
So the best way to fix the problem is to keep page_tail->_count zero at all times. This will guarantee that get_page_unless_zero() can never succeed on any tail page. page_tail->_mapcount is guaranteed zero and is unused for all tail pages of a compound page, so we can simply account the tail page references there and transfer them to tail_page->_count in __split_huge_page_refcount() (in addition to the head_page->_mapcount).
While debugging this s/_count/_mapcount/ change I also noticed get_page is called by direct-io.c on pages returned by get_user_pages. That wasn't entirely safe because the two atomic_inc in get_page weren't atomic. As opposed to other get_user_page users like secondary-MMU page fault to establish the shadow pagetables would never call any superflous get_page after get_user_page returns. It's safer to make get_page universally safe for tail pages and to use get_page_foll() within follow_page (inside get_user_pages()). get_page_foll() is safe to do the refcounting for tail pages without taking any locks because it is run within PT lock protected critical sections (PT lock for pte and page_table_lock for pmd_trans_huge).
The standard get_page() as invoked by direct-io instead will now take the compound_lock but still only for tail pages. The direct-io paths are usually I/O bound and the compound_lock is per THP so very finegrined, so there's no risk of scalability issues with it. A simple direct-io benchmarks with all lockdep prove locking and spinlock debugging infrastructure enabled shows identical performance and no overhead. So it's worth it. Ideally direct-io should stop calling get_page() on pages returned by get_user_pages(). The spinlock in get_page() is already optimized away for no-THP builds but doing get_page() on tail pages returned by GUP is generally a rare operation and usually only run in I/O paths.
This new refcounting on page_tail->_mapcount in addition to avoiding new RCU critical sections will also allow the working set estimation code to work without any further complexity associated to the tail page refcounting with THP.
--- arch/powerpc/mm/gup.c | 5 +- arch/x86/mm/gup.c | 5 +- include/linux/mm.h | 56 ++++++++++++------------------- include/linux/mm_types.h | 22 ++++++++++-- mm/huge_memory.c | 37 ++++++++++++++------ mm/internal.h | 46 ++++++++++++++++++++++++++ mm/memory.c | 2 - mm/swap.c | 83 ++++++++++++++++++++++++++++++----------------- 8 files changed, 172 insertions(+), 84 deletions(-)
arch/powerpc/mm/gup.c +3 -2
@@ -22,8 +22,9 @@ static inline void get_huge_page_tail(st* __split_huge_page_refcount() cannot run * from under us. */ -VM_BUG_ON (atomic_read (&page->_count) <0 ); -atomic_inc (&page->_count); +VM_BUG_ON (page_mapcount (page) <0 ); +VM_BUG_ON (atomic_read (&page->_count) !=0 ); +atomic_inc (&page->_mapcount); }/*
arch/x86/mm/gup.c +3 -2
@@ -114,8 +114,9 @@ static inline void get_huge_page_tail(st* __split_huge_page_refcount() cannot run * from under us. */ -VM_BUG_ON (atomic_read (&page->_count) <0 ); -atomic_inc (&page->_count); +VM_BUG_ON (page_mapcount (page) <0 ); +VM_BUG_ON (atomic_read (&page->_count) !=0 ); +atomic_inc (&page->_mapcount); } static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr,
include/linux/mm.h +22 -34
79 lines not on this page · raw message
include/linux/mm_types.h +18 -4
@@ -36,10 +36,24 @@ struct page {* updated asynchronously */ atomic_t _count;/* Usage count, see below. */ union { -atomic_t _mapcount;/* Count of ptes mapped in mms, -* to show when page is mapped -* & limit reverse map searches. -*/ +/* +* Count of ptes mapped in +* mms, to show when page is +* mapped & limit reverse map +* searches. +* +* Used also for tail pages +* refcounting instead of +* _count. Tail pages cannot +* be mapped and keeping the +* tail page _count zero at +* all times guarantees +* get_page_unless_zero() will +* never succeed on tail +* pages. +*/ +atomic_t _mapcount; +struct {/* SLUB */ u16 inuse;u16 objects;
mm/huge_memory.c +26 -11
@@ -989,7 +989,7 @@ struct page *follow_trans_huge_pmd(struc page += (addr & ~HPAGE_PMD_MASK ) >>PAGE_SHIFT ;VM_BUG_ON (!PageCompound (page));if (flags &FOLL_GET ) -get_page (page); +get_page_foll (page); out:return page;
@@ -1156,6 +1156,7 @@ static void __split_huge_page_refcount(sunsigned long head_index = page->index;struct zone *zone =page_zone (page);int zonestat; +int tail_count =0 ;/* prevent PageLRU to go away from under us, and freeze lru stats */ spin_lock_irq (&zone->lru_lock);
@@ -1164,11 +1165,27 @@ static void __split_huge_page_refcount(sfor (i =1 ; i <HPAGE_PMD_NR ; i++) {struct page *page_tail = page + i; -/* tail_page->_count cannot change */ -atomic_sub (atomic_read (&page_tail->_count), &page->_count); -BUG_ON (page_count (page) <=0 ); -atomic_add (page_mapcount (page) +1 , &page_tail->_count); -BUG_ON (atomic_read (&page_tail->_count) <=0 ); +/* tail_page->_mapcount cannot change */ +BUG_ON (page_mapcount (page_tail) <0 ); + tail_count +=page_mapcount (page_tail); +/* check for overflow */ +BUG_ON (tail_count <0 ); +BUG_ON (atomic_read (&page_tail->_count) !=0 ); +/* +* tail_page->_count is zero and not changing from +* under us. But get_page_unless_zero() may be running +* from under us on the tail_page. If we used +* atomic_set() below instead of atomic_add(), we +* would then run atomic_set() concurrently with +* get_page_unless_zero(), and atomic_set() is +* implemented in C not using locked ops. spin_unlock +* on x86 sometime uses locked ops because of PPro +* errata 66, 92, so unless somebody can guarantee +* atomic_set() here would be safe on all archs (and +* not only on x86), it's safer to use atomic_add(). +*/ +atomic_add (page_mapcount (page) +page_mapcount (page_tail) +1 , + &page_tail->_count);/* after clearing PageTail the gup refcount can be released */ smp_mb ();
@@ -1186,10 +1203,7 @@ static void __split_huge_page_refcount(s (1L << PG_uptodate))); page_tail->flags |= (1L << PG_dirty); -/* -* 1) clear PageTail before overwriting first_page -* 2) clear PageTail before clearing PageHead for VM_BUG_ON -*/ +/* clear PageTail before overwriting first_page */ smp_wmb ();/*
@@ -1206,7 +1220,6 @@ static void __split_huge_page_refcount(s* status is achieved setting a reserved bit in the * pmd, not by clearing the present bit. */ -BUG_ON (page_mapcount (page_tail)); page_tail->_mapcount = page->_mapcount;BUG_ON (page_tail->mapping);
@@ -1223,6 +1236,8 @@ static void __split_huge_page_refcount(slru_add_page_tail (zone, page, page_tail); } +atomic_sub (tail_count, &page->_count); +BUG_ON (atomic_read (&page->_count) <=0 );__dec_zone_page_state (page,NR_ANON_TRANSPARENT_HUGEPAGES );__mod_zone_page_state (zone,NR_ANON_PAGES ,HPAGE_PMD_NR );
mm/internal.h +46 -0
52 lines not on this page · raw message
mm/memory.c +1 -1
@@ -1514,7 +1514,7 @@ split_fallthrough: }if (flags &FOLL_GET ) -get_page (page); +get_page_foll (page);if (flags &FOLL_TOUCH ) {if ((flags &FOLL_WRITE ) && !pte_dirty (pte) && !PageDirty (page))
mm/swap.c +53 -30
114 lines not on this page · raw message
PATCH 149/262 binfmt_elf: fix PIE execution with randomization disabled
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit a3defbe5c337dbc6da911f8cc49ae3cc3b49b453 upstream.
The case of address space randomization being disabled in runtime through randomize_va_space sysctl is not treated properly in load_elf_binary(), resulting in SIGKILL coming at exec() time for certain PIE-linked binaries in case the randomization has been disabled at runtime prior to calling exec().
Handle the randomize_va_space == 0 case the same way as if we were not supporting .text randomization at all.
Based on original patch by H.J. Lu and Josh Boyer.
--- fs/binfmt_elf.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/binfmt_elf.c +10 -1
@@ -796,7 +796,16 @@ static int load_elf_binary(struct linux_* might try to exec. This is because the brk will * follow the loader, and is not movable. */ #if defined(CONFIG_X86 ) || defined(CONFIG_ARM ) - load_bias =0 ; +/* Memory randomization might have been switched off +* in runtime via sysctl. +* If that is the case, retain the original non-zero +* load_bias value in order to establish proper +* non-randomized mappings. +*/ +if (current->flags &PF_RANDOMIZE ) + load_bias =0 ; +else + load_bias =ELF_PAGESTART (ELF_ET_DYN_BASE - vaddr);#else load_bias =ELF_PAGESTART (ELF_ET_DYN_BASE - vaddr);#endif
PATCH 150/262 vfs: show O_CLOEXE bit properly in /proc/<pid>/fdinfo/<fd> files
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 1117f72ea0217ba0cc19f05adbbd8b9a397f5ab7 upstream.
The CLOEXE bit is magical, and for performance (and semantic) reasons we don't actually maintain it in the file descriptor itself, but in a separate bit array. Which means that when we show f_flags, the CLOEXE status is shown incorrectly: we show the status not as it is now, but as it was when the file was opened.
Fix that by looking up the bit properly in the 'fdt->close_on_exec' bit array.
Uli needs this in order to re-implement the pfiles program:
"For normal file descriptors (not sockets) this was the last piece of
information which wasn't available. This is all part of my 'give Solaris users no reason to not switch' effort. I intend to offer the code to the util-linux-ng maintainers."
--- fs/proc/base.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/proc/base.c +9 -1
@@ -1920,6 +1920,14 @@ static int proc_fd_info(struct inode *inspin_lock (&files->file_lock); file =fcheck_files (files, fd);if (file) { +unsigned int f_flags; +struct fdtable *fdt; + + fdt =files_fdtable (files); + f_flags = file->f_flags & ~O_CLOEXEC ; +if (FD_ISSET (fd, fdt->close_on_exec)) + f_flags |=O_CLOEXEC ; +if (path) { *path = file->f_path;path_get (&file->f_path);
@@ -1929,7 +1937,7 @@ static int proc_fd_info(struct inode *in"pos:\t%lli\n" "flags:\t0%o\n" , (long long ) file->f_pos, - file->f_flags); + f_flags);spin_unlock (&files->file_lock);put_files_struct (files);return 0 ;
PATCH 151/262 iwlagn: do not use interruptible waits
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
Upstream commit effd4d9aece9184f526e6556786a94d335e38b71.
Since the dawn of its time, iwlwifi has used interruptible waits to wait for synchronous commands and firmware loading.
This leads to "interesting" bugs, because it can't actually handle the interruptions; for example when a command sending is interrupted it will assume the command completed fully, and then leave it pending, which leads to all kinds of trouble when the command finishes later.
Since there's no easy way to gracefully deal with interruptions, fix the driver to not use interruptible waits.
This at least fixes the error
iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD'
I have seen in P2P testing, but it is likely that there are other errors caused by this.
--- drivers/net/wireless/iwlwifi/iwl-agn-ucode.c | 9 ++------- drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +- drivers/net/wireless/iwlwifi/iwl-core.c | 4 ++-- drivers/net/wireless/iwlwifi/iwl-hcmd.c | 2 +- drivers/net/wireless/iwlwifi/iwl-rx.c | 2 +- drivers/net/wireless/iwlwifi/iwl-tx.c | 2 +- 6 files changed, 8 insertions(+), 13 deletions(-)
drivers/net/wireless/iwlwifi/iwl-agn-ucode.c +2 -7
@@ -144,13 +144,8 @@ static int iwlagn_load_section(struct iw FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);IWL_DEBUG_INFO (priv,"%s uCode section being loaded...\n" , name); - ret =wait_event_interruptible_timeout (priv->wait_command_queue, - priv->ucode_write_complete,5 *HZ ); -if (ret == -ERESTARTSYS ) { -IWL_ERR (priv,"Could not load the %s uCode section due " -"to interrupt\n" , name); -return ret; - } + ret =wait_event_timeout (priv->wait_command_queue, + priv->ucode_write_complete,5 *HZ );if (!ret) {IWL_ERR (priv,"Could not load the %s uCode section\n" , name);
drivers/net/wireless/iwlwifi/iwl-agn.c +1 -1
@@ -797,7 +797,7 @@ static void iwl_irq_tasklet(struct iwl_p handled |=CSR_INT_BIT_FH_TX ;/* Wake up uCode load routine, now that load is complete */ priv->ucode_write_complete =1 ; -wake_up_interruptible (&priv->wait_command_queue); +wake_up (&priv->wait_command_queue); }if (inta & ~handled) {
drivers/net/wireless/iwlwifi/iwl-core.c +2 -2
@@ -899,7 +899,7 @@ void iwlagn_fw_error(struct iwl_priv *pr* commands by clearing the ready bit */ clear_bit (STATUS_READY , &priv->status); -wake_up_interruptible (&priv->wait_command_queue); +wake_up (&priv->wait_command_queue);if (!ondemand) {/*
@@ -950,7 +950,7 @@ void iwl_irq_handle_error(struct iwl_pri*/ clear_bit (STATUS_READY , &priv->status);clear_bit (STATUS_HCMD_ACTIVE , &priv->status); -wake_up_interruptible (&priv->wait_command_queue); +wake_up (&priv->wait_command_queue);IWL_ERR (priv,"RF is used by WiMAX\n" );return ; }
drivers/net/wireless/iwlwifi/iwl-hcmd.c +1 -1
@@ -194,7 +194,7 @@ int iwl_send_cmd_sync(struct iwl_priv *preturn ret; } - ret =wait_event_interruptible_timeout (priv->wait_command_queue, + ret =wait_event_timeout (priv->wait_command_queue, !test_bit (STATUS_HCMD_ACTIVE , &priv->status),HOST_COMPLETE_TIMEOUT );if (!ret) {
drivers/net/wireless/iwlwifi/iwl-rx.c +1 -1
@@ -738,7 +738,7 @@ static void iwl_rx_card_state_notif(struwiphy_rfkill_set_hw_state (priv->hw->wiphy,test_bit (STATUS_RF_KILL_HW , &priv->status)); else - wake_up_interruptible(&priv->wait_command_queue); + wake_up(&priv->wait_command_queue); } static void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
drivers/net/wireless/iwlwifi/iwl-tx.c +1 -1
@@ -821,7 +821,7 @@ void iwl_tx_cmd_complete(struct iwl_privclear_bit (STATUS_HCMD_ACTIVE , &priv->status);IWL_DEBUG_INFO (priv,"Clearing HCMD_ACTIVE for command %s\n" ,get_cmd_string (cmd->hdr.cmd)); -wake_up_interruptible (&priv->wait_command_queue); +wake_up (&priv->wait_command_queue); }/* Mark as unmapped */
PATCH 152/262 drivers/net/rionet.c: fix ethernet address macros for LE platforms
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Bounine <[email protected]>
commit e0c87bd95e8dad455c23bc56513af8dcb1737e55 upstream.
Modify Ethernet addess macros to be compatible with BE/LE platforms
--- drivers/net/rionet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/rionet.c +2 -2
@@ -88,8 +88,8 @@ static struct rio_dev **rionet_active;#define dev_rionet_capable (dev) \ is_rionet_capable(dev->src_ops, dev->dst_ops) -#define RIONET_MAC_MATCH (x) (*(u32 *)x == 0x00010001) -#define RIONET_GET_DESTID (x) (*(u16 *)(x + 4)) +#define RIONET_MAC_MATCH (x) (!memcmp((x), "\00\01\00\01", 4)) +#define RIONET_GET_DESTID (x) ((*((u8 *)x + 4) << 8) | *((u8 *)x + 5))static int rionet_rx_clean (struct net_device *ndev) {
PATCH 153/262 hwspinlock/core: use a mutex to protect the radix tree
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juan Gutierrez <[email protected]>
commit 93b465c2e186d96fb90012ba0f9372eb9952e732 upstream.
Since we're using non-atomic radix tree allocations, we should be protecting the tree using a mutex and not a spinlock.
Non-atomic allocations and process context locking is good enough, as the tree is manipulated only when locks are registered/ unregistered/requested/freed.
The locks themselves are still protected by spinlocks of course, and mutexes are not involved in the locking/unlocking paths.
[[email protected]: rewrite the commit log, #include mutex.h, add minor commentary]
--- Documentation/hwspinlock.txt | 18 +++++--------- drivers/hwspinlock/hwspinlock_core.c | 45 +++++++++++++++-------------------- 2 files changed, 27 insertions(+), 36 deletions(-)
Documentation/hwspinlock.txt +7 -11
@@ -39,23 +39,20 @@ independent, drivers. in case an unused hwspinlock isn't available. Users of this API will usually want to communicate the lock's id to the remote core before it can be used to achieve synchronization. - Can be called from an atomic context (this function will not sleep) but - not from within interrupt context. + Should be called from a process context (might sleep). struct hwspinlock *hwspin_lock_request_specific(unsigned int id); - assign a specific hwspinlock id and return its address, or NULL if that hwspinlock is already in use. Usually board code will be calling this function in order to reserve specific hwspinlock ids for predefined purposes. - Can be called from an atomic context (this function will not sleep) but - not from within interrupt context. + Should be called from a process context (might sleep). int hwspin_lock_free(struct hwspinlock *hwlock); - free a previously-assigned hwspinlock; returns 0 on success, or an appropriate error code on failure (e.g. -EINVAL if the hwspinlock is already free). - Can be called from an atomic context (this function will not sleep) but - not from within interrupt context. + Should be called from a process context (might sleep). int hwspin_lock_timeout(struct hwspinlock *hwlock, unsigned int timeout); - lock a previously-assigned hwspinlock with a timeout limit (specified in
@@ -232,15 +229,14 @@ int hwspinlock_example2(void) int hwspin_lock_register(struct hwspinlock *hwlock); - to be called from the underlying platform-specific implementation, in - order to register a new hwspinlock instance. Can be called from an atomic - context (this function will not sleep) but not from within interrupt - context. Returns 0 on success, or appropriate error code on failure. + order to register a new hwspinlock instance. Should be called from + a process context (this function might sleep). + Returns 0 on success, or appropriate error code on failure. struct hwspinlock *hwspin_lock_unregister(unsigned int id); - to be called from the underlying vendor-specific implementation, in order to unregister an existing (and unused) hwspinlock instance. - Can be called from an atomic context (will not sleep) but not from - within interrupt context. + Should be called from a process context (this function might sleep). Returns the address of hwspinlock on success, or NULL on error (e.g. if the hwspinlock is sill in use).
drivers/hwspinlock/hwspinlock_core.c +20 -25
149 lines not on this page · raw message
PATCH 154/262 drivers/power/ds2780_battery.c: create central point for calling w1 interface
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clifton Barnes <[email protected]>
commit 853eee72f74f449797f0500ea19fc1bf497428d8 upstream.
Simply creates one point to call the w1 interface.
--- drivers/power/ds2780_battery.c | 77 ++++++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 35 deletions(-)
drivers/power/ds2780_battery.c +42 -35
@@ -49,8 +49,8 @@ enum current_types {static const char model[] ="DS2780" ;static const char manufacturer[] ="Maxim/Dallas" ; -static inline struct ds2780_device_info *to_ds2780_device_info ( -struct power_supply *psy) +static inline struct ds2780_device_info * +to_ds2780_device_info (struct power_supply *psy) { return container_of(psy, struct ds2780_device_info, bat); }
@@ -60,17 +60,25 @@ static inline struct power_supply *to_poreturn dev_get_drvdata (dev); } -static inline int ds2780_read8 (struct device *dev,u8 *val,int addr) +static inline int ds2780_battery_io (struct ds2780_device_info *dev_info, +char *buf,int addr,size_t count,int io) { -return w1_ds2780_io (dev, val, addr,sizeof (u8),0 ); +return w1_ds2780_io (dev_info->w1_dev, buf, addr, count, io); } -static int ds2780_read16 (struct device *dev,s16 *val,int addr) +static inline int ds2780_read8 (struct ds2780_device_info *dev_info,u8 *val, +int addr) +{ +return ds2780_battery_io (dev_info, val, addr,sizeof (u8),0 ); +} + +static int ds2780_read16 (struct ds2780_device_info *dev_info,s16 *val, +int addr) {int ret;u8 raw[2 ]; - ret =w1_ds2780_io (dev, raw, addr,sizeof (u8) *2 ,0 ); + ret =ds2780_battery_io (dev_info, raw, addr,sizeof (raw),0 );if (ret <0 )return ret;
@@ -79,16 +87,16 @@ static int ds2780_read16(struct device *return 0 ; } -static inline int ds2780_read_block (struct device *dev,u8 *val,int addr, -size_t count) +static inline int ds2780_read_block (struct ds2780_device_info *dev_info, +u8 *val,int addr,size_t count) { -return w1_ds2780_io (dev, val, addr, count,0 ); +return ds2780_battery_io (dev_info, val, addr, count,0 ); } -static inline int ds2780_write (struct device *dev,u8 *val,int addr, -size_t count) +static inline int ds2780_write (struct ds2780_device_info *dev_info,u8 *val, +int addr,size_t count) { -return w1_ds2780_io (dev, val, addr, count,1 ); +return ds2780_battery_io (dev_info, val, addr, count,1 ); }static inline int ds2780_store_eeprom (struct device *dev,int addr)
@@ -122,7 +130,7 @@ static int ds2780_set_sense_register(str {int ret; - ret =ds2780_write (dev_info->w1_dev, &conductance, + ret =ds2780_write (dev_info, &conductance,DS2780_RSNSP_REG ,sizeof (u8));if (ret <0 )return ret;
@@ -134,7 +142,7 @@ static int ds2780_set_sense_register(strstatic int ds2780_get_rsgain_register (struct ds2780_device_info *dev_info,u16 *rsgain) { -return ds2780_read16 (dev_info->w1_dev, rsgain,DS2780_RSGAIN_MSB_REG ); +return ds2780_read16 (dev_info, rsgain,DS2780_RSGAIN_MSB_REG ); }/* Set RSGAIN value from 0 to 1.999 in steps of 0.001 */
@@ -144,8 +152,8 @@ static int ds2780_set_rsgain_register(stint ret;u8 raw[] = {rsgain >>8 , rsgain &0xFF }; - ret =ds2780_write (dev_info->w1_dev, raw, -DS2780_RSGAIN_MSB_REG ,sizeof (u8) *2 ); + ret =ds2780_write (dev_info, raw, +DS2780_RSGAIN_MSB_REG ,sizeof (raw));if (ret <0 )return ret;
@@ -167,7 +175,7 @@ static int ds2780_get_voltage(struct ds2* Bits 2 - 0 of the voltage value are in bits 7 - 5 of the * voltage LSB register */ - ret =ds2780_read16 (dev_info->w1_dev, &voltage_raw, + ret =ds2780_read16 (dev_info, &voltage_raw,DS2780_VOLT_MSB_REG );if (ret <0 )return ret;
@@ -196,7 +204,7 @@ static int ds2780_get_temperature(struct* Bits 2 - 0 of the temperature value are in bits 7 - 5 of the * temperature LSB register */ - ret =ds2780_read16 (dev_info->w1_dev, &temperature_raw, + ret =ds2780_read16 (dev_info, &temperature_raw,DS2780_TEMP_MSB_REG );if (ret <0 )return ret;
@@ -222,13 +230,13 @@ static int ds2780_get_current(struct ds2* The units of measurement for current are dependent on the value of * the sense resistor. */ - ret =ds2780_read8 (dev_info->w1_dev, &sense_res_raw,DS2780_RSNSP_REG ); + ret =ds2780_read8 (dev_info, &sense_res_raw,DS2780_RSNSP_REG );if (ret <0 )return ret;if (sense_res_raw ==0 ) {dev_err (dev_info->dev,"sense resistor value is 0\n" ); -return -ENXIO ; +return -EINVAL ; } sense_res =1000 / sense_res_raw;
@@ -248,7 +256,7 @@ static int ds2780_get_current(struct ds2* Bits 7 - 0 of the current value are in bits 7 - 0 of the current * LSB register */ - ret =ds2780_read16 (dev_info->w1_dev, ¤t_raw, reg_msb); + ret =ds2780_read16 (dev_info, ¤t_raw, reg_msb);if (ret <0 )return ret;
@@ -267,7 +275,7 @@ static int ds2780_get_accumulated_curren* The units of measurement for accumulated current are dependent on * the value of the sense resistor. */ - ret =ds2780_read8 (dev_info->w1_dev, &sense_res_raw,DS2780_RSNSP_REG ); + ret =ds2780_read8 (dev_info, &sense_res_raw,DS2780_RSNSP_REG );if (ret <0 )return ret;
@@ -285,7 +293,7 @@ static int ds2780_get_accumulated_curren* Bits 7 - 0 of the ACR value are in bits 7 - 0 of the ACR * LSB register */ - ret =ds2780_read16 (dev_info->w1_dev, ¤t_raw,DS2780_ACR_MSB_REG ); + ret =ds2780_read16 (dev_info, ¤t_raw,DS2780_ACR_MSB_REG );if (ret <0 )return ret;
@@ -299,7 +307,7 @@ static int ds2780_get_capacity(struct dsint ret;u8 raw; - ret =ds2780_read8 (dev_info->w1_dev, &raw,DS2780_RARC_REG ); + ret =ds2780_read8 (dev_info, &raw,DS2780_RARC_REG );if (ret <0 )return ret;
@@ -345,7 +353,7 @@ static int ds2780_get_charge_now(struct* Bits 7 - 0 of the RAAC value are in bits 7 - 0 of the RAAC * LSB register */ - ret =ds2780_read16 (dev_info->w1_dev, &charge_raw,DS2780_RAAC_MSB_REG ); + ret =ds2780_read16 (dev_info, &charge_raw,DS2780_RAAC_MSB_REG );if (ret <0 )return ret;
@@ -356,7 +364,7 @@ static int ds2780_get_charge_now(structstatic int ds2780_get_control_register (struct ds2780_device_info *dev_info,u8 *control_reg) { -return ds2780_read8 (dev_info->w1_dev, control_reg,DS2780_CONTROL_REG ); +return ds2780_read8 (dev_info, control_reg,DS2780_CONTROL_REG ); } static int ds2780_set_control_register(struct ds2780_device_info *dev_info,
@@ -364,7 +372,7 @@ static int ds2780_set_control_register(s {int ret; - ret =ds2780_write (dev_info->w1_dev, &control_reg, + ret =ds2780_write (dev_info, &control_reg,DS2780_CONTROL_REG ,sizeof (u8));if (ret <0 )return ret;
@@ -503,7 +511,7 @@ static ssize_t ds2780_get_sense_resistorstruct power_supply *psy =to_power_supply (dev);struct ds2780_device_info *dev_info =to_ds2780_device_info (psy); - ret =ds2780_read8 (dev_info->w1_dev, &sense_resistor,DS2780_RSNSP_REG ); + ret =ds2780_read8 (dev_info, &sense_resistor,DS2780_RSNSP_REG );if (ret <0 )return ret;
@@ -584,7 +592,7 @@ static ssize_t ds2780_get_pio_pin(structstruct power_supply *psy =to_power_supply (dev);struct ds2780_device_info *dev_info =to_ds2780_device_info (psy); - ret =ds2780_read8 (dev_info->w1_dev, &sfr,DS2780_SFR_REG ); + ret =ds2780_read8 (dev_info, &sfr,DS2780_SFR_REG );if (ret <0 )return ret;
@@ -611,7 +619,7 @@ static ssize_t ds2780_set_pio_pin(structreturn -EINVAL ; } - ret =ds2780_write (dev_info->w1_dev, &new_setting, + ret =ds2780_write (dev_info, &new_setting,DS2780_SFR_REG ,sizeof (u8));if (ret <0 )return ret;
@@ -632,7 +640,7 @@ static ssize_t ds2780_read_param_eeprom_DS2780_EEPROM_BLOCK1_END - DS2780_EEPROM_BLOCK1_START + 1 - off); -return ds2780_read_block (dev_info->w1_dev, buf, +return ds2780_read_block (dev_info, buf,DS2780_EEPROM_BLOCK1_START + off, count); }
@@ -650,7 +658,7 @@ static ssize_t ds2780_write_param_eepromDS2780_EEPROM_BLOCK1_END - DS2780_EEPROM_BLOCK1_START + 1 - off); - ret =ds2780_write (dev_info->w1_dev, buf, + ret =ds2780_write (dev_info, buf,DS2780_EEPROM_BLOCK1_START + off, count);if (ret <0 )return ret;
@@ -685,9 +693,8 @@ static ssize_t ds2780_read_user_eeprom_bDS2780_EEPROM_BLOCK0_END - DS2780_EEPROM_BLOCK0_START + 1 - off); -return ds2780_read_block (dev_info->w1_dev, buf, +return ds2780_read_block (dev_info, buf,DS2780_EEPROM_BLOCK0_START + off, count); - } static ssize_t ds2780_write_user_eeprom_bin(struct file *filp,
@@ -704,7 +711,7 @@ static ssize_t ds2780_write_user_eeprom_DS2780_EEPROM_BLOCK0_END - DS2780_EEPROM_BLOCK0_START + 1 - off); - ret =ds2780_write (dev_info->w1_dev, buf, + ret =ds2780_write (dev_info, buf,DS2780_EEPROM_BLOCK0_START + off, count);if (ret <0 )return ret;
PATCH 155/262 drivers/power/ds2780_battery.c: add a nolock function to w1 interface
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clifton Barnes <[email protected]>
commit 9fe678fa2feb4aaac0b4220de63e1b7f8ccebae6 upstream.
Adds a nolock function to the w1 interface to avoid locking the mutex if needed.
--- drivers/w1/slaves/w1_ds2780.c | 48 ++++++++++++++++++++++++++++++------------ drivers/w1/slaves/w1_ds2780.h | 2 + 2 files changed, 37 insertions(+), 13 deletions(-)
drivers/w1/slaves/w1_ds2780.c +35 -13
@@ -26,20 +26,14 @@#include "../w1_family.h" #include "w1_ds2780.h" -int w1_ds2780_io (struct device *dev,char *buf,int addr,size_t count, -int io) +static int w1_ds2780_do_io (struct device *dev,char *buf,int addr, +size_t count,int io) { struct w1_slave *sl = container_of(dev, struct w1_slave, dev); -if (!dev) -return -ENODEV ; - -mutex_lock (&sl->master->mutex); +if (addr >DS2780_DATA_SIZE || addr <0 ) +return 0 ; -if (addr >DS2780_DATA_SIZE || addr <0 ) { - count =0 ; - goto out; - } count =min_t (int, count,DS2780_DATA_SIZE - addr);if (w1_reset_select_slave (sl) ==0 ) {
@@ -47,7 +41,6 @@ int w1_ds2780_io(struct device *dev, chaw1_write_8 (sl->master,W1_DS2780_WRITE_DATA );w1_write_8 (sl->master, addr);w1_write_block (sl->master, buf, count); -/* XXX w1_write_block returns void, not n_written */ }else {w1_write_8 (sl->master,W1_DS2780_READ_DATA );w1_write_8 (sl->master, addr);
@@ -55,13 +48,42 @@ int w1_ds2780_io(struct device *dev, cha } } -out: +return count; +} + +int w1_ds2780_io (struct device *dev,char *buf,int addr,size_t count, +int io) +{ + struct w1_slave *sl = container_of(dev, struct w1_slave, dev); +int ret; + +if (!dev) +return -ENODEV ; + +mutex_lock (&sl->master->mutex); + + ret =w1_ds2780_do_io (dev, buf, addr, count, io); +mutex_unlock (&sl->master->mutex); -return count; +return ret; }EXPORT_SYMBOL (w1_ds2780_io); +int w1_ds2780_io_nolock (struct device *dev,char *buf,int addr,size_t count, +int io) +{ +int ret; + +if (!dev) +return -ENODEV ; + + ret =w1_ds2780_do_io (dev, buf, addr, count, io); + +return ret; +} +EXPORT_SYMBOL (w1_ds2780_io_nolock); +int w1_ds2780_eeprom_cmd (struct device *dev,int addr,int cmd) { struct w1_slave *sl = container_of(dev, struct w1_slave, dev);
drivers/w1/slaves/w1_ds2780.h +2 -0
@@ -124,6 +124,8 @@extern int w1_ds2780_io (struct device *dev,char *buf,int addr,size_t count,int io); +extern int w1_ds2780_io_nolock (struct device *dev,char *buf,int addr, +size_t count,int io);extern int w1_ds2780_eeprom_cmd (struct device *dev,int addr,int cmd);#endif /* !_W1_DS2780_H */
PATCH 156/262 drivers/power/ds2780_battery.c: fix deadlock upon insertion and removal
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clifton Barnes <[email protected]>
commit 0e053fcbbbc4d945247cb32cad2767b483cb65f8 upstream.
Fixes the deadlock when inserting and removing the ds2780.
--- drivers/power/ds2780_battery.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/power/ds2780_battery.c +9 -0
@@ -39,6 +39,7 @@ struct ds2780_device_info {struct device *dev;struct power_supply bat;struct device *w1_dev; +struct task_struct *mutex_holder; };enum current_types {
@@ -63,6 +64,9 @@ static inline struct power_supply *to_postatic inline int ds2780_battery_io (struct ds2780_device_info *dev_info,char *buf,int addr,size_t count,int io) { +if (dev_info->mutex_holder == current) +return w1_ds2780_io_nolock (dev_info->w1_dev, buf, addr, count, io); +else return w1_ds2780_io (dev_info->w1_dev, buf, addr, count, io); }
@@ -775,6 +779,7 @@ static int __devinit ds2780_battery_prob dev_info->bat.properties = ds2780_battery_props; dev_info->bat.num_properties =ARRAY_SIZE (ds2780_battery_props); dev_info->bat.get_property = ds2780_battery_get_property; + dev_info->mutex_holder = current; ret =power_supply_register (&pdev->dev, &dev_info->bat);if (ret) {
@@ -804,6 +809,8 @@ static int __devinit ds2780_battery_prob goto fail_remove_bin_file; } + dev_info->mutex_holder =NULL ; +return 0 ; fail_remove_bin_file:
@@ -823,6 +830,8 @@ static int __devexit ds2780_battery_remo {struct ds2780_device_info *dev_info =platform_get_drvdata (pdev); + dev_info->mutex_holder = current; +/* remove attributes */ sysfs_remove_group (&dev_info->bat.dev->kobj, &ds2780_attr_group);
PATCH 157/262 ext2,ext3,ext4: dont inherit APPEND_FL or IMMUTABLE_FL for new inodes
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 1cd9f0976aa4606db8d6e3dc3edd0aca8019372a upstream.
This doesn't make much sense, and it exposes a bug in the kernel where attempts to create a new file in an append-only directory using O_CREAT will fail (but still leave a zero-length file). This was discovered when xfstests #79 was generalized so it could run on all file systems.
--- fs/ext4/ext4.h | 3 +-- include/linux/ext2_fs.h | 4 ++-- include/linux/ext3_fs.h | 4 ++-- 3 files changed, 5 insertions(+), 6 deletions(-)
fs/ext4/ext4.h +1 -2
@@ -357,8 +357,7 @@ struct flex_groups {/* Flags that should be inherited by new inodes from their parent. */ #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\ - EXT4_SYNC_FL | EXT4_IMMUTABLE_FL | EXT4_APPEND_FL |\ - EXT4_NODUMP_FL | EXT4_NOATIME_FL |\ + EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\ EXT4_NOCOMPR_FL | EXT4_JOURNAL_DATA_FL |\ EXT4_NOTAIL_FL | EXT4_DIRSYNC_FL)
include/linux/ext2_fs.h +2 -2
@@ -196,8 +196,8 @@ struct ext2_group_desc/* Flags that should be inherited by new inodes from their parent. */ #define EXT2_FL_INHERITED (EXT2_SECRM_FL | EXT2_UNRM_FL | EXT2_COMPR_FL |\ - EXT2_SYNC_FL | EXT2_IMMUTABLE_FL | EXT2_APPEND_FL |\ - EXT2_NODUMP_FL | EXT2_NOATIME_FL | EXT2_COMPRBLK_FL|\ + EXT2_SYNC_FL | EXT2_NODUMP_FL |\ + EXT2_NOATIME_FL | EXT2_COMPRBLK_FL |\ EXT2_NOCOMP_FL | EXT2_JOURNAL_DATA_FL |\ EXT2_NOTAIL_FL | EXT2_DIRSYNC_FL)
include/linux/ext3_fs.h +2 -2
@@ -180,8 +180,8 @@ struct ext3_group_desc/* Flags that should be inherited by new inodes from their parent. */ #define EXT3_FL_INHERITED (EXT3_SECRM_FL | EXT3_UNRM_FL | EXT3_COMPR_FL |\ - EXT3_SYNC_FL | EXT3_IMMUTABLE_FL | EXT3_APPEND_FL |\ - EXT3_NODUMP_FL | EXT3_NOATIME_FL | EXT3_COMPRBLK_FL|\ + EXT3_SYNC_FL | EXT3_NODUMP_FL |\ + EXT3_NOATIME_FL | EXT3_COMPRBLK_FL |\ EXT3_NOCOMPR_FL | EXT3_JOURNAL_DATA_FL |\ EXT3_NOTAIL_FL | EXT3_DIRSYNC_FL)
PATCH 158/262 ext4: ext4_rename should dirty dir_bh with the correct directory
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
commit bcaa992975041e40449be8c010c26192b8c8b409 upstream.
When ext4_rename performs a directory rename (move), dir_bh is a buffer that is modified to update the '..' link in the directory being moved (old_inode). However, ext4_handle_dirty_metadata is called with the old parent directory inode (old_dir) and dir_bh, which is incorrect because dir_bh does not belong to the parent inode. Fix this error.
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -2540,7 +2540,7 @@ static int ext4_rename(struct inode *oldPARENT_INO (dir_bh->b_data, new_dir->i_sb->s_blocksize) =cpu_to_le32 (new_dir->i_ino);BUFFER_TRACE (dir_bh,"call ext4_handle_dirty_metadata" ); - retval =ext4_handle_dirty_metadata (handle, old_dir, dir_bh); + retval =ext4_handle_dirty_metadata (handle, old_inode, dir_bh);if (retval) {ext4_std_error (old_dir->i_sb, retval); goto end_rename;
PATCH 159/262 ext4: ext4_mkdir should dirty dir_block with newly created directory inode
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
commit f9287c1f2d329f4d78a3bbc9cf0db0ebae6f146a upstream.
ext4_mkdir calls ext4_handle_dirty_metadata with dir_block and the inode "dir". Unfortunately, dir_block belongs to the newly created directory (which is "inode"), not the parent directory (which is "dir"). Fix the incorrect association.
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -1866,7 +1866,7 @@ retry:ext4_set_de_type (dir->i_sb, de,S_IFDIR ); inode->i_nlink =2 ;BUFFER_TRACE (dir_block,"call ext4_handle_dirty_metadata" ); - err =ext4_handle_dirty_metadata (handle, dir, dir_block); + err =ext4_handle_dirty_metadata (handle, inode, dir_block);if (err) goto out_clear_inode; err =ext4_mark_inode_dirty (handle, inode);
PATCH 160/262 ext4: call ext4_handle_dirty_metadata with correct inode in ext4_dx_add_entry
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 5930ea643805feb50a2f8383ae12eb6f10935e49 upstream.
ext4_dx_add_entry manipulates bh2 and frames[0].bh, which are two buffer_heads that point to directory blocks assigned to the directory inode. However, the function calls ext4_handle_dirty_metadata with the inode of the file that's being added to the directory, not the directory inode itself. Therefore, correct the code to dirty the directory buffers with the directory inode, not the file inode.
--- fs/ext4/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/namei.c +2 -2
@@ -1589,7 +1589,7 @@ static int ext4_dx_add_entry(handle_t *hdxtrace (dx_show_index ("node" , frames[1 ].entries));dxtrace (dx_show_index ("node" , ((struct dx_node *) bh2->b_data)->entries)); - err =ext4_handle_dirty_metadata (handle, inode, bh2); + err =ext4_handle_dirty_metadata (handle, dir, bh2);if (err) goto journal_error;brelse (bh2);
@@ -1615,7 +1615,7 @@ static int ext4_dx_add_entry(handle_t *hif (err) goto journal_error; } - err =ext4_handle_dirty_metadata (handle, inode, frames[0 ].bh); + err =ext4_handle_dirty_metadata (handle, dir, frames[0 ].bh);if (err) {ext4_std_error (inode->i_sb, err); goto cleanup;
PATCH 161/262 ext4: fix race in xattr block allocation path
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit 6d6a435190bdf2e04c9465cde5bdc3ac68cf11a4 upstream.
Ceph users reported that when using Ceph on ext4, the filesystem would often become corrupted, containing inodes with incorrect i_blocks counters.
I managed to reproduce this with a very hacked-up "streamtest" binary from the Ceph tree.
Ceph is doing a lot of xattr writes, to out-of-inode blocks. There is also another thread which does sync_file_range and close, of the same files. The problem appears to happen due to this race:
sync/flush thread xattr-set thread
----------------- ----------------
do_writepages ext4_xattr_set ext4_da_writepages ext4_xattr_set_handle mpage_da_map_blocks ext4_xattr_block_set
set DELALLOC_RESERVE
ext4_new_meta_blocks
ext4_mb_new_blocks
if (!i_delalloc_reserved_flag)
vfs_dq_alloc_blockext4_get_blocks
down_write(i_data_sem)
set i_delalloc_reserved_flag
...
up_write(i_data_sem)
if (i_delalloc_reserved_flag)
vfs_dq_alloc_block_nofailIn other words, the sync/flush thread pops in and sets i_delalloc_reserved_flag on the inode, which makes the xattr thread think that it's in a delalloc path in ext4_new_meta_blocks(), and add the block for a second time, after already having added it once in the !i_delalloc_reserved_flag case in ext4_mb_new_blocks
The real problem is that we shouldn't be using the DELALLOC_RESERVED state flag, and instead we should be passing EXT4_GET_BLOCKS_DELALLOC_RESERVE down to ext4_map_blocks() instead of using an inode state flag. We'll fix this for now with using i_data_sem to prevent this race, but this is really not the right way to fix things.
--- fs/ext4/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/xattr.c +6 -0
@@ -820,8 +820,14 @@ inserted:if (!(ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS ))) goal = goal &EXT4_MAX_BLOCK_FILE_PHYS ; +/* +* take i_data_sem because we will test +* i_delalloc_reserved_flag in ext4_mb_new_blocks +*/ +down_read ((&EXT4_I (inode)->i_data_sem)); block =ext4_new_meta_blocks (handle, inode, goal,0 ,NULL , &error); +up_read ((&EXT4_I (inode)->i_data_sem));if (error) goto cleanup;
PATCH 162/262 enic: Bug Fix: Fix hardware transmit queue indexing in enic_poll_controller
In reply to Greg KH3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasanthy Kolluri <[email protected]>
commit b880a954b9e2585ce325aedd76e4741880cab180 upstream.
--- drivers/net/enic/enic_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/enic/enic_main.c +6 -2
@@ -1718,8 +1718,12 @@ static void enic_poll_controller(structenic_isr_msix_rq (enic->msix_entry[intr].vector, &enic->napi[i]); } - intr =enic_msix_wq_intr (enic, i); -enic_isr_msix_wq (enic->msix_entry[intr].vector, enic); + +for (i =0 ; i < enic->wq_count; i++) { + intr =enic_msix_wq_intr (enic, i); +enic_isr_msix_wq (enic->msix_entry[intr].vector, enic); + } +break ;case VNIC_DEV_INTR_MODE_MSI :enic_isr_msi (enic->pdev->irq, enic);