3.4.12-stable review
Subsystems (125)
Greg Kroah-Hartman
maintainercover 3.4.12-stable review
This is the start of the stable review cycle for the 3.4.12 release. There are 218 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Sep 30 20:13:59 UTC 2012. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.12-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Revert: drm/i915: correctly order the ring init sequence
Dan Carpenter <[email protected]>
vmwgfx: corruption in vmw_event_fence_action_create()
Jani Nikula <[email protected]>
drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads
Dave Airlie <[email protected]>
drm/udl: limit modes to the sku pixel limits.
Roland Stigge <[email protected]>
gpio-lpc32xx: Fix value handling of gpio_direction_output()
Mark Brown <[email protected]>
ASoC: wm2000: Correct register size
Alan Stern <[email protected]>
USB: Fix race condition when removing host controllers
Joachim Eastwood <[email protected]>
USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq
Stanislav Kinsbursky <[email protected]>
LockD: pass service to per-net up and down functions
Tejun Heo <[email protected]>
kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed
Tejun Heo <[email protected]>
kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation
Stanislav Kinsbursky <[email protected]>
NFSd: set nfsd_serv to NULL after service destruction
Stanislav Kinsbursky <[email protected]>
NFSd: introduce nfsd_destroy() helper
Artem Bityutskiy <[email protected]>
UBI: fix a horrible memory deallocation bug
Seth Forshee <[email protected]>
irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU
Satoru Moriya <[email protected]>
mm: avoid swapping out with swappiness==0
Bjørn Mork <[email protected]>
net: qmi_wwan: new devices: UML290 and K5006-Z
Bjørn Mork <[email protected]>
net: qmi_wwan: add Sierra Wireless devices
Bjørn Mork <[email protected]>
net: qmi_wwan: add ZTE MF821D
Bjørn Mork <[email protected]>
net: qmi_wwan: add ZTE MF60
Bjørn Mork <[email protected]>
net: qmi_wwan: Add Sierra Wireless device IDs
Andrew Bird (Sphere Systems) <[email protected]>
USB: qmi_wwan: Add ZTE (Vodafone) K3765-Z
Bjørn Mork <[email protected]>
net: qmi_wwan: Add Vodafone/Huawei K5005 support
Darren Hart <[email protected]>
pch_uart: Add eg20t_port lock field, avoid recursive spinlocks
Timur Tabi <[email protected]>
powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled
Timur Tabi <[email protected]>
powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled
Tomoya MORINAGA <[email protected]>
pch_uart: Fix parity setting issue
Tomoya MORINAGA <[email protected]>
pch_uart: Fix rx error interrupt setting issue
Alan Cox <[email protected]>
pch_uart: Fix missing break for 16 byte fifo
Douglas Bagnall <[email protected]>
media: Avoid sysfs oops when an rc_dev's raw device is absent
John Stultz <[email protected]>
time: Move ktime_t overflow checking into timespec_valid_strict
John Stultz <[email protected]>
time: Avoid making adjustments if we haven't accumulated anything
John Stultz <[email protected]>
time: Improve sanity checking of timekeeping inputs
Jarod Wilson <[email protected]>
media: lirc_sir: make device registration work
Yinghai Lu <[email protected]>
mm: sparse: fix usemap allocation above node descriptor section
Peter Zijlstra <[email protected]>
sched: Fix race in task_group()
Francois Romieu <[email protected]>
r8169: RxConfig hack for the 8168evl.
Daniel J Blueman <[email protected]>
libata: Prevent interface errors with Seagate FreeAgent GoFlex
Weiping Pan <[email protected]>
rds: set correct msg_namelen
Li Zhong <[email protected]>
Fix a dead loop in async_synchronize_full()
Ezequiel Garcia <[email protected]>
media: cx25821: Remove bad strcpy to read-only char*
Rustad, Mark D <[email protected]>
net: Statically initialize init_net.dev_base_head
Vinicius Costa Gomes <[email protected]>
Bluetooth: Fix sending a HCI Authorization Request over LE links
Vinicius Costa Gomes <[email protected]>
Bluetooth: Change signature of smp_conn_security()
Andre Guedes <[email protected]>
Bluetooth: Fix use-after-free bug in SMP
Henrik Rydberg <[email protected]>
Bluetooth: Add support for Apple vendor-specific devices
Gustavo Padovan <[email protected]>
Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices
Manoj Iyer <[email protected]>
Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0
Jason Wang <[email protected]>
macvtap: zerocopy: set SKBTX_DEV_ZEROCOPY only when skb is built successfully
Jason Wang <[email protected]>
macvtap: zerocopy: put page when fail to get all requested user pages
Jason Wang <[email protected]>
macvtap: zerocopy: fix truesize underestimation
Jason Wang <[email protected]>
macvtap: zerocopy: fix offset calculation when building skb
Alan Cox <[email protected]>
x86: Fix boot on Twinhead H12Y
Lai Jiangshan <[email protected]>
workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic
NeilBrown <[email protected]>
md/raid10: fix problem with on-stack allocation of r10bio structure.
Wang Xingchao <[email protected]>
drm/i915: HDMI - Clear Audio Enable bit for Hot Plug
Dave Airlie <[email protected]>
drm/nouveau: fix booting with plymouth + dumb support
Alex Deucher <[email protected]>
drm/radeon: fix dig encoder selection on DCE61
Jerome Glisse <[email protected]>
drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740
Alex Deucher <[email protected]>
drm/radeon: don't disable plls that are in use by other crtcs
Alex Deucher <[email protected]>
drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
Xu, Anhua <[email protected]>
drm/i915: fix wrong order of parameters in port checking functions
Alex Deucher <[email protected]>
drm/radeon/atom: powergating fixes for DCE6
Alex Deucher <[email protected]>
drm/radeon/atom: rework DIG modesetting on DCE3+
Jakob Bornecrantz <[email protected]>
drm: Check for invalid cursor flags
AceLan Kao <[email protected]>
asus-nb-wmi: add some video toggle keys
Corentin Chary <[email protected]>
asus-laptop: HRWS/HWRS typo
Jani Nikula <[email protected]>
drm/i915: extract connector update from intel_ddc_get_modes() for reuse
Tvrtko Ursulin <[email protected]>
drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
David Lamparter <[email protected]>
drm/radeon: implement ACPI VFCT vbios fetch (v3)
Alex Deucher <[email protected]>
drm/radeon: split ATRM support out from the ATPX handler (v3)
Alex Deucher <[email protected]>
drm/radeon/ss: use num_crtc rather than hardcoded 6
Jerome Glisse <[email protected]>
drm/radeon: avoid turning off spread spectrum for used pll
Dave Airlie <[email protected]>
fbcon: fix race condition between console lock and cursor timer (v1.1)
Robin Holt <[email protected]>
drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
Rafael J. Wysocki <[email protected]>
PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
Rafael J. Wysocki <[email protected]>
PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
Atsushi Nemoto <[email protected]>
drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
Will Deacon <[email protected]>
mutex: Place lock in contended state after fastpath_lock failure
Xinyu Chen <[email protected]>
tty: serial: imx: console write routing is unsafe on SMP
Moiz Sonasath <[email protected]>
usb: host: xhci: fix compilation error for non-PCI based stacks
Manoj Iyer <[email protected]>
xhci: Recognize USB 3.0 devices as superspeed at powerup
Matthew Garrett <[email protected]>
xhci: Make handover code more robust
Dan Carpenter <[email protected]>
xhci: Fix a logical vs bitwise AND bug
Ruchika Kharwar <[email protected]>
usb: host: xhci-plat: use ioremap_nocache
Keng-Yu Lin <[email protected]>
Intel xhci: Only switch the switchable ports
Alexis R. Cortes <[email protected]>
usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware
Sergei Poselenov <[email protected]>
rt2800usb: Added rx packet length validity check
Alan Stern <[email protected]>
USB: add device quirk for Joss Optical touchboard
Nicolas Ferre <[email protected]>
USB: ohci-at91: fix PIO handling in relation with number of ports
Bjørn Mork <[email protected]>
USB: cdc-wdm: fix wdm_find_device* return value
Pratyush Anand <[email protected]>
usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced
Éric Piel <[email protected]>
USB: ftdi-sio: add support for more Physik Instrumente devices
Bjørn Mork <[email protected]>
USB: ftdi_sio: do not claim CDC ACM function
Horst Schirmeier <[email protected]>
USB: ftdi_sio: PID for NZR SEM 16+ USB
Pavankumar Kondeti <[email protected]>
EHCI: Update qTD next pointer in QH overlay region during unlink
Weston Andros Adamson <[email protected]>
NFS: return error from decode_getfh in decode open
Trond Myklebust <[email protected]>
NFS: Fix a problem with the legacy binary mount code
Trond Myklebust <[email protected]>
NFS: Fix the initialisation of the readdir 'cookieverf' array
Gertjan van Wingerde <[email protected]>
rt2x00: Fix rfkill polling prior to interface start.
Gertjan van Wingerde <[email protected]>
rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
Gertjan van Wingerde <[email protected]>
rt2x00: Identify ASUS USB-N53 device.
Nicolas Ferre <[email protected]>
dmaengine: at_hdmac: check that each sg data length is non-null
Nicolas Ferre <[email protected]>
dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
Sachin Kamat <[email protected]>
DMA: PL330: Check the pointer returned by kzalloc
Sachin Kamat <[email protected]>
DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()
Luis R. Rodriguez <[email protected]>
cfg80211: fix possible circular lock on reg_regdb_search()
Ira W. Snyder <[email protected]>
can: janz-ican3: fix support for older hardware revisions
Marc Kleine-Budde <[email protected]>
can: ti_hecc: fix oops during rmmod
Søren Holm <[email protected]>
asix: Support DLink DUB-E100 H/W Ver C1
Larry Finger <[email protected]>
rtlwifi: rtl8192ce: Log message that B_CUT device may not work
Jovi Zhang <[email protected]>
MIPS: mm: Add compound tail page _mapcount when mapped
Anisse Astier <[email protected]>
Input: i8042 - disable mux on Toshiba C850D
Wen Congyang <[email protected]>
tracing: Don't call page_to_pfn() if page is NULL
Matthew Leach <[email protected]>
ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
Toshi Kani <[email protected]>
hpwdt: Fix kdump issue in hpwdt
Andrzej Kaczmarek <[email protected]>
Bluetooth: mgmt: Fix enabling LE while powered off
Vinicius Costa Gomes <[email protected]>
Bluetooth: Fix not removing power_off delayed work
Andrzej Kaczmarek <[email protected]>
Bluetooth: mgmt: Fix enabling SSP while powered off
Wang Sen <[email protected]>
SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list
Stephen M. Cameron <[email protected]>
SCSI: hpsa: fix handling of protocol error
Eddie Wai <[email protected]>
SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
[email protected] <[email protected]>
SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
James Bottomley <[email protected]>
SCSI: lpfc: fix problems with -Werror
Hante Meuleman <[email protected]>
brcmfmac: Fix big endian host configuration data.
Hante Meuleman <[email protected]>
brcmfmac: fix big endian bug in i-scan.
Eliad Peller <[email protected]>
mac80211: clear bssid on auth/assoc failure
Santiago Leon <[email protected]>
ibmveth: Fix alignment of rx queue bug
Dave Airlie <[email protected]>
vmwgfx: add dumb ioctl support
Jeff Layton <[email protected]>
cifs: fix return value in cifsConvertToUTF16
Nestor Lopez Casado <[email protected]>
HID: Fix logitech-dj: missing Unifying device issue
Guenter Roeck <[email protected]>
hwmon: (ad7314) Add 'name' sysfs attribute
Guenter Roeck <[email protected]>
hwmon: (ads7871) Add 'name' sysfs attribute
Andreas Herrmann <[email protected]>
hwmon: (fam15h_power) Tweak runavg_range on resume
Konrad Rzeszutek Wilk <[email protected]>
xen/boot: Disable NUMA for PV guests.
Stefano Stabellini <[email protected]>
xen/m2p: do not reuse kmap_op->dev_bus_addr
qiuxishi <[email protected]>
memory hotplug: fix section info double registration bug
Jianguo Wu <[email protected]>
mm/ia64: fix a memory block size bug
Benoît Locher <[email protected]>
can: mcp251x: avoid repeated frame bug
Charles Wang <[email protected]>
sched: Add missing call to calc_load_exit_idle()
Guenter Roeck <[email protected]>
hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements
Kevin Hilman <[email protected]>
drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
Li Haifeng <[email protected]>
mm/page_alloc: fix the page address of higher page's buddy calculation
Dylan Reid <[email protected]>
ASoC: samsung dma - Don't indicate support for pause/resume.
Paul Clements <[email protected]>
nbd: clear waiting_queue on shutdown
NeilBrown <[email protected]>
md/raid5: fix calculate of 'degraded' when a replacement becomes active.
NeilBrown <[email protected]>
md: make sure metadata is updated when spares are activated or removed.
NeilBrown <[email protected]>
md: Don't truncate size at 4TB for RAID0 and Linear
Trond Myklebust <[email protected]>
SUNRPC: Fix a UDP transport regression
Dmitry Kasatkin <[email protected]>
digsig: add hash size comparision on signature verification
Mel Gorman <[email protected]>
Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
Bjørn Mork <[email protected]>
kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"
Alan Cox <[email protected]>
ahci: Add alternate identifier for the 88SE9172
Robert Richter <[email protected]>
oprofile, s390: Fix uninitialized memory access when writing to oprofilefs
Ian Chen <[email protected]>
mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
Shawn Guo <[email protected]>
mmc: sdhci-esdhc: break out early if clock is 0
Lauri Hintsala <[email protected]>
mmc: mxs-mmc: fix deadlock in SDIO IRQ case
Aaron Lu <[email protected]>
ACPI / PM: Use KERN_DEBUG when no power resources are found
Lin Ming <[email protected]>
ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device
Al Viro <[email protected]>
perf_event: Switch to internal refcount, fix race with close()
Stephen Warren <[email protected]>
sound: tegra_alc5632: remove HP detect GPIO inversion
Francesco Ruggeri <[email protected]>
fs/proc: fix potential unregister_sysctl_table hang
Bjørn Mork <[email protected]>
USB: option: replace ZTE K5006-Z entry with vendor class rule
Ian Abbott <[email protected]>
staging: comedi: das08: Correct AO output for das08jr-16-ao
Eric Dumazet <[email protected]>
staging: r8712u: fix bug in r8712_recv_indicatepkt()
Malcolm Priestley <[email protected]>
staging: vt6656: [BUG] - Failed connection, incorrect endian.
Seth Jennings <[email protected]>
staging: zcache: fix cleancache race condition with shrinker
Christopher Brannon <[email protected]>
Staging: speakup: fix an improperly-declared variable.
Takashi Iwai <[email protected]>
ALSA: hda - Workaround for silent output on VAIO Z with ALC889
Matteo Frigo <[email protected]>
ALSA: ice1724: Use linear scale for AK4396 volume control.
Takashi Iwai <[email protected]>
ALSA: hda - Fix Oops at codec reset/reconfig
Takashi Iwai <[email protected]>
ALSA: hda - Fix missing Master volume for STAC9200/925x
Russell King <[email protected]>
ARM: Fix ioremap() of address zero
Igor Grinberg <[email protected]>
ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
Dae S. Kim <[email protected]>
Staging: Android alarm: IOCTL command encoding fix
Russell King <[email protected]>
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
Will Deacon <[email protected]>
ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
David Brown <[email protected]>
ARM: 7513/1: Make sure dtc is built before running it
Will Deacon <[email protected]>
ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint access type
Nicholas Bellinger <[email protected]>
target: Fix ->data_length re-assignment bug with SCSI overflow
Tyler Hicks <[email protected]>
eCryptfs: Copy up attributes of the lower target inode after rename
Amerigo Wang <[email protected]>
netconsole: remove a redundant netconsole_target_put()
Miklos Szeredi <[email protected]>
vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
Linus Torvalds <[email protected]>
vfs: make O_PATH file descriptors usable for 'fstat()'
Stephen M. Cameron <[email protected]>
cciss: fix handling of protocol error
Tejun Heo <[email protected]>
cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU
Tejun Heo <[email protected]>
workqueue: reimplement work_on_cpu() using system_wq
Jesse Gross <[email protected]>
openvswitch: Reset upper layer protocol info on internal devices.
Yuval Mintz <[email protected]>
bnx2x: fix 57840_MF pci id
Francesco Ruggeri <[email protected]>
net: ipv4: ipmr_expire_timer causes crash when removing net namespace
[email protected] <[email protected]>
l2tp: avoid to use synchronize_rcu in tunnel free function
Claudiu Manoil <[email protected]>
gianfar: fix default tx vlan offload feature flag
Ben Hutchings <[email protected]>
sfc: Fix reporting of IPv4 full filters through ethtool
Yuchung Cheng <[email protected]>
tcp: fix cwnd reduction for non-sack recovery
Pablo Neira Ayuso <[email protected]>
netlink: fix possible spoofing from non-root processes
Eric Dumazet <[email protected]>
af_netlink: force credentials passing [CVE-2012-3520]
Eric Leblond <[email protected]>
af_packet: don't emit packet on orig fanout group
Mathias Krause <[email protected]>
net: fix info leak in compat dev_ifconf()
Mathias Krause <[email protected]>
ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
Mathias Krause <[email protected]>
dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)
Mathias Krause <[email protected]>
llc: fix info leak via getsockname()
Mathias Krause <[email protected]>
Bluetooth: L2CAP - Fix info leak via getsockname()
Mathias Krause <[email protected]>
Bluetooth: RFCOMM - Fix info leak via getsockname()
Mathias Krause <[email protected]>
Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
Mathias Krause <[email protected]>
Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
Mathias Krause <[email protected]>
Bluetooth: HCI - Fix info leak via getsockname()
Mathias Krause <[email protected]>
Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)
Mathias Krause <[email protected]>
atm: fix info leak via getsockname()
Mathias Krause <[email protected]>
atm: fix info leak in getsockopt(SO_ATMPVC)
Ben Hutchings <[email protected]>
ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock
[email protected] <[email protected]>
af_packet: remove BUG statement in tpacket_destruct_skb
Alexey Khoroshilov <[email protected]>
net/core: Fix potential memory leak in dev_set_alias()
Gao feng <[email protected]>
pptp: lookup route with the proper net namespace
Wu Fengguang <[email protected]>
isdnloop: fix and simplify isdnloop_init()
Hiroaki SHIMODA <[email protected]>
net_sched: gact: Fix potential panic in tcf_gact().
Ben Hutchings <[email protected]>
tcp: Apply device TSO segment limit earlier
Ben Hutchings <[email protected]>
sfc: Fix maximum number of TSO segments and minimum TX queue size
Ben Hutchings <[email protected]>
net: Allow driver to limit number of GSO segments per skb
-------------
Diffstat:
Documentation/sound/alsa/HD-Audio-Models.txt | 1 + Makefile | 4 +- arch/alpha/include/asm/atomic.h | 4 +- arch/arm/Makefile | 4 +- arch/arm/boot/compressed/head.S | 1 + arch/arm/include/asm/assembler.h | 8 +++ arch/arm/include/asm/uaccess.h | 40 +++++++++---- arch/arm/kernel/hw_breakpoint.c | 55 ++++++++++++----- arch/arm/kernel/traps.c | 11 ++-- arch/arm/lib/getuser.S | 23 +++++--- arch/arm/lib/putuser.S | 6 ++ arch/arm/mach-omap2/timer.c | 7 +++ arch/arm/mm/mm.h | 3 + arch/arm/mm/mmu.c | 4 +- arch/mips/mm/gup.c | 2 + arch/powerpc/platforms/85xx/p1022_ds.c | 102 ++++++++++++++++++++++++++++---- arch/s390/oprofile/init.c | 10 ++-- arch/x86/include/asm/xen/page.h | 3 +- arch/x86/pci/fixup.c | 17 ++++++ arch/x86/xen/p2m.c | 27 ++++----- arch/x86/xen/setup.c | 4 ++ drivers/acpi/power.c | 36 ++++++++---- drivers/ata/ahci.c | 2 + drivers/ata/libata-core.c | 1 + drivers/base/power/runtime.c | 5 +- drivers/block/cciss_scsi.c | 1 + drivers/block/nbd.c | 9 +++ drivers/block/xen-blkback/blkback.c | 2 +- drivers/bluetooth/btusb.c | 10 ++-- drivers/cpufreq/powernow-k8.c | 63 +++++++++++--------- drivers/dma/at_hdmac.c | 13 +++- drivers/dma/pl330.c | 21 ++++--- drivers/gpio/gpio-lpc32xx.c | 5 ++ drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 36 +++++++++++- drivers/gpu/drm/i915/intel_display.c | 12 ++-- drivers/gpu/drm/i915/intel_drv.h | 2 + drivers/gpu/drm/i915/intel_hdmi.c | 2 +- drivers/gpu/drm/i915/intel_modes.c | 31 +++++++--- drivers/gpu/drm/i915/intel_ringbuffer.c | 7 +-- drivers/gpu/drm/nouveau/nouveau_display.c | 2 +- drivers/gpu/drm/radeon/atombios_crtc.c | 61 +++++++++++-------- drivers/gpu/drm/radeon/atombios_encoders.c | 140 +++++++++++++++++++++++--------------------- drivers/gpu/drm/radeon/radeon.h | 15 ----- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 56 +----------------- drivers/gpu/drm/radeon/radeon_bios.c | 138 +++++++++++++++++++++++++++++++++++++++++-- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/udl/udl_connector.c | 7 +++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 ++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 10 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 73 +++++++++++++++++++++++ drivers/hid/hid-logitech-dj.c | 41 +++++++++++++ drivers/hid/hid-logitech-dj.h | 1 + drivers/hwmon/ad7314.c | 8 +++ drivers/hwmon/ads7871.c | 9 +++ drivers/hwmon/fam15h_power.c | 15 ++++- drivers/hwmon/twl4030-madc-hwmon.c | 9 +-- drivers/input/serio/i8042-x86ia64io.h | 6 ++ drivers/iommu/intr_remapping.c | 18 ++++-- drivers/isdn/isdnloop/isdnloop.c | 12 ---- drivers/md/md.c | 15 +++-- drivers/md/raid10.c | 16 +++-- drivers/md/raid10.h | 2 +- drivers/md/raid5.c | 4 ++ drivers/media/rc/rc-main.c | 5 +- drivers/media/video/cx25821/cx25821-core.c | 3 - drivers/media/video/cx25821/cx25821.h | 2 +- drivers/misc/sgi-xp/xpc_uv.c | 84 ++++++++++++++++++++------ drivers/mmc/card/block.c | 26 +++++++- drivers/mmc/host/mxs-mmc.c | 4 +- drivers/mmc/host/sdhci-esdhc.h | 6 +- drivers/mtd/ubi/vtbl.c | 4 +- drivers/net/can/janz-ican3.c | 4 +- drivers/net/can/mcp251x.c | 11 +++- drivers/net/can/ti_hecc.c | 2 +- drivers/net/ethernet/freescale/gianfar.c | 2 +- drivers/net/ethernet/ibm/ibmveth.c | 26 +++----- drivers/net/ethernet/realtek/r8169.c | 1 + drivers/net/ethernet/sfc/efx.c | 6 ++ drivers/net/ethernet/sfc/efx.h | 14 +++-- drivers/net/ethernet/sfc/ethtool.c | 20 ++++--- drivers/net/ethernet/sfc/tx.c | 19 ++++++ drivers/net/macvtap.c | 35 ++++++----- drivers/net/netconsole.c | 1 - drivers/net/ppp/pptp.c | 4 +- drivers/net/usb/asix.c | 4 ++ drivers/net/usb/qmi_wwan.c | 95 ++++++++++++++++++++++++++++++ drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 ++++---- drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 +- drivers/net/wireless/rt2x00/rt2400pci.c | 9 +++ drivers/net/wireless/rt2x00/rt2400pci.h | 1 + drivers/net/wireless/rt2x00/rt2500pci.c | 9 +++ drivers/net/wireless/rt2x00/rt2500usb.c | 11 +++- drivers/net/wireless/rt2x00/rt2500usb.h | 17 +++--- drivers/net/wireless/rt2x00/rt2800pci.c | 9 +++ drivers/net/wireless/rt2x00/rt2800usb.c | 22 ++++++- drivers/net/wireless/rt2x00/rt2x00dev.c | 2 +- drivers/net/wireless/rt2x00/rt61pci.c | 9 +++ drivers/net/wireless/rt2x00/rt61pci.h | 1 + drivers/net/wireless/rt2x00/rt73usb.c | 9 +++ drivers/net/wireless/rt2x00/rt73usb.h | 3 + drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 + drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 +++- drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 +- drivers/platform/x86/asus-laptop.c | 8 +-- drivers/platform/x86/asus-nb-wmi.c | 4 ++ drivers/rtc/rtc-rs5c348.c | 7 ++- drivers/rtc/rtc-twl.c | 5 ++ drivers/scsi/bnx2i/bnx2i_hwi.c | 3 + drivers/scsi/hpsa.c | 3 +- drivers/scsi/lpfc/Makefile | 2 + drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++ drivers/scsi/virtio_scsi.c | 2 +- drivers/staging/android/android_alarm.h | 4 +- drivers/staging/comedi/drivers/das08.c | 2 +- drivers/staging/media/lirc/lirc_sir.c | 60 ++++++++++++++++++- drivers/staging/rtl8712/recv_linux.c | 7 +-- drivers/staging/speakup/main.c | 2 +- drivers/staging/vt6656/dpc.c | 2 +- drivers/staging/vt6656/rxtx.c | 38 ++++++------ drivers/staging/zcache/zcache-main.c | 7 +-- drivers/target/target_core_transport.c | 9 ++- drivers/tty/serial/imx.c | 12 +++- drivers/tty/serial/pch_uart.c | 59 +++++++++++++------ drivers/usb/class/cdc-wdm.c | 12 ++-- drivers/usb/core/devices.c | 2 +- drivers/usb/core/hcd.c | 6 +- drivers/usb/core/quirks.c | 4 ++ drivers/usb/dwc3/ep0.c | 1 - drivers/usb/dwc3/gadget.c | 7 ++- drivers/usb/host/ehci-q.c | 12 +++- drivers/usb/host/ohci-at91.c | 13 +++- drivers/usb/host/pci-quirks.c | 42 ++++++++++--- drivers/usb/host/pci-quirks.h | 1 + drivers/usb/host/xhci-hub.c | 42 +++++++++++++ drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/host/xhci.c | 123 +++++++++++++++++++++++++++++++++++++- drivers/usb/host/xhci.h | 6 ++ drivers/usb/serial/ftdi_sio.c | 22 ++++++- drivers/usb/serial/ftdi_sio_ids.h | 29 ++++++++- drivers/usb/serial/option.c | 6 +- drivers/video/console/fbcon.c | 9 ++- drivers/watchdog/hpwdt.c | 3 + drivers/xen/gntdev.c | 5 +- drivers/xen/grant-table.c | 6 +- fs/cifs/cifs_unicode.c | 2 +- fs/dcache.c | 4 +- fs/ecryptfs/inode.c | 5 ++ fs/lockd/svc.c | 12 ++-- fs/nfs/inode.c | 2 +- fs/nfs/nfs3proc.c | 2 +- fs/nfs/nfs4proc.c | 4 +- fs/nfs/nfs4xdr.c | 3 +- fs/nfs/super.c | 2 + fs/nfsd/nfsctl.c | 8 +-- fs/nfsd/nfsd.h | 11 ++++ fs/nfsd/nfssvc.c | 24 +++----- fs/proc/proc_sysctl.c | 5 +- fs/stat.c | 2 +- include/asm-generic/mutex-xchg.h | 11 +++- include/drm/drm_mode.h | 5 +- include/linux/dcache.h | 2 + include/linux/init_task.h | 12 +++- include/linux/kobject.h | 2 +- include/linux/kthread.h | 8 +-- include/linux/ktime.h | 7 --- include/linux/memory.h | 2 +- include/linux/mmc/card.h | 1 + include/linux/netdevice.h | 4 ++ include/linux/nfs_fs.h | 5 -- include/linux/pci_ids.h | 2 +- include/linux/perf_event.h | 2 +- include/linux/sched.h | 5 +- include/linux/sunrpc/xprt.h | 3 + include/linux/time.h | 29 ++++++++- include/net/bluetooth/smp.h | 2 +- include/net/scm.h | 4 +- include/net/sock.h | 2 + include/trace/events/kmem.h | 4 +- include/xen/grant_table.h | 3 +- kernel/async.c | 13 ++-- kernel/events/core.c | 62 +++++++++++--------- kernel/kthread.c | 88 ++++++++++++++++------------ kernel/sched/core.c | 9 ++- kernel/sched/sched.h | 23 ++++---- kernel/time/tick-sched.c | 1 + kernel/time/timekeeping.c | 33 +++++++++-- kernel/workqueue.c | 34 +++++------ lib/digsig.c | 6 +- mm/bootmem.c | 8 ++- mm/memory_hotplug.c | 16 +++-- mm/page_alloc.c | 2 +- mm/vmscan.c | 6 +- net/atm/common.c | 1 + net/atm/pvc.c | 1 + net/bluetooth/hci_conn.c | 4 ++ net/bluetooth/hci_core.c | 2 + net/bluetooth/hci_sock.c | 2 + net/bluetooth/l2cap_core.c | 11 ++-- net/bluetooth/l2cap_sock.c | 3 +- net/bluetooth/mgmt.c | 16 +++++ net/bluetooth/rfcomm/sock.c | 2 + net/bluetooth/rfcomm/tty.c | 2 +- net/bluetooth/smp.c | 10 ++-- net/core/dev.c | 30 ++++++++-- net/core/net_namespace.c | 4 +- net/core/sock.c | 1 + net/dccp/ccids/ccid3.c | 1 + net/ipv4/ipmr.c | 14 ++++- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_cong.c | 3 +- net/ipv4/tcp_input.c | 15 +++-- net/ipv4/tcp_output.c | 21 ++++--- net/ipv6/addrconf.c | 4 +- net/l2tp/l2tp_core.c | 3 +- net/l2tp/l2tp_core.h | 1 + net/llc/af_llc.c | 3 +- net/mac80211/mlme.c | 4 ++ net/netfilter/ipvs/ip_vs_ctl.c | 1 + net/netlink/af_netlink.c | 6 +- net/openvswitch/vport-internal_dev.c | 8 +++ net/packet/af_packet.c | 10 +++- net/rds/recv.c | 3 + net/sched/act_gact.c | 14 ++++- net/socket.c | 1 + net/sunrpc/xprt.c | 34 ++++++----- net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 3 + net/unix/af_unix.c | 4 +- net/wireless/reg.c | 12 +++- sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/patch_realtek.c | 22 ++++++- sound/pci/hda/patch_sigmatel.c | 2 +- sound/pci/ice1712/prodigy_hifi.c | 3 +- sound/soc/codecs/wm2000.c | 2 +- sound/soc/samsung/dma.c | 8 +-- sound/soc/tegra/tegra_alc5632.c | 1 - 239 files changed, 2335 insertions(+), 858 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/218 net: Allow driver to limit number of GSO segments per skb
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]
A peer (or local user) may cause TCP to use a nominal MSS of as little as 88 (actual MSS of 76 with timestamps). Given that we have a sufficiently prodigious local sender and the peer ACKs quickly enough, it is nevertheless possible to grow the window for such a connection to the point that we will try to send just under 64K at once. This results in a single skb that expands to 861 segments.
In some drivers with TSO support, such an skb will require hundreds of DMA descriptors; a substantial fraction of a TX ring or even more than a full ring. The TX queue selected for the skb may stall and trigger the TX watchdog repeatedly (since the problem skb will be retried after the TX reset). This particularly affects sfc, for which the issue is designated as CVE-2012-3412.
Therefore:
1. Add the field net_device::gso_max_segs holding the device-specific limit.
2. In netif_skb_features(), if the number of segments is too high then mask out GSO features to force fall back to software GSO.
--- include/linux/netdevice.h | 2 ++ net/core/dev.c | 4 ++++ 2 files changed, 6 insertions(+)
include/linux/netdevice.h +2 -0
@@ -1279,6 +1279,8 @@ struct net_device {/* for setting kernel sock attribute on TCP connection setup */ #define GSO_MAX_SIZE 65536unsigned int gso_max_size; +#define GSO_MAX_SEGS 65535 +u16 gso_max_segs;#ifdef CONFIG_DCB /* Data Center Bridging netlink ops */
net/core/dev.c +4 -0
@@ -2121,6 +2121,9 @@ netdev_features_t netif_skb_features(str__be16 protocol = skb->protocol;netdev_features_t features = skb->dev->features; +if (skb_shinfo (skb)->gso_segs > skb->dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK ; +if (protocol ==htons (ETH_P_8021Q )) {struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; protocol = veh->h_vlan_encapsulated_proto;
@@ -5909,6 +5912,7 @@ struct net_device *alloc_netdev_mqs(intdev_net_set (dev, &init_net); dev->gso_max_size =GSO_MAX_SIZE ; + dev->gso_max_segs =GSO_MAX_SEGS ;INIT_LIST_HEAD (&dev->napi_list);INIT_LIST_HEAD (&dev->unreg_list);
Greg Kroah-Hartman
maintainerPATCH 2/218 sfc: Fix maximum number of TSO segments and minimum TX queue size
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 7e6d06f0de3f74ca929441add094518ae332257c ]
Currently an skb requiring TSO may not fit within a minimum-size TX queue. The TX queue selected for the skb may stall and trigger the TX watchdog repeatedly (since the problem skb will be retried after the TX reset). This issue is designated as CVE-2012-3412.
Set the maximum number of TSO segments for our devices to 100. This should make no difference to behaviour unless the actual MSS is less than about 700. Increase the minimum TX queue size accordingly to allow for 2 worst-case skbs, so that there will definitely be space to add an skb after we wake a queue.
To avoid invalidating existing configurations, change efx_ethtool_set_ringparam() to fix up values that are too small rather than returning -EINVAL.
--- drivers/net/ethernet/sfc/efx.c | 6 ++++++ drivers/net/ethernet/sfc/efx.h | 14 ++++++++++---- drivers/net/ethernet/sfc/ethtool.c | 16 +++++++++++----- drivers/net/ethernet/sfc/tx.c | 19 +++++++++++++++++++ 4 files changed, 46 insertions(+), 9 deletions(-)
drivers/net/ethernet/sfc/efx.c +6 -0
@@ -1498,6 +1498,11 @@ static int efx_probe_all(struct efx_nic goto fail2; } +BUILD_BUG_ON (EFX_DEFAULT_DMAQ_SIZE <EFX_RXQ_MIN_ENT ); +if (WARN_ON (EFX_DEFAULT_DMAQ_SIZE <EFX_TXQ_MIN_ENT (efx))) { + rc = -EINVAL ; + goto fail3; + } efx->rxq_entries = efx->txq_entries =EFX_DEFAULT_DMAQ_SIZE ; rc =efx_probe_filters (efx);
@@ -2065,6 +2070,7 @@ static int efx_register_netdev(struct ef net_dev->irq = efx->pci_dev->irq; net_dev->netdev_ops = &efx_netdev_ops;SET_ETHTOOL_OPS (net_dev, &efx_ethtool_ops); + net_dev->gso_max_segs =EFX_TSO_MAX_SEGS ;rtnl_lock ();
drivers/net/ethernet/sfc/efx.h +10 -4
@@ -30,6 +30,7 @@ extern netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);extern void efx_xmit_done (struct efx_tx_queue *tx_queue,unsigned int index);extern int efx_setup_tc (struct net_device *net_dev,u8 num_tc); +extern unsigned int efx_tx_max_skb_descs (struct efx_nic *efx);/* RX */ extern int efx_probe_rx_queue (struct efx_rx_queue *rx_queue);
@@ -52,10 +53,15 @@ extern void efx_schedule_slow_fill(struc#define EFX_MAX_EVQ_SIZE 16384UL#define EFX_MIN_EVQ_SIZE 512UL -/* The smallest [rt]xq_entries that the driver supports. Callers of -* efx_wake_queue() assume that they can subsequently send at least one -* skb. Falcon/A1 may require up to three descriptors per skb_frag. */ -#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS)) +/* Maximum number of TCP segments we support for soft-TSO */ +#define EFX_TSO_MAX_SEGS 100 + +/* The smallest [rt]xq_entries that the driver supports. RX minimum +* is a bit arbitrary. For TX, we must have space for at least 2 +* TSO skbs. +*/ +#define EFX_RXQ_MIN_ENT 128U +#define EFX_TXQ_MIN_ENT (efx) (2 * efx_tx_max_skb_descs(efx))/* Filters */ extern int efx_probe_filters (struct efx_nic *efx);
drivers/net/ethernet/sfc/ethtool.c +11 -5
@@ -680,21 +680,27 @@ static int efx_ethtool_set_ringparam(str struct ethtool_ringparam *ring) {struct efx_nic *efx =netdev_priv (net_dev); +u32 txq_entries;if (ring->rx_mini_pending || ring->rx_jumbo_pending || ring->rx_pending >EFX_MAX_DMAQ_SIZE || ring->tx_pending >EFX_MAX_DMAQ_SIZE )return -EINVAL ; -if (ring->rx_pending <EFX_MIN_RING_SIZE || - ring->tx_pending <EFX_MIN_RING_SIZE ) { +if (ring->rx_pending <EFX_RXQ_MIN_ENT ) {netif_err (efx, drv, efx->net_dev, -"TX and RX queues cannot be smaller than %ld\n" , -EFX_MIN_RING_SIZE ); +"RX queues cannot be smaller than %u\n" , +EFX_RXQ_MIN_ENT );return -EINVAL ; } -return efx_realloc_channels (efx, ring->rx_pending, ring->tx_pending); + txq_entries =max (ring->tx_pending,EFX_TXQ_MIN_ENT (efx)); +if (txq_entries != ring->tx_pending) +netif_warn (efx, drv, efx->net_dev, +"increasing TX queue size to minimum of %u\n" , + txq_entries); + +return efx_realloc_channels (efx, ring->rx_pending, txq_entries); } static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
drivers/net/ethernet/sfc/tx.c +19 -0
@@ -119,6 +119,25 @@ efx_max_tx_len(struct efx_nic *efx, dma_return len; } +unsigned int efx_tx_max_skb_descs (struct efx_nic *efx) +{ +/* Header and payload descriptor for each output segment, plus +* one for every input fragment boundary within a segment +*/ +unsigned int max_descs =EFX_TSO_MAX_SEGS *2 +MAX_SKB_FRAGS ; + +/* Possibly one more per segment for the alignment workaround */ +if (EFX_WORKAROUND_5391 (efx)) + max_descs +=EFX_TSO_MAX_SEGS ; + +/* Possibly more for PCIe page boundaries within input fragments */ +if (PAGE_SIZE >EFX_PAGE_SIZE ) + max_descs += max_t(unsigned int, MAX_SKB_FRAGS, +DIV_ROUND_UP (GSO_MAX_SIZE ,EFX_PAGE_SIZE )); + +return max_descs; +} +/* * Add a socket buffer to a TX queue *
Greg Kroah-Hartman
maintainerPATCH 3/218 tcp: Apply device TSO segment limit earlier
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]
Cache the device gso_max_segs in sock::sk_gso_max_segs and use it to limit the size of TSO skbs. This avoids the need to fall back to software GSO for local TCP senders.
--- include/net/sock.h | 2 ++ net/core/sock.c | 1 + net/ipv4/tcp.c | 4 +++- net/ipv4/tcp_cong.c | 3 ++- net/ipv4/tcp_output.c | 21 ++++++++++++--------- 5 files changed, 20 insertions(+), 11 deletions(-)
include/net/sock.h +2 -0
@@ -216,6 +216,7 @@ struct cg_proto;* @sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK) * @sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4) * @sk_gso_max_size: Maximum GSO segment size to build +* @sk_gso_max_segs: Maximum number of GSO segments * @sk_lingertime: %SO_LINGER l_linger setting * @sk_backlog: always used with the per-socket spinlock held * @sk_callback_lock: used with the callbacks in the end of this struct
@@ -335,6 +336,7 @@ struct sock {netdev_features_t sk_route_nocaps;int sk_gso_type;unsigned int sk_gso_max_size; +u16 sk_gso_max_segs;int sk_rcvlowat;unsigned long sk_lingertime;struct sk_buff_head sk_error_queue;
net/core/sock.c +1 -0
@@ -1411,6 +1411,7 @@ void sk_setup_caps(struct sock *sk, stru }else { sk->sk_route_caps |=NETIF_F_SG |NETIF_F_HW_CSUM ; sk->sk_gso_max_size = dst->dev->gso_max_size; + sk->sk_gso_max_segs = dst->dev->gso_max_segs; } } }
net/ipv4/tcp.c +3 -1
@@ -740,7 +740,9 @@ static unsigned int tcp_xmit_size_goal(s old_size_goal + mss_now > xmit_size_goal)) { xmit_size_goal = old_size_goal; }else { - tp->xmit_size_goal_segs = xmit_size_goal / mss_now; + tp->xmit_size_goal_segs = +min_t (u16, xmit_size_goal / mss_now, + sk->sk_gso_max_segs); xmit_size_goal = tp->xmit_size_goal_segs * mss_now; } }
net/ipv4/tcp_cong.c +2 -1
@@ -291,7 +291,8 @@ int tcp_is_cwnd_limited(const struct soc left = tp->snd_cwnd - in_flight;if (sk_can_gso (sk) && left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd && - left * tp->mss_cache < sk->sk_gso_max_size) + left * tp->mss_cache < sk->sk_gso_max_size && + left < sk->sk_gso_max_segs)return 1 ;return left <=tcp_max_tso_deferred_mss (tp); }
net/ipv4/tcp_output.c +12 -9
@@ -1318,21 +1318,21 @@ static void tcp_cwnd_validate(struct soc* when we would be allowed to send the split-due-to-Nagle skb fully. */ static unsigned int tcp_mss_split_point (const struct sock *sk,const struct sk_buff *skb, -unsigned int mss_now,unsigned int cwnd) +unsigned int mss_now,unsigned int max_segs) {const struct tcp_sock *tp =tcp_sk (sk); -u32 needed, window, cwnd_len; +u32 needed, window, max_len; window =tcp_wnd_end (tp) -TCP_SKB_CB (skb)->seq; - cwnd_len = mss_now * cwnd; + max_len = mss_now * max_segs; -if (likely (cwnd_len <= window && skb !=tcp_write_queue_tail (sk))) -return cwnd_len; +if (likely (max_len <= window && skb !=tcp_write_queue_tail (sk))) +return max_len; needed =min (skb->len, window); -if (cwnd_len <= needed) -return cwnd_len; +if (max_len <= needed) +return max_len;return needed - needed % mss_now; }
@@ -1560,7 +1560,8 @@ static int tcp_tso_should_defer(struct s limit =min (send_win, cong_win);/* If a full-sized TSO skb can be sent, do it. */ -if (limit >= sk->sk_gso_max_size) + if (limit >= min_t(unsigned int, sk->sk_gso_max_size, + sk->sk_gso_max_segs * tp->mss_cache)) goto send_now;/* Middle in queue won't get any more data, full sendable already? */
@@ -1786,7 +1787,9 @@ static int tcp_write_xmit(struct sock *s limit = mss_now;if (tso_segs >1 && !tcp_urg_mode (tp)) limit =tcp_mss_split_point (sk, skb, mss_now, - cwnd_quota); + min_t(unsigned int, + cwnd_quota, + sk->sk_gso_max_segs));if (skb->len > limit &&unlikely (tso_fragment (sk, skb, limit, mss_now, gfp)))
Greg Kroah-Hartman
maintainerPATCH 4/218 net_sched: gact: Fix potential panic in tcf_gact().
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <[email protected]>
[ Upstream commit 696ecdc10622d86541f2e35cc16e15b6b3b1b67e ]
gact_rand array is accessed by gact->tcfg_ptype whose value is assumed to less than MAX_RAND, but any range checks are not performed.
So add a check in tcf_gact_init(). And in tcf_gact(), we can reduce a branch.
--- net/sched/act_gact.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/sched/act_gact.c +11 -3
@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *struct tcf_common *pc;int ret =0 ;int err; +#ifdef CONFIG_GACT_PROB +struct tc_gact_p *p_parm =NULL ; +#endif if (nla ==NULL )return -EINVAL ;
@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *#ifndef CONFIG_GACT_PROB if (tb[TCA_GACT_PROB ] !=NULL )return -EOPNOTSUPP ; +#else +if (tb[TCA_GACT_PROB ]) { + p_parm =nla_data (tb[TCA_GACT_PROB ]); +if (p_parm->ptype >=MAX_RAND ) +return -EINVAL ; + }#endif pc =tcf_hash_check (parm->index, a, bind, &gact_hash_info);
@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *spin_lock_bh (&gact->tcf_lock); gact->tcf_action = parm->action;#ifdef CONFIG_GACT_PROB -if (tb[TCA_GACT_PROB ] !=NULL ) { -struct tc_gact_p *p_parm =nla_data (tb[TCA_GACT_PROB ]); +if (p_parm) { gact->tcfg_paction = p_parm->paction; gact->tcfg_pval = p_parm->pval; gact->tcfg_ptype = p_parm->ptype;
@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb,spin_lock (&gact->tcf_lock);#ifdef CONFIG_GACT_PROB -if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] !=NULL ) +if (gact->tcfg_ptype) action = gact_rand[gact->tcfg_ptype](gact);else action = gact->tcf_action;
Greg Kroah-Hartman
maintainerPATCH 5/218 isdnloop: fix and simplify isdnloop_init()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wu Fengguang <[email protected]>
[ Upstream commit 77f00f6324cb97cf1df6f9c4aaeea6ada23abdb2 ]
Fix a buffer overflow bug by removing the revision and printk.
[ 22.016214] isdnloop-ISDN-driver Rev 1.11.6.7 [ 22.097508] isdnloop: (loop0) virtual card added [ 22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972 [ 22.174400] [ 22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129 [ 22.624071] Call Trace: [ 22.720558] [<ffffffff832448c3>] ? CallcNew+0x56/0x56 [ 22.815248] [<ffffffff8222b623>] panic+0x110/0x329 [ 22.914330] [<ffffffff83244972>] ? isdnloop_init+0xaf/0xb1 [ 23.014800] [<ffffffff832448c3>] ? CallcNew+0x56/0x56 [ 23.090763] [<ffffffff8108e24b>] __stack_chk_fail+0x2b/0x30 [ 23.185748] [<ffffffff83244972>] isdnloop_init+0xaf/0xb1
--- drivers/isdn/isdnloop/isdnloop.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/isdn/isdnloop/isdnloop.c +0 -12
@@ -16,7 +16,6 @@#include <linux/sched.h> #include "isdnloop.h" -static char *revision ="$Revision: 1.11.6.7 $" ;static char *isdnloop_id ="loop0" ;MODULE_DESCRIPTION ("ISDN4Linux: Pseudo Driver that simulates an ISDN card" );
@@ -1494,17 +1493,6 @@ isdnloop_addcard(char *id1)static int __init isdnloop_init (void ) { -char *p; -char rev[10 ]; - -if ((p =strchr (revision,':' ))) { -strcpy (rev, p +1 ); - p =strchr (rev,'$' ); - *p =0 ; - }else -strcpy (rev," ??? " ); -printk (KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n" , rev); -if (isdnloop_id)return (isdnloop_addcard (isdnloop_id));
Greg Kroah-Hartman
maintainerPATCH 6/218 pptp: lookup route with the proper net namespace
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao feng <[email protected]>
[ Upstream commit 08252b32311c3fa84219ad794d640af7399b5485 ]
pptp always use init_net as the net namespace to lookup route, this will cause route lookup failed in container.
because we already set the correct net namespace to struct sock in pptp_create,so fix this by using sock_net(sk) to replace &init_net.
--- drivers/net/ppp/pptp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ppp/pptp.c +2 -2
@@ -189,7 +189,7 @@ static int pptp_xmit(struct ppp_channelif (sk_pppox (po)->sk_state &PPPOX_DEAD ) goto tx_error; - rt = ip_route_output_ports(&init_net, &fl4, NULL, + rt = ip_route_output_ports(sock_net(sk), &fl4, NULL, opt->dst_addr.sin_addr.s_addr, opt->src_addr.sin_addr.s_addr, 0, 0, IPPROTO_GRE,
@@ -468,7 +468,7 @@ static int pptp_connect(struct socket *s po->chan.private = sk; po->chan.ops = &pptp_chan_ops; - rt = ip_route_output_ports(&init_net, &fl4, sk, + rt = ip_route_output_ports(sock_net(sk), &fl4, sk, opt->dst_addr.sin_addr.s_addr, opt->src_addr.sin_addr.s_addr, 0, 0,
Greg Kroah-Hartman
maintainerPATCH 7/218 net/core: Fix potential memory leak in dev_set_alias()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Khoroshilov <[email protected]>
[ Upstream commit 7364e445f62825758fa61195d237a5b8ecdd06ec ]
Do not leak memory by updating pointer with potentially NULL realloc return value.
Found by Linux Driver Verification project (linuxtesting.org).
--- net/core/dev.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/core/dev.c +5 -2
@@ -1056,6 +1056,8 @@ rollback:*/ int dev_set_alias (struct net_device *dev,const char *alias,size_t len) { +char *new_ifalias; +ASSERT_RTNL ();if (len >=IFALIASZ )
@@ -1069,9 +1071,10 @@ int dev_set_alias(struct net_device *devreturn 0 ; } - dev->ifalias =krealloc (dev->ifalias, len +1 ,GFP_KERNEL ); -if (!dev->ifalias) + new_ifalias =krealloc (dev->ifalias, len +1 ,GFP_KERNEL ); +if (!new_ifalias)return -ENOMEM ; + dev->ifalias = new_ifalias;strlcpy (dev->ifalias, alias, len+1 );return len;
Greg Kroah-Hartman
maintainerPATCH 8/218 af_packet: remove BUG statement in tpacket_destruct_skb
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
[ Upstream commit 7f5c3e3a80e6654cf48dfba7cf94f88c6b505467 ]
Here's a quote of the comment about the BUG macro from asm-generic/bug.h:
Don't use BUG() or BUG_ON() unless there's really no way out; one example might be detecting data structure corruption in the middle of an operation that can't be backed out of. If the (sub)system can somehow continue operating, perhaps with reduced functionality, it's probably not BUG-worthy.
If you're tempted to BUG(), think again: is completely giving up really the *only* solution? There are usually better options, where users don't need to reboot ASAP and can mostly shut down cleanly.
In our case, the status flag of a ring buffer slot is managed from both sides, the kernel space and the user space. This means that even though the kernel side might work as expected, the user space screws up and changes this flag right between the send(2) is triggered when the flag is changed to TP_STATUS_SENDING and a given skb is destructed after some time. Then, this will hit the BUG macro. As David suggested, the best solution is to simply remove this statement since it cannot be used for kernel side internal consistency checks. I've tested it and the system still behaves /stable/ in this case, so in accordance with the above comment, we should rather remove it.
--- net/packet/af_packet.c | 1 - 1 file changed, 1 deletion(-)
net/packet/af_packet.c +0 -1
@@ -1943,7 +1943,6 @@ static void tpacket_destruct_skb(structif (likely (po->tx_ring.pg_vec)) { ph =skb_shinfo (skb)->destructor_arg; -BUG_ON (__packet_get_status (po, ph) !=TP_STATUS_SENDING );BUG_ON (atomic_read (&po->tx_ring.pending) ==0 );atomic_dec (&po->tx_ring.pending);__packet_set_status (po, ph,TP_STATUS_AVAILABLE );
Greg Kroah-Hartman
maintainerPATCH 9/218 ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]
Cong Wang reports that lockdep detected suspicious RCU usage while enabling IPV6 forwarding:
[ 1123.310275] ===============================
[ 1123.442202] [ INFO: suspicious RCU usage. ]
[ 1123.558207] 3.6.0-rc1+ #109 Not tainted
[ 1123.665204] -------------------------------
[ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!
[ 1123.992320]
[ 1123.992320] other info that might help us debug this:
[ 1123.992320]
[ 1124.307382]
[ 1124.307382] rcu_scheduler_active = 1, debug_locks = 0
[ 1124.522220] 2 locks held by sysctl/5710:
[ 1124.648364] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff81768498>] rtnl_trylock+0x15/0x17
[ 1124.882211] #1: (rcu_read_lock){.+.+.+}, at: [<ffffffff81871df8>] rcu_lock_acquire+0x0/0x29
[ 1125.085209]
[ 1125.085209] stack backtrace:
[ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109
[ 1125.441291] Call Trace:
[ 1125.545281] [<ffffffff8109d915>] lockdep_rcu_suspicious+0x109/0x112
[ 1125.667212] [<ffffffff8107c240>] rcu_preempt_sleep_check+0x45/0x47
[ 1125.781838] [<ffffffff8107c260>] __might_sleep+0x1e/0x19b
[...]
[ 1127.445223] [<ffffffff81757ac5>] call_netdevice_notifiers+0x4a/0x4f
[...]
[ 1127.772188] [<ffffffff8175e125>] dev_disable_lro+0x32/0x6b
[ 1127.885174] [<ffffffff81872d26>] dev_forward_change+0x30/0xcb
[ 1128.013214] [<ffffffff818738c4>] addrconf_forward_change+0x85/0xc5[...]
addrconf_forward_change() uses RCU iteration over the netdev list, which is unnecessary since it already holds the RTNL lock. We also cannot reasonably require netdevice notifier functions not to sleep.
--- net/ipv6/addrconf.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv6/addrconf.c +1 -3
@@ -493,8 +493,7 @@ static void addrconf_forward_change(strustruct net_device *dev;struct inet6_dev *idev; -rcu_read_lock (); -for_each_netdev_rcu (net, dev) { +for_each_netdev (net, dev) { idev =__in6_dev_get (dev);if (idev) {int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -503,7 +502,6 @@ static void addrconf_forward_change(strudev_forward_change (idev); } } -rcu_read_unlock (); }static int addrconf_fixup_forwarding (struct ctl_table *table,int *p,int newf)
Greg Kroah-Hartman
maintainerPATCH 10/218 atm: fix info leak in getsockopt(SO_ATMPVC)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit e862f1a9b7df4e8196ebec45ac62295138aa3fc2 ]
The ATM code fails to initialize the two padding bytes of struct sockaddr_atmpvc inserted for alignment. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/atm/common.c | 1 + 1 file changed, 1 insertion(+)
net/atm/common.c +1 -0
@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock,if (!vcc->dev || !test_bit (ATM_VF_ADDR , &vcc->flags))return -ENOTCONN ; +memset (&pvc,0 ,sizeof (pvc)); pvc.sap_family =AF_ATMPVC ; pvc.sap_addr.itf = vcc->dev->number; pvc.sap_addr.vpi = vcc->vpi;
Greg Kroah-Hartman
maintainerPATCH 11/218 atm: fix info leak via getsockname()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a ]
The ATM code fails to initialize the two padding bytes of struct sockaddr_atmpvc inserted for alignment. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/atm/pvc.c | 1 + 1 file changed, 1 insertion(+)
net/atm/pvc.c +1 -0
@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *soreturn -ENOTCONN ; *sockaddr_len =sizeof (struct sockaddr_atmpvc ); addr = (struct sockaddr_atmpvc *)sockaddr; +memset (addr,0 ,sizeof (*addr)); addr->sap_family =AF_ATMPVC ; addr->sap_addr.itf = vcc->dev->number; addr->sap_addr.vpi = vcc->vpi;
Greg Kroah-Hartman
maintainerPATCH 12/218 Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit e15ca9a0ef9a86f0477530b0f44a725d67f889ee ]
The HCI code fails to initialize the two padding bytes of struct hci_ufilter before copying it to userland -- that for leaking two bytes kernel stack. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/bluetooth/hci_sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_sock.c +1 -0
@@ -1016,6 +1016,7 @@ static int hci_sock_getsockopt(struct so {struct hci_filter *f = &hci_pi (sk)->filter; +memset (&uf,0 ,sizeof (uf)); uf.type_mask = f->type_mask; uf.opcode = f->opcode; uf.event_mask[0 ] = *((u32 *) f->event_mask +0 );
Greg Kroah-Hartman
maintainerPATCH 13/218 Bluetooth: HCI - Fix info leak via getsockname()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 3f68ba07b1da811bf383b4b701b129bfcb2e4988 ]
The HCI code fails to initialize the hci_channel member of struct sockaddr_hci and that for leaks two bytes kernel stack via the getsockname() syscall. Initialize hci_channel with 0 to avoid the info leak.
--- net/bluetooth/hci_sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_sock.c +1 -0
@@ -706,6 +706,7 @@ static int hci_sock_getname(struct socke *addr_len =sizeof (*haddr); haddr->hci_family =AF_BLUETOOTH ; haddr->hci_dev = hdev->id; + haddr->hci_channel=0 ;release_sock (sk);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 14/218 Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]
The RFCOMM code fails to initialize the key_size member of struct bt_security before copying it to userland -- that for leaking one byte kernel stack. Initialize key_size with 0 to avoid the info leak.
--- net/bluetooth/rfcomm/sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/rfcomm/sock.c +1 -0
@@ -836,6 +836,7 @@ static int rfcomm_sock_getsockopt(struct } sec.level =rfcomm_pi (sk)->sec_level; + sec.key_size =0 ; len = min_t(unsigned int, len, sizeof(sec));if (copy_to_user (optval, (char *) &sec, len))
Greg Kroah-Hartman
maintainerPATCH 15/218 Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]
The RFCOMM code fails to initialize the two padding bytes of struct rfcomm_dev_list_req inserted for alignment before copying it to userland. Additionally there are two padding bytes in each instance of struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus dev_num times two bytes uninitialized kernel heap memory.
Allocate the memory using kzalloc() to fix this issue.
--- net/bluetooth/rfcomm/tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/rfcomm/tty.c +1 -1
@@ -467,7 +467,7 @@ static int rfcomm_get_dev_list(void __us size =sizeof (*dl) + dev_num *sizeof (*di); - dl =kmalloc (size,GFP_KERNEL ); + dl =kzalloc (size,GFP_KERNEL );if (!dl)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 16/218 Bluetooth: RFCOMM - Fix info leak via getsockname()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]
The RFCOMM code fails to initialize the trailing padding byte of struct sockaddr_rc added for alignment. It that for leaks one byte kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/bluetooth/rfcomm/sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/rfcomm/sock.c +1 -0
@@ -546,6 +546,7 @@ static int rfcomm_sock_getname(struct soBT_DBG ("sock %p, sk %p" , sock, sk); +memset (sa,0 ,sizeof (*sa)); sa->rc_family =AF_BLUETOOTH ; sa->rc_channel =rfcomm_pi (sk)->channel;if (peer)
Greg Kroah-Hartman
maintainerPATCH 17/218 Bluetooth: L2CAP - Fix info leak via getsockname()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]
The L2CAP code fails to initialize the l2_bdaddr_type member of struct sockaddr_l2 and the padding byte added for alignment. It that for leaks two bytes kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/l2cap_sock.c +1 -0
@@ -242,6 +242,7 @@ static int l2cap_sock_getname(struct socBT_DBG ("sock %p, sk %p" , sock, sk); +memset (la,0 ,sizeof (struct sockaddr_l2 )); addr->sa_family =AF_BLUETOOTH ; *len =sizeof (struct sockaddr_l2 );
Greg Kroah-Hartman
maintainerPATCH 18/218 llc: fix info leak via getsockname()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]
The LLC code wrongly returns 0, i.e. "success", when the socket is zapped. Together with the uninitialized uaddrlen pointer argument from sys_getsockname this leads to an arbitrary memory leak of up to 128 bytes kernel stack via the getsockname() syscall.
Return an error instead when the socket is zapped to prevent the info leak. Also remove the unnecessary memset(0). We don't directly write to the memory pointed by uaddr but memcpy() a local structure at the end of the function that is properly initialized.
--- net/llc/af_llc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/llc/af_llc.c +1 -2
@@ -971,14 +971,13 @@ static int llc_ui_getname(struct socketstruct sockaddr_llc sllc;struct sock *sk = sock->sk;struct llc_sock *llc =llc_sk (sk); -int rc =0 ; +int rc = -EBADF ;memset (&sllc,0 ,sizeof (sllc));lock_sock (sk);if (sock_flag (sk,SOCK_ZAPPED )) goto out; *uaddrlen =sizeof (sllc); -memset (uaddr,0 , *uaddrlen);if (peer) { rc = -ENOTCONN ;if (sk->sk_state !=TCP_ESTABLISHED )
Greg Kroah-Hartman
maintainerPATCH 19/218 dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 7b07f8eb75aa3097cdfd4f6eac3da49db787381d ]
The CCID3 code fails to initialize the trailing padding bytes of struct tfrc_tx_info added for alignment on 64 bit architectures. It that for potentially leaks four bytes kernel stack via the getsockopt() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/dccp/ccids/ccid3.c | 1 + 1 file changed, 1 insertion(+)
net/dccp/ccids/ccid3.c +1 -0
@@ -531,6 +531,7 @@ static int ccid3_hc_tx_getsockopt(structcase DCCP_SOCKOPT_CCID_TX_INFO :if (len <sizeof (tfrc))return -EINVAL ; +memset (&tfrc,0 ,sizeof (tfrc)); tfrc.tfrctx_x = hc->tx_x; tfrc.tfrctx_x_recv = hc->tx_x_recv; tfrc.tfrctx_x_calc = hc->tx_x_calc;
Greg Kroah-Hartman
maintainerPATCH 20/218 ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]
If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is not set, __ip_vs_get_timeouts() does not fully initialize the structure that gets copied to userland and that for leaks up to 12 bytes of kernel stack. Add an explicit memset(0) before passing the structure to __ip_vs_get_timeouts() to avoid the info leak.
--- net/netfilter/ipvs/ip_vs_ctl.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/ipvs/ip_vs_ctl.c +1 -0
@@ -2713,6 +2713,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cm {struct ip_vs_timeout_user t; +memset (&t,0 ,sizeof (t));__ip_vs_get_timeouts (net, &t);if (copy_to_user (user, &t,sizeof (t)) !=0 ) ret = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 21/218 net: fix info leak in compat dev_ifconf()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]
The implementation of dev_ifconf() for the compat ioctl interface uses an intermediate ifc structure allocated in userland for the duration of the syscall. Though, it fails to initialize the padding bytes inserted for alignment and that for leaks four bytes of kernel stack. Add an explicit memset(0) before filling the structure to avoid the info leak.
--- net/socket.c | 1 + 1 file changed, 1 insertion(+)
net/socket.c +1 -0
@@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, sif (copy_from_user (&ifc32, uifc32,sizeof (struct compat_ifconf )))return -EFAULT ; +memset (&ifc,0 ,sizeof (ifc));if (ifc32.ifcbuf ==0 ) { ifc32.ifc_len =0 ; ifc.ifc_len =0 ;
Greg Kroah-Hartman
maintainerPATCH 22/218 af_packet: dont emit packet on orig fanout group
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Leblond <[email protected]>
[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]
If a packet is emitted on one socket in one group of fanout sockets, it is transmitted again. It is thus read again on one of the sockets of the fanout group. This result in a loop for software which generate packets when receiving one.
This retransmission is not the intended behavior: a fanout group must behave like a single socket. The packet should not be transmitted on a socket if it originates from a socket belonging to the same fanout group.
This patch fixes the issue by changing the transmission check to take fanout group info account.
--- include/linux/netdevice.h | 2 ++ net/core/dev.c | 16 ++++++++++++++-- net/packet/af_packet.c | 9 +++++++++ 3 files changed, 25 insertions(+), 2 deletions(-)
include/linux/netdevice.h +2 -0
@@ -1496,6 +1496,8 @@ struct packet_type {struct sk_buff **(*gro_receive)(struct sk_buff **head,struct sk_buff *skb);int (*gro_complete)(struct sk_buff *skb); +bool (*id_match)(struct packet_type *ptype, +struct sock *sk);void *af_packet_priv;struct list_head list; };
net/core/dev.c +14 -2
@@ -1641,6 +1641,19 @@ static inline int deliver_skb(struct sk_return pt_prev->func (skb, skb->dev, pt_prev, orig_dev); } +static inline bool skb_loop_sk (struct packet_type *ptype,struct sk_buff *skb) +{ +if (ptype->af_packet_priv ==NULL ) +return false; + +if (ptype->id_match) +return ptype->id_match (ptype, skb->sk); +else if ((struct sock *)ptype->af_packet_priv == skb->sk) +return true; + +return false; +} +/* * Support routine. Sends outgoing frames to any network * taps currently in use.
@@ -1658,8 +1671,7 @@ static void dev_queue_xmit_nit(struct sk* they originated from - MvS ([email protected]) */ if ((ptype->dev == dev || !ptype->dev) && - (ptype->af_packet_priv ==NULL || - (struct sock *)ptype->af_packet_priv != skb->sk)) { + (!skb_loop_sk (ptype, skb))) {if (pt_prev) {deliver_skb (skb2, pt_prev, skb->dev); pt_prev = ptype;
net/packet/af_packet.c +9 -0
@@ -1280,6 +1280,14 @@ static void __fanout_unlink(struct sockspin_unlock (&f->lock); } +bool match_fanout_group (struct packet_type *ptype,struct sock * sk) +{ +if (ptype->af_packet_priv == (void *)((struct packet_sock *)sk)->fanout) +return true; + +return false; +} +static int fanout_add (struct sock *sk,u16 id,u16 type_flags) {struct packet_sock *po =pkt_sk (sk);
@@ -1332,6 +1340,7 @@ static int fanout_add(struct sock *sk, u match->prot_hook.dev = po->prot_hook.dev; match->prot_hook.func = packet_rcv_fanout; match->prot_hook.af_packet_priv = match; + match->prot_hook.id_match = match_fanout_group;dev_add_pack (&match->prot_hook);list_add (&match->list, &fanout_list); }
Greg Kroah-Hartman
maintainerPATCH 23/218 af_netlink: force credentials passing [CVE-2012-3520]
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]
Pablo Neira Ayuso discovered that avahi and
potentially NetworkManager accept spoofed Netlink messages because of a kernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data to the receiver if the sender did not provide such data, instead of not including any such data at all or including the correct data from the peer (as it is the case with AF_UNIX).
This bug was introduced in commit 16e572626961
(af_unix: dont send SCM_CREDENTIALS by default)
This patch forces passing credentials for netlink, as before the regression.
Another fix would be to not add SCM_CREDENTIALS in netlink messages if not provided by the sender, but it might break some programs.
With help from Florian Weimer & Petr Matousek
This issue is designated as CVE-2012-3520
--- include/net/scm.h | 4 +++- net/netlink/af_netlink.c | 2 +- net/unix/af_unix.c | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-)
include/net/scm.h +3 -1
@@ -71,9 +71,11 @@ static __inline__ void scm_destroy(struc }static __inline__int scm_send (struct socket *sock,struct msghdr *msg, -struct scm_cookie *scm) +struct scm_cookie *scm,bool forcecreds) {memset (scm,0 ,sizeof (*scm)); +if (forcecreds) +scm_set_cred (scm,task_tgid (current),current_cred ());unix_get_peersec_dgram (sock, scm);if (msg->msg_controllen <=0 )return 0 ;
net/netlink/af_netlink.c +1 -1
@@ -1329,7 +1329,7 @@ static int netlink_sendmsg(struct kiocbif (NULL == siocb->scm) siocb->scm = &scm; - err =scm_send (sock, msg, siocb->scm); + err =scm_send (sock, msg, siocb->scm, true);if (err <0 )return err;
net/unix/af_unix.c +2 -2
@@ -1446,7 +1446,7 @@ static int unix_dgram_sendmsg(struct kioif (NULL == siocb->scm) siocb->scm = &tmp_scm;wait_for_unix_gc (); - err =scm_send (sock, msg, siocb->scm); + err =scm_send (sock, msg, siocb->scm, false);if (err <0 )return err;
@@ -1607,7 +1607,7 @@ static int unix_stream_sendmsg(struct kiif (NULL == siocb->scm) siocb->scm = &tmp_scm;wait_for_unix_gc (); - err =scm_send (sock, msg, siocb->scm); + err =scm_send (sock, msg, siocb->scm, false);if (err <0 )return err;
Greg Kroah-Hartman
maintainerPATCH 24/218 netlink: fix possible spoofing from non-root processes
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]
Non-root user-space processes can send Netlink messages to other processes that are well-known for being subscribed to Netlink asynchronous notifications. This allows ilegitimate non-root process to send forged messages to Netlink subscribers.
The userspace process usually verifies the legitimate origin in two ways:
a) Socket credentials. If UID != 0, then the message comes from some ilegitimate process and the message needs to be dropped.
b) Netlink portID. In general, portID == 0 means that the origin of the messages comes from the kernel. Thus, discarding any message not coming from the kernel.
However, ctnetlink sets the portID in event messages that has been triggered by some user-space process, eg. conntrack utility. So other processes subscribed to ctnetlink events, eg. conntrackd, know that the event was triggered by some user-space action.
Neither of the two ways to discard ilegitimate messages coming from non-root processes can help for ctnetlink.
This patch adds capability validation in case that dst_pid is set in netlink_sendmsg(). This approach is aggressive since existing applications using any Netlink bus to deliver messages between two user-space processes will break. Note that the exception is NETLINK_USERSOCK, since it is reserved for netlink-to-netlink userspace communication.
Still, if anyone wants that his Netlink bus allows netlink-to-netlink userspace, then they can set NL_NONROOT_SEND. However, by default, I don't think it makes sense to allow to use NETLINK_ROUTE to communicate two processes that are sending no matter what information that is not related to link/neighbouring/routing. They should be using NETLINK_USERSOCK instead for that.
--- net/netlink/af_netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netlink/af_netlink.c +3 -1
@@ -1340,7 +1340,8 @@ static int netlink_sendmsg(struct kiocb dst_pid = addr->nl_pid; dst_group =ffs (addr->nl_groups); err = -EPERM ; -if (dst_group && !netlink_capable (sock,NL_NONROOT_SEND )) +if ((dst_group || dst_pid) && + !netlink_capable (sock,NL_NONROOT_SEND )) goto out; }else { dst_pid = nlk->dst_pid;
@@ -2115,6 +2116,7 @@ static void __init netlink_add_usersock_rcu_assign_pointer (nl_table[NETLINK_USERSOCK ].listeners, listeners); nl_table[NETLINK_USERSOCK ].module =THIS_MODULE ; nl_table[NETLINK_USERSOCK ].registered =1 ; + nl_table[NETLINK_USERSOCK ].nl_nonroot =NL_NONROOT_SEND ;netlink_table_ungrab (); }
Greg Kroah-Hartman
maintainerPATCH 25/218 tcp: fix cwnd reduction for non-sack recovery
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <[email protected]>
[ Upstream commit 7c4a56fec379ac0d7754e0d4da6a7361f1a4fe64 ]
The cwnd reduction in fast recovery is based on the number of packets newly delivered per ACK. For non-sack connections every DUPACK signifies a packet has been delivered, but the sender mistakenly skips counting them for cwnd reduction.
The fix is to compute newly_acked_sacked after DUPACKs are accounted in sacked_out for non-sack connections.
--- net/ipv4/tcp_input.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
net/ipv4/tcp_input.c +7 -8
@@ -3037,13 +3037,14 @@ static void tcp_update_cwnd_in_recovery(* tcp_xmit_retransmit_queue(). */ static void tcp_fastretrans_alert (struct sock *sk,int pkts_acked, -int newly_acked_sacked,bool is_dupack, +int prior_sacked,bool is_dupack,int flag) {struct inet_connection_sock *icsk =inet_csk (sk);struct tcp_sock *tp =tcp_sk (sk);int do_lost = is_dupack || ((flag &FLAG_DATA_SACKED ) && (tcp_fackets_out (tp) > tp->reordering)); +int newly_acked_sacked =0 ;int fast_rexmit =0 , mib_idx;if (WARN_ON (!tp->packets_out && tp->sacked_out))
@@ -3103,6 +3104,7 @@ static void tcp_fastretrans_alert(structtcp_add_reno_sack (sk); }else do_lost =tcp_try_undo_partial (sk, pkts_acked); + newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;break ;case TCP_CA_Loss:if (flag &FLAG_DATA_ACKED )
@@ -3124,6 +3126,7 @@ static void tcp_fastretrans_alert(structif (is_dupack)tcp_add_reno_sack (sk); } + newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;if (icsk->icsk_ca_state <= TCP_CA_Disorder)tcp_try_undo_dsack (sk);
@@ -3695,7 +3698,6 @@ static int tcp_ack(struct sock *sk, consint prior_packets;int prior_sacked = tp->sacked_out;int pkts_acked =0 ; -int newly_acked_sacked =0 ;int frto_cwnd =0 ;/* If the ack is older than previous acks
@@ -3768,8 +3770,6 @@ static int tcp_ack(struct sock *sk, cons flag |=tcp_clean_rtx_queue (sk, prior_fackets, prior_snd_una); pkts_acked = prior_packets - tp->packets_out; - newly_acked_sacked = (prior_packets - prior_sacked) - - (tp->packets_out - tp->sacked_out);if (tp->frto_counter) frto_cwnd =tcp_process_frto (sk, flag);
@@ -3783,7 +3783,7 @@ static int tcp_ack(struct sock *sk, cons tcp_may_raise_cwnd(sk, flag))tcp_cong_avoid (sk, ack, prior_in_flight); is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED |FLAG_NOT_DUP )); -tcp_fastretrans_alert (sk, pkts_acked, newly_acked_sacked, +tcp_fastretrans_alert (sk, pkts_acked, prior_sacked, is_dupack, flag); }else {if ((flag &FLAG_DATA_ACKED ) && !frto_cwnd)
@@ -3798,7 +3798,7 @@ static int tcp_ack(struct sock *sk, cons no_queue:/* If data was DSACKed, see if we can undo a cwnd reduction. */ if (flag &FLAG_DSACKING_ACK ) -tcp_fastretrans_alert (sk, pkts_acked, newly_acked_sacked, +tcp_fastretrans_alert (sk, pkts_acked, prior_sacked, is_dupack, flag);/* If this ack opens up a zero window, clear backoff. It was * being used to time the probes, and is probably far higher than
@@ -3818,8 +3818,7 @@ old_ack:*/ if (TCP_SKB_CB (skb)->sacked) { flag |=tcp_sacktag_write_queue (sk, skb, prior_snd_una); - newly_acked_sacked = tp->sacked_out - prior_sacked; -tcp_fastretrans_alert (sk, pkts_acked, newly_acked_sacked, +tcp_fastretrans_alert (sk, pkts_acked, prior_sacked, is_dupack, flag); }
Greg Kroah-Hartman
maintainerPATCH 26/218 sfc: Fix reporting of IPv4 full filters through ethtool
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit ac70b2e9a13423b5efa0178e081936ce6979aea5 ]
ETHTOOL_GRXCLSRULE returns filters for a TCP/IPv4 or UDP/IPv4 4-tuple with source and destination swapped.
--- drivers/net/ethernet/sfc/ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/sfc/ethtool.c +2 -2
@@ -863,8 +863,8 @@ static int efx_ethtool_get_class_rule(st &ip_entry->ip4dst, &ip_entry->pdst);if (rc !=0 ) { rc =efx_filter_get_ipv4_full ( - &spec, &proto, &ip_entry->ip4src, &ip_entry->psrc, - &ip_entry->ip4dst, &ip_entry->pdst); + &spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst, + &ip_entry->ip4src, &ip_entry->psrc);EFX_WARN_ON_PARANOID (rc); ip_mask->ip4src = ~0 ; ip_mask->psrc = ~0 ;
Greg Kroah-Hartman
maintainerPATCH 27/218 gianfar: fix default tx vlan offload feature flag
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Manoil <[email protected]>
[ Upstream commit e2c53be223aca36cf93eb6a0f6bafa079e78f52b ]
Commit -
"b852b72 gianfar: fix bug caused by 87c288c6e9aa31720b72e2bc2d665e24e1653c3e"
disables by default (on mac init) the hw vlan tag insertion. The "features" flags were not updated to reflect this, and "ethtool -K" shows tx-vlan-offload to be "on" by default.
--- drivers/net/ethernet/freescale/gianfar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/gianfar.c +1 -1
@@ -1037,7 +1037,7 @@ static int gfar_probe(struct platform_deif (priv->device_flags &FSL_GIANFAR_DEV_HAS_VLAN ) { dev->hw_features |=NETIF_F_HW_VLAN_TX |NETIF_F_HW_VLAN_RX ; - dev->features |=NETIF_F_HW_VLAN_TX |NETIF_F_HW_VLAN_RX ; + dev->features |=NETIF_F_HW_VLAN_RX ; }if (priv->device_flags &FSL_GIANFAR_DEV_HAS_EXTENDED_HASH ) {
Greg Kroah-Hartman
maintainerPATCH 28/218 l2tp: avoid to use synchronize_rcu in tunnel free function
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
[ Upstream commit 99469c32f79a32d8481f87be0d3c66dad286f4ec ]
Avoid to use synchronize_rcu in l2tp_tunnel_free because context may be atomic.
--- net/l2tp/l2tp_core.c | 3 +-- net/l2tp/l2tp_core.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-)
net/l2tp/l2tp_core.c +1 -2
@@ -1253,11 +1253,10 @@ static void l2tp_tunnel_free(struct l2tp/* Remove from tunnel list */ spin_lock_bh (&pn->l2tp_tunnel_list_lock);list_del_rcu (&tunnel->list); +kfree_rcu (tunnel, rcu);spin_unlock_bh (&pn->l2tp_tunnel_list_lock); -synchronize_rcu ();atomic_dec (&l2tp_tunnel_count); -kfree (tunnel); }/* Create a socket for the tunnel, if one isn't set up by
net/l2tp/l2tp_core.h +1 -0
@@ -157,6 +157,7 @@ struct l2tp_tunnel_cfg {struct l2tp_tunnel {int magic;/* Should be L2TP_TUNNEL_MAGIC */ +struct rcu_head rcu;rwlock_t hlist_lock;/* protect session_hlist */ struct hlist_head session_hlist[L2TP_HASH_SIZE ];/* hashed list of sessions,
Greg Kroah-Hartman
maintainerPATCH 29/218 net: ipv4: ipmr_expire_timer causes crash when removing net namespace
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Ruggeri <[email protected]>
[ Upstream commit acbb219d5f53821b2d0080d047800410c0420ea1 ]
When tearing down a net namespace, ipv4 mr_table structures are freed without first deactivating their timers. This can result in a crash in run_timer_softirq.
This patch mimics the corresponding behaviour in ipv6.
Locking and synchronization seem to be adequate.
We are about to kfree mrt, so existing code should already make sure that no other references to mrt are pending or can be created by incoming traffic. The functions invoked here do not cause new references to mrt or other race conditions to be created.
Invoking del_timer_sync guarantees that ipmr_expire_timer is inactive. Both ipmr_expire_process (whose completion we may have to wait in del_timer_sync) and mroute_clean_tables internally use mfc_unres_lock or other synchronizations when needed, and they both only modify mrt.
Tested in Linux 3.4.8.
--- net/ipv4/ipmr.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/ipv4/ipmr.c +12 -2
@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);static struct kmem_cache *mrt_cachep__read_mostly ;static struct mr_table *ipmr_new_table (struct net *net,u32 id); +static void ipmr_free_table (struct mr_table *mrt); +static int ip_mr_forward (struct net *net,struct mr_table *mrt,struct sk_buff *skb,struct mfc_cache *cache,int local);
@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_t struct sk_buff *pkt, vifi_t vifi, int assert);static int __ipmr_fill_mroute (struct mr_table *mrt,struct sk_buff *skb,struct mfc_cache *c,struct rtmsg *rtm); +static void mroute_clean_tables (struct mr_table *mrt);static void ipmr_expire_process (unsigned long arg);#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(slist_for_each_entry_safe (mrt, next, &net->ipv4.mr_tables, list) {list_del (&mrt->list); -kfree (mrt); +ipmr_free_table (mrt); }fib_rules_unregister (net->ipv4.mr_rules_ops); }
@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(st static void __net_exit ipmr_rules_exit(struct net *net) { -kfree (net->ipv4.mrt); +ipmr_free_table (net->ipv4.mrt); }#endif
@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(sreturn mrt; } +static void ipmr_free_table (struct mr_table *mrt) +{ +del_timer_sync (&mrt->ipmr_expire_timer); +mroute_clean_tables (mrt); +kfree (mrt); +} +/* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */ static void ipmr_del_tunnel (struct net_device *dev,struct vifctl *v)
Greg Kroah-Hartman
maintainerPATCH 30/218 bnx2x: fix 57840_MF pci id
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuval Mintz <[email protected]>
[ Upstream commit 5c879d2094946081af934739850c7260e8b25d3c ]
Commit c3def943c7117d42caaed3478731ea7c3c87190e have added support for new pci ids of the 57840 board, while failing to change the obsolete value in 'pci_ids.h'.
This patch does so, allowing the probe of such devices.
--- include/linux/pci_ids.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/pci_ids.h +1 -1
@@ -2148,7 +2148,7 @@#define PCI_DEVICE_ID_TIGON3_5704S 0x16a8#define PCI_DEVICE_ID_NX2_57800_VF 0x16a9#define PCI_DEVICE_ID_NX2_5706S 0x16aa -#define PCI_DEVICE_ID_NX2_57840_MF 0x16ab +#define PCI_DEVICE_ID_NX2_57840_MF 0x16a4#define PCI_DEVICE_ID_NX2_5708S 0x16ac#define PCI_DEVICE_ID_NX2_57840_VF 0x16ad#define PCI_DEVICE_ID_NX2_57810_MF 0x16ae
Greg Kroah-Hartman
maintainerPATCH 31/218 openvswitch: Reset upper layer protocol info on internal devices.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Gross <[email protected]>
[ Upstream commit 7fe99e2d434eafeac0c57b279a77e5de39212636 ]
It's possible that packets that are sent on internal devices (from the OVS perspective) have already traversed the local IP stack. After they go through the internal device, they will again travel through the IP stack which may get confused by the presence of existing information in the skb. The problem can be observed when switching between namespaces. This clears out that information to avoid problems but deliberately leaves other metadata alone. This is to provide maximum flexibility in chaining together OVS and other Linux components.
--- net/openvswitch/vport-internal_dev.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/openvswitch/vport-internal_dev.c +8 -0
@@ -24,6 +24,9 @@#include <linux/ethtool.h> #include <linux/skbuff.h> +#include <net/dst.h> +#include <net/xfrm.h> +#include "datapath.h" #include "vport-internal_dev.h" #include "vport-netdev.h"
@@ -209,6 +212,11 @@ static int internal_dev_recv(struct vporint len; len = skb->len; + +skb_dst_drop (skb); +nf_reset (skb); +secpath_reset (skb); + skb->dev = netdev; skb->pkt_type =PACKET_HOST ; skb->protocol =eth_type_trans (skb, netdev);
Greg Kroah-Hartman
maintainerPATCH 32/218 workqueue: reimplement work_on_cpu() using system_wq
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.
The existing work_on_cpu() implementation is hugely inefficient. It creates a new kthread, execute that single function and then let the kthread die on each invocation.
Now that system_wq can handle concurrent executions, there's no advantage of doing this. Reimplement work_on_cpu() using system_wq which makes it simpler and way more efficient.
stable: While this isn't a fix in itself, it's needed to fix a
workqueue related bug in cpufreq/powernow-k8. AFAICS, this shouldn't break other existing users.
--- kernel/workqueue.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-)
kernel/workqueue.c +8 -17
@@ -3620,18 +3620,17 @@ static int __devinit workqueue_cpu_down_#ifdef CONFIG_SMP struct work_for_cpu { -struct completion completion; +struct work_struct work;long (*fn)(void *);void *arg;long ret; }; -static int do_work_for_cpu (void *_wfc) +static void work_for_cpu_fn (struct work_struct *work) { -struct work_for_cpu *wfc = _wfc; + struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work); + wfc->ret = wfc->fn (wfc->arg); -complete (&wfc->completion); -return 0 ; }/**
@@ -3646,19 +3645,11 @@ static int do_work_for_cpu(void *_wfc)*/ long work_on_cpu (unsigned int cpu,long (*fn)(void *),void *arg) { -struct task_struct *sub_thread; -struct work_for_cpu wfc = { - .completion =COMPLETION_INITIALIZER_ONSTACK (wfc.completion), - .fn = fn, - .arg = arg, - }; +struct work_for_cpu wfc = { .fn = fn, .arg = arg }; - sub_thread =kthread_create (do_work_for_cpu, &wfc,"work_for_cpu" ); -if (IS_ERR (sub_thread)) -return PTR_ERR (sub_thread); -kthread_bind (sub_thread, cpu); -wake_up_process (sub_thread); -wait_for_completion (&wfc.completion); +INIT_WORK_ONSTACK (&wfc.work, work_for_cpu_fn); +schedule_work_on (cpu, &wfc.work); +flush_work (&wfc.work);return wfc.ret; }EXPORT_SYMBOL_GPL (work_on_cpu);
Greg Kroah-Hartman
maintainerPATCH 33/218 cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.
powernowk8_target() runs off a per-cpu work item and if the cpufreq_policy->cpu is different from the current one, it migrates the kworker to the target CPU by manipulating current->cpus_allowed. The function migrates the kworker back to the original CPU but this is still broken. Workqueue concurrency management requires the kworkers to stay on the same CPU and powernowk8_target() ends up triggerring BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on fidvid_mutex and sleeps.
It is unclear why this bug is being reported now. Duncan says it appeared to be a regression of 3.6-rc1 and couldn't reproduce it on 3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool instead of @gcwq or @cpu where applicable" which is an non-functional change. Given that the reproduce case sometimes took upto days to trigger, it's easy to be misled while bisecting. Maybe something made contention on fidvid_mutex more likely? I don't know.
This patch fixes the bug by using work_on_cpu() instead if @pol->cpu isn't the same as the current one. The code assumes that cpufreq_policy->cpu is kept online by the caller, which Rafael tells me is the case.
stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
system_wq") should be applied before this; otherwise, the behavior could be horrible.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
--- drivers/cpufreq/powernow-k8.c | 63 ++++++++++++++++++++++-------------------- 1 file changed, 34 insertions(+), 29 deletions(-)
drivers/cpufreq/powernow-k8.c +34 -29
@@ -35,7 +35,6 @@#include <linux/slab.h> #include <linux/string.h> #include <linux/cpumask.h> -#include <linux/sched.h> /* for current / set_cpus_allowed() */ #include <linux/io.h> #include <linux/delay.h>
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(sreturn res; } -/* Driver entry point to switch to the target frequency */ -static int powernowk8_target (struct cpufreq_policy *pol, -unsigned targfreq,unsigned relation) +struct powernowk8_target_arg { +struct cpufreq_policy *pol; +unsigned targfreq; +unsigned relation; +}; + +static long powernowk8_target_fn (void *arg) { -cpumask_var_t oldmask; +struct powernowk8_target_arg *pta = arg; +struct cpufreq_policy *pol = pta->pol; +unsigned targfreq = pta->targfreq; +unsigned relation = pta->relation;struct powernow_k8_data *data =per_cpu (powernow_data, pol->cpu);u32 checkfid;u32 checkvid;unsigned int newstate; -int ret = -EIO ; +int ret;if (!data)return -EINVAL ;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpuf checkfid = data->currfid; checkvid = data->currvid; -/* only run on specific CPU from here on. */ -/* This is poor form: use a workqueue or smp_call_function_single */ -if (!alloc_cpumask_var (&oldmask,GFP_KERNEL )) -return -ENOMEM ; - -cpumask_copy (oldmask,tsk_cpus_allowed (current)); -set_cpus_allowed_ptr (current,cpumask_of (pol->cpu)); - -if (smp_processor_id () != pol->cpu) { - printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu); - goto err_out; - } -if (pending_bit_stuck ()) { printk(KERN_ERR PFX "failing targ, change pending bit set\n"); - goto err_out; +return -EIO ; }pr_debug ("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n" , pol->cpu, targfreq, pol->min, pol->max, relation);if (query_current_values_with_pending_wait (data)) - goto err_out; +return -EIO ;if (cpu_family !=CPU_HW_PSTATE ) { pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufif (cpufreq_frequency_table_target (pol, data->powernow_table, targfreq, relation, &newstate)) - goto err_out; +return -EIO ;mutex_lock (&fidvid_mutex);
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpuf ret =transition_frequency_fidvid (data, newstate);if (ret) { printk(KERN_ERR PFX "transition frequency failed\n"); - ret =1 ;mutex_unlock (&fidvid_mutex); - goto err_out; +return 1 ; }mutex_unlock (&fidvid_mutex);
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpuf data->powernow_table[newstate].index); else pol->cur = find_khz_freq_from_fid(data->currfid); - ret =0 ; -err_out: -set_cpus_allowed_ptr (current, oldmask); -free_cpumask_var (oldmask); -return ret; +return 0 ; +} + +/* Driver entry point to switch to the target frequency */ +static int powernowk8_target (struct cpufreq_policy *pol, +unsigned targfreq,unsigned relation) +{ +struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, + .relation = relation }; + +/* +* Must run on @pol->cpu. cpufreq core is responsible for ensuring +* that we're bound to the current CPU and pol->cpu stays online. +*/ +if (smp_processor_id () == pol->cpu) +return powernowk8_target_fn (&pta); +else +return work_on_cpu (pol->cpu, powernowk8_target_fn, &pta); }/* Driver entry point to verify the policy and range of frequencies */
Greg Kroah-Hartman
maintainerPATCH 34/218 cciss: fix handling of protocol error
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.
If a command completes with a status of CMD_PROTOCOL_ERR, this information should be conveyed to the SCSI mid layer, not dropped on the floor. Unlike a similar bug in the hpsa driver, this bug only affects tape drives and CD and DVD ROM drives in the cciss driver, and to induce it, you have to disconnect (or damage) a cable, so it is not a very likely scenario (which would explain why the bug has gone undetected for the last 10 years.)
--- drivers/block/cciss_scsi.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/cciss_scsi.c +1 -0
@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"%p has protocol error\n" , c);break ;
Greg Kroah-Hartman
maintainerPATCH 35/218 vfs: make O_PATH file descriptors usable for fstat()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream.
We already use them for openat() and friends, but fstat() also wants to be able to use O_PATH file descriptors. This should make it more directly comparable to the O_SEARCH of Solaris.
Note that you could already do the same thing with "fstatat()" and an empty path, but just doing "fstat()" directly is simpler and faster, so there is no reason not to just allow it directly.
See also commit 332a2e1244bd, which did the same thing for fchdir, for the same reasons.
--- fs/stat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/stat.c +1 -1
@@ -57,7 +57,7 @@ EXPORT_SYMBOL(vfs_getattr);int vfs_fstat (unsigned int fd,struct kstat *stat) { -struct file *f =fget (fd); +struct file *f =fget_raw (fd);int error = -EBADF ;if (f) {
Re: [ 035/218] vfs: make O_PATH file descriptors usable for fstat()
Quoted 16 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit
55815f70147dcfa3ead5738fd56d3574e2e3c1c2upstream.We already use them for
openat()and friends, butfstat()also wants to be able to useO_PATHfile descriptors. This should make it more directly comparable to theO_SEARCHof Solaris.Note that you could already do the same thing with "
fstatat()" and an empty path, but just doing "fstat()" directly is simpler and faster, so there is no reason not to just allow it directly.
Quoted 7 lines
See also commit
332a2e1244bd, which did the same thing for fchdir, for the same reasons.Reported-by ольга крыжановская <[email protected]>Cc Al Viro <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
The upstream version exchanges fget_light() for fget_raw_light(). Since 3.2 (and likewise 3.4) have fget() here, I cherry-picked e994def 'VFS:
make vfs_fstat() use f[get|put]_light()' before this. Was that a bad/good/neutral idea?
Ben.
Quoted 15 lines
--- fs/stat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)fs/stat.c +1
-1@@ -57,7 +57,7 @@ EXPORT_SYMBOL(vfs_getattr);int vfs_fstat (unsigned int fd,struct kstat *stat) { -struct file *f =fget (fd); +struct file *f =fget_raw (fd);int error = -EBADF ;if (f) {
Signature · 3 lines
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
- Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'Re: [ 035/218] vfs: make O_PATH file descriptors usable for fstat()
Quoted 5 lines · Ben Hutchings
The upstream version exchanges
fget_light()forfget_raw_light(). Since 3.2 (and likewise 3.4) havefget()here, I cherry-picked e994def 'VFS:
makevfs_fstat()use f[get|put]_light()' before this. Was that a bad/good/neutral idea?
Pretty neutral, I don't think it matters. Doing like greg did and just doing it with fget_raw() (without the cherry-pick) is fine too.
Linus
Greg Kroah-Hartman
maintainerPATCH 36/218 vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.
IBM reported a soft lockup after applying the fix for the rename_lock deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression in kernel 2.6.38") was found to be the culprit.
The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the dentry was killed. This flag can be set on non-killed dentries too, which results in infinite retries when trying to traverse the dentry tree.
This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is only set in d_kill() and makes try_to_ascend() test only this flag.
IBM reported successful test results with this patch.
--- fs/dcache.c | 4 ++-- include/linux/dcache.h | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-)
fs/dcache.c +2 -2
@@ -373,7 +373,7 @@ static struct dentry *d_kill(struct dent* Inform try_to_ascend() that we are no longer attached to the * dentry tree */ - dentry->d_flags |=DCACHE_DISCONNECTED ; + dentry->d_flags |=DCACHE_DENTRY_KILLED ;if (parent)spin_unlock (&parent->d_lock);dentry_iput (dentry);
@@ -1030,7 +1030,7 @@ static struct dentry *try_to_ascend(stru* or deletion */ if (new != old->d_parent || - (old->d_flags &DCACHE_DISCONNECTED ) || + (old->d_flags &DCACHE_DENTRY_KILLED ) || (!locked &&read_seqretry (&rename_lock, seq))) {spin_unlock (&new->d_lock); new =NULL ;
include/linux/dcache.h +2 -0
@@ -191,6 +191,8 @@ struct dentry_operations {#define DCACHE_MANAGED_DENTRY \ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT) +#define DCACHE_DENTRY_KILLED 0x100000 +extern seqlock_t rename_lock;static inline int dname_external (struct dentry *dentry)
Greg Kroah-Hartman
maintainerPATCH 37/218 netconsole: remove a redundant netconsole_target_put()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amerigo Wang <[email protected]>
commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream.
This netconsole_target_put() is obviously redundant, and it causes a kernel segfault when removing a bridge device which has netconsole running on it.
This is caused by:
commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093 Author: Amerigo Wang <[email protected]> Date: Thu May 19 21:39:10 2011 +0000 netpoll: disable netpoll when enslave a device
--- drivers/net/netconsole.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/netconsole.c +0 -1
@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struc flags);dev_put (nt->np.dev); nt->np.dev =NULL ; -netconsole_target_put (nt); } nt->enabled =0 ; stopped = true;
Greg Kroah-Hartman
maintainerPATCH 38/218 eCryptfs: Copy up attributes of the lower target inode after rename
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream.
After calling into the lower filesystem to do a rename, the lower target inode's attributes were not copied up to the eCryptfs target inode. This resulted in the eCryptfs target inode staying around, rather than being evicted, because i_nlink was not updated for the eCryptfs inode. This also meant that eCryptfs didn't do the final iput() on the lower target inode so it stayed around, as well. This would result in a failure to free up space occupied by the target file in the rename() operation. Both target inodes would eventually be evicted when the eCryptfs filesystem was unmounted.
This patch calls fsstack_copy_attr_all() after the lower filesystem does its ->rename() so that important inode attributes, such as i_nlink, are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called and eCryptfs can drop its final reference on the lower inode.
http://launchpad.net/bugs/561129
--- fs/ecryptfs/inode.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ecryptfs/inode.c +5 -0
@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, sstruct dentry *lower_old_dir_dentry;struct dentry *lower_new_dir_dentry;struct dentry *trap =NULL ; +struct inode *target_inode; lower_old_dentry =ecryptfs_dentry_to_lower (old_dentry); lower_new_dentry =ecryptfs_dentry_to_lower (new_dentry);
@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, sdget (lower_new_dentry); lower_old_dir_dentry =dget_parent (lower_old_dentry); lower_new_dir_dentry =dget_parent (lower_new_dentry); + target_inode = new_dentry->d_inode; trap =lock_rename (lower_old_dir_dentry, lower_new_dir_dentry);/* source should not be ancestor of target */ if (trap == lower_old_dentry) {
@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, s lower_new_dir_dentry->d_inode, lower_new_dentry);if (rc) goto out_lock; +if (target_inode) +fsstack_copy_attr_all (target_inode, +ecryptfs_inode_to_lower (target_inode));fsstack_copy_attr_all (new_dir, lower_new_dir_dentry->d_inode);if (new_dir != old_dir)fsstack_copy_attr_all (old_dir, lower_old_dir_dentry->d_inode);
Greg Kroah-Hartman
maintainerPATCH 39/218 target: Fix ->data_length re-assignment bug with SCSI overflow
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.
This patch fixes a long-standing bug with SCSI overflow handling where se_cmd->data_length was incorrectly being re-assigned to the larger CDB extracted allocation length, resulting in a number of fabric level errors that would end up causing a session reset in most cases. So instead now:
- Only re-assign se_cmd->data_length durining UNDERFLOW (to use the smaller value)
- Use existing se_cmd->data_length for OVERFLOW (to use the smaller value)
This fix has been tested with the following CDB to generate an SCSI overflow:
sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0
Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric ports. Here is a bit more detail on each case:
- iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
-3584 bytes of data.
- tcm_qla2xxx: Working as expected, returnins 512 bytes of data
- loopback: sg_raw returns CHECK_CONDITION, from overflow rejection in transport_generic_map_mem_to_cmd()
- tcm_vhost: Same as loopback
--- drivers/target/target_core_transport.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/target/target_core_transport.c +7 -2
@@ -3167,15 +3167,20 @@ static int transport_generic_cmd_sequenc/* Returns CHECK_CONDITION + INVALID_CDB_FIELD */ goto out_invalid_cdb_field; } - +/* +* For the overflow case keep the existing fabric provided +* ->data_length. Otherwise for the underflow case, reset +* ->data_length to the smaller SCSI expected data transfer +* length. +*/ if (size > cmd->data_length) { cmd->se_cmd_flags |=SCF_OVERFLOW_BIT ; cmd->residual_count = (size - cmd->data_length); }else { cmd->se_cmd_flags |=SCF_UNDERFLOW_BIT ; cmd->residual_count = (cmd->data_length - size); + cmd->data_length = size; } - cmd->data_length = size; } if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB &&
Greg Kroah-Hartman
maintainerPATCH 40/218 ARM: 7496/1: hw_breakpoint: dont rely on dfsr to show watchpoint access type
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit bf8801145c01ab600f8df66e8c879ac642fa5846 upstream.
Quoted 1 line
From ARM debug architecture v7.1 onwards, a watchpoint exception causes
the DFAR to be updated with the faulting data address. However, DFSR.WnR takes an UNKNOWN value and therefore cannot be used in general to determine the access type that triggered the watchpoint.
This patch forbids watchpoints without an overflow handler from specifying a specific access type (load/store). Those with overflow handlers must be able to handle false positives potentially triggered by a watchpoint of a different access type on the same address. For SIGTRAP-based handlers (i.e. ptrace), this should have no impact.
--- arch/arm/kernel/hw_breakpoint.c | 55 +++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 15 deletions(-)
arch/arm/kernel/hw_breakpoint.c +40 -15
@@ -159,6 +159,12 @@ static int debug_arch_supported(void) arch >=ARM_DEBUG_ARCH_V7_1 ; } +/* Can we determine the watchpoint access type from the fsr? */ +static int debug_exception_updates_fsr (void ) +{ +return 0 ; +} +/* Determine number of WRP registers available. */ static int get_num_wrp_resources (void ) {
@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct info->address &= ~alignment_mask; info->ctrl.len <<= offset; -/* -* Currently we rely on an overflow handler to take -* care of single-stepping the breakpoint when it fires. -* In the case of userspace breakpoints on a core with V7 debug, -* we can use the mismatch feature as a poor-man's hardware -* single-step, but this only works for per-task breakpoints. -*/ -if (!bp->overflow_handler && (arch_check_bp_in_kernelspace (bp) || - !core_has_mismatch_brps () || !bp->hw.bp_target)) { -pr_warning ("overflow handler required but none found\n" ); - ret = -EINVAL ; +if (!bp->overflow_handler) { +/* +* Mismatch breakpoints are required for single-stepping +* breakpoints. +*/ +if (!core_has_mismatch_brps ()) +return -EINVAL ; + +/* We don't allow mismatch breakpoints in kernel space. */ +if (arch_check_bp_in_kernelspace (bp)) +return -EPERM ; + +/* +* Per-cpu breakpoints are not supported by our stepping +* mechanism. +*/ +if (!bp->hw.bp_target) +return -EINVAL ; + +/* +* We only support specific access types if the fsr +* reports them. +*/ +if (!debug_exception_updates_fsr () && + (info->ctrl.type ==ARM_BREAKPOINT_LOAD || + info->ctrl.type ==ARM_BREAKPOINT_STORE )) +return -EINVAL ; } + out:return ret; }
@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned goto unlock;/* Check that the access type matches. */ - access = (fsr &ARM_FSR_ACCESS_MASK ) ?HW_BREAKPOINT_W : -HW_BREAKPOINT_R ; -if (!(access &hw_breakpoint_type (wp))) - goto unlock; +if (debug_exception_updates_fsr ()) { + access = (fsr &ARM_FSR_ACCESS_MASK ) ? +HW_BREAKPOINT_W :HW_BREAKPOINT_R ; +if (!(access &hw_breakpoint_type (wp))) + goto unlock; + }/* We have a winner. */ info->trigger = addr;
Greg Kroah-Hartman
maintainerPATCH 41/218 ARM: 7513/1: Make sure dtc is built before running it
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Brown <[email protected]>
commit 70b0476a2394de4f4e32e0b67288d80ff71ca963 upstream.
'make dtbs' in a clean tree will try running the dtc before actually building it. Make these rules depend upon the scripts to build it.
--- arch/arm/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/Makefile +2 -2
@@ -283,10 +283,10 @@ zImage Image xipImage bootpImage uImage: zinstall uinstall install: vmlinux $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@ -%.dtb: +%.dtb: scripts $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@ -dtbs: +dtbs: scripts $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@ # We use MRPROPER_FILES and CLEAN_FILES now
Greg Kroah-Hartman
maintainerPATCH 42/218 ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream.
get_user may fail to load from the provided __user address due to an unhandled fault generated by the access.
In the case of the undefined instruction trap, this results in failure to load the faulting instruction, in which case we should send SIGILL to the task rather than continue with potentially uninitialised data.
--- arch/arm/kernel/traps.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/arm/kernel/traps.c +7 -4
@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst#endif instr = *(u32 *) pc; }else if (thumb_mode (regs)) { -get_user (instr, (u16 __user *)pc); +if (get_user (instr, (u16 __user *)pc)) + goto die_sig;if (is_wide_instruction (instr)) {unsigned int instr2; -get_user (instr2, (u16 __user *)pc+1 ); +if (get_user (instr2, (u16 __user *)pc+1 )) + goto die_sig; instr <<=16 ; instr |= instr2; } - }else { -get_user (instr, (u32 __user *)pc); + }else if (get_user (instr, (u32 __user *)pc)) { + goto die_sig; }if (call_undef_hook (regs, instr) ==0 )return ; +die_sig:#ifdef CONFIG_DEBUG_USER if (user_debug &UDBG_UNDEFINED ) { printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
Greg Kroah-Hartman
maintainerPATCH 43/218 ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 8404663f81d212918ff85f493649a7991209fa04 upstream.
The {get,put}_user macros don't perform range checking on the provided __user address when !CPU_HAS_DOMAINS.
This patch reworks the out-of-line assembly accessors to check the user address against a specified limit, returning -EFAULT if is is out of range.
[will: changed get_user register allocation to match put_user] [rmk: fixed building on older ARM architectures]
--- arch/arm/include/asm/assembler.h | 8 +++++++ arch/arm/include/asm/uaccess.h | 40 ++++++++++++++++++++++++++------------- arch/arm/lib/getuser.S | 23 ++++++++++++++-------- arch/arm/lib/putuser.S | 6 +++++ 4 files changed, 56 insertions(+), 21 deletions(-)
arch/arm/include/asm/assembler.h +8 -0
@@ -320,4 +320,12 @@ .size \name , . - \name .endm + .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req +#ifndef CONFIG_CPU_USE_DOMAINS + adds \tmp, \addr, #\size - 1 + sbcccs \tmp, \tmp, \limit + bcs \bad +#endif + .endm + #endif /* __ASM_ASSEMBLER_H__ */
arch/arm/include/asm/uaccess.h +27 -13
@@ -101,28 +101,39 @@ extern int __get_user_1(void *);extern int __get_user_2 (void *);extern int __get_user_4 (void *); -#define __get_user_x(__r2,__p,__e,__s,__i...) \ +#define __GUP_CLOBBER_1 "lr", "cc" +#ifdef CONFIG_CPU_USE_DOMAINS +#define __GUP_CLOBBER_2 "ip", "lr", "cc" +#else +#define __GUP_CLOBBER_2 "lr", "cc" +#endif +#define __GUP_CLOBBER_4 "lr", "cc" + +#define __get_user_x (__r2,__p,__e,__l,__s) \ __asm__ __volatile__ ( \ __asmeq("%0", "r0") __asmeq("%1", "r2") \ + __asmeq("%3", "r1") \ "bl __get_user_" #__s \ : "=&r" (__e), "=r" (__r2) \ - : "0" (__p) \ - : __i, "cc") + : "0" (__p), "r" (__l) \ + : __GUP_CLOBBER_##__s)#define get_user (x,p) \ ({ \ + unsigned long __limit = current_thread_info()->addr_limit - 1; \ register const typeof(*(p)) __user *__p asm("r0") = (p);\ register unsigned long __r2 asm("r2"); \ + register unsigned long __l asm("r1") = __limit; \ register int __e asm("r0"); \ switch (sizeof(*(__p))) { \ case 1: \ - __get_user_x(__r2, __p, __e, 1, "lr"); \ - break; \ + __get_user_x(__r2, __p, __e, __l, 1); \ + break; \ case 2: \ - __get_user_x(__r2, __p, __e, 2, "r3", "lr"); \ + __get_user_x(__r2, __p, __e, __l, 2); \ break; \ case 4: \ - __get_user_x(__r2, __p, __e, 4, "lr"); \ + __get_user_x(__r2, __p, __e, __l, 4); \ break; \ default: __e = __get_user_bad(); break; \ } \
@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsignedextern int __put_user_4 (void *,unsigned int );extern int __put_user_8 (void *,unsigned long long ); -#define __put_user_x (__r2,__p,__e,__s) \ +#define __put_user_x (__r2,__p,__e,__l,__s) \ __asm__ __volatile__ ( \ __asmeq("%0", "r0") __asmeq("%2", "r2") \ + __asmeq("%3", "r1") \ "bl __put_user_" #__s \ : "=&r" (__e) \ - : "0" (__p), "r" (__r2) \ + : "0" (__p), "r" (__r2), "r" (__l) \ : "ip", "lr", "cc")#define put_user (x,p) \ ({ \ + unsigned long __limit = current_thread_info()->addr_limit - 1; \ register const typeof(*(p)) __r2 asm("r2") = (x); \ register const typeof(*(p)) __user *__p asm("r0") = (p);\ + register unsigned long __l asm("r1") = __limit; \ register int __e asm("r0"); \ switch (sizeof(*(__p))) { \ case 1: \ - __put_user_x(__r2, __p, __e, 1); \ + __put_user_x(__r2, __p, __e, __l, 1); \ break; \ case 2: \ - __put_user_x(__r2, __p, __e, 2); \ + __put_user_x(__r2, __p, __e, __l, 2); \ break; \ case 4: \ - __put_user_x(__r2, __p, __e, 4); \ + __put_user_x(__r2, __p, __e, __l, 4); \ break; \ case 8: \ - __put_user_x(__r2, __p, __e, 8); \ + __put_user_x(__r2, __p, __e, __l, 8); \ break; \ default: __e = __put_user_bad(); break; \ } \
arch/arm/lib/getuser.S +15 -8
@@ -16,8 +16,9 @@ * __get_user_X * * Inputs: r0 contains the address + * r1 contains the address limit, which must be preserved * Outputs: r0 is the error code - * r2, r3 contains the zero-extended value + * r2 contains the zero-extended value * lr corrupted * * No other registers must be altered. (see <asm/uaccess.h>
@@ -27,33 +28,39 @@ * Note also that it is intended that __get_user_bad is not global. */ #include <linux/linkage.h> +#include <asm/assembler.h> #include <asm/errno.h> #include <asm/domain.h> ENTRY(__get_user_1) + check_uaccess r0, 1, r1, r2, __get_user_bad 1: TUSER(ldrb) r2, [r0] mov r0, #0 mov pc, lr ENDPROC(__get_user_1) ENTRY(__get_user_2) -#ifdef CONFIG_THUMB2_KERNEL -2: TUSER(ldrb) r2, [r0] -3: TUSER(ldrb) r3, [r0, #1] + check_uaccess r0, 2, r1, r2, __get_user_bad +#ifdef CONFIG_CPU_USE_DOMAINS +rb .req ip +2: ldrbt r2, [r0], #1 +3: ldrbt rb, [r0], #0 #else -2: TUSER(ldrb) r2, [r0], #1 -3: TUSER(ldrb) r3, [r0] +rb .req r0 +2: ldrb r2, [r0] +3: ldrb rb, [r0, #1] #endif #ifndef __ARMEB__ - orr r2, r2, r3, lsl #8 + orr r2, r2, rb, lsl #8 #else - orr r2, r3, r2, lsl #8 + orr r2, rb, r2, lsl #8 #endif mov r0, #0 mov pc, lr ENDPROC(__get_user_2) ENTRY(__get_user_4) + check_uaccess r0, 4, r1, r2, __get_user_bad 4: TUSER(ldr) r2, [r0] mov r0, #0 mov pc, lr
arch/arm/lib/putuser.S +6 -0
@@ -16,6 +16,7 @@ * __put_user_X * * Inputs: r0 contains the address + * r1 contains the address limit, which must be preserved * r2, r3 contains the value * Outputs: r0 is the error code * lr corrupted
@@ -27,16 +28,19 @@ * Note also that it is intended that __put_user_bad is not global. */ #include <linux/linkage.h> +#include <asm/assembler.h> #include <asm/errno.h> #include <asm/domain.h> ENTRY(__put_user_1) + check_uaccess r0, 1, r1, ip, __put_user_bad 1: TUSER(strb) r2, [r0] mov r0, #0 mov pc, lr ENDPROC(__put_user_1) ENTRY(__put_user_2) + check_uaccess r0, 2, r1, ip, __put_user_bad mov ip, r2, lsr #8 #ifdef CONFIG_THUMB2_KERNEL #ifndef __ARMEB__
@@ -60,12 +64,14 @@ ENTRY(__put_user_2) ENDPROC(__put_user_2) ENTRY(__put_user_4) + check_uaccess r0, 4, r1, ip, __put_user_bad 4: TUSER(str) r2, [r0] mov r0, #0 mov pc, lr ENDPROC(__put_user_4) ENTRY(__put_user_8) + check_uaccess r0, 8, r1, ip, __put_user_bad #ifdef CONFIG_THUMB2_KERNEL 5: TUSER(str) r2, [r0] 6: TUSER(str) r3, [r0, #4]
Re: [ 043/218] ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
Quoted 11 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit
8404663f81d212918ff85f493649a7991209fa04upstream.The {get,put}_user macros don't perform range checking on the provided
__useraddress when !CPU_HAS_DOMAINS.
Quoted 6 lines
This patch reworks the out-of-line assembly accessors to check the user address against a specified limit, returning
-EFAULTif is is out of range.[will: changed
get_userregister allocation to matchput_user] [rmk: fixed building on older ARM architectures]
[...]
It looks like this is needed for at least some older kernel versions, but a backported version will be needed for 3.2 and earlier.
Ben.
Signature · 3 lines
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
- Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'Greg Kroah-Hartman
maintainerPATCH 44/218 Staging: Android alarm: IOCTL command encoding fix
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dae S. Kim" <[email protected]>
commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 upstream.
Fixed a bug. Data was being written to user space using an IOCTL command encoded with _IOC_WRITE access mode.
--- drivers/staging/android/android_alarm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/android/android_alarm.h +3 -1
@@ -110,10 +110,12 @@ enum android_alarm_return_flags {#define ANDROID_ALARM_WAIT _IO('a', 1)#define ALARM_IOW (c, type, size) _IOW('a', (c) | ((type) << 4), size) +#define ALARM_IOR (c, type, size) _IOR('a', (c) | ((type) << 4), size) +/* Set alarm */ #define ANDROID_ALARM_SET (type) ALARM_IOW(2, type, struct timespec)#define ANDROID_ALARM_SET_AND_WAIT (type) ALARM_IOW(3, type, struct timespec) -#define ANDROID_ALARM_GET_TIME (type) ALARM_IOW(4, type, struct timespec) +#define ANDROID_ALARM_GET_TIME (type) ALARM_IOR(4, type, struct timespec)#define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)#define ANDROID_ALARM_BASE_CMD (cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))#define ANDROID_ALARM_IOCTL_TO_TYPE (cmd) (_IOC_NR(cmd) >> 4)
Re: [ 044/218] Staging: Android alarm: IOCTL command encoding fix
Quoted 37 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dae S. Kim" <[email protected]>
commit
6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9upstream.Fixed a bug. Data was being written to user space using an IOCTL command encoded with
_IOC_WRITEaccess mode.Signed-off-by Dae S. Kim <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/staging/android/android_alarm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/staging/android/android_alarm.h +3
-2@@ -110,10 +110,12 @@ enum android_alarm_return_flags {#define ANDROID_ALARM_WAIT _IO('a', 1)#define ALARM_IOW (c, type, size) _IOW('a', (c) | ((type) << 4), size) +#define ALARM_IOR (c, type, size) _IOR('a', (c) | ((type) << 4), size) +/* Set alarm */ #define ANDROID_ALARM_SET (type) ALARM_IOW(2, type, struct timespec)#define ANDROID_ALARM_SET_AND_WAIT (type) ALARM_IOW(3, type, struct timespec) -#define ANDROID_ALARM_GET_TIME (type) ALARM_IOW(4, type, struct timespec) +#define ANDROID_ALARM_GET_TIME (type) ALARM_IOR(4, type, struct timespec)#define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)#define ANDROID_ALARM_BASE_CMD (cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))#define ANDROID_ALARM_IOCTL_TO_TYPE (cmd) (_IOC_NR(cmd) >> 4) --
Quoted 4 lines
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This patch breaks Android userspace by changing the ioctl ABI to /dev/alarm. It's definitely not a bug fix, as the IOW vs. IOR flag is only ever used by drivers, and is not used by alarm-dev.c.
I would have commented sooner, but the original patch was not sent to any lists I am on, nor any lists that Google can find.
Greg Kroah-Hartman
maintainerRe: [ 044/218] Staging: Android alarm: IOCTL command encoding fix
Quoted 25 lines · Colin Cross
Quoted 23 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dae S. Kim" <[email protected]>
commit
6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9upstream.Fixed a bug. Data was being written to user space using an IOCTL command encoded with
_IOC_WRITEaccess mode.Signed-off-by Dae S. Kim <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/staging/android/android_alarm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/staging/android/android_alarm.h +0
-0@@ -110,10 +110,12 @@ enum android_alarm_return_flags {#define ANDROID_ALARM_WAIT _IO('a', 1)
Quoted 16 lines
drivers/staging/android/android_alarm.h enum android_alarm_return_flags { · line 121
Quoted 12 lines
drivers/staging/android/android_alarm.h +3
-1#define ALARM_IOW (c, type, size) _IOW('a', (c) | ((type) << 4), size) +#define ALARM_IOR (c, type, size) _IOR('a', (c) | ((type) << 4), size) +/* Set alarm */ #define ANDROID_ALARM_SET (type) ALARM_IOW(2, type, struct timespec)#define ANDROID_ALARM_SET_AND_WAIT (type) ALARM_IOW(3, type, struct timespec) -#define ANDROID_ALARM_GET_TIME (type) ALARM_IOW(4, type, struct timespec) +#define ANDROID_ALARM_GET_TIME (type) ALARM_IOR(4, type, struct timespec)#define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)#define ANDROID_ALARM_BASE_CMD (cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))#define ANDROID_ALARM_IOCTL_TO_TYPE (cmd) (_IOC_NR(cmd) >> 4)This patch breaks Android userspace by changing the ioctl ABI to
/dev/alarm. It's definitely not a bug fix, as the IOW vs. IOR flag is only ever used by drivers, and is not used byalarm-dev.c.
But shouldn't Android userspace work fine if it's rebuilt with the fixed header file?
And isn't this the correct fix that the kernel needs, to properly check this ioctl data access works correctly?
Quoted 2 lines
I would have commented sooner, but the original patch was not sent to any lists I am on, nor any lists that Google can find.
Odd, I don't have access to my email archive, so I don't remember where it came from originally, sorry. Possibly the driverdevel mailing list?
thanks,
greg k-h
Re: [ 044/218] Staging: Android alarm: IOCTL command encoding fix
Quoted 43 lines · Greg Kroah-Hartman
Quoted 25 lines · Colin Cross
Quoted 23 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dae S. Kim" <[email protected]>
commit
6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9upstream.Fixed a bug. Data was being written to user space using an IOCTL command encoded with
_IOC_WRITEaccess mode.Signed-off-by Dae S. Kim <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/staging/android/android_alarm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/staging/android/android_alarm.h +0
-0@@ -110,10 +110,12 @@ enum android_alarm_return_flags {#define ANDROID_ALARM_WAIT _IO('a', 1)Quoted 16 lines
drivers/staging/android/android_alarm.h enum android_alarm_return_flags { · line 121
Quoted 12 lines
drivers/staging/android/android_alarm.h +3
-1#define ALARM_IOW (c, type, size) _IOW('a', (c) | ((type) << 4), size) +#define ALARM_IOR (c, type, size) _IOR('a', (c) | ((type) << 4), size) +/* Set alarm */ #define ANDROID_ALARM_SET (type) ALARM_IOW(2, type, struct timespec)#define ANDROID_ALARM_SET_AND_WAIT (type) ALARM_IOW(3, type, struct timespec) -#define ANDROID_ALARM_GET_TIME (type) ALARM_IOW(4, type, struct timespec) +#define ANDROID_ALARM_GET_TIME (type) ALARM_IOR(4, type, struct timespec)#define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)#define ANDROID_ALARM_BASE_CMD (cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))#define ANDROID_ALARM_IOCTL_TO_TYPE (cmd) (_IOC_NR(cmd) >> 4)This patch breaks Android userspace by changing the ioctl ABI to
/dev/alarm. It's definitely not a bug fix, as the IOW vs. IOR flag is only ever used by drivers, and is not used byalarm-dev.c.
Quoted 2 lines
But shouldn't Android userspace work fine if it's rebuilt with the fixed header file?
Sure, but it's an ABI change, so any existing userspace won't work with a new kernel.
Quoted 2 lines
And isn't this the correct fix that the kernel needs, to properly check this ioctl data access works correctly?
No, the ioctl syscall never checks the direction bits anywhere I can see. Many of the hardcoded VFS ioctls in do_vfs_ioctl have no direction bits in their ioctl numbers. The direction bits are just helpful to allow ioctl handlers to use a pattern like:
if (_IOC_DIR(cmd) & _IOC_WRITE)
copy_from_user(...);
switch(cmd) {
...
}
if (_IOC_DIR(cmd) & _IOC_READ)
copy_to_user(...);
The alarm-dev.c ioctl handler does not use this pattern, so the direction bits are meaningless. I agree that the ANDROID_ALARM_GET_TIME ioctl should have been marked IOR originally, but it's an actively used ABI now and shouldn't be changed for a purely cosmetic reason.
Quoted 9 lines
Quoted 2 lines
I would have commented sooner, but the original patch was not sent to any lists I am on, nor any lists that Google can find.
Odd, I don't have access to my email archive, so I don't remember where it came from originally, sorry. Possibly the driverdevel mailing list?
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 45/218 ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Grinberg <[email protected]>
commit 45caae74d238ef6583e9402cb8c550cc0b0f7dbd upstream.
Currently, omap2_sync32k_clocksource_init() function initializes the 32K timer as the system clock source regardless of the CONFIG_OMAP_32K_TIMER setting.
Fix this by providing a default implementation for !CONFIG_OMAP_32K_TIMER case.
--- arch/arm/mach-omap2/timer.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm/mach-omap2/timer.c +7 -0
@@ -275,6 +275,7 @@ static u32 notrace dmtimer_read_sched_clreturn 0 ; } +#ifdef CONFIG_OMAP_32K_TIMER /* Setup free-running counter for clocksource */ static void __init omap2_gp_clocksource_init (int gptimer_id,const char *fck_source)
@@ -304,6 +305,12 @@ static void __init omap##name##_timer_inomap2_gp_clockevent_init ((clkev_nr), clkev_src); \omap2_gp_clocksource_init ((clksrc_nr), clksrc_src); \ } +#else +static inline int omap2_sync32k_clocksource_init (void ) +{ +return -ENODEV ; +} +#endif #define OMAP_SYS_TIMER (name) \ struct sys_timer omap##name##_timer = { \
Re: [ 045/218] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
Quoted 20 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Grinberg <[email protected]>
commit
45caae74d238ef6583e9402cb8c550cc0b0f7dbdupstream.Currently,
omap2_sync32k_clocksource_init()function initializes the 32K timer as the system clock source regardless of theCONFIG_OMAP_32K_TIMERsetting.
Fix this by providing a default implementation for !CONFIG_OMAP_32K_TIMER case.Signed-off-by Igor Grinberg <[email protected]>Reviewed-by Paul Walmsley <[email protected]>Signed-off-by Tony Lindgren <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 3 lines
--- arch/arm/mach-omap2/timer.c | 7 +++++++ 1 file changed, 7 insertions(+)
Build failure with this patch:
linux/arch/arm/mach-omap2/timer.c:308:2: error: #else after #else linux/arch/arm/mach-omap2/timer.c:238:0: error: the conditional began here linux/arch/arm/mach-omap2/timer.c:326:21: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:326:24: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:326:27: error: expected declaration specifiers or '...' before string constant linux/arch/arm/mach-omap2/timer.c:326:47: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:326:50: error: expected declaration specifiers or '...' before string constant linux/arch/arm/mach-omap2/timer.c:328:21: error: invalid suffix "_secure" on integer constant linux/arch/arm/mach-omap2/timer.c:328:21: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:328:31: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:328:51: error: expected declaration specifiers or '...' before string constant linux/arch/arm/mach-omap2/timer.c:329:4: error: expected declaration specifiers or '...' before numeric constant linux/arch/arm/mach-omap2/timer.c:329:7: error: expected declaration specifiers or '...' before string constant
Signature · 2 lines
[]'s Herton
Greg Kroah-Hartman
maintainerRe: [ 045/218] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
Quoted 27 lines · Herton Ronaldo Krzesinski
Quoted 20 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Grinberg <[email protected]>
commit
45caae74d238ef6583e9402cb8c550cc0b0f7dbdupstream.Currently,
omap2_sync32k_clocksource_init()function initializes the 32K timer as the system clock source regardless of theCONFIG_OMAP_32K_TIMERsetting.
Fix this by providing a default implementation for !CONFIG_OMAP_32K_TIMER case.Signed-off-by Igor Grinberg <[email protected]>Reviewed-by Paul Walmsley <[email protected]>Signed-off-by Tony Lindgren <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 3 lines
--- arch/arm/mach-omap2/timer.c | 7 +++++++ 1 file changed, 7 insertions(+)Build failure with this patch:
Quoted 13 lines
linux/arch/arm/mach-omap2/timer.c:308:2: error: #else after #elselinux/arch/arm/mach-omap2/timer.c:238:0: error: the conditional began herelinux/arch/arm/mach-omap2/timer.c:326:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:24: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:27: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:326:47: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:50: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: invalid suffix "_secure" on integer constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:31: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:51: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:329:4: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:329:7: error: expected declaration specifiers or '...' before string constant
Does it also fail in Linus's tree? Was there a follow-on patch that fixed the build issues?
thanks,
greg k-h
Re: [ 045/218] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
Quoted 42 lines · Greg Kroah-Hartman
Quoted 27 lines · Herton Ronaldo Krzesinski
Quoted 20 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Grinberg <[email protected]>
commit
45caae74d238ef6583e9402cb8c550cc0b0f7dbdupstream.Currently,
omap2_sync32k_clocksource_init()function initializes the 32K timer as the system clock source regardless of theCONFIG_OMAP_32K_TIMERsetting.
Fix this by providing a default implementation for !CONFIG_OMAP_32K_TIMER case.Signed-off-by Igor Grinberg <[email protected]>Reviewed-by Paul Walmsley <[email protected]>Signed-off-by Tony Lindgren <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 3 lines
--- arch/arm/mach-omap2/timer.c | 7 +++++++ 1 file changed, 7 insertions(+)Build failure with this patch:
Quoted 13 lines
linux/arch/arm/mach-omap2/timer.c:308:2: error: #else after #elselinux/arch/arm/mach-omap2/timer.c:238:0: error: the conditional began herelinux/arch/arm/mach-omap2/timer.c:326:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:24: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:27: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:326:47: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:50: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: invalid suffix "_secure" on integer constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:31: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:51: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:329:4: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:329:7: error: expected declaration specifiers or '...' before string constant
Quoted 2 lines
Does it also fail in Linus's tree? Was there a follow-on patch that fixed the build issues?
I only saw the build failure, and proposed 3.5.5 which have the same patch builds fine. It looks like this patch isn't applicable to 3.4 (that seems to be fixing a problem in commit 1fe97c8f).
Quoted 5 lines
thanks,
greg k-h
Signature · 2 lines
[]'s Herton
Greg Kroah-Hartman
maintainerRe: [ 045/218] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
Quoted 43 lines · Herton Ronaldo Krzesinski
Quoted 42 lines · Greg Kroah-Hartman
Quoted 40 lines · Herton Ronaldo Krzesinski
Quoted 20 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Grinberg <[email protected]>
commit
45caae74d238ef6583e9402cb8c550cc0b0f7dbdupstream.Currently,
omap2_sync32k_clocksource_init()function initializes the 32K timer as the system clock source regardless of theCONFIG_OMAP_32K_TIMERsetting.
Fix this by providing a default implementation for !CONFIG_OMAP_32K_TIMER case.Signed-off-by Igor Grinberg <[email protected]>Reviewed-by Paul Walmsley <[email protected]>Signed-off-by Tony Lindgren <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 3 lines
--- arch/arm/mach-omap2/timer.c | 7 +++++++ 1 file changed, 7 insertions(+)Build failure with this patch:
linux/arch/arm/mach-omap2/timer.c:308:2: error: #else after #elselinux/arch/arm/mach-omap2/timer.c:238:0: error: the conditional began herelinux/arch/arm/mach-omap2/timer.c:326:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:24: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:27: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:326:47: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:326:50: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: invalid suffix "_secure" on integer constantlinux/arch/arm/mach-omap2/timer.c:328:21: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:31: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:328:51: error: expected declaration specifiers or '...' before string constantlinux/arch/arm/mach-omap2/timer.c:329:4: error: expected declaration specifiers or '...' before numeric constantlinux/arch/arm/mach-omap2/timer.c:329:7: error: expected declaration specifiers or '...' before string constant
Quoted 6 lines
Quoted 2 lines
Does it also fail in Linus's tree? Was there a follow-on patch that fixed the build issues?
I only saw the build failure, and proposed 3.5.5 which have the same patch builds fine. It looks like this patch isn't applicable to 3.4 (that seems to be fixing a problem in commit
1fe97c8f).
Ah, nice catch, I'll go drop this patch from the 3.4-stable queue, thanks for letting me know.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 46/218 ARM: Fix ioremap() of address zero
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit a849088aa1552b1a28eea3daff599ee22a734ae3 upstream.
Murali Nalajala reports a regression that ioremapping address zero results in an oops dump:
Unable to handle kernel paging request at virtual address fa200000 pgd = d4f80000 [fa200000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 Tainted: G W (3.4.0-g3b5f728-00009-g638207a #13) PC is at msm_pm_config_rst_vector_before_pc+0x8/0x30 LR is at msm_pm_boot_config_before_pc+0x18/0x20 pc : [<c0078f84>] lr : [<c007903c>] psr: a0000093
sp : c0837ef0 ip : cfe00000 fp : 0000000d
r10: da7efc17 r9 : 225c4278 r8 : 00000006
r7 : 0003c000 r6 : c085c824 r5 : 00000001 r4 : fa101000
r3 : fa200000 r2 : c095080c r1 : 002250fc r0 : 00000000
Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c5387d Table: 25180059 DAC: 00000015
[<c0078f84>] (msm_pm_config_rst_vector_before_pc+0x8/0x30) from [<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20) [<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20) from [<c007a55c>] (msm_pm_power_collapse+0x410/0xb04) [<c007a55c>] (msm_pm_power_collapse+0x410/0xb04) from [<c007b17c>] (arch_idle+0x294/0x3e0) [<c007b17c>] (arch_idle+0x294/0x3e0) from [<c000eed8>] (default_idle+0x18/0x2c)
[<c000eed8>] (default_idle+0x18/0x2c) from [<c000f254>] (cpu_idle+0x90/0xe4)
[<c000f254>] (cpu_idle+0x90/0xe4) from [<c057231c>] (rest_init+0x88/0xa0)
[<c057231c>] (rest_init+0x88/0xa0) from [<c07ff890>] (start_kernel+0x3a8/0x40c)
Code: c0704256 e12fff1e e59f2020 e5923000 (e5930000)
This is caused by the 'reserved' entries which we insert (see 19b52abe3c5d7 - ARM: 7438/1: fill possible PMD empty section gaps) which get matched for physical address zero.
Resolve this by marking these reserved entries with a different flag.
--- arch/arm/mm/mm.h | 3 +++ arch/arm/mm/mmu.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/arm/mm/mm.h +3 -0
@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct a/* permanent static mappings from iotable_init() */ #define VM_ARM_STATIC_MAPPING 0x40000000 +/* empty mapping */ +#define VM_ARM_EMPTY_MAPPING 0x20000000 +/* mapping type (attributes) for permanent static mappings */ #define VM_ARM_MTYPE (mt) ((mt) << 20)#define VM_ARM_MTYPE_MASK (0x1f << 20)
arch/arm/mm/mmu.c +2 -2
@@ -805,7 +805,7 @@ static void __init pmd_empty_section_gap vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm)); vm->addr = (void *)addr; vm->size =SECTION_SIZE ; - vm->flags =VM_IOREMAP |VM_ARM_STATIC_MAPPING ; + vm->flags =VM_IOREMAP |VM_ARM_EMPTY_MAPPING ; vm->caller = pmd_empty_section_gap;vm_area_add_early (vm); }
@@ -818,7 +818,7 @@ static void __init fill_pmd_gaps(void)/* we're still single threaded hence no lock needed here */ for (vm = vmlist; vm; vm = vm->next) { -if (!(vm->flags &VM_ARM_STATIC_MAPPING )) +if (!(vm->flags & (VM_ARM_STATIC_MAPPING |VM_ARM_EMPTY_MAPPING )))continue ; addr = (unsigned long )vm->addr;if (addr < next)
Greg Kroah-Hartman
maintainerPATCH 47/218 ALSA: hda - Fix missing Master volume for STAC9200/925x
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ab548d2dba63ba947287965e525cc02a15d9853d upstream.
With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with vmaster hook in patch_sigmatel.c], the former Master volume control was converted to PCM. This was supposed to be covered by the vmaster control. But due to the lack of "PCM" slave definition, this didn't happen properly. The patch fixes the missing entry.
--- sound/pci/hda/patch_sigmatel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_sigmatel.c +1 -1
@@ -1072,7 +1072,7 @@ static struct snd_kcontrol_new stac_smuxstatic const char *const slave_pfxs[] = {"Front" ,"Surround" ,"Center" ,"LFE" ,"Side" , -"Headphone" ,"Speaker" ,"IEC958" , +"Headphone" ,"Speaker" ,"IEC958" ,"PCM" ,NULL };
Greg Kroah-Hartman
maintainerPATCH 48/218 ALSA: hda - Fix Oops at codec reset/reconfig
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 07dc59f0988cb54fd87bd373b3b27eb2401dd811 upstream.
snd_hda_codec_reset() calls restore_pincfgs() where the codec is powered up again, which eventually tries to resume and initialize via the callbacks of the codec. However, it's the place just after codec free callback, thus no codec callbacks should be called after that. On a codec like CS4206, it results in Oops due to the access in init callback.
This patch fixes the issue by clearing the codec callbacks properly after freeing codec.
--- sound/pci/hda/hda_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_codec.c +1 -1
@@ -2279,6 +2279,7 @@ int snd_hda_codec_reset(struct hda_codec }if (codec->patch_ops.free) codec->patch_ops.free (codec); +memset (&codec->patch_ops,0 ,sizeof (codec->patch_ops));snd_hda_jack_tbl_clear (codec); codec->proc_widget_hook =NULL ; codec->spec =NULL ;
@@ -2292,7 +2293,6 @@ int snd_hda_codec_reset(struct hda_codec codec->num_pcms =0 ; codec->pcm_info =NULL ; codec->preset =NULL ; -memset (&codec->patch_ops,0 ,sizeof (codec->patch_ops)); codec->slave_dig_outs =NULL ; codec->spdif_status_reset =0 ;module_put (codec->owner);
Greg Kroah-Hartman
maintainerPATCH 49/218 ALSA: ice1724: Use linear scale for AK4396 volume control.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matteo Frigo <[email protected]>
commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream.
The AK4396 DAC has a linear-scale attentuator, but sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is not quite right. This patch restores the correct scale, borrowing from the ak4396 code in sound/pci/oxygen/oxygen.c.
--- sound/pci/ice1712/prodigy_hifi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/ice1712/prodigy_hifi.c +2 -1
@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd } static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1); +static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);static struct snd_kcontrol_new prodigy_hd2_controls[]__devinitdata = { {
@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h .info = ak4396_dac_vol_info, .get = ak4396_dac_vol_get, .put = ak4396_dac_vol_put, - .tlv = { .p = db_scale_wm_dac }, + .tlv = { .p = ak4396_db_scale }, }, };
Greg Kroah-Hartman
maintainerPATCH 50/218 ALSA: hda - Workaround for silent output on VAIO Z with ALC889
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e427c2375646789ecd0ccaef1a1e41458559ab2d upstream.
On recent kernels, Realtek codec parser tries to optimize the routing aggressively and take the headphone output as primary at first. This caused a regression on VAIO Z with ALC889, the silent output from the speaker.
The problem seems that the speaker pin must be connected to the first DAC (0x02) on this machine by some reason although the codec itself advertises the flexible routing with any DACs.
This patch adds a fix-up for choosing the speaker pin as the primary so that the right DAC is assigned on this device.
---
--- Documentation/sound/alsa/HD-Audio-Models.txt | 1 + sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-)
Documentation/sound/alsa/HD-Audio-Models.txt +1 -0
@@ -47,6 +47,7 @@ ALC882/883/885/888/889 acer-aspire-4930g Acer Aspire 4930G/5930G/6530G/6930G/7730G acer-aspire-8930g Acer Aspire 8330G/6935G acer-aspire Acer Aspire others + no-primary-hp VAIO Z workaround (for fixed speaker DAC) ALC861/660 ==========
sound/pci/hda/patch_realtek.c +21 -1
@@ -188,6 +188,7 @@ struct alc_spec { unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */unsigned int parse_flags;/* passed to snd_hda_parse_pin_defcfg() */ unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */ + unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins *//* auto-mute control */ int automute_mode;
@@ -4365,7 +4366,8 @@ static int alc_parse_auto_config(structreturn 0 ;/* can't find valid BIOS pin config */ } -if (cfg->line_out_type ==AUTO_PIN_SPEAKER_OUT && +if (!spec->no_primary_hp && + cfg->line_out_type ==AUTO_PIN_SPEAKER_OUT && cfg->line_outs <= cfg->hp_outs) {/* use HP as primary out */ cfg->speaker_outs = cfg->line_outs;
@@ -5076,6 +5078,7 @@ enum {ALC889_FIXUP_DAC_ROUTE ,ALC889_FIXUP_MBP_VREF ,ALC889_FIXUP_IMAC91_VREF , + ALC882_FIXUP_NO_PRIMARY_HP, }; static void alc889_fixup_coef(struct hda_codec *codec,
@@ -5199,6 +5202,17 @@ static void alc889_fixup_imac91_vref(str spec->keep_vref_in_automute =1 ; } +/* Don't take HP output as primary +* strangely, the speaker output doesn't work on VAIO Z through DAC 0x05 +*/ +static void alc882_fixup_no_primary_hp (struct hda_codec *codec, +const struct alc_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; +if (action ==ALC_FIXUP_ACT_PRE_PROBE ) + spec->no_primary_hp =1 ; +} +static const struct alc_fixup alc882_fixups[] = { [ALC882_FIXUP_ABIT_AW9D_MAX ] = { .type =ALC_FIXUP_PINS ,
@@ -5381,6 +5395,10 @@ static const struct alc_fixup alc882_fix .chained = true, .chain_id = ALC882_FIXUP_GPIO1, }, + [ALC882_FIXUP_NO_PRIMARY_HP] = { + .type = ALC_FIXUP_FUNC, + .v.func = alc882_fixup_no_primary_hp, + }, }; static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -5415,6 +5433,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1043 ,0x1971 ,"Asus W2JC" ,ALC882_FIXUP_ASUS_W2JC ),SND_PCI_QUIRK (0x1043 ,0x835f ,"Asus Eee 1601" ,ALC888_FIXUP_EEE1601 ),SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ), +SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ),/* All Apple entries are in codec SSIDs */ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
@@ -5455,6 +5474,7 @@ static const struct alc_model_fixup alc8 {.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"}, {.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"}, {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"}, + {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"}, {} };
Greg Kroah-Hartman
maintainerPATCH 51/218 Staging: speakup: fix an improperly-declared variable.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Brannon <[email protected]>
commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.
A local static variable was declared as a pointer to a string constant. We're assigning to the underlying memory, so it needs to be an array instead.
--- drivers/staging/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/speakup/main.c +1 -1
@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_datastatic int handle_goto (struct vc_data *vc,u_char type,u_char ch,u_short key) { -static u_char *goto_buf ="\0\0\0\0\0\0" ; +static u_char goto_buf[8 ];static int num;int maxlen, go_pos;char *cp;
Greg Kroah-Hartman
maintainerPATCH 52/218 staging: zcache: fix cleancache race condition with shrinker
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Jennings <[email protected]>
commit 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 upstream.
This patch fixes a race condition that results in memory corruption when using cleancache.
The race exists between the zcache shrinker handler, shrink_zcache_memory() and cleancache_get_page().
In most cases, the shrinker will both evict a zbpg from its buddy list and flush it from tmem before a cleancache_get_page() occurs on that page. A subsequent cleancache_get_page() will fail in the tmem layer.
In the rare case that two occur together and the cleancache_get_page() path gets through the tmem layer before the shrinker path can flush tmem, zbud_decompress() does a check to see if the zbpg is a "zombie", i.e. not on a buddy list, which means the shrinker is in the process of reclaiming it. If the zbpg is a zombie, zbud_decompress() returns -EINVAL.
However, this return code is being ignored by the caller, zcache_pampd_get_data_and_free(), which results in the caller of cleancache_get_page() thinking that the page has been properly retrieved when it has not.
This patch modifies zcache_pampd_get_data_and_free() to convey the failure up the stack so that the caller of cleancache_get_page() knows the page retrieval failed.
This needs to be applied to stable trees as well. zcache-main.c was named zcache.c before v3.1, so I'm not sure how you want to handle trees earlier than that.
--- drivers/staging/zcache/zcache-main.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/staging/zcache/zcache-main.c +3 -4
@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_fre void *pampd, struct tmem_pool *pool, struct tmem_oid *oid, uint32_t index) { - int ret = 0; - BUG_ON(!is_ephemeral(pool)); -zbud_decompress ((struct page *)(data), pampd); +if (zbud_decompress ((struct page *)(data), pampd) <0 ) +return -EINVAL ;zbud_free_and_delist ((struct zbud_hdr *)pampd);atomic_dec (&zcache_curr_eph_pampd_count); -return ret; +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 53/218 staging: vt6656: [BUG] - Failed connection, incorrect endian.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream.
Hi,
This patch fixes a bug with driver failing to negotiate a connection.
The bug was traced to commit 203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90
staging: vt6656: removed custom definitions of Ethernet packet types
In that patch, definitions in include/linux/if_ether.h replaced ones in tether.h which had both big and little endian definitions.
include/linux/if_ether.h only refers to big endian values, cpu_to_be16 should be used for the correct endian architectures.
--- drivers/staging/vt6656/dpc.c | 2 +- drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++------------------- 2 files changed, 20 insertions(+), 20 deletions(-)
drivers/staging/vt6656/dpc.c +1 -1
@@ -200,7 +200,7 @@ s_vProcessRxMACHeader ( }else if (!compare_ether_addr (pbyRxBuffer, &pDevice->abySNAP_RFC1042[0 ])) { cbHeaderSize +=6 ; pwType = (PWORD ) (pbyRxBufferAddr + cbHeaderSize); -if ((*pwType ==cpu_to_le16 (ETH_P_IPX )) || +if ((*pwType ==cpu_to_be16 (ETH_P_IPX )) || (*pwType ==cpu_to_le16 (0xF380 ))) { cbHeaderSize -=8 ; pwType = (PWORD ) (pbyRxBufferAddr + cbHeaderSize);
drivers/staging/vt6656/rxtx.c +19 -19
@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(// 802.1H if (ntohs (psEthHeader->wType) >ETH_DATA_LEN ) {if (pDevice->dwDiagRefCount ==0 ) { -if ((psEthHeader->wType ==cpu_to_le16 (ETH_P_IPX )) || +if ((psEthHeader->wType ==cpu_to_be16 (ETH_P_IPX )) || (psEthHeader->wType ==cpu_to_le16 (0xF380 ))) {memcpy ((PBYTE ) (pbyPayloadHead), abySNAP_Bridgetunnel,6 );
@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un Packet_Type = skb->data[ETH_HLEN +1 ]; Descriptor_type = skb->data[ETH_HLEN +1 +1 +2 ]; Key_info = (skb->data[ETH_HLEN +1 +1 +2 +1 ] <<8 )|(skb->data[ETH_HLEN +1 +1 +2 +2 ]); -if (pDevice->sTxEthHeader.wType ==cpu_to_le16 (ETH_P_PAE )) { -/* 802.1x OR eapol-key challenge frame transfer */ -if (((Protocol_Version ==1 ) || (Protocol_Version ==2 )) && - (Packet_Type ==3 )) { +if (pDevice->sTxEthHeader.wType ==cpu_to_be16 (ETH_P_PAE )) { +/* 802.1x OR eapol-key challenge frame transfer */ +if (((Protocol_Version ==1 ) || (Protocol_Version ==2 )) && + (Packet_Type ==3 )) { bTxeapol_key = TRUE;if (!(Key_info &BIT3 ) &&//WPA or RSN group-key challenge (Key_info &BIT8 ) && (Key_info &BIT9 )) {//send 2/2 key
@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un } } -if (pDevice->sTxEthHeader.wType ==cpu_to_le16 (ETH_P_PAE )) { -if (pDevice->byBBType !=BB_TYPE_11A ) { - pDevice->wCurrentRate =RATE_1M ; - pDevice->byACKRate =RATE_1M ; - pDevice->byTopCCKBasicRate =RATE_1M ; - pDevice->byTopOFDMBasicRate =RATE_6M ; - }else { - pDevice->wCurrentRate =RATE_6M ; - pDevice->byACKRate =RATE_6M ; - pDevice->byTopCCKBasicRate =RATE_1M ; - pDevice->byTopOFDMBasicRate =RATE_6M ; - } - } +if (pDevice->sTxEthHeader.wType ==cpu_to_be16 (ETH_P_PAE )) { +if (pDevice->byBBType !=BB_TYPE_11A ) { + pDevice->wCurrentRate =RATE_1M ; + pDevice->byACKRate =RATE_1M ; + pDevice->byTopCCKBasicRate =RATE_1M ; + pDevice->byTopOFDMBasicRate =RATE_6M ; + }else { + pDevice->wCurrentRate =RATE_6M ; + pDevice->byACKRate =RATE_6M ; + pDevice->byTopCCKBasicRate =RATE_1M ; + pDevice->byTopOFDMBasicRate =RATE_6M ; + } + } DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, unif (bNeedEncryption == TRUE) {DBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO "ntohs Pkt Type=%04x\n" ,ntohs (pDevice->sTxEthHeader.wType)); -if ((pDevice->sTxEthHeader.wType) ==cpu_to_le16 (ETH_P_PAE )) { +if ((pDevice->sTxEthHeader.wType) ==cpu_to_be16 (ETH_P_PAE )) { bNeedEncryption = FALSE;DBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO "Pkt Type=%04x\n" , (pDevice->sTxEthHeader.wType));if ((pMgmt->eCurrMode ==WMAC_MODE_ESS_STA ) && (pMgmt->eCurrState ==WMAC_STATE_ASSOC )) {
Greg Kroah-Hartman
maintainerPATCH 54/218 staging: r8712u: fix bug in r8712_recv_indicatepkt()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream.
64bit arches have a buggy r8712u driver, let's fix it.
skb->tail must be set properly or network stack behavior is undefined.
Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071
--- drivers/staging/rtl8712/recv_linux.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/staging/rtl8712/recv_linux.c +1 -6
@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adapif (skb ==NULL ) goto _recv_indicatepkt_drop; skb->data = precv_frame->u.hdr.rx_data; -#ifdef NET_SKBUFF_DATA_USES_OFFSET - skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail - - precv_frame->u.hdr.rx_head); -#else - skb->tail = (sk_buff_data_t )precv_frame->u.hdr.rx_tail; -#endif skb->len = precv_frame->u.hdr.len; +skb_set_tail_pointer (skb, skb->len);if ((pattrib->tcpchk_valid ==1 ) && (pattrib->tcp_chkrpt ==1 )) skb->ip_summed =CHECKSUM_UNNECESSARY ;else
Greg Kroah-Hartman
maintainerPATCH 55/218 staging: comedi: das08: Correct AO output for das08jr-16-ao
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.
Don't zero out bits 15..12 of the data value in das08jr_ao_winsn() as that knobbles the upper three-quarters of the output range for the 'das08jr-16-ao' board.
--- drivers/staging/comedi/drivers/das08.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/das08.c +1 -1
@@ -653,7 +653,7 @@ static int das08jr_ao_winsn(struct comedint chan; lsb = data[0 ] &0xff ; - msb = (data[0 ] >>8 ) &0xf ; + msb = (data[0 ] >>8 ) &0xff ; chan =CR_CHAN (insn->chanspec);
Greg Kroah-Hartman
maintainerPATCH 56/218 USB: option: replace ZTE K5006-Z entry with vendor class rule
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <[email protected]>
commit ba9edaa468869a8cea242a411066b0f490751798 upstream.
Fix the ZTE K5006-Z entry so that it actually matches anything
commit f1b5c997 USB: option: add ZTE K5006-Z
added a device specific entry assuming that the device would use class/subclass/proto == ff/ff/ff like other ZTE devices. It turns out that ZTE has started using vendor specific subclass and protocol codes:
T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=1018 Rev= 0.00 S: Manufacturer=ZTE,Incorporated S: Product=ZTE LTE Technologies MSM S: SerialNumber=MF821Vxxxxxxx C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none) E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none) E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
We do not have any information on how ZTE intend to use these codes, but let us assume for now that the 3 sets matching serial functions in the K5006-Z always will identify a serial function in a ZTE device.
--- drivers/usb/serial/option.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +4 -2
@@ -886,8 +886,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1092,6 +1090,10 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
Greg Kroah-Hartman
maintainerPATCH 57/218 fs/proc: fix potential unregister_sysctl_table hang
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Ruggeri <[email protected]>
commit 6bf6104573482570f7103d3e5ddf9574db43a363 upstream.
The unregister_sysctl_table() function hangs if all references to its ctl_table_header structure are not dropped.
This can happen sometimes because of a leak in proc_sys_lookup():proc_sys_lookup() gets a reference to the table via lookup_entry(), but it does not release it when a subsequent call to sysctl_follow_link() fails.
This patch fixes this leak by making sure the reference is always dropped on return.
See also commit 076c3eed2c31 ("sysctl: Rewrite proc_sys_lookup introducing find_entry and lookup_entry") which reorganized this code in 3.4.
Tested in Linux 3.4.4.
--- fs/proc/proc_sysctl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/proc/proc_sysctl.c +2 -3
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(st err =ERR_PTR (-ENOMEM ); inode =proc_sys_make_inode (dir->i_sb, h ? h : head, p); -if (h) -sysctl_head_finish (h); -if (!inode) goto out;
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(std_add (dentry, inode); out: +if (h) +sysctl_head_finish (h);sysctl_head_finish (head);return err; }
Greg Kroah-Hartman
maintainerPATCH 58/218 sound: tegra_alc5632: remove HP detect GPIO inversion
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <[email protected]>
commit c921928661eda599d73a6a86e58bdd5aecfa18cb upstream.
Both the schematics and practical testing show that the HP detect GPIO is high when the headphones are plugged in. Hence, the snd_soc_jack_gpio should not specify to invert the signal.
--- sound/soc/tegra/tegra_alc5632.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/tegra/tegra_alc5632.c +0 -1
@@ -95,7 +95,6 @@ static struct snd_soc_jack_gpio tegra_al .name = "Headset detection", .report = SND_JACK_HEADSET, .debounce_time = 150, - .invert = 1, };static const struct snd_soc_dapm_widget tegra_alc5632_dapm_widgets[] = {
Greg Kroah-Hartman
maintainerPATCH 59/218 perf_event: Switch to internal refcount, fix race with close()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit a6fa941d94b411bbd2b6421ffbde6db3c93e65ab upstream.
Don't mess with file refcounts (or keep a reference to file, for that matter) in perf_event. Use explicit refcount of its own instead. Deal with the race between the final reference to event going away and new children getting created for it by use of atomic_long_inc_not_zero() in inherit_event(); just have the latter free what it had allocated and return NULL, that works out just fine (children of siblings of something doomed are created as singletons, same as if the child of leader had been created and immediately killed).
--- include/linux/perf_event.h | 2 - kernel/events/core.c | 62 +++++++++++++++++++++++---------------------- 2 files changed, 34 insertions(+), 30 deletions(-)
include/linux/perf_event.h +1 -1
@@ -925,7 +925,7 @@ struct perf_event {struct hw_perf_event hw;struct perf_event_context *ctx; -struct file *filp; +atomic_long_t refcount;/* * These accumulate total time (in nanoseconds) that children
kernel/events/core.c +33 -29
160 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 60/218 ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ming <[email protected]>
commit 40bf66ec9791f1452b90b82aadc3b6e6aee201f5 upstream.
Commit 0090def("ACPI: Add interface to register/unregister device to/from power resources") used resource_lock to protect the devices list that relies on power resource. It caused a mutex dead lock, as below
acpi_power_on ---> lock resource_lock
__acpi_power_on
acpi_power_on_device
acpi_power_get_inferred_state
acpi_power_get_list_state ---> lock resource_lockThis patch adds a new mutex "devices_lock" to protect the devices list and calls acpi_power_on_device in acpi_power_on, instead of __acpi_power_on, after the resource_lock is released.
[rjw: Changed data type of a boolean variable to bool.]
--- drivers/acpi/power.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-)
drivers/acpi/power.c +23 -11
@@ -103,6 +103,7 @@ struct acpi_power_resource {/* List of devices relying on this power resource */ struct acpi_power_resource_device *devices; +struct mutex devices_lock; };static struct list_head acpi_power_resource_list;
@@ -221,7 +222,6 @@ static void acpi_power_on_device(structstatic int __acpi_power_on (struct acpi_power_resource *resource) { -struct acpi_power_resource_device *device_list = resource->devices;acpi_status status =AE_OK ; status =acpi_evaluate_object (resource->device->handle,"_ON" ,NULL ,NULL );
@@ -234,19 +234,15 @@ static int __acpi_power_on(struct acpi_pACPI_DEBUG_PRINT ((ACPI_DB_INFO ,"Power resource [%s] turned on\n" , resource->name)); -while (device_list) { -acpi_power_on_device (device_list->device); - - device_list = device_list->next; - } -return 0 ; }static int acpi_power_on (acpi_handle handle) {int result =0 ; +bool resume_device = false;struct acpi_power_resource *resource =NULL ; +struct acpi_power_resource_device *device_list; result =acpi_power_get_context (handle, &resource);if (result)
@@ -262,10 +258,25 @@ static int acpi_power_on(acpi_handle han result =__acpi_power_on (resource);if (result) resource->ref_count--; +else + resume_device = true; }mutex_unlock (&resource->resource_lock); +if (!resume_device) +return result; + +mutex_lock (&resource->devices_lock); + + device_list = resource->devices; +while (device_list) { +acpi_power_on_device (device_list->device); + device_list = device_list->next; + } + +mutex_unlock (&resource->devices_lock); +return result; }
@@ -351,7 +362,7 @@ static void __acpi_power_resource_unregiif (acpi_power_get_context (res_handle, &resource))return ; -mutex_lock (&resource->resource_lock); +mutex_lock (&resource->devices_lock); prev =NULL ; curr = resource->devices;while (curr) {
@@ -368,7 +379,7 @@ static void __acpi_power_resource_unregi prev = curr; curr = curr->next; } -mutex_unlock (&resource->resource_lock); +mutex_unlock (&resource->devices_lock); }/* Unlink dev from all power resources in _PR0 */
@@ -409,10 +420,10 @@ static int __acpi_power_resource_registe power_resource_device->device = powered_device; -mutex_lock (&resource->resource_lock); +mutex_lock (&resource->devices_lock); power_resource_device->next = resource->devices; resource->devices = power_resource_device; -mutex_unlock (&resource->resource_lock); +mutex_unlock (&resource->devices_lock);return 0 ; }
@@ -715,6 +726,7 @@ static int acpi_power_add(struct acpi_de resource->device = device;mutex_init (&resource->resource_lock); +mutex_init (&resource->devices_lock);strcpy (resource->name, device->pnp.bus_id);strcpy (acpi_device_name (device),ACPI_POWER_DEVICE_NAME );strcpy (acpi_device_class (device),ACPI_POWER_CLASS );
Greg Kroah-Hartman
maintainerPATCH 61/218 ACPI / PM: Use KERN_DEBUG when no power resources are found
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <[email protected]>
commit f25b70613c048ceb1df052576fda03321ebf41cf upstream.
commit a606dac368eed5696fb38e16b1394f1d049c09e9 adds support to link devices which have _PRx, if a device does not have _PRx, a warning message will be printed.
This commit is for ZPODD on Intel ZPODD capable platforms, on other platforms, it has no problem if there is no power resource for this device, so a warning here is not appropriate, change it to debug.
--- drivers/acpi/power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/power.c +1 -1
@@ -468,7 +468,7 @@ int acpi_power_resource_register_device(return ret; no_power_resource: - printk(KERN_WARNING PREFIX "Invalid Power Resource to register!"); + printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");return -ENODEV ; }
Greg Kroah-Hartman
maintainerPATCH 62/218 mmc: mxs-mmc: fix deadlock in SDIO IRQ case
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lauri Hintsala <[email protected]>
commit 1af36b2a993dddfa3d6860ec4879c9e8abc9b976 upstream.
Release the lock before mmc_signal_sdio_irq is called by mxs_mmc_irq_handler.
Backtrace:
[ 79.660000] =============================================
[ 79.660000] [ INFO: possible recursive locking detected ]
[ 79.660000] 3.4.0-00009-g3e96082-dirty #11 Not tainted
[ 79.660000] ---------------------------------------------
[ 79.660000] swapper/0 is trying to acquire lock:
[ 79.660000] (&(&host->lock)->rlock#2){-.....}, at: [<c026ea3c>] mxs_mmc_enable_sdio_irq+0x18/0xd4
[ 79.660000]
[ 79.660000] but task is already holding lock:
[ 79.660000] (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
[ 79.660000]
[ 79.660000] other info that might help us debug this:
[ 79.660000] Possible unsafe locking scenario:
[ 79.660000]
[ 79.660000] CPU0
[ 79.660000] ----
[ 79.660000] lock(&(&host->lock)->rlock#2);
[ 79.660000] lock(&(&host->lock)->rlock#2);
[ 79.660000]
[ 79.660000] *** DEADLOCK ***
[ 79.660000]
[ 79.660000] May be due to missing lock nesting notation
[ 79.660000]
[ 79.660000] 1 lock held by swapper/0:
[ 79.660000] #0: (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
[ 79.660000]
[ 79.660000] stack backtrace:
[ 79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c005f9c0>] (__lock_acquire+0x1948/0x1d48)
[ 79.660000] [<c005f9c0>] (__lock_acquire+0x1948/0x1d48) from [<c005fea0>] (lock_acquire+0xe0/0xf8)
[ 79.660000] [<c005fea0>] (lock_acquire+0xe0/0xf8) from [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58)
[ 79.660000] [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
[ 79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
[ 79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
[ 79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
[ 79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
[ 79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
[ 79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
[ 79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
[ 79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
[ 79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
[ 79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
[ 79.660000] BUG: spinlock lockup on CPU#0, swapper/0
[ 79.660000] lock: c398cb2c, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0
[ 79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144)
[ 79.660000] [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144) from [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58)
[ 79.660000] [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
[ 79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
[ 79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
[ 79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
[ 79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
[ 79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
[ 79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
[ 79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
[ 79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
[ 79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
[ 79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)--- drivers/mmc/host/mxs-mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/mxs-mmc.c +2 -2
@@ -280,11 +280,11 @@ static irqreturn_t mxs_mmc_irq_handler(iwritel (stat &MXS_MMC_IRQ_BITS , host->base +HW_SSP_CTRL1 +MXS_CLR_ADDR ); +spin_unlock (&host->lock); +if ((stat &BM_SSP_CTRL1_SDIO_IRQ ) && (stat &BM_SSP_CTRL1_SDIO_IRQ_EN ))mmc_signal_sdio_irq (host->mmc); -spin_unlock (&host->lock); -if (stat &BM_SSP_CTRL1_RESP_TIMEOUT_IRQ ) cmd->error = -ETIMEDOUT ;else if (stat &BM_SSP_CTRL1_RESP_ERR_IRQ )
Greg Kroah-Hartman
maintainerPATCH 63/218 mmc: sdhci-esdhc: break out early if clock is 0
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <[email protected]>
commit 74f330bceaa7b88d06062e1cac3d519a3dfc041e upstream.
Since commit 30832ab56 ("mmc: sdhci: Always pass clock request value zero to set_clock host op") was merged, esdhc_set_clock starts hitting "if (clock == 0)" where ESDHC_SYSTEM_CONTROL has been operated. This causes SDHCI card-detection function being broken. Fix the regression by moving "if (clock == 0)" above ESDHC_SYSTEM_CONTROL operation.
--- drivers/mmc/host/sdhci-esdhc.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci-esdhc.h +3 -3
@@ -48,14 +48,14 @@ static inline void esdhc_set_clock(strucint div =1 ;u32 temp; +if (clock ==0 ) + goto out; + temp =sdhci_readl (host,ESDHC_SYSTEM_CONTROL ); temp &= ~(ESDHC_CLOCK_IPGEN |ESDHC_CLOCK_HCKEN |ESDHC_CLOCK_PEREN |ESDHC_CLOCK_MASK );sdhci_writel (host, temp,ESDHC_SYSTEM_CONTROL ); -if (clock ==0 ) - goto out; -while (host->max_clk / pre_div /16 > clock && pre_div <256 ) pre_div *=2 ;
Greg Kroah-Hartman
maintainerPATCH 64/218 mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Chen <[email protected]>
commit 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 upstream.
For several MoviNAND eMMC parts, there are known issues with secure erase and secure trim. For these specific MoviNAND devices, we skip these operations.
Specifically, there is a bug in the eMMC firmware that causes unrecoverable corruption when the MMC is erased with MMC_CAP_ERASE enabled.
References:
http://forum.xda-developers.com/showthread.php?t=1644364
https://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB
--- drivers/mmc/card/block.c | 26 +++++++++++++++++++++++++- include/linux/mmc/card.h | 1 + 2 files changed, 26 insertions(+), 1 deletion(-)
drivers/mmc/card/block.c +25 -1
@@ -1430,7 +1430,8 @@ static int mmc_blk_issue_rq(struct mmc_q/* complete ongoing async transfer before issuing discard */ if (card->host->areq)mmc_blk_issue_rw_rq (mq,NULL ); -if (req->cmd_flags &REQ_SECURE ) +if (req->cmd_flags &REQ_SECURE && + !(card->quirks &MMC_QUIRK_SEC_ERASE_TRIM_BROKEN )) ret =mmc_blk_issue_secdiscard_rq (mq, req);else ret =mmc_blk_issue_discard_rq (mq, req);
@@ -1730,6 +1731,7 @@ force_ro_fail:#define CID_MANFID_SANDISK 0x2#define CID_MANFID_TOSHIBA 0x11#define CID_MANFID_MICRON 0x13 +#define CID_MANFID_SAMSUNG 0x15static const struct mmc_fixup blk_fixups[] = {
@@ -1766,6 +1768,28 @@ static const struct mmc_fixup blk_fixupsMMC_FIXUP (CID_NAME_ANY ,CID_MANFID_MICRON ,0x200 , add_quirk_mmc,MMC_QUIRK_LONG_READ_TIME ), +/* +* On these Samsung MoviNAND parts, performing secure erase or +* secure trim can result in unrecoverable corruption due to a +* firmware bug. +*/ +MMC_FIXUP ("M8G2FA" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("MAG4FA" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("MBG8FA" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("MCGAFA" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("VAL00M" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("VYL00M" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("KYL00M" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +MMC_FIXUP ("VZL00M" ,CID_MANFID_SAMSUNG ,CID_OEMID_ANY , add_quirk_mmc, +MMC_QUIRK_SEC_ERASE_TRIM_BROKEN ), +END_FIXUP };
include/linux/mmc/card.h +1 -0
@@ -234,6 +234,7 @@ struct mmc_card {#define MMC_QUIRK_BLK_NO_CMD23 (1<<7)/* Avoid CMD23 for regular multiblock */ #define MMC_QUIRK_BROKEN_BYTE_MODE_512 (1<<8)/* Avoid sending 512 bytes in */ #define MMC_QUIRK_LONG_READ_TIME (1<<9)/* Data read time > CSD says */ +#define MMC_QUIRK_SEC_ERASE_TRIM_BROKEN (1<<10)/* Skip secure for erase/trim */ /* byte mode */ unsigned int poweroff_notify_state;/* eMMC4.5 notify feature */ #define MMC_NO_POWER_NOTIFICATION 0
Re: [ 064/218] mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
Quoted 21 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Chen <[email protected]>
commit
3550ccdb9d8d350e526b809bf3dd92b550a74fe1upstream.For several MoviNAND eMMC parts, there are known issues with secure erase and secure trim. For these specific MoviNAND devices, we skip these operations.
Specifically, there is a bug in the eMMC firmware that causes unrecoverable corruption when the MMC is erased with
MMC_CAP_ERASEenabled.References:
http://forum.xda-developers.com/showthread.php?t=1644364
https://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB
Quoted 6 lines
Signed-off-by Ian Chen <[email protected]>Reviewed-by Namjae Jeon <[email protected]>Acked-by Jaehoon Chung <[email protected]>Reviewed-by Linus Walleij <[email protected]>Signed-off-by Chris Ball <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
[...]
I think you owe Greg a backport of this to 3.0.
Ben.
Signature · 3 lines
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
- Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'Greg Kroah-Hartman
maintainerPATCH 65/218 oprofile, s390: Fix uninitialized memory access when writing to oprofilefs
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Richter <[email protected]>
commit 81ff3478d9ba7f0b48b0abef740e542fd83adf79 upstream.
If oprofilefs_ulong_from_user() is called with count equals zero, *val remains unchanged. Depending on the implementation it might be uninitialized. Fixing users of oprofilefs_ulong_ from_user().
We missed these s390 changes with:
913050b oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
--- arch/s390/oprofile/init.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/s390/oprofile/init.c +5 -5
@@ -171,7 +171,7 @@ static ssize_t hw_interval_write(structif (*offset)return -EINVAL ; retval =oprofilefs_ulong_from_user (&val, buf, count); -if (retval) +if (retval <=0 )return retval;if (val < oprofile_min_interval) oprofile_hw_interval = oprofile_min_interval;
@@ -214,7 +214,7 @@ static ssize_t hwsampler_zero_write(strureturn -EINVAL ; retval =oprofilefs_ulong_from_user (&val, buf, count); -if (retval) +if (retval <=0 )return retval;if (val !=0 )return -EINVAL ;
@@ -245,7 +245,7 @@ static ssize_t hwsampler_kernel_write(streturn -EINVAL ; retval =oprofilefs_ulong_from_user (&val, buf, count); -if (retval) +if (retval <=0 )return retval;if (val !=0 && val !=1 )
@@ -280,7 +280,7 @@ static ssize_t hwsampler_user_write(strureturn -EINVAL ; retval =oprofilefs_ulong_from_user (&val, buf, count); -if (retval) +if (retval <=0 )return retval;if (val !=0 && val !=1 )
@@ -319,7 +319,7 @@ static ssize_t timer_enabled_write(strucreturn -EINVAL ; retval =oprofilefs_ulong_from_user (&val, buf, count); -if (retval) +if (retval <=0 )return retval;if (val !=0 && val !=1 )
Greg Kroah-Hartman
maintainerPATCH 66/218 ahci: Add alternate identifier for the 88SE9172
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <[email protected]>
commit 17c60c6b763cb5b83b0185e7d38d01d18e55a05a upstream.
This can also appear as 0x9192. Reported in bugzilla and confirmed with the board documentation for these boards.
Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42970
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -396,6 +396,8 @@ static const struct pci_device_id ahci_p .driver_data = board_ahci_yes_fbs }, /* 88se9125 */ { PCI_DEVICE(0x1b4b, 0x917a), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ + { PCI_DEVICE(0x1b4b, 0x9192), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ { PCI_DEVICE(0x1b4b, 0x91a3), .driver_data = board_ahci_yes_fbs },
Greg Kroah-Hartman
maintainerPATCH 67/218 kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
commit 60e233a56609fd963c59e99bd75c663d63fa91b6 upstream.
Quoted 18 lines · Fengguang Wu
After the __devinit* removal series, I can still get kernel panic in
show_uevent(). So there are more sources of bug..Debug patch:
(quoted diff) +4
-1@@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device goto out; /* copy keys to file */ - for (i = 0; i < env->envp_idx; i++) + dev_err(dev, "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name); + for (i = 0; i < env->envp_idx; i++) { + printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]); count += sprintf(&buf[count], "%s\n", env->envp[i]); + }Oops message, the env[] is again not properly initilized:
Quoted 2 lines
[ 44.068623] input input0: uevent 61 env[805306368]: input0/.../input0 [ 44.069552] uevent 0 env[0]: (null)
This is a completely different CONFIG_HOTPLUG problem, only demonstrating another reason why CONFIG_HOTPLUG should go away. I had a hard time trying to disable it anyway ;-)
The problem this time is lots of code assuming that a call to add_uevent_var() will guarantee that env->buflen > 0. This is not true if CONFIG_HOTPLUG is unset. So things like this end up overwriting env->envp_idx because the array index is -1:
if (add_uevent_var(env, "MODALIAS="))
return -ENOMEM;
len = input_print_modalias(&env->buf[env->buflen - 1],
sizeof(env->buf) - env->buflen,
dev, 0);Don't know what the best action is, given that there seem to be a *lot* of this around the kernel. This patch "fixes" the problem for me, but I don't know if it can be considered an appropriate fix.
[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to always be on is the longterm fix, but it's too late for 3.6 and older kernels to resolve this that way - gregkh ]
--- include/linux/kobject.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kobject.h +1 -1
@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(str static inline __printf(2, 3) int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...) -{return 0 ; } +{ return -ENOMEM; } static inline int kobject_action_type(const char *buf, size_t count, enum kobject_action *type)
Greg Kroah-Hartman
maintainerPATCH 68/218 Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit 67a806d9499353fabd5b5ff07337f3aa88a1c3ba upstream.
The following build error occurred during an alpha build:
net/core/sock.c:274:36: error: initializer element is not constant
Dave Anglin says:
Quoted 4 lines
Here is the line in sock.i:
struct
static_keymemalloc_socks= ((structstatic_key) { .enabled = ((atomic_t) { (0) }) });
The above line contains two compound literals. It also uses a designated initializer to initialize the field enabled. A compound literal is not a constant expression.
The location of the above statement isn't fully clear, but if a compound literal occurs outside the body of a function, the initializer list must consist of constant expressions.
--- arch/alpha/include/asm/atomic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/alpha/include/asm/atomic.h +2 -2
@@ -14,8 +14,8 @@*/ -#define ATOMIC_INIT (i) ( (atomic_t) { (i) } ) -#define ATOMIC64_INIT (i) ( (atomic64_t) { (i) } ) +#define ATOMIC_INIT (i) { (i) } +#define ATOMIC64_INIT (i) { (i) }#define atomic_read (v) (*(volatile int *)&(v)->counter)#define atomic64_read (v) (*(volatile long *)&(v)->counter)
Greg Kroah-Hartman
maintainerPATCH 69/218 digsig: add hash size comparision on signature verification
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kasatkin <[email protected]>
commit bc01637a80f5b670bd70a0279d3f93fa8de1c96d upstream.
When pkcs_1_v1_5_decode_emsa() returns without error and hash sizes do not match, hash comparision is not done and digsig_verify_rsa() returns no error. This is a bug and this patch fixes it.
The bug was introduced in v3.3 by commit b35e286a640f ("lib/digsig:pkcs_1_v1_5_decode_emsa cleanup").
--- lib/digsig.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
lib/digsig.c +4 -2
@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct keymemcpy (out1 + head, p, l); err =pkcs_1_v1_5_decode_emsa (out1, len, mblen, out2, &len); +if (err) + goto err; -if (!err && len == hlen) - err =memcmp (out2, h, hlen); +if (len != hlen ||memcmp (out2, h, hlen)) + err = -EINVAL ; err:mpi_free (in);
Greg Kroah-Hartman
maintainerPATCH 70/218 SUNRPC: Fix a UDP transport regression
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.
Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing hangs in the case of NFS over UDP mounts.
Since neither the UDP or the RDMA transport mechanism use dynamic slot allocation, we can skip grabbing the socket lock for those transports. Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA case.
Note that the NFSv4.1 back channel assigns the slot directly through rpc_run_bc_task, so we can ignore that case.
--- include/linux/sunrpc/xprt.h | 3 +++ net/sunrpc/xprt.c | 34 ++++++++++++++++++++-------------- net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 3 +++ 4 files changed, 27 insertions(+), 14 deletions(-)
include/linux/sunrpc/xprt.h +3 -0
@@ -114,6 +114,7 @@ struct rpc_xprt_ops {void (*set_buffer_size)(struct rpc_xprt *xprt,size_t sndsize,size_t rcvsize);int (*reserve_xprt)(struct rpc_xprt *xprt,struct rpc_task *task);void (*release_xprt)(struct rpc_xprt *xprt,struct rpc_task *task); +void (*alloc_slot)(struct rpc_xprt *xprt,struct rpc_task *task);void (*rpcbind)(struct rpc_task *task);void (*set_port)(struct rpc_xprt *xprt,unsigned short port);void (*connect)(struct rpc_task *task);
@@ -279,6 +280,8 @@ void xprt_connect(struct rpc_task *tasvoid xprt_reserve (struct rpc_task *task);int xprt_reserve_xprt (struct rpc_xprt *xprt,struct rpc_task *task);int xprt_reserve_xprt_cong (struct rpc_xprt *xprt,struct rpc_task *task); +void xprt_alloc_slot (struct rpc_xprt *xprt,struct rpc_task *task); +void xprt_lock_and_alloc_slot (struct rpc_xprt *xprt,struct rpc_task *task);int xprt_prepare_transmit (struct rpc_task *task);void xprt_transmit (struct rpc_task *task);void xprt_end_transmit (struct rpc_task *task);
net/sunrpc/xprt.c +20 -14
@@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(strucreturn false; } -static void xprt_alloc_slot (struct rpc_task *task) +void xprt_alloc_slot (struct rpc_xprt *xprt,struct rpc_task *task) { -struct rpc_xprt *xprt = task->tk_xprt;struct rpc_rqst *req; +spin_lock (&xprt->reserve_lock);if (!list_empty (&xprt->free)) { req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);list_del (&req->rq_list);
@@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_tdefault : task->tk_status = -EAGAIN ; } +spin_unlock (&xprt->reserve_lock);return ; out_init_req: task->tk_status =0 ; task->tk_rqstp = req;xprt_request_init (task, xprt); +spin_unlock (&xprt->reserve_lock); +} +EXPORT_SYMBOL_GPL (xprt_alloc_slot); + +void xprt_lock_and_alloc_slot (struct rpc_xprt *xprt,struct rpc_task *task) +{ +/* Note: grabbing the xprt_lock_write() ensures that we throttle +* new slot allocation if the transport is congested (i.e. when +* reconnecting a stream transport or when out of socket write +* buffer space). +*/ +if (xprt_lock_write (xprt, task)) { +xprt_alloc_slot (xprt, task); +xprt_release_write (xprt, task); + } } +EXPORT_SYMBOL_GPL (xprt_lock_and_alloc_slot);static void xprt_free_slot (struct rpc_xprt *xprt,struct rpc_rqst *req) {
@@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)if (task->tk_rqstp !=NULL )return ; -/* Note: grabbing the xprt_lock_write() here is not strictly needed, -* but ensures that we throttle new slot allocation if the transport -* is congested (e.g. if reconnecting or if we're out of socket -* write buffer space). -*/ task->tk_timeout =0 ; task->tk_status = -EAGAIN ; -if (!xprt_lock_write (xprt, task)) -return ; - -spin_lock (&xprt->reserve_lock); -xprt_alloc_slot (task); -spin_unlock (&xprt->reserve_lock); -xprt_release_write (xprt, task); + xprt->ops->alloc_slot (xprt, task); }static inline __be32 xprt_alloc_xid (struct rpc_xprt *xprt)
net/sunrpc/xprtrdma/transport.c +1 -0
@@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(structstatic struct rpc_xprt_ops xprt_rdma_procs = { .reserve_xprt = xprt_rdma_reserve_xprt, .release_xprt = xprt_release_xprt_cong,/* sunrpc/xprt.c */ + .alloc_slot = xprt_alloc_slot, .release_request = xprt_release_rqst_cong,/* ditto */ .set_retrans_timeout = xprt_set_retrans_timeout_def,/* ditto */ .rpcbind = rpcb_getport_async,/* sunrpc/rpcb_clnt.c */
net/sunrpc/xprtsock.c +3 -0
@@ -2433,6 +2433,7 @@ static void bc_destroy(struct rpc_xprt *static struct rpc_xprt_ops xs_local_ops = { .reserve_xprt = xprt_reserve_xprt, .release_xprt = xs_tcp_release_xprt, + .alloc_slot = xprt_alloc_slot, .rpcbind = xs_local_rpcbind, .set_port = xs_local_set_port, .connect = xs_connect,
@@ -2449,6 +2450,7 @@ static struct rpc_xprt_ops xs_udp_ops = .set_buffer_size = xs_udp_set_buffer_size, .reserve_xprt = xprt_reserve_xprt_cong, .release_xprt = xprt_release_xprt_cong, + .alloc_slot = xprt_alloc_slot, .rpcbind = rpcb_getport_async, .set_port = xs_set_port, .connect = xs_connect,
@@ -2466,6 +2468,7 @@ static struct rpc_xprt_ops xs_udp_ops =static struct rpc_xprt_ops xs_tcp_ops = { .reserve_xprt = xprt_reserve_xprt, .release_xprt = xs_tcp_release_xprt, + .alloc_slot = xprt_lock_and_alloc_slot, .rpcbind = rpcb_getport_async, .set_port = xs_set_port, .connect = xs_connect,
Re: [ 070/218] SUNRPC: Fix a UDP transport regression
Quoted 11 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit
f39c1bfb5a03e2d255451bff05be0d7255298fa4upstream.Commit
43cedbf0e8dfb9c5610eb7985d5f21263e313802(SUNRPC: Ensure that we grab theXPRT_LOCKbefore callingxprt_alloc_slot) is causing hangs in the case of NFS over UDP mounts.
Ditto with this. Please hold this patch until the 1 line fix mentioned previously has been merged upstream (at which point I will resend the patch through [email protected]).
Thanks!
Trond
Signature · 7 lines
Trond Myklebust Linux NFS client maintainer NetApp [email protected] www.netapp.com ���{.n�+�������+%�����ݶ��w��{.n�+����{��G�����{ay� ʇڙ�,j��f���h��������z_�(�階�ݢj"���m������G������?����&���~��iO��z��v�^�m���� ������?�I�
Greg Kroah-Hartman
maintainerRe: [ 070/218] SUNRPC: Fix a UDP transport regression
Quoted 9 lines · Trond
Quoted 8 lines · Greg Kroah-Hartman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit
f39c1bfb5a03e2d255451bff05be0d7255298fa4upstream.
Quoted 7 lines
Quoted 3 lines
Commit
43cedbf0e8dfb9c5610eb7985d5f21263e313802(SUNRPC: Ensure that we grab theXPRT_LOCKbefore callingxprt_alloc_slot) is causing hangs in the case of NFS over UDP mounts.Ditto with this. Please hold this patch until the 1 line fix mentioned previously has been merged upstream (at which point I will resend the patch through [email protected]).
Ok, now dropped from the 3.4-stable queue, please let me know when it's safe to reapply.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 71/218 md: Dont truncate size at 4TB for RAID0 and Linear
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 667a5313ecd7308d79629c0738b0db588b0b0a4e upstream.
commit 27a7b260f71439c40546b43588448faac01adb93
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
changed 0.90 metadata handling to truncated size to 4TB as that is all that 0.90 can record.
However for RAID0 and Linear, 0.90 doesn't need to record the size, so this truncation is not needed and causes working arrays to become too small.
So avoid the truncation for RAID0 and Linear
This bug was introduced in 3.1 and is suitable for any stable kernels from then onwards.
As the offending commit was tagged for 'stable', any stable kernel that it was applied to should also get this patch. That includes at least 2.6.32, 2.6.33 and 3.0. (Thanks to Ben Hutchings for providing that list).
--- drivers/md/md.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/md/md.c +6 -3
@@ -1143,8 +1143,11 @@ static int super_90_load(struct md_rdev ret =0 ; } rdev->sectors = rdev->sb_start; -/* Limit to 4TB as metadata cannot record more than that */ -if (rdev->sectors >= (2ULL <<32 )) +/* Limit to 4TB as metadata cannot record more than that. +* (not needed for Linear and RAID0 as metadata doesn't +* record this size) +*/ +if (rdev->sectors >= (2ULL <<32 ) && sb->level >=1 ) rdev->sectors = (2ULL <<32 ) -2 ;if (rdev->sectors < ((sector_t )sb->size) *2 && sb->level >=1 )
@@ -1426,7 +1429,7 @@ super_90_rdev_size_change(struct md_rdev/* Limit to 4TB as metadata cannot record more than that. * 4TB == 2^32 KB, or 2*2^32 sectors. */ -if (num_sectors >= (2ULL <<32 )) +if (num_sectors >= (2ULL <<32 ) && rdev->mddev->level >=1 ) num_sectors = (2ULL <<32 ) -2 ;md_super_write (rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, rdev->sb_page);
Greg Kroah-Hartman
maintainerPATCH 72/218 md: make sure metadata is updated when spares are activated or removed.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 6dafab6b1383e912cd252fa809570b484eb6e0dc upstream.
It isn't always necessary to update the metadata when spares are removed as the presence-or-not of a spare isn't really important to the integrity of an array.
Also activating a spare doesn't always require updating the metadata as the update on 'recovery-completed' is usually sufficient.
However the introduction of 'replacement' devices have made these transitions sometimes more important. For example the 'Replacement' flag isn't cleared until the original device is removed, so we need to ensure a metadata update after that 'spare' is removed.
So set MD_CHANGE_DEVS whenever a spare is activated or removed, to complement the current situation where it is set when a spare is added or a device is failed (or a number of other less common situations).
This is suitable for -stable as out-of-data metadata could lead to data corruption.
This is only relevant for 3.3 and later 9when 'replacement' as introduced.
--- drivers/md/md.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/md/md.c +5 -1
@@ -7420,6 +7420,8 @@ static int remove_and_add_spares(struct } } } +if (removed) +set_bit (MD_CHANGE_DEVS , &mddev->flags);return spares; }
@@ -7433,9 +7435,11 @@ static void reap_sync_thread(struct mdde !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {/* success...*/ /* activate any spares */ -if (mddev->pers->spare_active (mddev)) +if (mddev->pers->spare_active (mddev)) {sysfs_notify (&mddev->kobj,NULL ,"degraded" ); +set_bit (MD_CHANGE_DEVS , &mddev->flags); + } }if (test_bit (MD_RECOVERY_RESHAPE , &mddev->recovery) && mddev->pers->finish_reshape)
Greg Kroah-Hartman
maintainerPATCH 73/218 md/raid5: fix calculate of degraded when a replacement becomes active.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit e5c86471f933608db5d43679f84cb4346c32033e upstream.
When a replacement device becomes active, we mark the device that it replaces as 'faulty' so that it can subsequently get removed. However 'calc_degraded' only pays attention to the primary device, not the replacement, so the array appears to become degraded, which is wrong.
So teach 'calc_degraded' to consider any replacement if a primary device is faulty.
This is suitable for -stable as an incorrect 'degraded' value can confuse md and could lead to data corruption.
This is only relevant for 3.3 and later.
--- drivers/md/raid5.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/raid5.c +4 -0
@@ -380,6 +380,8 @@ static int calc_degraded(struct r5conf * degraded =0 ;for (i =0 ; i < conf->previous_raid_disks; i++) {struct md_rdev *rdev =rcu_dereference (conf->disks[i].rdev); +if (rdev &&test_bit (Faulty, &rdev->flags)) + rdev =rcu_dereference (conf->disks[i].replacement);if (!rdev ||test_bit (Faulty, &rdev->flags)) degraded++;else if (test_bit (In_sync, &rdev->flags))
@@ -404,6 +406,8 @@ static int calc_degraded(struct r5conf * degraded2 =0 ;for (i =0 ; i < conf->raid_disks; i++) {struct md_rdev *rdev =rcu_dereference (conf->disks[i].rdev); +if (rdev &&test_bit (Faulty, &rdev->flags)) + rdev =rcu_dereference (conf->disks[i].replacement);if (!rdev ||test_bit (Faulty, &rdev->flags)) degraded2++;else if (test_bit (In_sync, &rdev->flags))
Greg Kroah-Hartman
maintainerPATCH 74/218 nbd: clear waiting_queue on shutdown
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Clements <[email protected]>
commit fded4e090c60100d709318896c79816d68d5b47d upstream.
Fix a serious but uncommon bug in nbd which occurs when there is heavy I/O going to the nbd device while, at the same time, a failure (server, network) or manual disconnect of the nbd connection occurs.
There is a small window between the time that the nbd_thread is stopped and the socket is shutdown where requests can continue to be queued to nbd's internal waiting_queue. When this happens, those requests are never completed or freed.
The fix is to clear the waiting_queue on shutdown of the nbd device, in the same way that the nbd request queue (queue_head) is already being cleared.
--- drivers/block/nbd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/block/nbd.c +9 -0
@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_dev req->errors++;nbd_end_request (req); } + +while (!list_empty (&nbd->waiting_queue)) { + req = list_entry(nbd->waiting_queue.next, struct request, + queuelist); +list_del_init (&req->queuelist); + req->errors++; +nbd_end_request (req); + } }
@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_devi nbd->file =NULL ;nbd_clear_que (nbd);BUG_ON (!list_empty (&nbd->queue_head)); +BUG_ON (!list_empty (&nbd->waiting_queue));if (file)fput (file);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 75/218 ASoC: samsung dma - Dont indicate support for pause/resume.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dylan Reid <[email protected]>
commit 57b2d68863f281737d8596cb3d76d89d9cc54fd8 upstream.
The pause and resume operations indicate that the stream can be un-paused/resumed from the exact location they were paused/suspended. This is not true for this driver, the pause and suspend triggers share the same code path with stop, they flush all pending DMA transfers. This drops all pending samples. The pause_release/resume triggers are the same as start, except that prepare won't be called beforehand, nothing will be enqueued to the DMA engine and nothing will happen (no audio). Removing the pause flag will let apps know that it isn't supported. Removing the resume flag will cause user space to call prepare and start instead of resume, so audio will continue playing when the system wakes up.
Before removing the pause and resume flags, I tested this on an exynos 5250, using 'aplay -i'. Pause/un-pause leads to silence followed by a write error. Suspend/resume testing led to the same result. Removing the two flags fixes suspend/resume (since snd_pcm_prepare is called again). And leads to a proper reporting of pause not supported.
--- sound/soc/samsung/dma.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
sound/soc/samsung/dma.c +1 -7
@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma .info = SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_BLOCK_TRANSFER |SNDRV_PCM_INFO_MMAP | -SNDRV_PCM_INFO_MMAP_VALID | -SNDRV_PCM_INFO_PAUSE | - SNDRV_PCM_INFO_RESUME, + SNDRV_PCM_INFO_MMAP_VALID, .formats =SNDRV_PCM_FMTBIT_S16_LE |SNDRV_PCM_FMTBIT_U16_LE | SNDRV_PCM_FMTBIT_U8 |
@@ -246,15 +244,11 @@ static int dma_trigger(struct snd_pcm_suswitch (cmd) {case SNDRV_PCM_TRIGGER_START : -case SNDRV_PCM_TRIGGER_RESUME : -case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : prtd->state |=ST_RUNNING ; prtd->params->ops->trigger (prtd->params->ch);break ;case SNDRV_PCM_TRIGGER_STOP : -case SNDRV_PCM_TRIGGER_SUSPEND : -case SNDRV_PCM_TRIGGER_PAUSE_PUSH : prtd->state &= ~ST_RUNNING ; prtd->params->ops->stop (prtd->params->ch);break ;
Greg Kroah-Hartman
maintainerPATCH 76/218 mm/page_alloc: fix the page address of higher pages buddy calculation
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Haifeng <[email protected]>
commit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.
The heuristic method for buddy has been introduced since commit 43506fad21ca ("mm/page_alloc.c: simplify calculation of combined index of adjacent buddy lists"). But the page address of higher page's buddy was wrongly calculated, which will lead page_is_buddy to fail for ever. IOW, the heuristic method would be disabled with the wrong page address of higher page's buddy.
Calculating the page address of higher page's buddy should be based higher_page with the offset between index of higher page and index of higher page's buddy.
--- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page_alloc.c +1 -1
@@ -579,7 +579,7 @@ static inline void __free_one_page(struc combined_idx = buddy_idx & page_idx; higher_page = page + (combined_idx - page_idx); buddy_idx =__find_buddy_index (combined_idx, order +1 ); - higher_buddy = page + (buddy_idx - combined_idx); + higher_buddy = higher_page + (buddy_idx - combined_idx);if (page_is_buddy (higher_page, higher_buddy, order +1 )) {list_add_tail (&page->lru, &zone->free_area[order].free_list[migratetype]);
Greg Kroah-Hartman
maintainerPATCH 77/218 drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hilman <[email protected]>
commit 8dcebaa9a0ae8a0487f4342f3d56d2cb1c980860 upstream.
On some platforms, bootloaders are known to do some interesting RTC programming. Without going into the obscurities as to why this may be the case, suffice it to say the the driver should not make any assumptions about the state of the RTC when the driver loads. In particular, the driver probe should be sure that all interrupts are disabled until otherwise programmed.
This was discovered when finding bursty I2C traffic every second on Overo platforms. This I2C overhead was keeping the SoC from hitting deep power states. The cause was found to be the RTC firing every second on the I2C-connected TWL PMIC.
Special thanks to Felipe Balbi for suggesting to look for a rogue driver as the source of the I2C traffic rather than the I2C driver itself.
Special thanks to Steve Sakoman for helping track down the source of the continuous RTC interrups on the Overo boards.
--- drivers/rtc/rtc-twl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/rtc/rtc-twl.c +5 -0
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(strucif (ret <0 ) goto out1; +/* ensure interrupts are disabled, bootloaders can be strange */ + ret =twl_rtc_write_u8 (0 ,REG_RTC_INTERRUPTS_REG ); +if (ret <0 ) +dev_warn (&pdev->dev,"unable to disable interrupt\n" ); +/* init cached IRQ enable bits */ ret =twl_rtc_read_u8 (&rtc_irq_bits,REG_RTC_INTERRUPTS_REG );if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 78/218 hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 73d7c119255615a26070f9d6cdb722a166a29015 upstream.
twl4030_madc_conversion uses do_avg and type structure elements of twl4030_madc_request. Initialize structure to avoid random operation.
Fix for: Coverity CID 200794 Uninitialized scalar variable.
--- drivers/hwmon/twl4030-madc-hwmon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/hwmon/twl4030-madc-hwmon.c +5 -4
@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device * struct device_attribute *devattr, char *buf) { struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); -struct twl4030_madc_request req; +struct twl4030_madc_request req = { + .channels =1 << attr->index, + .method =TWL4030_MADC_SW2 , + .type =TWL4030_MADC_WAIT , + };long val; - req.channels = (1 << attr->index); - req.method =TWL4030_MADC_SW2 ; - req.func_cb =NULL ; val =twl4030_madc_conversion (&req);if (val <0 )return val;
Greg Kroah-Hartman
maintainerPATCH 79/218 sched: Add missing call to calc_load_exit_idle()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Wang <[email protected]>
commit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.
Azat Khuzhin reported high loadavg in Linux v3.6
After checking the upstream scheduler code, I found Peter's commit:
5167e8d5417b sched/nohz: Rewrite and fix load-avg computation -- again
not fully applied, missing the call to calc_load_exit_idle().
After that idle exit in sampling window will always be calculated to non-idle, and the load will be higher than normal.
This patch adds the missing call to calc_load_exit_idle().
--- kernel/time/tick-sched.c | 1 + 1 file changed, 1 insertion(+)
kernel/time/tick-sched.c +1 -0
@@ -145,6 +145,7 @@ static void tick_nohz_update_jiffies(ktitick_do_update_jiffies64 (now);local_irq_restore (flags); +calc_load_exit_idle ();touch_softlockup_watchdog (); }
Greg Kroah-Hartman
maintainerPATCH 80/218 can: mcp251x: avoid repeated frame bug
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Locher <[email protected]>
commit cab32f39dcc5b35db96497dc0a026b5dea76e4e7 upstream.
The MCP2515 has a silicon bug causing repeated frame transmission, see section 5 of MCP2515 Rev. B Silicon Errata Revision G (March 2007).
Basically, setting TXBnCTRL.TXREQ in either SPI mode (00 or 11) will eventually cause the bug. The workaround proposed by Microchip is to use mode 00 and send a RTS command on the SPI bus to initiate the transmission.
--- drivers/net/can/mcp251x.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/can/mcp251x.c +10 -1
@@ -83,6 +83,11 @@#define INSTRUCTION_LOAD_TXB (n) (0x40 + 2 * (n))#define INSTRUCTION_READ_RXB (n) (((n) == 0) ? 0x90 : 0x94)#define INSTRUCTION_RESET 0xC0 +#define RTS_TXB0 0x01 +#define RTS_TXB1 0x02 +#define RTS_TXB2 0x04 +#define INSTRUCTION_RTS (n) (0x80 | ((n) & 0x07)) +/* MPC251x registers */ #define CANSTAT 0x0e
@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct sstatic void mcp251x_hw_tx (struct spi_device *spi,struct can_frame *frame,int tx_buf_idx) { +struct mcp251x_priv *priv =dev_get_drvdata (&spi->dev);u32 sid, eid, exide, rtr;u8 buf[SPI_TRANSFER_BUF_LEN ];
@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_dev buf[TXBDLC_OFF ] = (rtr <<DLC_RTR_SHIFT ) | frame->can_dlc;memcpy (buf +TXBDAT_OFF , frame->data, frame->can_dlc);mcp251x_hw_tx_frame (spi, buf, frame->can_dlc, tx_buf_idx); -mcp251x_write_reg (spi,TXBCTRL (tx_buf_idx),TXBCTRL_TXREQ ); + +/* use INSTRUCTION_RTS, to avoid "repeated frame problem" */ + priv->spi_tx_buf[0 ] =INSTRUCTION_RTS (1 << tx_buf_idx); +mcp251x_spi_trans (priv->spi,1 ); } static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
Greg Kroah-Hartman
maintainerPATCH 81/218 mm/ia64: fix a memory block size bug
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
commit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.
I found following definition in include/linux/memory.h, in my IA64 platform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE will be 0.
#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS)
Because MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits, so MIN_MEMORY_BLOCK_SIZE(1 << 32) will will equal to 0. Actually when SECTION_SIZE_BITS >= 31, MIN_MEMORY_BLOCK_SIZE will be wrong. This will cause wrong system memory infomation in sysfs.
I think it should be:
#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)
And "echo offline > memory0/state" will cause following call trace:
kernel BUG at mm/memory_hotplug.c:885!
sh[6455]: bugcheck! 0 [1]
Pid: 6455, CPU 0, comm: sh
psr : 0000101008526030 ifs : 8000000000000fa4 ip : [<a0000001008c40f0>] Not tainted (3.6.0-rc1)
ip is at offline_pages+0x210/0xee0
Call Trace:
show_stack+0x80/0xa0
show_regs+0x640/0x920
die+0x190/0x2c0
die_if_kernel+0x50/0x80
ia64_bad_break+0x3d0/0x6e0
ia64_native_leave_kernel+0x0/0x270
offline_pages+0x210/0xee0
alloc_pages_current+0x180/0x2a0--- include/linux/memory.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/memory.h +1 -1
@@ -19,7 +19,7 @@#include <linux/compiler.h> #include <linux/mutex.h> -#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS) +#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)struct memory_block {unsigned long start_section_nr;
Greg Kroah-Hartman
maintainerPATCH 82/218 memory hotplug: fix section info double registration bug
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: qiuxishi <[email protected]>
commit f14851af0ebb32745c6c5a2e400aa0549f9d20df upstream.
There may be a bug when registering section info. For example, on my Itanium platform, the pfn range of node0 includes the other nodes, so other nodes' section info will be double registered, and memmap's page count will equal to 3.
node0: start_pfn=0x100, spanned_pfn=0x20fb00, present_pfn=0x7f8a3, => 0x000100-0x20fc00
node1: start_pfn=0x80000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x080000-0x100000 node2: start_pfn=0x100000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x100000-0x180000 node3: start_pfn=0x180000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x180000-0x200000
free_all_bootmem_node()
register_page_bootmem_info_node()
register_page_bootmem_info_section()
When hot remove memory, we can't free the memmap's page because page_count() is 2 after put_page_bootmem().
sparse_remove_one_section()
free_section_usemap()
free_map_bootmem()
put_page_bootmem()
--- mm/memory_hotplug.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
mm/memory_hotplug.c +10 -6
@@ -127,9 +127,6 @@ static void register_page_bootmem_info_sstruct mem_section *ms;struct page *page, *memmap; -if (!pfn_valid (start_pfn)) -return ; - section_nr =pfn_to_section_nr (start_pfn); ms =__nr_to_section (section_nr);
@@ -188,9 +185,16 @@ void register_page_bootmem_info_node(str end_pfn = pfn + pgdat->node_spanned_pages;/* register_section info */ -for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) - register_page_bootmem_info_section(pfn); - +for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) { +/* +* Some platforms can assign the same pfn to multiple nodes - on +* node0 as well as nodeN. To avoid registering a pfn against +* multiple nodes we check that this pfn does not already +* reside in some other node. +*/ +if (pfn_valid (pfn) && (pfn_to_nid (pfn) == node)) +register_page_bootmem_info_section (pfn); + } }#endif /* !CONFIG_SPARSEMEM_VMEMMAP */
Greg Kroah-Hartman
maintainerPATCH 83/218 xen/m2p: do not reuse kmap_op->dev_bus_addr
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Stabellini <[email protected]>
commit 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 upstream.
If the caller passes a valid kmap_op to m2p_add_override, we use kmap_op->dev_bus_addr to store the original mfn, but dev_bus_addr is part of the interface with Xen and if we are batching the hypercalls it might not have been written by the hypervisor yet. That means that later on Xen will write to it and we'll think that the original mfn is actually what Xen has written to it.
Rather than "stealing" struct members from kmap_op, keep using page->index to store the original mfn and add another parameter to m2p_remove_override to get the corresponding kmap_op instead. It is now responsibility of the caller to keep track of which kmap_op corresponds to a particular page in the m2p_override (gntdev, the only user of this interface that passes a valid kmap_op, is already doing that).
--- arch/x86/include/asm/xen/page.h | 3 ++- arch/x86/xen/p2m.c | 27 +++++++++++---------------- drivers/block/xen-blkback/blkback.c | 2 +- drivers/xen/gntdev.c | 5 +++-- drivers/xen/grant-table.c | 6 ++++-- include/xen/grant_table.h | 3 ++- 6 files changed, 23 insertions(+), 23 deletions(-)
arch/x86/include/asm/xen/page.h +2 -1
@@ -50,7 +50,8 @@ extern unsigned long set_phys_range_idenextern int m2p_add_override (unsigned long mfn,struct page *page,struct gnttab_map_grant_ref *kmap_op); -extern int m2p_remove_override (struct page *page,bool clear_pte); +extern int m2p_remove_override (struct page *page, +struct gnttab_map_grant_ref *kmap_op);extern struct page *m2p_find_override (unsigned long mfn);extern unsigned long m2p_find_override_pfn (unsigned long mfn,unsigned long pfn);
arch/x86/xen/p2m.c +11 -16
@@ -714,9 +714,6 @@ int m2p_add_override(unsigned long mfn,xen_mc_issue (PARAVIRT_LAZY_MMU ); } -/* let's use dev_bus_addr to record the old mfn instead */ - kmap_op->dev_bus_addr = page->index; - page->index = (unsigned long ) kmap_op; }spin_lock_irqsave (&m2p_override_lock, flags);list_add (&page->lru, &m2p_overrides[mfn_hash (mfn)]);
@@ -743,7 +740,8 @@ int m2p_add_override(unsigned long mfn,return 0 ; }EXPORT_SYMBOL_GPL (m2p_add_override); -int m2p_remove_override (struct page *page,bool clear_pte) +int m2p_remove_override (struct page *page, +struct gnttab_map_grant_ref *kmap_op) {unsigned long flags;unsigned long mfn;
@@ -773,10 +771,8 @@ int m2p_remove_override(struct page *pagWARN_ON (!PagePrivate (page));ClearPagePrivate (page); -if (clear_pte) { -struct gnttab_map_grant_ref *map_op = - (struct gnttab_map_grant_ref *) page->index; -set_phys_to_machine (pfn, map_op->dev_bus_addr); +set_phys_to_machine (pfn, page->index); +if (kmap_op !=NULL ) {if (!PageHighMem (page)) {struct multicall_space mcs;struct gnttab_unmap_grant_ref *unmap_op;
@@ -788,13 +784,13 @@ int m2p_remove_override(struct page *pag* issued. In this case handle is going to -1 because * it hasn't been modified yet. */ -if (map_op->handle ==-1 ) +if (kmap_op->handle ==-1 )xen_mc_flush ();/* -* Now if map_op->handle is negative it means that the +* Now if kmap_op->handle is negative it means that the * hypercall actually returned an error. */ -if (map_op->handle == GNTST_general_error) { +if (kmap_op->handle == GNTST_general_error) {printk (KERN_WARNING "m2p_remove_override: " "pfn %lx mfn %lx, failed to modify kernel mappings" , pfn, mfn);
@@ -804,8 +800,8 @@ int m2p_remove_override(struct page *pag mcs =xen_mc_entry (sizeof (struct gnttab_unmap_grant_ref )); unmap_op = mcs.args; - unmap_op->host_addr = map_op->host_addr; - unmap_op->handle = map_op->handle; + unmap_op->host_addr = kmap_op->host_addr; + unmap_op->handle = kmap_op->handle; unmap_op->dev_bus_addr =0 ; MULTI_grant_table_op(mcs.mc,
@@ -816,10 +812,9 @@ int m2p_remove_override(struct page *pagset_pte_at (&init_mm, address, ptep,pfn_pte (pfn,PAGE_KERNEL ));__flush_tlb_single (address); - map_op->host_addr =0 ; + kmap_op->host_addr =0 ; } - }else -set_phys_to_machine (pfn, page->index); + }/* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present * somewhere in this domain, even before being added to the
drivers/block/xen-blkback/blkback.c +1 -1
@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pendi invcount++; } - ret =gnttab_unmap_refs (unmap, pages, invcount, false); + ret =gnttab_unmap_refs (unmap,NULL , pages, invcount);BUG_ON (ret); }
drivers/xen/gntdev.c +3 -2
@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct gr } } - err =gnttab_unmap_refs (map->unmap_ops + offset, map->pages + offset, - pages, true); + err =gnttab_unmap_refs (map->unmap_ops + offset, + use_ptemod ? map->kmap_ops + offset :NULL , map->pages + offset, + pages);if (err)return err;
drivers/xen/grant-table.c +4 -2
@@ -774,7 +774,8 @@ int gnttab_map_refs(struct gnttab_map_grEXPORT_SYMBOL_GPL (gnttab_map_refs);int gnttab_unmap_refs (struct gnttab_unmap_grant_ref *unmap_ops, -struct page **pages,unsigned int count,bool clear_pte) +struct gnttab_map_grant_ref *kmap_ops, +struct page **pages,unsigned int count) {int i, ret;
@@ -786,7 +787,8 @@ int gnttab_unmap_refs(struct gnttab_unmareturn ret;for (i =0 ; i < count; i++) { - ret =m2p_remove_override (pages[i], clear_pte); + ret =m2p_remove_override (pages[i], kmap_ops ? + &kmap_ops[i] :NULL );if (ret)return ret; }
include/xen/grant_table.h +2 -1
@@ -185,6 +185,7 @@ int gnttab_map_refs(struct gnttab_map_grstruct gnttab_map_grant_ref *kmap_ops, struct page **pages, unsigned int count);int gnttab_unmap_refs (struct gnttab_unmap_grant_ref *unmap_ops, -struct page **pages,unsigned int count,bool clear_pte); +struct gnttab_map_grant_ref *kunmap_ops, +struct page **pages,unsigned int count);#endif /* __ASM_GNTTAB_H__ */
Greg Kroah-Hartman
maintainerPATCH 84/218 xen/boot: Disable NUMA for PV guests.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit 8d54db795dfb1049d45dc34f0dddbc5347ec5642 upstream.
The hypervisor is in charge of allocating the proper "NUMA" memory and dealing with the CPU scheduler to keep them bound to the proper NUMA node. The PV guests (and PVHVM) have no inkling of where they run and do not need to know that right now. In the future we will need to inject NUMA configuration data (if a guest spans two or more NUMA nodes) so that the kernel can make the right choices. But those patches are not yet present.
In the meantime, disable the NUMA capability in the PV guest, which also fixes a bootup issue. Andre says:
"we see Dom0 crashes due to the kernel detecting the NUMA topology not by ACPI, but directly from the northbridge (CONFIG_AMD_NUMA).
This will detect the actual NUMA config of the physical machine, but will crash about the mismatch with Dom0's virtual memory. Variation of the theme: Dom0 sees what it's not supposed to see.
This happens with the said config option enabled and on a machine where this scanning is still enabled (K8 and Fam10h, not Bulldozer class)
We have this dump then:
NUMA: Warning: node ids are out of bound, from=-1 to=-1 distance=10 Scanning NUMA topology in Northbridge 24
Number of physical nodes 4
Node 0 MemBase 0000000000000000 Limit 0000000040000000 Node 1 MemBase 0000000040000000 Limit 0000000138000000 Node 2 MemBase 0000000138000000 Limit 00000001f8000000 Node 3 MemBase 00000001f8000000 Limit 0000000238000000 Initmem setup node 0 0000000000000000-0000000040000000
NODE_DATA [000000003ffd9000 - 000000003fffffff]
Initmem setup node 1 0000000040000000-0000000138000000
NODE_DATA [0000000137fd9000 - 0000000137ffffff]
Initmem setup node 2 0000000138000000-00000001f8000000
NODE_DATA [00000001f095e000 - 00000001f0984fff]
Initmem setup node 3 00000001f8000000-0000000238000000 Cannot find 159744 bytes in node 3
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96 Pid: 0, comm: swapper Not tainted 3.3.6 #1 AMD Dinar/Dinar RIP: e030:[<ffffffff81d220e6>] [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96 .. snip.. [<ffffffff81d23024>] sparse_early_usemaps_alloc_node+0x64/0x178 [<ffffffff81d23348>] sparse_init+0xe4/0x25a [<ffffffff81d16840>] paging_init+0x13/0x22 [<ffffffff81d07fbb>] setup_arch+0x9c6/0xa9b [<ffffffff81683954>] ? printk+0x3c/0x3e [<ffffffff81d01a38>] start_kernel+0xe5/0x468 [<ffffffff81d012cf>] x86_64_start_reservations+0xba/0xc1 [<ffffffff81007153>] ? xen_setup_runstate_info+0x2c/0x36 [<ffffffff81d050ee>] xen_start_kernel+0x565/0x56c
"
so we just disable NUMA scanning by setting numa_off=1.
--- arch/x86/xen/setup.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/xen/setup.c +4 -0
@@ -17,6 +17,7 @@#include <asm/e820.h> #include <asm/setup.h> #include <asm/acpi.h> +#include <asm/numa.h> #include <asm/xen/hypervisor.h> #include <asm/xen/hypercall.h>
@@ -431,4 +432,7 @@ void __init xen_arch_setup(void)disable_cpufreq ();WARN_ON (set_pm_idle_to_default ());fiddle_vdso (); +#ifdef CONFIG_NUMA + numa_off =1 ; +#endif }
Greg Kroah-Hartman
maintainerPATCH 85/218 hwmon: (fam15h_power) Tweak runavg_range on resume
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Herrmann <[email protected]>
commit 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 upstream.
The quirk introduced with commit 00250ec90963b7ef6678438888f3244985ecde14 (hwmon: fam15h_power: fix bogus values with current BIOSes) is not only required during driver load but also when system resumes from suspend. The BIOS might set the previously recommended (but unsuitable) initilization value for the running average range register during resume.
--- drivers/hwmon/fam15h_power.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/hwmon/fam15h_power.c +13 -2
@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_in* counter saturations resulting in bogus power readings. * We correct this value ourselves to cope with older BIOSes. */ -static DEFINE_PCI_DEVICE_TABLE (affected_device) = { +static const struct pci_device_id affected_device[] = { {PCI_VDEVICE (AMD ,PCI_DEVICE_ID_AMD_15H_NB_F4 ) }, {0 } }; -static void __devinit tweak_runavg_range (struct pci_dev *pdev) +static void tweak_runavg_range (struct pci_dev *pdev) {u32 val;
@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range REG_TDP_RUNNING_AVERAGE, val); } +#ifdef CONFIG_PM +static int fam15h_power_resume (struct pci_dev *pdev) +{ +tweak_runavg_range (pdev); +return 0 ; +} +#else +#define fam15h_power_resume NULL +#endif +static void __devinit fam15h_power_init_data (struct pci_dev *f4,struct fam15h_power_data *data) {
@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_dr .id_table = fam15h_power_id_table, .probe = fam15h_power_probe, .remove = __devexit_p(fam15h_power_remove), + .resume = fam15h_power_resume, };static int __init fam15h_power_init (void )
Greg Kroah-Hartman
maintainerPATCH 86/218 hwmon: (ads7871) Add name sysfs attribute
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 4e21f4eaa49f78d3e977e316514c941053871c76 upstream.
The 'name' sysfs attribute is mandatory for hwmon devices, but was missing in this driver.
--- drivers/hwmon/ads7871.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/hwmon/ads7871.c +9 -0
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct devic } } +static ssize_t ads7871_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0); static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1); static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_I static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6); static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7); +static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL); +static struct attribute *ads7871_attributes[] = { &sensor_dev_attr_in0_input.dev_attr.attr, &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attribu &sensor_dev_attr_in5_input.dev_attr.attr, &sensor_dev_attr_in6_input.dev_attr.attr, &sensor_dev_attr_in7_input.dev_attr.attr, + &dev_attr_name.attr, NULL };
Greg Kroah-Hartman
maintainerPATCH 87/218 hwmon: (ad7314) Add name sysfs attribute
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 3ceefe4319636d89d4bdf40dca9471970f942e4f upstream.
The 'name' sysfs attribute is mandatory for hwmon devices, but was missing in this driver.
--- drivers/hwmon/ad7314.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hwmon/ad7314.c +8 -0
@@ -94,10 +94,18 @@ static ssize_t ad7314_show_temperature(s } } +static ssize_t ad7314_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + +static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL); static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ad7314_show_temperature, NULL, 0);static struct attribute *ad7314_attributes[] = { + &dev_attr_name.attr, &sensor_dev_attr_temp1_input.dev_attr.attr,NULL , };
Greg Kroah-Hartman
maintainerPATCH 88/218 HID: Fix logitech-dj: missing Unifying device issue
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nestor Lopez Casado <[email protected]>
commit 596264082f10dd4a567c43d4526b2f54ac5520bc upstream.
This patch fixes an issue introduced after commit 4ea5454203d991ec ("HID: Fix race condition between driver core and ll-driver").
After that commit, hid-core discards any incoming packet that arrives while hid driver's probe function is being executed.
This broke the enumeration process of hid-logitech-dj, that must receive control packets in-band with the mouse and keyboard packets. Discarding mouse or keyboard data at the very begining is usually fine, but it is not the case for control packets.
This patch forces a re-enumeration of the paired devices when a packet arrives that comes from an unknown device.
Based on a patch originally written by Benjamin Tissoires.
--- drivers/hid/hid-logitech-dj.c | 41 +++++++++++++++++++++++++++++++++++++++++ drivers/hid/hid-logitech-dj.h | 1 + 2 files changed, 42 insertions(+)
drivers/hid/hid-logitech-dj.c +41 -0
@@ -185,6 +185,7 @@ static struct hid_ll_driver logi_dj_ll_dstatic int logi_dj_output_hidraw_report (struct hid_device *hid,u8 * buf,size_t count,unsigned char report_type); +static int logi_dj_recv_query_paired_devices (struct dj_receiver_dev *djrcv_dev);static void logi_dj_recv_destroy_djhid_device (struct dj_receiver_dev *djrcv_dev,struct dj_report *dj_report)
@@ -225,6 +226,7 @@ static void logi_dj_recv_add_djhid_devicif (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION ] &SPFUNCTION_DEVICE_LIST_EMPTY ) {dbg_hid ("%s: device list is empty\n" , __func__); + djrcv_dev->querying_devices = false;return ; }
@@ -235,6 +237,12 @@ static void logi_dj_recv_add_djhid_devicreturn ; } +if (djrcv_dev->paired_dj_devices[dj_report->device_index]) { +/* The device is already known. No need to reallocate it. */ +dbg_hid ("%s: device is already known\n" , __func__); +return ; + } + dj_hiddev =hid_allocate_device ();if (IS_ERR (dj_hiddev)) { dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -298,6 +306,7 @@ static void delayedwork_callback(structstruct dj_report dj_report;unsigned long flags;int count; +int retval;dbg_hid ("%s\n" , __func__);
@@ -330,6 +339,25 @@ static void delayedwork_callback(structlogi_dj_recv_destroy_djhid_device (djrcv_dev, &dj_report);break ;default : +/* A normal report (i. e. not belonging to a pair/unpair notification) +* arriving here, means that the report arrived but we did not have a +* paired dj_device associated to the report's device_index, this +* means that the original "device paired" notification corresponding +* to this dj_device never arrived to this driver. The reason is that +* hid-core discards all packets coming from a device while probe() is +* executing. */ +if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) { +/* ok, we don't know the device, just re-ask the +* receiver for the list of connected devices. */ + retval =logi_dj_recv_query_paired_devices (djrcv_dev); +if (!retval) { +/* everything went fine, so just leave */ +break ; + } +dev_err (&djrcv_dev->hdev->dev, +"%s:logi_dj_recv_query_paired_devices " +"error:%d\n" , __func__, retval); + }dbg_hid ("%s: unexpected report type\n" , __func__); } }
@@ -360,6 +388,12 @@ static void logi_dj_recv_forward_null_reif (!djdev) {dbg_hid ("djrcv_dev->paired_dj_devices[dj_report->device_index]" " is NULL, index %d\n" , dj_report->device_index); +kfifo_in (&djrcv_dev->notif_fifo, dj_report,sizeof (struct dj_report )); + +if (schedule_work (&djrcv_dev->work) ==0 ) { +dbg_hid ("%s: did not schedule the work item, was already " +"queued\n" , __func__); + }return ; }
@@ -390,6 +424,12 @@ static void logi_dj_recv_forward_report(if (dj_device ==NULL ) {dbg_hid ("djrcv_dev->paired_dj_devices[dj_report->device_index]" " is NULL, index %d\n" , dj_report->device_index); +kfifo_in (&djrcv_dev->notif_fifo, dj_report,sizeof (struct dj_report )); + +if (schedule_work (&djrcv_dev->work) ==0 ) { +dbg_hid ("%s: did not schedule the work item, was already " +"queued\n" , __func__); + }return ; }
@@ -437,6 +477,7 @@ static int logi_dj_recv_query_paired_devreturn logi_dj_recv_send_report (djrcv_dev, &dj_report); } +static int logi_dj_recv_switch_to_dj_mode (struct dj_receiver_dev *djrcv_dev,unsigned timeout) {
drivers/hid/hid-logitech-dj.h +1 -0
@@ -101,6 +101,7 @@ struct dj_receiver_dev {struct work_struct work;struct kfifo notif_fifo;spinlock_t lock; +bool querying_devices; };struct dj_device {
Greg Kroah-Hartman
maintainerPATCH 89/218 cifs: fix return value in cifsConvertToUTF16
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit c73f693989d7a7d99ec66a7065295a0c93d0b127 upstream.
This function returns the wrong value, which causes the callers to get the length of the resulting pathname wrong when it contains non-ASCII characters.
This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767
--- fs/cifs/cifs_unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/cifs_unicode.c +1 -1
@@ -328,6 +328,6 @@ cifsConvertToUTF16(__le16 *target, const } ctoUTF16_out: -return i; +return j; }
Greg Kroah-Hartman
maintainerPATCH 90/218 vmwgfx: add dumb ioctl support
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 5e1782d224c79b26ab7d5c31e3f87657000714fb upstream.
Testing and works with the -modesetting driver,
--- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 ++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 10 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 73 +++++++++++++++++++++++++++++++ 3 files changed, 88 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +5 -0
@@ -1159,6 +1159,11 @@ static struct drm_driver driver = { .open = vmw_driver_open, .preclose = vmw_preclose, .postclose = vmw_postclose, + + .dumb_create = vmw_dumb_create, + .dumb_map_offset = vmw_dumb_map_offset, + .dumb_destroy = vmw_dumb_destroy, + .fops = &vmwgfx_driver_fops, .name = VMWGFX_DRIVER_NAME, .desc = VMWGFX_DRIVER_DESC,
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +10 -0
@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_privateint vmw_kms_update_layout_ioctl (struct drm_device *dev,void *data,struct drm_file *file_priv); +int vmw_dumb_create (struct drm_file *file_priv, +struct drm_device *dev, +struct drm_mode_create_dumb *args); + +int vmw_dumb_map_offset (struct drm_file *file_priv, +struct drm_device *dev,uint32_t handle, +uint64_t *offset); +int vmw_dumb_destroy (struct drm_file *file_priv, +struct drm_device *dev, +uint32_t handle);/** * Overlay control - vmwgfx_overlay.c */
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +73 -0
76 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 91/218 ibmveth: Fix alignment of rx queue bug
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santiago Leon <[email protected]>
commit d90c92fee89ccd75ef2646f3bde0b4c0450666c3 upstream.
This patch fixes a bug found by Nish Aravamudan
(https://lkml.org/lkml/2012/5/15/220) where the driver is not following the spec (it is not aligning the rx buffer on a 16-byte boundary) and the hypervisor aborts the registration, making the device unusable.
The fix follows BenH's recommendation (https://lkml.org/lkml/2012/7/20/461)
to replace the kmalloc+map for a single call to dma_alloc_coherent() because that function always aligns to a 16-byte boundary.
The stable trees will run into this bug whenever the rx buffer kmalloc call returns something not aligned on a 16-byte boundary.
--- drivers/net/ethernet/ibm/ibmveth.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +9 -17
@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmve }if (adapter->rx_queue.queue_addr !=NULL ) { -if (!dma_mapping_error (dev, adapter->rx_queue.queue_dma)) { -dma_unmap_single (dev, - adapter->rx_queue.queue_dma, - adapter->rx_queue.queue_len, -DMA_BIDIRECTIONAL ); - adapter->rx_queue.queue_dma =DMA_ERROR_CODE ; - } -kfree (adapter->rx_queue.queue_addr); +dma_free_coherent (dev, adapter->rx_queue.queue_len, + adapter->rx_queue.queue_addr, + adapter->rx_queue.queue_dma); adapter->rx_queue.queue_addr =NULL ; }
@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_devic goto err_out; } + dev = &adapter->vdev->dev; + adapter->rx_queue.queue_len =sizeof (struct ibmveth_rx_q_entry ) * rxq_entries; - adapter->rx_queue.queue_addr =kmalloc (adapter->rx_queue.queue_len, -GFP_KERNEL ); + adapter->rx_queue.queue_addr = +dma_alloc_coherent (dev, adapter->rx_queue.queue_len, + &adapter->rx_queue.queue_dma,GFP_KERNEL );if (!adapter->rx_queue.queue_addr) {netdev_err (netdev,"unable to allocate rx queue pages\n" );
@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_devic goto err_out; } - dev = &adapter->vdev->dev; - adapter->buffer_list_dma =dma_map_single (dev, adapter->buffer_list_addr,4096 ,DMA_BIDIRECTIONAL ); adapter->filter_list_dma =dma_map_single (dev, adapter->filter_list_addr,4096 ,DMA_BIDIRECTIONAL ); - adapter->rx_queue.queue_dma =dma_map_single (dev, - adapter->rx_queue.queue_addr, - adapter->rx_queue.queue_len,DMA_BIDIRECTIONAL );if ((dma_mapping_error (dev, adapter->buffer_list_dma)) || - (dma_mapping_error (dev, adapter->filter_list_dma)) || - (dma_mapping_error (dev, adapter->rx_queue.queue_dma))) { + (dma_mapping_error (dev, adapter->filter_list_dma))) {netdev_err (netdev,"unable to map filter or buffer list " "pages\n" ); rc = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 92/218 mac80211: clear bssid on auth/assoc failure
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <[email protected]>
commit 3d2abdfdf14f4d6decc2023708211e19b096f4ca upstream.
ifmgd->bssid wasn't cleared properly in some auth/assoc failure cases, causing mac80211 and the low-level driver to go out of sync.
Clear ifmgd->bssid on failure, and notify the driver.
--- net/mac80211/mlme.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/mlme.c +4 -0
@@ -3232,6 +3232,8 @@ int ieee80211_mgd_auth(struct ieee80211_ goto out_unlock; err_clear: +memset (ifmgd->bssid,0 ,ETH_ALEN ); +ieee80211_bss_info_change_notify (sdata,BSS_CHANGED_BSSID ); ifmgd->auth_data =NULL ; err_free:kfree (auth_data);
@@ -3410,6 +3412,8 @@ int ieee80211_mgd_assoc(struct ieee80211 err =0 ; goto out; err_clear: +memset (ifmgd->bssid,0 ,ETH_ALEN ); +ieee80211_bss_info_change_notify (sdata,BSS_CHANGED_BSSID ); ifmgd->assoc_data =NULL ; err_free:kfree (assoc_data);
Greg Kroah-Hartman
maintainerPATCH 93/218 brcmfmac: fix big endian bug in i-scan.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hante Meuleman <[email protected]>
commit ed205b361956c96e0d8c09a8c9135a6a79cd9541 upstream.
ssid len is 32 bit and needs endian conversion for big endian systems.
--- drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +4 -2
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_s params_le->active_time =cpu_to_le32 (-1 ); params_le->passive_time =cpu_to_le32 (-1 ); params_le->home_time =cpu_to_le32 (-1 ); -if (ssid && ssid->SSID_len) -memcpy (¶ms_le->ssid_le, ssid,sizeof (struct brcmf_ssid )); +if (ssid && ssid->SSID_len) { + params_le->ssid_le.SSID_len =cpu_to_le32 (ssid->SSID_len); +memcpy (¶ms_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len); + } } static s32
Greg Kroah-Hartman
maintainerPATCH 94/218 brcmfmac: Fix big endian host configuration data.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hante Meuleman <[email protected]>
commit e020a83d0942a5aceac35986500c9834efc8707d upstream.
Fixes big endian host configuration parameters.
--- drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 +++++++++++-------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c +16 -10
@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(stru {char iovbuf[32 ];int retcode; +__le32 arp_mode_le; -brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode,4 , iovbuf,sizeof (iovbuf)); + arp_mode_le =cpu_to_le32 (arp_mode); +brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode_le,4 , iovbuf, +sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf)); retcode = retcode >=0 ?0 : retcode;
@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(s {char iovbuf[32 ];int retcode; +__le32 arp_enable_le; -brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable,4 , + arp_enable_le =cpu_to_le32 (arp_enable); + +brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable_le,4 , iovbuf,sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -803,10 +809,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pchar buf[128 ], *ptr;u32 dongle_align = drvr->bus_if->align;u32 glom =0 ; -u32 roaming =1 ; -uint bcn_timeout =3 ; -int scan_assoc_time =40 ; -int scan_unassoc_time =40 ; +__le32 roaming_le =cpu_to_le32 (1 ); +__le32 bcn_timeout_le =cpu_to_le32 (3 ); +__le32 scan_assoc_time_le =cpu_to_le32 (40 ); +__le32 scan_unassoc_time_le =cpu_to_le32 (40 );int i;mutex_lock (&drvr->proto_block);
@@ -841,14 +847,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_p/* Setup timeout if Beacons are lost and roam is off to report link down */ -brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout,4 , iovbuf, +brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));/* Enable/Disable build-in roaming to allowed ext supplicant to take of romaing */ -brcmf_c_mkiovar ("roam_off" , (char *)&roaming,4 , +brcmf_c_mkiovar ("roam_off" , (char *)&roaming_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -863,9 +869,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_p sizeof(iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_CHANNEL_TIME , - (char *)&scan_assoc_time,sizeof (scan_assoc_time)); + (char *)&scan_assoc_time_le,sizeof (scan_assoc_time_le));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_UNASSOC_TIME , - (char *)&scan_unassoc_time,sizeof (scan_unassoc_time)); + (char *)&scan_unassoc_time_le,sizeof (scan_unassoc_time_le));/* Set and enable ARP offload feature */ brcmf_c_arp_offload_set (drvr,BRCMF_ARPOL_MODE );
Greg Kroah-Hartman
maintainerPATCH 95/218 SCSI: lpfc: fix problems with -Werror
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Bottomley <[email protected]>
commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream.
Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage with random gcc incarnations. These look like gcc problems, but we shouldn't break the build because of a bad gcc. Fix this by adding a make flag
WARNINGS_BECOME_ERRORS=1
which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror
--- drivers/scsi/lpfc/Makefile | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/lpfc/Makefile +2 -0
@@ -22,7 +22,9 @@ ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage ccflags-$(GCOV) += -O0 +ifdef WARNINGS_BECOME_ERRORS ccflags-y += -Werror +endif obj-$(CONFIG_SCSI_LPFC) := lpfc.o
Greg Kroah-Hartman
maintainerPATCH 96/218 SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream.
This patch checks whether HBA is SAS2008 B0 controller.
if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX, as SAS2008 B0 controller doesn't support MSIX interrupts.
--- drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_base.c +7 -0
@@ -1202,6 +1202,13 @@ _base_check_enable_msix(struct MPT2SAS_Au16 message_control; +/* Check whether controller SAS2008 B0 controller, +if it is SAS2008 B0 controller use IO-APIC instead of MSIX */ +if (ioc->pdev->device ==MPI2_MFGPAGE_DEVID_SAS2008 && + ioc->pdev->revision ==0x01 ) { +return -EINVAL ; + } + base =pci_find_capability (ioc->pdev,PCI_CAP_ID_MSIX );if (!base) { dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
Greg Kroah-Hartman
maintainerPATCH 97/218 SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie Wai <[email protected]>
commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.
This patch fixes the following kernel panic invoked by uninitialized fields in the chip initialization for the 1G bnx2 iSCSI offload.
One of the bits in the chip initialization is being used by the latest firmware to control overflow packets. When this control bit gets enabled erroneously, it would ultimately result in a bad packet placement which would cause the bnx2 driver to dereference a NULL ptr in the placement handler.
This can happen under certain stress I/O environment under the Linux iSCSI offload operation.
This change only affects Broadcom's 5709 chipset.
Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP: [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2 RIP: 0010:[<ffffffff881f0e7d>] [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216 RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000 RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220 RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000 R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010 R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558 FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0 Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820) Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520 ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8 Call Trace: <IRQ> [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231 [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1 [<ffffffff800125a0>] __do_softirq+0x89/0x133 [<ffffffff8005e30c>] call_softirq+0x1c/0x28 [<ffffffff8006d5de>] do_softirq+0x2c/0x7d [<ffffffff8006d46e>] do_IRQ+0xee/0xf7 [<ffffffff8005d625>] ret_from_intr+0x0/0xa <EOI> [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341 [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341 [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341 [<ffffffff80049560>] cpu_idle+0x95/0xb8 [<ffffffff80078b1c>] start_secondary+0x479/0x488
--- drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/bnx2i/bnx2i_hwi.c +3 -0
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(structint rc =0 ;u64 mask64; +memset (&iscsi_init,0x00 ,sizeof (struct iscsi_kwqe_init1 )); +memset (&iscsi_init2,0x00 ,sizeof (struct iscsi_kwqe_init2 )); +bnx2i_adjust_qp_size (hba); iscsi_init.flags =
Greg Kroah-Hartman
maintainerPATCH 98/218 SCSI: hpsa: fix handling of protocol error
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream.
If a command status of CMD_PROTOCOL_ERR is received, this information should be conveyed to the SCSI mid layer, not dropped on the floor. CMD_PROTOCOL_ERR may be received from the Smart Array for any commands destined for an external RAID controller such as a P2000, or commands destined for tape drives or CD/DVD-ROM drives, if for instance a cable is disconnected. This mostly affects multipath configurations, as disconnecting a cable on a non-multipath configuration is not going to do anything good regardless of whether CMD_PROTOCOL_ERR is handled correctly or not. Not handling CMD_PROTOCOL_ERR correctly in a multipath configaration involving external RAID controllers may cause data corruption, so this is quite a serious bug. This bug should not normally cause a problem for direct attached disk storage.
--- drivers/scsi/hpsa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/hpsa.c +2 -1
@@ -1264,8 +1264,9 @@ static void complete_scsi_command(struct }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"cp %p has " -"protocol error \n" , cp); +"protocol error\n" , cp);break ;case CMD_HARDWARE_ERR : cmd->result =DID_ERROR <<16 ;
Greg Kroah-Hartman
maintainerPATCH 99/218 SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Sen <[email protected]>
commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream.
When using the commands below to write some data to a virtio-scsi LUN of the QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash.
# sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.)
# sudo mount /dev/sdb /mnt
# dd if=/dev/zero of=/mnt/file bs=1M count=1024In current implementation, sg_set_buf is called to add buffers to sg list which is put into the virtqueue eventually. But if there are some HighMem pages in table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may return NULL value. This will cause QEMU exit when virtqueue_map_sg is called in QEMU because an invalid GPA is passed by virtqueue.
Two solutions are discussed here:
http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html
Finally, value assignment approach was adopted because:
Value assignment creates a well-formed scatterlist, because the termination marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the source sg_list is just copied to the the last entry in destination list. Note that, for now, virtio_ring does not care about the form of the scatterlist and simply processes the first out_num + in_num consecutive elements of the sg[] array.
I have tested the patch on my workstation. QEMU would not crash any more.
--- drivers/scsi/virtio_scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/virtio_scsi.c +1 -1
@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scatint i;for_each_sg (table->sgl, sg_elem, table->nents, i) -sg_set_buf (&sg[idx++],sg_virt (sg_elem), sg_elem->length); + sg[idx++] = *sg_elem; *p_idx = idx; }
Greg Kroah-Hartman
maintainerPATCH 100/218 Bluetooth: mgmt: Fix enabling SSP while powered off
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Kaczmarek <[email protected]>
commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.
When new BT USB adapter is plugged in it's configured while still being powered off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't write changes to controller. As a result remote devices won't use Secure Simple Pairing with our device due to SSP Host Support flag disabled in extended features and may also reject SSP attempt from our side (with possible fallback to legacy pairing).
This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is called to power on controller and clear HCI_AUTO_OFF flag.
--- net/bluetooth/mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/mgmt.c +6 -0
@@ -2801,6 +2801,12 @@ int mgmt_powered(struct hci_dev *hdev, uif (scan)hci_send_cmd (hdev,HCI_OP_WRITE_SCAN_ENABLE ,1 , &scan); +if (test_bit (HCI_SSP_ENABLED , &hdev->dev_flags)) { +u8 ssp =1 ; + +hci_send_cmd (hdev,HCI_OP_WRITE_SSP_MODE ,1 , &ssp); + } +update_class (hdev);update_name (hdev, hdev->dev_name);update_eir (hdev);
Greg Kroah-Hartman
maintainerPATCH 101/218 Bluetooth: Fix not removing power_off delayed work
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.
For example, when a usb reset is received (I could reproduce it running something very similar to this[1] in a loop) it could be that the device is unregistered while the power_off delayed work is still scheduled to run.
Backtrace: WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d() Hardware name: To Be Filled By O.E.M. ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26 Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2 Call Trace: [<ffffffff8124cc00>] ? free_obj_work+0x57/0x91 [<ffffffff81058f88>] warn_slowpath_common+0x7e/0x97 [<ffffffff81059035>] warn_slowpath_fmt+0x41/0x43 [<ffffffff8124ccb6>] debug_print_object+0x7c/0x8d [<ffffffff8106e3ec>] ? __queue_work+0x259/0x259 [<ffffffff8124d63e>] ? debug_check_no_obj_freed+0x6f/0x1b5 [<ffffffff8124d667>] debug_check_no_obj_freed+0x98/0x1b5 [<ffffffffa00aa031>] ? bt_host_release+0x10/0x1e [bluetooth] [<ffffffff810fc035>] kfree+0x90/0xe6 [<ffffffffa00aa031>] bt_host_release+0x10/0x1e [bluetooth] [<ffffffff812ec2f9>] device_release+0x4a/0x7e [<ffffffff8123ef57>] kobject_release+0x11d/0x154 [<ffffffff8123ed98>] kobject_put+0x4a/0x4f [<ffffffff812ec0d9>] put_device+0x12/0x14 [<ffffffffa009472b>] hci_free_dev+0x22/0x26 [bluetooth] [<ffffffffa0280dd0>] btusb_disconnect+0x96/0x9f [btusb] [<ffffffff813581b4>] usb_unbind_interface+0x57/0x106 [<ffffffff812ef988>] __device_release_driver+0x83/0xd6 [<ffffffff812ef9fb>] device_release_driver+0x20/0x2d [<ffffffff813582a7>] usb_driver_release_interface+0x44/0x7b [<ffffffff81358795>] usb_forced_unbind_intf+0x45/0x4e [<ffffffff8134f959>] usb_reset_device+0xa6/0x12e [<ffffffff8135df86>] usbdev_do_ioctl+0x319/0xe20 [<ffffffff81203244>] ? avc_has_perm_flags+0xc9/0x12e [<ffffffff812031a0>] ? avc_has_perm_flags+0x25/0x12e [<ffffffff81050101>] ? do_page_fault+0x31e/0x3a1 [<ffffffff8135eaa6>] usbdev_ioctl+0x9/0xd [<ffffffff811126b1>] vfs_ioctl+0x21/0x34 [<ffffffff81112f7b>] do_vfs_ioctl+0x408/0x44b [<ffffffff81208d45>] ? file_has_perm+0x76/0x81 [<ffffffff8111300f>] sys_ioctl+0x51/0x76 [<ffffffff8158db22>] system_call_fastpath+0x16/0x1b
[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c
--- net/bluetooth/hci_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_core.c +2 -0
@@ -750,6 +750,8 @@ static int hci_dev_do_close(struct hci_dcancel_work_sync (&hdev->le_scan); +cancel_delayed_work (&hdev->power_off); +hci_req_cancel (hdev,ENODEV );hci_req_lock (hdev);
Greg Kroah-Hartman
maintainerPATCH 102/218 Bluetooth: mgmt: Fix enabling LE while powered off
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Kaczmarek <[email protected]>
commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.
When new BT USB adapter is plugged in it's configured while still being powered off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't write changes to controller. As a result it's not possible to start device discovery session on LE controller as it uses interleaved discovery which requires LE Supported Host flag in extended features.
This patch ensures HCI Write LE Host Supported is sent when Set Powered is called to power on controller and clear HCI_AUTO_OFF flag.
--- net/bluetooth/mgmt.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/bluetooth/mgmt.c +10 -0
@@ -2807,6 +2807,16 @@ int mgmt_powered(struct hci_dev *hdev, uhci_send_cmd (hdev,HCI_OP_WRITE_SSP_MODE ,1 , &ssp); } +if (test_bit (HCI_LE_ENABLED , &hdev->dev_flags)) { +struct hci_cp_write_le_host_supported cp; + + cp.le =1 ; + cp.simul = !!(hdev->features[6 ] &LMP_SIMUL_LE_BR ); + +hci_send_cmd (hdev,HCI_OP_WRITE_LE_HOST_SUPPORTED , +sizeof (cp), &cp); + } +update_class (hdev);update_name (hdev, hdev->dev_name);update_eir (hdev);
Greg Kroah-Hartman
maintainerPATCH 103/218 hpwdt: Fix kdump issue in hpwdt
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshi Kani <[email protected]>
commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream.
kdump can be interrupted by watchdog timer when the timer is left activated on the crash kernel. Changed the hpwdt driver to disable watchdog timer at boot-time. This assures that watchdog timer is disabled until /dev/watchdog is opened, and prevents watchdog timer to be left running on the crash kernel.
--- drivers/watchdog/hpwdt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/watchdog/hpwdt.c +3 -0
@@ -806,6 +806,9 @@ static int __devinit hpwdt_init_one(stru hpwdt_timer_reg = pci_mem_addr +0x70 ; hpwdt_timer_con = pci_mem_addr +0x72 ; +/* Make sure that timer is disabled until /dev/watchdog is opened */ +hpwdt_stop (); +/* Make sure that we have a valid soft_margin */ if (hpwdt_change_timer (soft_margin))hpwdt_change_timer (DEFAULT_MARGIN );
Greg Kroah-Hartman
maintainerPATCH 104/218 ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Leach <[email protected]>
commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream.
This patch zeroes the SCTLR.TRE bit prior to setting the mapping as cacheable for ARMv7 cores in the decompressor, ensuring that the memory region attributes are obtained from the C and B bits, not from the page tables.
--- arch/arm/boot/compressed/head.S | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/compressed/head.S +1 -0
@@ -648,6 +648,7 @@ __armv7_mmu_cache_on: mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs #endif mrc p15, 0, r0, c1, c0, 0 @ read control reg + bic r0, r0, #1 << 28 @ clear SCTLR.TRE orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement orr r0, r0, #0x003c @ write buffer #ifdef CONFIG_MMU
Greg Kroah-Hartman
maintainerPATCH 105/218 tracing: Dont call page_to_pfn() if page is NULL
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Congyang <[email protected]>
commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.
When allocating memory fails, page is NULL. page_to_pfn() will cause the kernel panicked if we don't use sparsemem vmemmap.
--- include/trace/events/kmem.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/trace/events/kmem.h +2 -2
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,TP_printk ("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype,show_gfp_flags (__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,TP_printk ("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype, __entry->order ==0 )
Greg Kroah-Hartman
maintainerPATCH 106/218 Input: i8042 - disable mux on Toshiba C850D
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anisse Astier <[email protected]>
commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream.
On Toshiba Satellite C850D, the touchpad and the keyboard might randomly not work at boot. Preventing MUX mode activation solves this issue.
--- drivers/input/serio/i8042-x86ia64io.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +6 -0
@@ -335,6 +335,12 @@ static const struct dmi_system_id __init }, { .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), + }, + }, + { + .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"ALIENWARE" ), DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"), },
Greg Kroah-Hartman
maintainerPATCH 107/218 MIPS: mm: Add compound tail page _mapcount when mapped
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jovi Zhang <[email protected]>
commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream.
See commit b6999b191 which did the same modification for x86's mm/gup,
Quote from commit b6999b191:
"If compound pages are used and the page is a
tail page, gup_huge_pmd() increases _mapcount to record tail page are mapped while gup_huge_pud does not do that."
[[email protected]: fixed rejects caused by the original patch getting linewrapped.]
Patchwork: https://patchwork.linux-mips.org/patch/4291/
--- arch/mips/mm/gup.c | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/mm/gup.c +2 -0
@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig do { VM_BUG_ON(compound_head(page) != head); pages[*nr] = page; + if (PageTail(page)) + get_huge_page_tail(page); (*nr)++; page++; refs++;
Greg Kroah-Hartman
maintainerPATCH 108/218 rtlwifi: rtl8192ce: Log message that B_CUT device may not work
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream.
There are a number of problems that occur for the latest version of the Realtek RTL8188CE device with the in-kernel driver. These include selection of the wrong firmware, and system lockup. A full fix is known, but is too invasive for inclusion in stable. This patch fixes the problem with loading the wrong firmware, and logs a message that the device may not work for kernels 3.6 and older.
--- drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 + drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 ++++++++++-- drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 ++++-- 3 files changed, 15 insertions(+), 4 deletions(-)
drivers/net/wireless/rtlwifi/rtl8192ce/def.h +1 -0
@@ -117,6 +117,7 @@#define CHIP_VER_B BIT(4)#define CHIP_92C_BITMASK BIT(0) +#define CHIP_UNKNOWN BIT(7)#define CHIP_92C_1T2R 0x03#define CHIP_92C 0x01#define CHIP_88C 0x00
drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +10 -2
@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_ version = (value32 &TYPE_ID ) ?VERSION_A_CHIP_92C :VERSION_A_CHIP_88C ; }else { - version = (value32 &TYPE_ID ) ?VERSION_B_CHIP_92C : -VERSION_B_CHIP_88C ; + version = (enum version_8192c ) (CHIP_VER_B | + ((value32 &TYPE_ID ) ?CHIP_92C_BITMASK :0 ) | + ((value32 &VENDOR_ID ) ?CHIP_VENDOR_UMC :0 )); +if ((!IS_CHIP_VENDOR_UMC (version)) && (value32 & +CHIP_VER_RTL_MASK )) { + version = (enum version_8192c )(version | + ((((value32 &CHIP_VER_RTL_MASK ) ==BIT (12 )) + ?CHIP_VENDOR_UMC_B_CUT :CHIP_UNKNOWN ) | +CHIP_VENDOR_UMC )); + } }switch (version) {
drivers/net/wireless/rtlwifi/rtl8192ce/sw.c +4 -2
@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211/* request fw */ if (IS_VENDOR_UMC_A_CUT (rtlhal->version) && - !IS_92C_SERIAL (rtlhal->version)) + !IS_92C_SERIAL (rtlhal->version)) { rtlpriv->cfg->fw_name ="rtlwifi/rtl8192cfwU.bin" ; -else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) + }else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) { rtlpriv->cfg->fw_name ="rtlwifi/rtl8192cfwU_B.bin" ; +pr_info ("****** This B_CUT device may not work with kernels 3.6 and earlier\n" ); + } rtlpriv->max_fw_size =0x4000 ;pr_info ("Using firmware %s\n" , rtlpriv->cfg->fw_name);
Greg Kroah-Hartman
maintainerPATCH 109/218 asix: Support DLink DUB-E100 H/W Ver C1
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Søren Holm <[email protected]>
commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream.
--- drivers/net/usb/asix.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/asix.c +4 -0
@@ -1604,6 +1604,10 @@ static const struct usb_device_id produc USB_DEVICE (0x2001, 0x3c05), .driver_info = (unsigned long ) &ax88772_info, }, { +// DLink DUB-E100 H/W Ver C1 +USB_DEVICE (0x2001 ,0x1a02 ), + .driver_info = (unsigned long) &ax88772_info, +}, {// Linksys USB1000 USB_DEVICE (0x1737 ,0x0039 ), .driver_info = (unsigned long) &ax88178_info,
Greg Kroah-Hartman
maintainerPATCH 110/218 can: ti_hecc: fix oops during rmmod
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit ab04c8bd423edb03e2148350a091836c196107fc upstream.
This patch fixes an oops which occurs when unloading the driver, while the network interface is still up. The problem is that first the io mapping is teared own, then the CAN device is unregistered, resulting in accessing the hardware's iomem:
[ 172.744232] Unable to handle kernel paging request at virtual address c88b0040 [ 172.752441] pgd = c7be4000 [ 172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000 [ 172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM [ 172.767517] Modules linked in: ti_hecc(-) can_dev [ 172.772430] CPU: 0 Not tainted (3.5.0alpha-00037-g3554cc0 #126) [ 172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc] [ 172.784423] LR is at __dev_close_many+0x90/0xc0 [ 172.789123] pc : [<bf00c768>] lr : [<c033be58>] psr: 60000013 [ 172.789123] sp : c5c1de68 ip : 00040081 fp : 00000000 [ 172.801025] r10: 00000001 r9 : c5c1c000 r8 : 00100100 [ 172.806457] r7 : c5d0a48c r6 : c5d0a400 r5 : 00000000 r4 : c5d0a000 [ 172.813232] r3 : c88b0000 r2 : 00000001 r1 : c5d0a000 r0 : c5d0a000 [ 172.820037] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 172.827423] Control: 10c5387d Table: 87be4019 DAC: 00000015 [ 172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0) [ 172.839447] Stack: (0xc5c1de68 to 0xc5c1e000) [ 172.843994] de60: bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58 [ 172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44 [ 172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724 [ 172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000 [ 172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc [ 172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000 [ 172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c [ 172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4 [ 172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006 [ 172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068 [ 172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008 [ 172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000 [ 172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344 [ 172.954498] [<bf00c768>] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [<c033be58>] (__dev__registered_many+0xc0/0x2a0) [ 172.984161] [<c033c098>] (rollback_registered_many+0xc0/0x2a0) from [<c033c2f8>] (rollback_registered+0x20/0x30) [ 172.994750] [<c033c2f8>] (rollback_registered+0x20/0x30) from [<c033c370>] (unregister_netdevice_queue+0x68/0x98) [ 173.005401] [<c033c370>] (unregister_netdevice_queue+0x68/0x98) from [<c033c3b8>] (unregister_netdev+0x18/0x20) [ 173.015899] [<c033c3b8>] (unregister_netdev+0x18/0x20) from [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) [ 173.026245] [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [<c02842dc>] (platform_drv_remove+0x14/0x18) [ 173.036712] [<c02842dc>] (platform_drv_remove+0x14/0x18) from [<c0282f90>] (__device_release_driver+0x7c/0xbc)
--- drivers/net/can/ti_hecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/ti_hecc.c +1 -1
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(strustruct net_device *ndev =platform_get_drvdata (pdev);struct ti_hecc_priv *priv =netdev_priv (ndev); +unregister_candev (ndev);clk_disable (priv->clk);clk_put (priv->clk); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );iounmap (priv->base);release_mem_region (res->start,resource_size (res)); -unregister_candev (ndev);free_candev (ndev);platform_set_drvdata (pdev,NULL );
Greg Kroah-Hartman
maintainerPATCH 111/218 can: janz-ican3: fix support for older hardware revisions
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ira W. Snyder" <[email protected]>
commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream.
The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for the reset registers. To support older hardware, the code is changed to use the hardware reset register on the Janz VMOD-ICAN3 hardware itself.
--- drivers/net/can/janz-ican3.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/can/janz-ican3.c +1 -3
@@ -1250,7 +1250,6 @@ static irqreturn_t ican3_irq(int irq, vo*/ static int ican3_reset_module (struct ican3_dev *mod) { -u8 val =1 << mod->num;unsigned long start;u8 runold, runnew;
@@ -1264,8 +1263,7 @@ static int ican3_reset_module(struct ica runold =ioread8 (mod->dpm +TARGET_RUNNING );/* reset the module */ -iowrite8 (val, &mod->ctrl->reset_assert); -iowrite8 (val, &mod->ctrl->reset_deassert); +iowrite8 (0x00 , &mod->dpmctrl->hwreset);/* wait until the module has finished resetting and is running */ start = jiffies;
Greg Kroah-Hartman
maintainerPATCH 112/218 cfg80211: fix possible circular lock on reg_regdb_search()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Luis R. Rodriguez" <[email protected]>
commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.
When call_crda() is called we kick off a witch hunt search for the same regulatory domain on our internal regulatory database and that work gets kicked off on a workqueue, this is done while the cfg80211_mutex is held. If that workqueue kicks off it will first lock reg_regdb_search_mutex and later cfg80211_mutex but to ensure two CPUs will not contend against cfg80211_mutex the right thing to do is to have the reg_regdb_search() wait until the cfg80211_mutex is let go.
The lockdep report is pasted below.
cfg80211: Calling CRDA to update world regulatory domain
======================================================
[ INFO: possible circular locking dependency detected ]
3.3.8 #3 Tainted: G O
-------------------------------------------------------
kworker/0:1/235 is trying to acquire lock:
(cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
but task is already holding lock:
(reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (reg_regdb_search_mutex){+.+...}:
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211]-> #1 (reg_mutex#2){+.+...}:
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211]-> #0 (cfg80211_mutex){+.+...}:
[<800a77b8>] __lock_acquire+0x10d4/0x17bc
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<816468a4>] set_regdom+0x78c/0x808 [cfg80211]other info that might help us debug this:
Chain exists of: cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(reg_regdb_search_mutex);
lock(reg_mutex#2);
lock(reg_regdb_search_mutex); lock(cfg80211_mutex);
*** DEADLOCK ***
3 locks held by kworker/0:1/235:
#0: (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460
#1: (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460
#2: (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]stack backtrace: Call Trace: [<80290fd4>] dump_stack+0x8/0x34 [<80291bc4>] print_circular_bug+0x2ac/0x2d8 [<800a77b8>] __lock_acquire+0x10d4/0x17bc [<800a8384>] lock_acquire+0x60/0x88 [<802950a8>] mutex_lock_nested+0x54/0x31c [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
--- net/wireless/reg.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/wireless/reg.c +9 -3
@@ -340,6 +340,9 @@ static void reg_regdb_search(struct workstruct reg_regdb_search_request *request;const struct ieee80211_regdomain *curdom, *regdom;int i, r; +bool set_reg = false; + +mutex_lock (&cfg80211_mutex);mutex_lock (®_regdb_search_mutex);while (!list_empty (®_regdb_search_list)) {
@@ -355,9 +358,7 @@ static void reg_regdb_search(struct work r =reg_copy_regd (®dom, curdom);if (r)break ; -mutex_lock (&cfg80211_mutex); -set_regdom (regdom); -mutex_unlock (&cfg80211_mutex); + set_reg = true;break ; } }
@@ -365,6 +366,11 @@ static void reg_regdb_search(struct workkfree (request); }mutex_unlock (®_regdb_search_mutex); + +if (set_reg) +set_regdom (regdom); + +mutex_unlock (&cfg80211_mutex); } static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
Greg Kroah-Hartman
maintainerPATCH 113/218 DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Kamat <[email protected]>
commit 2e2c682becb20416c140aa0d6d3137b51a5c76da upstream.
'r->cfg' is being checked for NULL. However, it is dereferenced in the previous statements. Thus moving those statements within the check.
--- drivers/dma/pl330.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/dma/pl330.c +9 -7
@@ -1568,17 +1568,19 @@ static int pl330_submit_req(void *ch_id, goto xfer_exit; } -/* Prefer Secure Channel */ -if (!_manager_ns (thrd)) - r->cfg->nonsecure =0 ; -else - r->cfg->nonsecure =1 ;/* Use last settings, if not provided */ -if (r->cfg) +if (r->cfg) { +/* Prefer Secure Channel */ +if (!_manager_ns (thrd)) + r->cfg->nonsecure =0 ; +else + r->cfg->nonsecure =1 ; + ccr =_prepare_ccr (r->cfg); -else + }else { ccr =readl (regs +CC (thrd->id)); + }/* If this req doesn't have valid xfer settings */ if (!_is_valid (ccr)) {
Greg Kroah-Hartman
maintainerPATCH 114/218 DMA: PL330: Check the pointer returned by kzalloc
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Kamat <[email protected]>
commit 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 upstream.
kzalloc could return NULL. Hence add a check to avoid NULL pointer dereference.
--- drivers/dma/pl330.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/pl330.c +5 -0
@@ -2937,6 +2937,11 @@ pl330_probe(struct amba_device *adev, co num_chan =max_t (int, pi->pcfg.num_peri, pi->pcfg.num_chan); pdmac->peripherals =kzalloc (num_chan *sizeof (*pch),GFP_KERNEL ); +if (!pdmac->peripherals) { + ret = -ENOMEM ; +dev_err (&adev->dev,"unable to allocate pdmac->peripherals\n" ); + goto probe_err5; + }for (i =0 ; i < num_chan; i++) { pch = &pdmac->peripherals[i];
Greg Kroah-Hartman
maintainerPATCH 115/218 dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream.
s/dma_memcpy/slave_sg/ and it is sg length that we are talking about.
--- drivers/dma/at_hdmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/at_hdmac.c +1 -1
@@ -664,7 +664,7 @@ atc_prep_slave_sg(struct dma_chan *chan, flags);if (unlikely (!atslave || !sg_len)) { -dev_dbg (chan2dev (chan),"prep_dma_memcpy: length is zero!\n" ); +dev_dbg (chan2dev (chan),"prep_slave_sg: sg length is zero!\n" );return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 116/218 dmaengine: at_hdmac: check that each sg data length is non-null
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit c456797681db814f4f5b36909e8e94047bf53d9c upstream.
Avoid the construction of a malformed DMA request sent to the DMA controller.
Log message is for debug only because this condition is unlikely to append and may only trigger at driver development time.
--- drivers/dma/at_hdmac.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/dma/at_hdmac.c +11 -0
@@ -691,6 +691,11 @@ atc_prep_slave_sg(struct dma_chan *chan, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -726,6 +731,11 @@ atc_prep_slave_sg(struct dma_chan *chan, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -759,6 +769,7 @@ atc_prep_slave_sg(struct dma_chan *chan, err_desc_get:dev_err (chan2dev (chan),"not enough descriptors available\n" ); +err:atc_desc_put (atchan, first);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 117/218 rt2x00: Identify ASUS USB-N53 device.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gertjan van Wingerde <[email protected]>
commit 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 upstream.
This is an RT3572 based device.
--- drivers/net/wireless/rt2x00/rt2800usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/rt2x00/rt2800usb.c +2 -1
@@ -1157,6 +1157,8 @@ static struct usb_device_id rt2800usb_de { USB_DEVICE(0x1690, 0x0744) }, { USB_DEVICE(0x1690, 0x0761) }, { USB_DEVICE(0x1690, 0x0764) }, +/* ASUS */ + { USB_DEVICE(0x0b05, 0x179d) },/* Cisco */ { USB_DEVICE(0x167b, 0x4001) },/* EnGenius */
@@ -1222,7 +1224,6 @@ static struct usb_device_id rt2800usb_de { USB_DEVICE(0x0b05, 0x1760) }, { USB_DEVICE(0x0b05, 0x1761) }, { USB_DEVICE(0x0b05, 0x1790) }, - { USB_DEVICE(0x0b05, 0x179d) },/* AzureWave */ { USB_DEVICE(0x13d3, 0x3262) }, { USB_DEVICE(0x13d3, 0x3284) },
Greg Kroah-Hartman
maintainerPATCH 118/218 rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gertjan van Wingerde <[email protected]>
commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.
The register is 16 bits wide, not 32.
--- drivers/net/wireless/rt2x00/rt2500usb.c | 2 +- drivers/net/wireless/rt2x00/rt2500usb.h | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/rt2x00/rt2500usb.c +1 -1
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(structu16 reg;rt2500usb_register_read (rt2x00dev,MAC_CSR19 , ®); -return rt2x00_get_field32 (reg,MAC_CSR19_BIT7 ); +return rt2x00_get_field16 (reg,MAC_CSR19_BIT7 ); }#ifdef CONFIG_RT2X00_LIB_LEDS
drivers/net/wireless/rt2x00/rt2500usb.h +8 -8
@@ -189,14 +189,14 @@* MAC_CSR19: GPIO control register. */ #define MAC_CSR19 0x0426 -#define MAC_CSR19_BIT0 FIELD32(0x0001) -#define MAC_CSR19_BIT1 FIELD32(0x0002) -#define MAC_CSR19_BIT2 FIELD32(0x0004) -#define MAC_CSR19_BIT3 FIELD32(0x0008) -#define MAC_CSR19_BIT4 FIELD32(0x0010) -#define MAC_CSR19_BIT5 FIELD32(0x0020) -#define MAC_CSR19_BIT6 FIELD32(0x0040) -#define MAC_CSR19_BIT7 FIELD32(0x0080) +#define MAC_CSR19_BIT0 FIELD16(0x0001) +#define MAC_CSR19_BIT1 FIELD16(0x0002) +#define MAC_CSR19_BIT2 FIELD16(0x0004) +#define MAC_CSR19_BIT3 FIELD16(0x0008) +#define MAC_CSR19_BIT4 FIELD16(0x0010) +#define MAC_CSR19_BIT5 FIELD16(0x0020) +#define MAC_CSR19_BIT6 FIELD16(0x0040) +#define MAC_CSR19_BIT7 FIELD16(0x0080)/* * MAC_CSR20: LED control register.
Greg Kroah-Hartman
maintainerPATCH 119/218 rt2x00: Fix rfkill polling prior to interface start.
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gertjan van Wingerde <[email protected]>
commit a396e10019eaf3809b0219c966865aaafec12630 upstream.
We need to program the rfkill switch GPIO pin direction to input at device initialization time, not only when the interface is brought up. Doing this only when the interface is brought up could lead to rfkill detecting the switch is turned on erroneously and inability to create the interface and bringing it up.
--- drivers/net/wireless/rt2x00/rt2400pci.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt2400pci.h | 1 + drivers/net/wireless/rt2x00/rt2500pci.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt2500usb.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt2500usb.h | 1 + drivers/net/wireless/rt2x00/rt2800pci.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt2800usb.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt61pci.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt61pci.h | 1 + drivers/net/wireless/rt2x00/rt73usb.c | 9 +++++++++ drivers/net/wireless/rt2x00/rt73usb.h | 3 +++ 11 files changed, 69 insertions(+)
drivers/net/wireless/rt2x00/rt2400pci.c +9 -0
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(strucstatic int rt2400pci_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00pci_register_read (rt2x00dev,GPIOCSR , ®); +rt2x00_set_field32 (®,GPIOCSR_BIT8 ,1 ); +rt2x00pci_register_write (rt2x00dev,GPIOCSR , reg); + +/* * Initialize hw specifications. */ retval =rt2400pci_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt2400pci.h +1 -0
@@ -670,6 +670,7 @@#define GPIOCSR_BIT5 FIELD32(0x00000020)#define GPIOCSR_BIT6 FIELD32(0x00000040)#define GPIOCSR_BIT7 FIELD32(0x00000080) +#define GPIOCSR_BIT8 FIELD32(0x00000100)/* * BBPPCSR: BBP Pin control register.
drivers/net/wireless/rt2x00/rt2500pci.c +9 -0
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(strucstatic int rt2500pci_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00pci_register_read (rt2x00dev,GPIOCSR , ®); +rt2x00_set_field32 (®,GPIOCSR_DIR0 ,1 ); +rt2x00pci_register_write (rt2x00dev,GPIOCSR , reg); + +/* * Initialize hw specifications. */ retval =rt2500pci_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt2500usb.c +9 -0
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(strucstatic int rt2500usb_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u16 reg;/* * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2500usb_register_read (rt2x00dev,MAC_CSR19 , ®); +rt2x00_set_field16 (®,MAC_CSR19_BIT8 ,0 ); +rt2500usb_register_write (rt2x00dev,MAC_CSR19 , reg); + +/* * Initialize hw specifications. */ retval =rt2500usb_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt2500usb.h +1 -0
@@ -197,6 +197,7 @@#define MAC_CSR19_BIT5 FIELD16(0x0020)#define MAC_CSR19_BIT6 FIELD16(0x0040)#define MAC_CSR19_BIT7 FIELD16(0x0080) +#define MAC_CSR19_BIT8 FIELD16(0x0100)/* * MAC_CSR20: LED control register.
drivers/net/wireless/rt2x00/rt2800pci.c +9 -0
@@ -973,6 +973,7 @@ static int rt2800pci_validate_eeprom(strstatic int rt2800pci_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Allocate eeprom data.
@@ -986,6 +987,14 @@ static int rt2800pci_probe_hw(struct rt2return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00pci_register_read (rt2x00dev,GPIO_CTRL_CFG , ®); +rt2x00_set_field32 (®,GPIO_CTRL_CFG_GPIOD_BIT2 ,1 ); +rt2x00pci_register_write (rt2x00dev,GPIO_CTRL_CFG , reg); + +/* * Initialize hw specifications. */ retval =rt2800_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt2800usb.c +9 -0
@@ -736,6 +736,7 @@ static int rt2800usb_validate_eeprom(strstatic int rt2800usb_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Allocate eeprom data.
@@ -749,6 +750,14 @@ static int rt2800usb_probe_hw(struct rt2return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00usb_register_read (rt2x00dev,GPIO_CTRL_CFG , ®); +rt2x00_set_field32 (®,GPIO_CTRL_CFG_GPIOD_BIT2 ,1 ); +rt2x00usb_register_write (rt2x00dev,GPIO_CTRL_CFG , reg); + +/* * Initialize hw specifications. */ retval =rt2800_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt61pci.c +9 -0
@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(structstatic int rt61pci_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Disable power saving.
@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x0return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00pci_register_read (rt2x00dev,MAC_CSR13 , ®); +rt2x00_set_field32 (®,MAC_CSR13_BIT13 ,1 ); +rt2x00pci_register_write (rt2x00dev,MAC_CSR13 , reg); + +/* * Initialize hw specifications. */ retval =rt61pci_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt61pci.h +1 -0
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {#define MAC_CSR13_BIT10 FIELD32(0x00000400)#define MAC_CSR13_BIT11 FIELD32(0x00000800)#define MAC_CSR13_BIT12 FIELD32(0x00001000) +#define MAC_CSR13_BIT13 FIELD32(0x00002000)/* * MAC_CSR14: LED control register.
drivers/net/wireless/rt2x00/rt73usb.c +9 -0
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(structstatic int rt73usb_probe_hw (struct rt2x00_dev *rt2x00dev) {int retval; +u32 reg;/* * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x0return retval;/* +* Enable rfkill polling by setting GPIO direction of the +* rfkill switch GPIO pin correctly. +*/ +rt2x00usb_register_read (rt2x00dev,MAC_CSR13 , ®); +rt2x00_set_field32 (®,MAC_CSR13_BIT15 ,0 ); +rt2x00usb_register_write (rt2x00dev,MAC_CSR13 , reg); + +/* * Initialize hw specifications. */ retval =rt73usb_probe_hw_mode (rt2x00dev);
drivers/net/wireless/rt2x00/rt73usb.h +3 -0
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {#define MAC_CSR13_BIT10 FIELD32(0x00000400)#define MAC_CSR13_BIT11 FIELD32(0x00000800)#define MAC_CSR13_BIT12 FIELD32(0x00001000) +#define MAC_CSR13_BIT13 FIELD32(0x00002000) +#define MAC_CSR13_BIT14 FIELD32(0x00004000) +#define MAC_CSR13_BIT15 FIELD32(0x00008000)/* * MAC_CSR14: LED control register.
Greg Kroah-Hartman
maintainerPATCH 120/218 NFS: Fix the initialisation of the readdir cookieverf array
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.
When the NFS_COOKIEVERF helper macro was converted into a static inline function in commit 99fadcd764 (nfs: convert NFS_*(inode) helpers to static inline), we broke the initialisation of the readdir cookies, since that depended on doing a memset with an argument of 'sizeof(NFS_COOKIEVERF(inode))' which therefore changed from sizeof(be32 cookieverf[2]) to sizeof(be32 *).
At this point, NFS_COOKIEVERF seems to be more of an obfuscation than a helper, so the best thing would be to just get rid of it.
Also see: https://bugzilla.kernel.org/show_bug.cgi?id=46881
--- fs/nfs/inode.c | 2 +- fs/nfs/nfs3proc.c | 2 +- fs/nfs/nfs4proc.c | 4 ++-- include/linux/nfs_fs.h | 5 ----- 4 files changed, 4 insertions(+), 9 deletions(-)
fs/nfs/inode.c +1 -1
@@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct nfsi->attrtimeo =NFS_MINATTRTIMEO (inode); nfsi->attrtimeo_timestamp = jiffies; -memset (NFS_COOKIEVERF (inode),0 ,sizeof (NFS_COOKIEVERF (inode))); +memset (NFS_I (inode)->cookieverf,0 ,sizeof (NFS_I (inode)->cookieverf));if (S_ISREG (mode) ||S_ISDIR (mode) ||S_ISLNK (mode)) nfsi->cache_validity |=NFS_INO_INVALID_ATTR |NFS_INO_INVALID_DATA |NFS_INO_INVALID_ACCESS |NFS_INO_INVALID_ACL |NFS_INO_REVAL_PAGECACHE ;else
fs/nfs/nfs3proc.c +1 -1
@@ -644,7 +644,7 @@ nfs3_proc_readdir(struct dentry *dentry, u64 cookie, struct page **pages, unsigned int count, int plus) { struct inode *dir = dentry->d_inode; -__be32 *verf =NFS_COOKIEVERF (dir); +__be32 *verf =NFS_I (dir)->cookieverf; struct nfs3_readdirargs arg = { .fh = NFS_FH(dir), .cookie = cookie,
fs/nfs/nfs4proc.c +2 -2
@@ -3150,11 +3150,11 @@ static int _nfs4_proc_readdir(struct den dentry->d_parent->d_name.name, dentry->d_name.name, (unsigned long long)cookie); -nfs4_setup_readdir (cookie,NFS_COOKIEVERF (dir), dentry, &args); +nfs4_setup_readdir (cookie,NFS_I (dir)->cookieverf, dentry, &args); res.pgbase = args.pgbase; status =nfs4_call_sync (NFS_SERVER (dir)->client,NFS_SERVER (dir), &msg, &args.seq_args, &res.seq_res,0 );if (status >=0 ) { -memcpy (NFS_COOKIEVERF (dir), res.verifier.data,NFS4_VERIFIER_SIZE ); +memcpy (NFS_I (dir)->cookieverf, res.verifier.data,NFS4_VERIFIER_SIZE ); status += args.pgbase; }
include/linux/nfs_fs.h +0 -5
@@ -264,11 +264,6 @@ static inline const struct nfs_rpc_ops *return NFS_SERVER (inode)->nfs_client->rpc_ops; } -static inline __be32 *NFS_COOKIEVERF (const struct inode *inode) -{ -return NFS_I (inode)->cookieverf; -} -static inline unsigned NFS_MINATTRTIMEO (const struct inode *inode) {struct nfs_server *nfss =NFS_SERVER (inode);
Greg Kroah-Hartman
maintainerPATCH 121/218 NFS: Fix a problem with the legacy binary mount code
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 872ece86ea5c367aa92f44689c2d01a1c767aeb3 upstream.
Apparently, am-utils is still using the legacy binary mountdata interface, and is having trouble parsing /proc/mounts due to the 'port=' field being incorrectly set.
The following patch should fix up the regression.
--- fs/nfs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/super.c +2 -0
@@ -1886,6 +1886,7 @@ static int nfs_validate_mount_data(voidmemcpy (sap, &data->addr,sizeof (data->addr)); args->nfs_server.addrlen =sizeof (data->addr); + args->nfs_server.port =ntohs (data->addr.sin_port);if (!nfs_verify_server_address (sap)) goto out_no_address;
@@ -2598,6 +2599,7 @@ static int nfs4_validate_mount_data(voidreturn -EFAULT ;if (!nfs_verify_server_address (sap)) goto out_no_address; + args->nfs_server.port =ntohs (((struct sockaddr_in *)sap)->sin_port);if (data->auth_flavourlen) {if (data->auth_flavourlen >1 )
Greg Kroah-Hartman
maintainerPATCH 122/218 NFS: return error from decode_getfh in decode open
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 upstream.
If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last decode_* call must have succeeded.
--- fs/nfs/nfs4xdr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/nfs4xdr.c +2 -1
@@ -6081,7 +6081,8 @@ static int nfs4_xdr_dec_open(struct rpc_ status =decode_open (xdr, res);if (status) goto out; -if (decode_getfh (xdr, &res->fh) !=0 ) + status =decode_getfh (xdr, &res->fh); +if (status) goto out;if (decode_getfattr (xdr, res->f_attr, res->server) !=0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 123/218 EHCI: Update qTD next pointer in QH overlay region during unlink
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavankumar Kondeti <[email protected]>
commit 3d037774b42ed677f699b1dce7d548d55f4e4c2b upstream.
There is a possibility of QH overlay region having reference to a stale qTD pointer during unlink.
Consider an endpoint having two pending qTD before unlink process begins. The endpoint's QH queue looks like this.
qTD1 --> qTD2 --> Dummy
To unlink qTD2, QH is removed from asynchronous list and Asynchronous Advance Doorbell is programmed. The qTD1's next qTD pointer is set to qTD2'2 next qTD pointer and qTD2 is retired upon controller's doorbell interrupt. If QH's current qTD pointer points to qTD1, transfer overlay region still have reference to qTD2. But qtD2 is just unlinked and freed. This may cause EHCI system error. Fix this by updating qTD next pointer in QH overlay region with the qTD next pointer of the current qTD.
--- drivers/usb/host/ehci-q.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-q.c +10 -2
@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, strucelse { qtd =list_entry (qh->qtd_list.next, struct ehci_qtd, qtd_list); -/* first qtd may already be partially processed */ -if (cpu_to_hc32 (ehci, qtd->qtd_dma) == qh->hw->hw_current) +/* +* first qtd may already be partially processed. +* If we come here during unlink, the QH overlay region +* might have reference to the just unlinked qtd. The +* qtd is updated in qh_completions(). Update the QH +* overlay here. +*/ +if (cpu_to_hc32 (ehci, qtd->qtd_dma) == qh->hw->hw_current) { + qh->hw->hw_qtd_next = qtd->hw_next; qtd =NULL ; + } }if (qtd)
Greg Kroah-Hartman
maintainerPATCH 124/218 USB: ftdi_sio: PID for NZR SEM 16+ USB
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horst Schirmeier <[email protected]>
commit 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 upstream.
This adds the USB PID for the NZR SEM 16+ USB energy monitor device
<http://www.nzr.de>. It works perfectly with the GPL software on
<http://schou.dk/linux/sparometer/>.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ 2 files changed, 4 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -704,6 +704,7 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) }, { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) }, { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) }, { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) }, { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) }, { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
drivers/usb/serial/ftdi_sio_ids.h +3 -0
@@ -75,6 +75,9 @@#define FTDI_OPENDCC_GATEWAY_PID 0xBFDB#define FTDI_OPENDCC_GBM_PID 0xBFDC +/* NZR SEM 16+ USB (http://www.nzr.de) */ +#define FTDI_NZR_SEM_USB_PID 0xC1E0/* NZR SEM-LOG16+ */ +/* * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com) */
Greg Kroah-Hartman
maintainerPATCH 125/218 USB: ftdi_sio: do not claim CDC ACM function
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
commit f08dea734844aa42ec57c229b0b73b3d7d21f810 upstream.
The Microchip vid:pid 04d8:000a is used for their CDC ACM demo firmware application. This is a device with a single function conforming to the CDC ACM specification and with the intention of demonstrating CDC ACM class firmware and driver interaction. The demo is used on a number of development boards, and may also be used unmodified by vendors using Microchip hardware.
Some vendors have re-used this vid:pid for other types of firmware, emulating FTDI chips. Attempting to continue to support such devices without breaking class based applications that by matching on interface class/subclass/proto being ff/ff/00. I have no information about the actual device or interface descriptors, but this will at least make the proper CDC ACM devices work again. Anyone having details of the offending device's descriptors should update this entry with the details.
--- drivers/usb/serial/ftdi_sio.c | 4 +++- drivers/usb/serial/ftdi_sio_ids.h | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/usb/serial/ftdi_sio.c +3 -1
@@ -805,7 +805,9 @@ static struct usb_device_id id_table_com .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) }, + {USB_DEVICE_AND_INTERFACE_INFO (MICROCHIP_VID ,MICROCHIP_USB_BOARD_PID , +USB_CLASS_VENDOR_SPEC , + USB_SUBCLASS_VENDOR_SPEC, 0x00) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
drivers/usb/serial/ftdi_sio_ids.h +4 -1
@@ -542,7 +542,10 @@/* * Microchip Technology, Inc. * -* MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by: +* MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are +* used by single function CDC ACM class based firmware demo +* applications. The VID/PID has also been used in firmware +* emulating FTDI serial chips by: * Hornby Elite - Digital Command Control Console * http://www.hornby.com/hornby-dcc/controllers/ */
Greg Kroah-Hartman
maintainerPATCH 126/218 USB: ftdi-sio: add support for more Physik Instrumente devices
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Éric Piel <[email protected]>
commit dafc4f7be1a556ca3868d343c00127728b397068 upstream.
Commit b69cc672052540 added support for the E-861. After acquiring a C-867, I realised that every Physik Instrumente's device has a different PID. They are listed in the Windows device driver's .inf file. So here are all PIDs for the current (and probably future) USB devices from Physik Instrumente.
Compiled, but only actually tested on the E-861 and C-867.
--- drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++ drivers/usb/serial/ftdi_sio_ids.h | 21 ++++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +17 -0
@@ -813,7 +813,24 @@ static struct usb_device_id id_table_com .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, + { USB_DEVICE(FTDI_VID, PI_C865_PID) }, + { USB_DEVICE(FTDI_VID, PI_C857_PID) }, + { USB_DEVICE(PI_VID, PI_C866_PID) }, + { USB_DEVICE(PI_VID, PI_C663_PID) }, + { USB_DEVICE(PI_VID, PI_C725_PID) }, + { USB_DEVICE(PI_VID, PI_E517_PID) }, + { USB_DEVICE(PI_VID, PI_C863_PID) }, { USB_DEVICE(PI_VID, PI_E861_PID) }, + { USB_DEVICE(PI_VID, PI_C867_PID) }, + { USB_DEVICE(PI_VID, PI_E609_PID) }, + { USB_DEVICE(PI_VID, PI_E709_PID) }, + { USB_DEVICE(PI_VID, PI_100F_PID) }, + { USB_DEVICE(PI_VID, PI_1011_PID) }, + { USB_DEVICE(PI_VID, PI_1012_PID) }, + { USB_DEVICE(PI_VID, PI_1013_PID) }, + { USB_DEVICE(PI_VID, PI_1014_PID) }, + { USB_DEVICE(PI_VID, PI_1015_PID) }, + { USB_DEVICE(PI_VID, PI_1016_PID) }, { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
drivers/usb/serial/ftdi_sio_ids.h +20 -1
@@ -797,8 +797,27 @@* Physik Instrumente * http://www.physikinstrumente.com/en/products/ */ +/* These two devices use the VID of FTDI */ +#define PI_C865_PID 0xe0a0/* PI C-865 Piezomotor Controller */ +#define PI_C857_PID 0xe0a1/* PI Encoder Trigger Box */ +#define PI_VID 0x1a72/* Vendor ID */ -#define PI_E861_PID 0x1008/* E-861 piezo controller USB connection */ +#define PI_C866_PID 0x1000/* PI C-866 Piezomotor Controller */ +#define PI_C663_PID 0x1001/* PI C-663 Mercury-Step */ +#define PI_C725_PID 0x1002/* PI C-725 Piezomotor Controller */ +#define PI_E517_PID 0x1005/* PI E-517 Digital Piezo Controller Operation Module */ +#define PI_C863_PID 0x1007/* PI C-863 */ +#define PI_E861_PID 0x1008/* PI E-861 Piezomotor Controller */ +#define PI_C867_PID 0x1009/* PI C-867 Piezomotor Controller */ +#define PI_E609_PID 0x100D/* PI E-609 Digital Piezo Controller */ +#define PI_E709_PID 0x100E/* PI E-709 Digital Piezo Controller */ +#define PI_100F_PID 0x100F/* PI Digital Piezo Controller */ +#define PI_1011_PID 0x1011/* PI Digital Piezo Controller */ +#define PI_1012_PID 0x1012/* PI Motion Controller */ +#define PI_1013_PID 0x1013/* PI Motion Controller */ +#define PI_1014_PID 0x1014/* PI Device */ +#define PI_1015_PID 0x1015/* PI Device */ +#define PI_1016_PID 0x1016/* PI Digital Servo Module */ /* * Kondo Kagaku Co.Ltd.
Greg Kroah-Hartman
maintainerPATCH 127/218 usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Anand <[email protected]>
commit 0416e494ce7dc84e2719bc9fb7daecb330476074 upstream.
In case of ep0 out, if length is not aligned to maxpacket size then we use dwc->ep_bounce_addr for dma transfer and not request->dma. Since, we have alreday done memcpy from dwc->ep0_bounce to request->buf, so we do not need to issue cache sync function. In fact, cache sync function will bring wrong data in request->buf from request->dma in this scenario.
So, cache sync function must not be executed in case of ep0 bounced.
--- drivers/usb/dwc3/ep0.c | 1 - drivers/usb/dwc3/gadget.c | 7 +++++-- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/usb/dwc3/ep0.c +0 -1
@@ -569,7 +569,6 @@ static void dwc3_ep0_complete_data(struc transferred =min_t (u32, ur->length, transfer_size - length);memcpy (ur->buf, dwc->ep0_bounce, transferred); - dwc->ep0_bounced = false; }else { transferred = ur->length - length; }
drivers/usb/dwc3/gadget.c +5 -2
@@ -238,8 +238,11 @@ void dwc3_gadget_giveback(struct dwc3_epif (req->request.status == -EINPROGRESS ) req->request.status = status; -usb_gadget_unmap_request (&dwc->gadget, &req->request, - req->direction); +if (dwc->ep0_bounced && dep->number ==0 ) + dwc->ep0_bounced = false; +else +usb_gadget_unmap_request (&dwc->gadget, &req->request, + req->direction); dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n", req, dep->name, req->request.actual,
Greg Kroah-Hartman
maintainerPATCH 128/218 USB: cdc-wdm: fix wdm_find_device* return value
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
commit 6a44886899ef8cc396e230e492e6a56a883889f3 upstream.
A logic error made the wdm_find_device* functions return a bogus pointer into static data instead of the intended NULL no matching device was found.
--- drivers/usb/class/cdc-wdm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/usb/class/cdc-wdm.c +8 -4
@@ -134,12 +134,14 @@ static struct usb_driver wdm_driver;/* return intfdata if we own the interface, else look up intf in the list */ static struct wdm_device *wdm_find_device (struct usb_interface *intf) { -struct wdm_device *desc =NULL ; +struct wdm_device *desc;spin_lock (&wdm_device_list_lock);list_for_each_entry (desc, &wdm_device_list, device_list)if (desc->intf == intf) -break ; + goto found; + desc =NULL ; +found:spin_unlock (&wdm_device_list_lock);return desc;
@@ -147,12 +149,14 @@ static struct wdm_device *wdm_find_devicstatic struct wdm_device *wdm_find_device_by_minor (int minor) { -struct wdm_device *desc =NULL ; +struct wdm_device *desc;spin_lock (&wdm_device_list_lock);list_for_each_entry (desc, &wdm_device_list, device_list)if (desc->intf->minor == minor) -break ; + goto found; + desc =NULL ; +found:spin_unlock (&wdm_device_list_lock);return desc;
Greg Kroah-Hartman
maintainerPATCH 129/218 USB: ohci-at91: fix PIO handling in relation with number of ports
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit 6fffb77c8393151b0cf8cef1b9c2ba90587dd2e8 upstream.
If the number of ports present on the SoC/board is not the maximum and that the platform data is not filled with all data, there is an easy way to mess the PIO setup for this interface. This quick fix addresses mis-configuration in USB host platform data that is common in at91 boards since commit 0ee6d1e (USB: ohci-at91:
change maximum number of ports) that did not modified the associatd board files.
--- drivers/usb/host/ohci-at91.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/usb/host/ohci-at91.c +10 -0
@@ -569,6 +569,16 @@ static int __devinit ohci_hcd_at91_drv_pif (pdata) {at91_for_each_port (i) { +/* +* do not configure PIO if not in relation with +* real USB port on board +*/ +if (i >= pdata->ports) { + pdata->vbus_pin[i] = -EINVAL ; + pdata->overcurrent_pin[i] = -EINVAL ; +break ; + } +if (!gpio_is_valid (pdata->vbus_pin[i]))continue ; gpio = pdata->vbus_pin[i];
Greg Kroah-Hartman
maintainerPATCH 130/218 USB: add device quirk for Joss Optical touchboard
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 upstream.
This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss infrared touchboard device. The device doesn't like to be asked for its interface strings.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -96,6 +96,10 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x04b4, 0x0526), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Microchip Joss Optical infrared touchboard device */ + { USB_DEVICE(0x04d8, 0x000c), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Samsung Android phone modem - ID conflict with SPH-I500 */ { USB_DEVICE(0x04e8, 0x6601), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 131/218 rt2800usb: Added rx packet length validity check
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Poselenov <[email protected]>
commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.
On our system (ARM Cortex-M3 SOC running linux-2.6.33) frequent crashes were observed in the rt2800usb module because of the invalid length of the received packet (3392, 46920...). This patch adds the sanity check on the packet legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone() so that the bad packet condition would be noticed.
The fix was tested on the latest compat-wireless-3.5.1-1-snpc.
--- drivers/net/wireless/rt2x00/rt2800usb.c | 10 +++++++++- drivers/net/wireless/rt2x00/rt2x00dev.c | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/rt2x00/rt2800usb.c +9 -1
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(structskb_pull (entry->skb,RXINFO_DESC_SIZE );/* -* FIXME: we need to check for rx_pkt_len validity +* Check for rx_pkt_len validity. Return if invalid, leaving +* rxdesc->size zeroed out by the upper level. */ +if (unlikely (rx_pkt_len ==0 || + rx_pkt_len > entry->queue->data_size)) { +ERROR (entry->queue->rt2x00dev, +"Bad frame size %d, forcing to 0\n" , rx_pkt_len); +return ; + } + rxd = (__le32 *)(entry->skb->data + rx_pkt_len);/*
drivers/net/wireless/rt2x00/rt2x00dev.c +1 -1
@@ -628,7 +628,7 @@ void rt2x00lib_rxdone(struct queue_entry*/ if (unlikely (rxdesc.size ==0 || rxdesc.size > entry->queue->data_size)) { -WARNING (rt2x00dev,"Wrong frame size %d max %d.\n" , +ERROR (rt2x00dev,"Wrong frame size %d max %d.\n" , rxdesc.size, entry->queue->data_size);dev_kfree_skb (entry->skb); goto renew_skb;
Greg Kroah-Hartman
maintainerPATCH 132/218 usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Alexis R. Cortes" <[email protected]>
commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 upstream.
This patch is intended to work around a known issue on the SN65LVPE502CP USB3.0 re-driver that can delay the negotiation between a device and the host past the usual handshake timeout.
If that happens on the first insertion, the host controller port will enter in Compliance Mode and NO port status event will be generated (as per xHCI Spec) making impossible to detect this event by software. The port will remain in compliance mode until a warm reset is applied to it.
As a result of this, the port will seem "dead" to the user and no device connections or disconnections will be detected.
For solving this, the patch creates a timer which polls every 2 seconds the link state of each host controller's port (this by reading the PORTSC register) and recovers the port by issuing a Warm reset every time Compliance mode is detected.
If a xHC USB3.0 port has previously entered to U0, the compliance mode issue will NOT occur only until system resumes from sleep/hibernate, therefore, the compliance mode timer is stopped when all xHC USB 3.0 ports have entered U0. The timer is initialized again after each system resume.
Since the issue is being caused by a piece of hardware, the timer will be enabled ONLY on those systems that have the SN65LVPE502CP installed (this patch uses DMI strings for detecting those systems) therefore making this patch to act as a quirk (XHCI_COMP_MODE_QUIRK has been added to the xhci stack).
This patch applies for these systems:
Vendor: Hewlett-Packard. System Models: Z420, Z620 and Z820.
This patch should be backported to kernels as old as 3.2, as that was the first kernel to support warm reset. The kernels will need to contain both commit 10d674a82e553cb8a1f41027bb3c3e309b3f6804 "USB: When hot reset for USB3 fails, try warm reset" and commit 8bea2bd37df08aaa599aa361a9f8b836ba98e554 "usb: Add support for root hub port status CAS". The first patch add warm reset support, and the second patch modifies the USB core to issue a warm reset when the port is in compliance mode.
--- drivers/usb/host/xhci-hub.c | 42 +++++++++++++++ drivers/usb/host/xhci.c | 121 ++++++++++++++++++++++++++++++++++++++++++++ drivers/usb/host/xhci.h | 6 ++ 3 files changed, 169 insertions(+)
drivers/usb/host/xhci-hub.c +42 -0
@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u* when this bit is set. */ pls |=USB_PORT_STAT_CONNECTION ; + }else { +/* +* If CAS bit isn't set but the Port is already at +* Compliance Mode, fake a connection so the USB core +* notices the Compliance state and resets the port. +* This resolves an issue generated by the SN65LVPE502CP +* in which sometimes the port enters compliance mode +* caused by a delay on the host-device negotiation. +*/ +if (pls ==USB_SS_PORT_LS_COMP_MOD ) + pls |=USB_PORT_STAT_CONNECTION ; } +/* update status field */ *status |= pls; } +/* +* Function for Compliance Mode Quirk. +* +* This Function verifies if all xhc USB3 ports have entered U0, if so, +* the compliance mode timer is deleted. A port won't enter +* compliance mode if it has previously entered U0. +*/ +void xhci_del_comp_mod_timer (struct xhci_hcd *xhci,u32 status,u16 wIndex) +{ +u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1 ); +bool port_in_u0 = ((status &PORT_PLS_MASK ) ==XDEV_U0 ); + +if (!(xhci->quirks &XHCI_COMP_MODE_QUIRK )) +return ; + +if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) { + xhci->port_status_u0 |=1 << wIndex; +if (xhci->port_status_u0 == all_ports_seen_u0) { +del_timer_sync (&xhci->comp_mode_recovery_timer); +xhci_dbg (xhci,"All USB3 ports have entered U0 already!\n" ); +xhci_dbg (xhci,"Compliance Mode Recovery Timer Deleted.\n" ); + } + } +} +int xhci_hub_control (struct usb_hcd *hcd,u16 typeReq,u16 wValue,u16 wIndex,char *buf,u16 wLength) {
@@ -644,6 +681,11 @@ int xhci_hub_control(struct usb_hcd *hcd/* Update Port Link State for super speed ports*/ if (hcd->speed ==HCD_USB3 ) {xhci_hub_report_link_state (&status, temp); +/* +* Verify if all USB3 Ports Have entered U0 already. +* Delete Compliance Mode Timer if so. +*/ +xhci_del_comp_mod_timer (xhci, temp, wIndex); }if (bus_state->port_c_suspend & (1 << wIndex)) status |=1 <<USB_PORT_FEAT_C_SUSPEND ;
drivers/usb/host/xhci.c +121 -0
157 lines not on this page · raw message
drivers/usb/host/xhci.h +6 -0
@@ -1487,6 +1487,7 @@ struct xhci_hcd {#define XHCI_AMD_0x96_HOST (1 << 9)#define XHCI_TRUST_TX_LENGTH (1 << 10)#define XHCI_SPURIOUS_REBOOT (1 << 13) +#define XHCI_COMP_MODE_QUIRK (1 << 14)unsigned int num_active_eps;unsigned int limit_active_eps;/* There are two roothubs to keep track of bus suspend info for */
@@ -1503,6 +1504,11 @@ struct xhci_hcd { unsigned sw_lpm_support:1;/* support xHCI 1.0 spec USB2 hardware LPM */ unsigned hw_lpm_support:1; +/* Compliance Mode Recovery Data */ +struct timer_list comp_mode_recovery_timer; +u32 port_status_u0; +/* Compliance Mode Timer Triggered every 2 seconds */ +#define COMP_MODE_RCVRY_MSECS 2000 };/* convert between an HCD pointer and the corresponding EHCI_HCD */
Greg Kroah-Hartman
maintainerPATCH 133/218 Intel xhci: Only switch the switchable ports
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keng-Yu Lin <[email protected]>
commit a96874a2a92feaef607ddd3137277a788cb927a6 upstream.
With a previous patch to enable the EHCI/XHCI port switching, it switches all the available ports.
The assumption is not correct because the BIOS may expect some ports not switchable by the OS.
There are two more registers that contains the information of the switchable and non-switchable ports.
This patch adds the checking code for the two register so that only the switchable ports are altered.
This patch should be backported to kernels as old as 3.0, that contain commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support EHCI/xHCI port switching."
--- drivers/usb/host/pci-quirks.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
drivers/usb/host/pci-quirks.c +23 -4
@@ -75,7 +75,9 @@#define NB_PIF0_PWRDOWN_1 0x01100013#define USB_INTEL_XUSB2PR 0xD0 +#define USB_INTEL_USB2PRM 0xD4#define USB_INTEL_USB3_PSSEN 0xD8 +#define USB_INTEL_USB3PRM 0xDC static struct amd_chipset_info { struct pci_dev *nb_dev;
@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_dereturn ; } - ports_available =0xffffffff ; +/* Read USB3PRM, the USB 3.0 Port Routing Mask Register +* Indicate the ports that can be changed from OS. +*/ +pci_read_config_dword (xhci_pdev,USB_INTEL_USB3PRM , + &ports_available); + +dev_dbg (&xhci_pdev->dev,"Configurable ports to enable SuperSpeed: 0x%x\n" , + ports_available); +/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable -* Register, to turn on SuperSpeed terminations for all -* available ports. +* Register, to turn on SuperSpeed terminations for the +* switchable ports. */ pci_write_config_dword (xhci_pdev,USB_INTEL_USB3_PSSEN ,cpu_to_le32 (ports_available));
@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_dedev_dbg (&xhci_pdev->dev,"USB 3.0 ports that are now enabled " "under xHCI: 0x%x\n" , ports_available); - ports_available =0xffffffff ; +/* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register +* Indicate the USB 2.0 ports to be controlled by the xHCI host. +*/ + +pci_read_config_dword (xhci_pdev,USB_INTEL_USB2PRM , + &ports_available); + +dev_dbg (&xhci_pdev->dev,"Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n" , + ports_available); +/* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to * switch the USB 2.0 power and data lines over to the xHCI * host.
Greg Kroah-Hartman
maintainerPATCH 134/218 usb: host: xhci-plat: use ioremap_nocache
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruchika Kharwar <[email protected]>
commit 319acdfc064169023cd9ada5085b434fbcdacec2 upstream.
Use the ioremap_nocache variant of the ioremap API in order to make sure our memory will be marked uncachable.
This patch should be backported to kernels as old as 3.4, that contain the commit 3429e91a661e1f383aecc86c6bbcf65afb15c892 "usb: host: xhci:
add platform driver support".
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platfo goto put_hcd; } - hcd->regs =ioremap (hcd->rsrc_start, hcd->rsrc_len); + hcd->regs =ioremap_nocache (hcd->rsrc_start, hcd->rsrc_len);if (!hcd->regs) {dev_dbg (&pdev->dev,"error mapping memory\n" ); ret = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 135/218 xhci: Fix a logical vs bitwise AND bug
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 052c7f9ffb0e95843e75448d02664459253f9ff8 upstream.
The intent was to test whether the flag was set.
This patch should be backported to stable kernels as old as 3.0, since it fixes a bug in commit e95829f474f0db3a4d940cae1423783edd966027 "xhci:
Switch PPT ports to EHCI on shutdown.", which was marked for stable.
--- drivers/usb/host/xhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci.c +1 -1
@@ -760,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd) {struct xhci_hcd *xhci =hcd_to_xhci (hcd); -if (xhci->quirks &&XHCI_SPURIOUS_REBOOT ) +if (xhci->quirks &XHCI_SPURIOUS_REBOOT )usb_disable_xhci_ports (to_pci_dev (hcd->self.controller));spin_lock_irq (&xhci->lock);
Greg Kroah-Hartman
maintainerPATCH 136/218 xhci: Make handover code more robust
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Garrett <[email protected]>
commit e955a1cd086de4d165ae0f4c7be7289d84b63bdc upstream.
My test platform (Intel DX79SI) boots reliably under BIOS, but frequently crashes when booting via UEFI. I finally tracked this down to the xhci handoff code. It seems that reads from the device occasionally just return 0xff, resulting in xhci_find_next_cap_offset generating a value that's larger than the resource region. We then oops when attempting to read the value. Sanity checking that value lets us avoid the crash.
I've no idea what's causing the underlying problem, and xhci still doesn't actually *work* even with this, but the machine at least boots which will probably make further debugging easier.
This should be backported to kernels as old as 2.6.31, that contain the commit 66d4eadd8d067269ea8fead1a50fe87c2979a80d "USB: xhci: BIOS handoff and HW initialization."
--- drivers/usb/host/pci-quirks.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/host/pci-quirks.c +10 -2
@@ -841,12 +841,12 @@ static void __devinit quirk_usb_handoff_void __iomem *op_reg_base;u32 val;int timeout; +int len =pci_resource_len (pdev,0 );if (!mmio_resource_enabled (pdev,0 ))return ; - base =ioremap_nocache (pci_resource_start (pdev,0 ), -pci_resource_len (pdev,0 )); + base =ioremap_nocache (pci_resource_start (pdev,0 ), len);if (base ==NULL )return ;
@@ -856,9 +856,17 @@ static void __devinit quirk_usb_handoff_*/ ext_cap_offset =xhci_find_next_cap_offset (base,XHCI_HCC_PARAMS_OFFSET ); do { + if ((ext_cap_offset + sizeof(val)) > len) { + /* We're reading garbage from the controller */ + dev_warn(&pdev->dev, + "xHCI controller failing to respond"); + return; + } + if (!ext_cap_offset) /* We've reached the end of the extended capabilities */ goto hc_init; + val = readl(base + ext_cap_offset); if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY) break;
Greg Kroah-Hartman
maintainerPATCH 137/218 xhci: Recognize USB 3.0 devices as superspeed at powerup
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manoj Iyer <[email protected]>
commit 29d214576f936db627ff62afb9ef438eea18bcd2 upstream.
On Intel Panther Point chipset USB 3.0 devices show up as high-speed devices on powerup, but after an s3 cycle they are correctly recognized as SuperSpeed. At powerup switch the port to xHCI so that USB 3.0 devices are correctly recognized.
This patch should be backported to kernels as old as 3.0, that contain commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support EHCI/xHCI port switching."
--- drivers/usb/host/pci-quirks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/pci-quirks.c +2 -1
@@ -897,9 +897,10 @@ static void __devinit quirk_usb_handoff_/* Disable any BIOS SMIs and clear all SMI events*/ writel (val, base + ext_cap_offset +XHCI_LEGACY_CONTROL_OFFSET ); +hc_init:if (usb_is_intel_switchable_xhci (pdev))usb_enable_xhci_ports (pdev); -hc_init: + op_reg_base = base +XHCI_HC_LENGTH (readl (base));/* Wait for the host controller to be ready before writing any
Greg Kroah-Hartman
maintainerPATCH 138/218 usb: host: xhci: fix compilation error for non-PCI based stacks
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moiz Sonasath <[email protected]>
commit 296365781903226a3fb8758901eaeec09d2798e4 upstream.
For non PCI-based stacks, this function call usb_disable_xhci_ports(to_pci_dev(hcd->self.controller)); made from xhci_shutdown is not applicable.
Ideally, we wouldn't have any PCI-specific code on a generic driver such as the xHCI stack, but it looks like we should just stub usb_disable_xhci_ports() out for non-PCI devices.
[ [email protected]: slight improvement to commit log ]
This patch should be backported to kernels as old as 3.0, since the commit it fixes (e95829f474f0db3a4d940cae1423783edd966027 "xhci: Switch PPT ports to EHCI on shutdown.") was marked for stable.
--- drivers/usb/host/pci-quirks.h | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/pci-quirks.h +1 -0
@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_dstatic inline void usb_amd_quirk_pll_disable (void ) {}static inline void usb_amd_quirk_pll_enable (void ) {}static inline void usb_amd_dev_put (void ) {} +static inline void usb_disable_xhci_ports (struct pci_dev *xhci_pdev) {}#endif /* CONFIG_PCI */ #endif /* __LINUX_USB_PCI_QUIRKS_H */
Greg Kroah-Hartman
maintainerPATCH 139/218 tty: serial: imx: console write routing is unsafe on SMP
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinyu Chen <[email protected]>
commit 9ec1882df244c4ee1baa692676fef5e8b0f5487d upstream.
The console feature's write routing is unsafe on SMP with the startup/shutdown call.
There could be several consumers of the console
* the kernel printk
* the init process using /dev/kmsg to call printk to show log
* shell, which open /dev/console and write with sys_write()
The shell goes into the normal uart open/write routing, but the other two go into the console operations.
The open routing calls imx serial startup, which will write USR1/2 register without any lock and critical with imx_console_write call.
Add a spin_lock for startup/shutdown/console_write routing.
This patch is a port from Freescale's Android kernel.
--- drivers/tty/serial/imx.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/tty/serial/imx.c +11 -1
@@ -756,6 +756,7 @@ static int imx_startup(struct uart_port } } +spin_lock_irqsave (&sport->port.lock, flags);/* * Finally, clear and enable interrupts */
@@ -809,7 +810,6 @@ static int imx_startup(struct uart_port/* * Enable modem status interrupts */ -spin_lock_irqsave (&sport->port.lock,flags);imx_enable_ms (&sport->port);spin_unlock_irqrestore (&sport->port.lock,flags);
@@ -839,10 +839,13 @@ static void imx_shutdown(struct uart_por {struct imx_port *sport = (struct imx_port *)port;unsigned long temp; +unsigned long flags; +spin_lock_irqsave (&sport->port.lock, flags); temp =readl (sport->port.membase +UCR2 ); temp &= ~(UCR2_TXEN );writel (temp, sport->port.membase +UCR2 ); +spin_unlock_irqrestore (&sport->port.lock, flags);if (USE_IRDA (sport)) {struct imxuart_platform_data *pdata;
@@ -871,12 +874,14 @@ static void imx_shutdown(struct uart_por* Disable all interrupts, port and break condition. */ +spin_lock_irqsave (&sport->port.lock, flags); temp =readl (sport->port.membase +UCR1 ); temp &= ~(UCR1_TXMPTYEN |UCR1_RRDYEN |UCR1_RTSDEN |UCR1_UARTEN );if (USE_IRDA (sport)) temp &= ~(UCR1_IREN );writel (temp, sport->port.membase +UCR1 ); +spin_unlock_irqrestore (&sport->port.lock, flags); } static void
@@ -1219,6 +1224,9 @@ imx_console_write(struct console *co, costruct imx_port *sport = imx_ports[co->index];struct imx_port_ucrs old_ucr;unsigned int ucr1; +unsigned long flags; + +spin_lock_irqsave (&sport->port.lock, flags);/* * First, save UCR1/2/3 and then disable interrupts
@@ -1244,6 +1252,8 @@ imx_console_write(struct console *co, cowhile (!(readl (sport->port.membase +USR2 ) &USR2_TXDC ));imx_port_ucrs_restore (&sport->port, &old_ucr); + +spin_unlock_irqrestore (&sport->port.lock, flags); }/*
Greg Kroah-Hartman
maintainerPATCH 140/218 mutex: Place lock in contended state after fastpath_lock failure
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.
ARM recently moved to asm-generic/mutex-xchg.h for its mutex implementation after the previous implementation was found to be missing some crucial memory barriers. However, this has revealed some problems running hackbench on SMP platforms due to the way in which the MUTEX_SPIN_ON_OWNER code operates.
The symptoms are that a bunch of hackbench tasks are left waiting on an unlocked mutex and therefore never get woken up to claim it. This boils down to the following sequence of events:
Task A Task B Task C Lock value
0 1 1 lock() 0 2 lock() 0 3 spin(A) 0 4 unlock() 1 5 lock() 0 6 cmpxchg(1,0) 0 7 contended() -1 8 lock() 0 9 spin(C) 0 10 unlock() 1 11 cmpxchg(1,0) 0 12 unlock() 1
At this point, the lock is unlocked, but Task B is in an uninterruptible sleep with nobody to wake it up.
This patch fixes the problem by ensuring we put the lock into the contended state if we fail to acquire it on the fastpath, ensuring that any blocked waiters are woken up when the mutex is released.
--- include/asm-generic/mutex-xchg.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
include/asm-generic/mutex-xchg.h +9 -2
@@ -26,7 +26,13 @@ static inline void __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *)) {if (unlikely (atomic_xchg (count,0 ) !=1 )) -fail_fn (count); +/* +* We failed to acquire the lock, so mark it contended +* to ensure that any waiting tasks are woken up by the +* unlock slow path. +*/ +if (likely (atomic_xchg (count,-1 ) !=1 )) +fail_fn (count); }/**
@@ -43,7 +49,8 @@ static inline int __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *)) {if (unlikely (atomic_xchg (count,0 ) !=1 )) -return fail_fn (count); +if (likely (atomic_xchg (count,-1 ) !=1 )) +return fail_fn (count);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 141/218 drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atsushi Nemoto <[email protected]>
commit 7dbfb315b2aaef0a115765946bf3026d074c33a7 upstream.
Correct the offset by subtracting 20 from tm_hour before taking the modulo 12.
[ "Why 20?" I hear you ask. Or at least I did.
Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly - included in the RS5C348_HOURS_MASK define. So it's really subtracting out that bit to get "hour+12". But then because it does things modulo 12, it needs to add the 12 in again afterwards anyway.
This code is confused. It would be much clearer if RS5C348_HOURS_MASK just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't need to do the silly subtract either.
Whatever. It's all just math, the end result is the same. - Linus ]
--- drivers/rtc/rtc-rs5c348.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/rtc/rtc-rs5c348.c +5 -2
@@ -122,9 +122,12 @@ rs5c348_rtc_read_time(struct device *dev tm->tm_min =bcd2bin (rxbuf[RS5C348_REG_MINS ] &RS5C348_MINS_MASK ); tm->tm_hour =bcd2bin (rxbuf[RS5C348_REG_HOURS ] &RS5C348_HOURS_MASK );if (!pdata->rtc_24h) { - tm->tm_hour %=12 ; -if (rxbuf[RS5C348_REG_HOURS ] &RS5C348_BIT_PM ) +if (rxbuf[RS5C348_REG_HOURS ] &RS5C348_BIT_PM ) { + tm->tm_hour -=20 ; + tm->tm_hour %=12 ; tm->tm_hour +=12 ; + }else + tm->tm_hour %=12 ; } tm->tm_wday =bcd2bin (rxbuf[RS5C348_REG_WDAY ] &RS5C348_WDAY_MASK ); tm->tm_mday =bcd2bin (rxbuf[RS5C348_REG_DAY ] &RS5C348_DAY_MASK );
Greg Kroah-Hartman
maintainerPATCH 142/218 PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 7f321c26c04807834fef4c524d2b21573423fc74 upstream.
For devices whose power.no_callbacks flag is set, rpm_resume() should return 1 if the device's parent is already active, so that the callers of pm_runtime_get() don't think that they have to wait for the device to resume (asynchronously) in that case (the core won't queue up an asynchronous resume in that case, so there's nothing to wait for anyway).
Modify the code accordingly (and make sure that an idle notification will be queued up on success, even if 1 is to be returned).
--- drivers/base/power/runtime.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/base/power/runtime.c +2 -1
@@ -652,6 +652,7 @@ static int rpm_resume(struct device *dev || dev->parent->power.runtime_status == RPM_ACTIVE) {atomic_inc (&dev->parent->power.child_count);spin_unlock (&dev->parent->power.lock); + retval =1 ; goto no_callback;/* Assume success. */ }spin_unlock (&dev->parent->power.lock);
@@ -735,7 +736,7 @@ static int rpm_resume(struct device *dev }wake_up_all (&dev->power.wait_queue); -if (!retval) +if (retval >=0 )rpm_idle (dev,RPM_ASYNC ); out:
Greg Kroah-Hartman
maintainerPATCH 143/218 PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b upstream.
The power.deferred_resume can only be set if the runtime PM status of device is RPM_SUSPENDING and it should be cleared after its status has been changed, regardless of whether or not the runtime suspend has been successful. However, it only is cleared on suspend failure, while it may remain set on successful suspend and is happily leaked to rpm_resume() executed in that case.
That shouldn't happen, so if power.deferred_resume is set in rpm_suspend() after the status has been changed to RPM_SUSPENDED, clear it before calling rpm_resume(). Then, it doesn't need to be cleared before changing the status to RPM_SUSPENDING any more, because it's always cleared after the status has been changed to either RPM_SUSPENDED (on success) or RPM_ACTIVE (on failure).
--- drivers/base/power/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/runtime.c +1 -1
@@ -430,7 +430,6 @@ static int rpm_suspend(struct device *de goto repeat; } - dev->power.deferred_resume = false;if (dev->power.no_callbacks) goto no_callback;/* Assume success. */
@@ -506,6 +505,7 @@ static int rpm_suspend(struct device *dewake_up_all (&dev->power.wait_queue);if (dev->power.deferred_resume) { + dev->power.deferred_resume = false;rpm_resume (dev,0 ); retval = -EAGAIN ; goto out;
Greg Kroah-Hartman
maintainerPATCH 144/218 drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Holt <[email protected]>
commit 7838f994b4fceff24c343f4e26a6cf4393869579 upstream.
On many of our larger systems, CPU 0 has had all of its IRQ resources consumed before XPC loads. Worst cases on machines with multiple 10 GigE cards and multiple IB cards have depleted the entire first socket of IRQs.
This patch makes selecting the node upon which IRQs are allocated (as well as all the other GRU Message Queue structures) specifiable as a module load param and has a default behavior of searching all nodes/cpus for an available resources.
--- drivers/misc/sgi-xp/xpc_uv.c | 84 +++++++++++++++++++++++++++++++++---------- 1 file changed, 65 insertions(+), 19 deletions(-)
drivers/misc/sgi-xp/xpc_uv.c +65 -19
@@ -18,6 +18,8 @@#include <linux/interrupt.h> #include <linux/delay.h> #include <linux/device.h> +#include <linux/cpu.h> +#include <linux/module.h> #include <linux/err.h> #include <linux/slab.h> #include <asm/uv/uv_hub.h>
@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_hear XPC_NOTIFY_MSG_SIZE_UV)#define XPC_NOTIFY_IRQ_NAME "xpc_notify" +static int xpc_mq_node =-1 ; +static struct xpc_gru_mq_uv *xpc_activate_mq_uv;static struct xpc_gru_mq_uv *xpc_notify_mq_uv;
@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_#if definedCONFIG_X86_64 mq->irq =uv_setup_irq (irq_name, cpu, mq->mmr_blade, mq->mmr_offset,UV_AFFINITY_CPU ); -if (mq->irq <0 ) { -dev_err (xpc_part,"uv_setup_irq() returned error=%d\n" , - -mq->irq); +if (mq->irq <0 )return mq->irq; - } mq->mmr_value =uv_read_global_mmr64 (mmr_pnode, mq->mmr_offset);
@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_siz mq->mmr_blade =uv_cpu_to_blade_id (cpu); nid =cpu_to_node (cpu); - page =alloc_pages_exact_node (nid,GFP_KERNEL | __GFP_ZERO |GFP_THISNODE , - pg_order); + page =alloc_pages_exact_node (nid, +GFP_KERNEL | __GFP_ZERO |GFP_THISNODE , + pg_order);if (page ==NULL ) {dev_err (xpc_part,"xpc_create_gru_mq_uv() failed to alloc %d " "bytes of memory on nid=%d for GRU mq\n" , mq_size, nid);
@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_ar .notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv, }; +static int +xpc_init_mq_node (int nid) +{ +int cpu; + +get_online_cpus (); + +for_each_cpu (cpu,cpumask_of_node (nid)) { + xpc_activate_mq_uv = +xpc_create_gru_mq_uv (XPC_ACTIVATE_MQ_SIZE_UV , nid, +XPC_ACTIVATE_IRQ_NAME , + xpc_handle_activate_IRQ_uv); +if (!IS_ERR (xpc_activate_mq_uv)) +break ; + } +if (IS_ERR (xpc_activate_mq_uv)) { +put_online_cpus (); +return PTR_ERR (xpc_activate_mq_uv); + } + +for_each_cpu (cpu,cpumask_of_node (nid)) { + xpc_notify_mq_uv = +xpc_create_gru_mq_uv (XPC_NOTIFY_MQ_SIZE_UV , nid, +XPC_NOTIFY_IRQ_NAME , + xpc_handle_notify_IRQ_uv); +if (!IS_ERR (xpc_notify_mq_uv)) +break ; + } +if (IS_ERR (xpc_notify_mq_uv)) { +xpc_destroy_gru_mq_uv (xpc_activate_mq_uv); +put_online_cpus (); +return PTR_ERR (xpc_notify_mq_uv); + } + +put_online_cpus (); +return 0 ; +} +int xpc_init_uv (void ) { +int nid; +int ret =0 ; + xpc_arch_ops = xpc_arch_ops_uv;if (sizeof (struct xpc_notify_mq_msghdr_uv ) >XPC_MSG_HDR_MAX_SIZE ) {
@@ -1742,21 +1785,21 @@ xpc_init_uv(void)return -E2BIG ; } - xpc_activate_mq_uv =xpc_create_gru_mq_uv (XPC_ACTIVATE_MQ_SIZE_UV ,0 , -XPC_ACTIVATE_IRQ_NAME , - xpc_handle_activate_IRQ_uv); -if (IS_ERR (xpc_activate_mq_uv)) -return PTR_ERR (xpc_activate_mq_uv); +if (xpc_mq_node <0 ) +for_each_online_node (nid) { + ret =xpc_init_mq_node (nid); - xpc_notify_mq_uv =xpc_create_gru_mq_uv (XPC_NOTIFY_MQ_SIZE_UV ,0 , -XPC_NOTIFY_IRQ_NAME , - xpc_handle_notify_IRQ_uv); -if (IS_ERR (xpc_notify_mq_uv)) { -xpc_destroy_gru_mq_uv (xpc_activate_mq_uv); -return PTR_ERR (xpc_notify_mq_uv); - } +if (!ret) +break ; + } +else + ret =xpc_init_mq_node (xpc_mq_node); -return 0 ; +if (ret <0 ) +dev_err (xpc_part,"xpc_init_mq_node() returned error=%d\n" , + -ret); + +return ret; }void
@@ -1765,3 +1808,6 @@ xpc_exit_uv(void)xpc_destroy_gru_mq_uv (xpc_notify_mq_uv);xpc_destroy_gru_mq_uv (xpc_activate_mq_uv); } + +module_param (xpc_mq_node, int,0 ); +MODULE_PARM_DESC (xpc_mq_node,"Node number on which to allocate message queues." );
Greg Kroah-Hartman
maintainerPATCH 145/218 fbcon: fix race condition between console lock and cursor timer (v1.1)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 upstream.
So we've had a fair few reports of fbcon handover breakage between efi/vesafb and i915 surface recently, so I dedicated a couple of days to finding the problem.
Essentially the last thing we saw was the conflicting framebuffer message and that was all.
So after much tracing with direct netconsole writes (printks under console_lock not so useful), I think I found the race.
Thread A (driver load) Thread B (timer thread)
unbind_con_driver -> |
bind_con_driver -> |
vc->vc_sw->con_deinit -> |
fbcon_deinit -> |
console_lock() |
| |
| fbcon_flashcursor timer fires
| console_lock() <- blocked for A
|
|fbcon_del_cursor_timer ->
del_timer_sync
(BOOM)
Of course because all of this is under the console lock, we never see anything, also since we also just unbound the active console guess what we never see anything.
Hopefully this fixes the problem for anyone seeing vesafb->kms driver handoff.
v1.1: add comment suggestion from Alan.
--- drivers/video/console/fbcon.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/video/console/fbcon.c +8 -1
@@ -372,8 +372,15 @@ static void fb_flashcursor(struct work_sstruct vc_data *vc =NULL ;int c;int mode; +int ret; + +/* FIXME: we should sort out the unbind locking instead */ +/* instead we just fail to flash the cursor if we can't get +* the lock instead of blocking fbcon deinit */ + ret =console_trylock (); +if (ret ==0 ) +return ; -console_lock ();if (ops && ops->currcon !=-1 ) vc = vc_cons[ops->currcon].d;
Greg Kroah-Hartman
maintainerPATCH 146/218 drm/radeon: avoid turning off spread spectrum for used pll
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Glisse <[email protected]>
commit 5efcc76c13a745f98e7b6604d6aca49761be1970 upstream.
If spread spectrum is enabled and in use for a given pll we should not turn it off as it will lead to turning off display for crtc that use the pll (this behavior was observed on chelsea edp).
--- drivers/gpu/drm/radeon/atombios_crtc.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/atombios_crtc.c +21 -4
@@ -444,11 +444,28 @@ union atom_enable_ss {static void atombios_crtc_program_ss (struct radeon_device *rdev,int enable,int pll_id, +int crtc_id,struct radeon_atom_ss *ss) { +unsigned i;int index =GetIndexIntoMasterTable (COMMAND , EnableSpreadSpectrumOnPPLL);union atom_enable_ss args; +if (!enable) { +for (i =0 ; i <6 ; i++) { +if (rdev->mode_info.crtcs[i] && + rdev->mode_info.crtcs[i]->enabled && + i != crtc_id && + pll_id == rdev->mode_info.crtcs[i]->pll_id) { +/* one other crtc is using this pll don't turn +* off spread spectrum as it might turn off +* display on active crtc +*/ +return ; + } + } + } +memset (&args,0 ,sizeof (args));if (ASIC_IS_DCE5 (rdev)) {
@@ -1039,7 +1056,7 @@ static void atombios_crtc_set_pll(structradeon_compute_pll_legacy (pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div, &ref_div, &post_div); -atombios_crtc_program_ss (rdev,ATOM_DISABLE , radeon_crtc->pll_id, &ss); +atombios_crtc_program_ss (rdev,ATOM_DISABLE , radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss); atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id, encoder_mode, radeon_encoder->encoder_id, mode->clock,
@@ -1062,7 +1079,7 @@ static void atombios_crtc_set_pll(struct ss.step = step_size; } -atombios_crtc_program_ss (rdev,ATOM_ENABLE , radeon_crtc->pll_id, &ss); +atombios_crtc_program_ss (rdev,ATOM_ENABLE , radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss); } }
@@ -1571,11 +1588,11 @@ void radeon_atom_disp_eng_pll_init(strucASIC_INTERNAL_SS_ON_DCPLL , rdev->clock.default_dispclk);if (ss_enabled) -atombios_crtc_program_ss (rdev,ATOM_DISABLE ,ATOM_DCPLL , &ss); +atombios_crtc_program_ss (rdev,ATOM_DISABLE ,ATOM_DCPLL ,-1 , &ss);/* XXX: DCE5, make sure voltage, dispclk is high enough */ atombios_crtc_set_disp_eng_pll (rdev, rdev->clock.default_dispclk);if (ss_enabled) -atombios_crtc_program_ss (rdev,ATOM_ENABLE ,ATOM_DCPLL , &ss); +atombios_crtc_program_ss (rdev,ATOM_ENABLE ,ATOM_DCPLL ,-1 , &ss); } }
Greg Kroah-Hartman
maintainerPATCH 147/218 drm/radeon/ss: use num_crtc rather than hardcoded 6
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5317670692f61675394db2eb6713484b67383750 upstream.
When checking if a pll is in use.
--- drivers/gpu/drm/radeon/atombios_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/atombios_crtc.c +1 -1
@@ -452,7 +452,7 @@ static void atombios_crtc_program_ss(strunion atom_enable_ss args;if (!enable) { -for (i =0 ; i <6 ; i++) { +for (i =0 ; i < rdev->num_crtc; i++) { if (rdev->mode_info.crtcs[i] && rdev->mode_info.crtcs[i]->enabled && i != crtc_id &&
Greg Kroah-Hartman
maintainerPATCH 148/218 drm/radeon: split ATRM support out from the ATPX handler (v3)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c61e2775873f603148e8e998a938721b7d222d24 upstream.
There are systems that use ATRM, but not ATPX.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=41265
V2: fix #ifdefs as per Greg's comments
V3: fix it harder
--- drivers/gpu/drm/radeon/radeon.h | 15 ----- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 56 ------------------ drivers/gpu/drm/radeon/radeon_bios.c | 80 +++++++++++++++++++++++++-- 3 files changed, 77 insertions(+), 74 deletions(-)
drivers/gpu/drm/radeon/radeon.h +0 -15
@@ -138,21 +138,6 @@ struct radeon_device;/* * BIOS. */ -#define ATRM_BIOS_PAGE 4096 - -#if defined(CONFIG_VGA_SWITCHEROO ) -bool radeon_atrm_supported (struct pci_dev *pdev); -int radeon_atrm_get_bios_chunk (uint8_t *bios,int offset,int len); -#else -static inline bool radeon_atrm_supported (struct pci_dev *pdev) -{ -return false; -} - -static inline int radeon_atrm_get_bios_chunk (uint8_t *bios,int offset,int len){ -return -EINVAL ; -} -#endif bool radeon_get_bios (struct radeon_device *rdev);
drivers/gpu/drm/radeon/radeon_atpx_handler.c +1 -55
78 lines not on this page · raw message
drivers/gpu/drm/radeon/radeon_bios.c +76 -4
107 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 149/218 drm/radeon: implement ACPI VFCT vbios fetch (v3)
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lamparter <[email protected]>
commit 268ba0a99f89a84dc5eb312470896113d0709c74 upstream.
This is required for pure UEFI systems. The vbios is stored in ACPI rather than at the legacy vga location.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=26891
V2: fix #ifdefs as per Greg's comments
V3: fix it harder
--- drivers/gpu/drm/radeon/radeon_bios.c | 60 +++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+)
drivers/gpu/drm/radeon/radeon_bios.c +60 -0
@@ -32,6 +32,7 @@#include <linux/vga_switcheroo.h> #include <linux/slab.h> +#include <linux/acpi.h> /* * BIOS. */
@@ -548,6 +549,63 @@ static bool radeon_read_disabled_bios(streturn legacy_read_disabled_bios (rdev); } +#ifdef CONFIG_ACPI +static bool radeon_acpi_vfct_bios (struct radeon_device *rdev) +{ +bool ret = false; +struct acpi_table_header *hdr; +/* acpi_get_table_with_size is not exported :( */ +acpi_size tbl_size =0x7fffffff ; +UEFI_ACPI_VFCT *vfct; +GOP_VBIOS_CONTENT *vbios; +VFCT_IMAGE_HEADER *vhdr; + +if (!ACPI_SUCCESS (acpi_get_table ("VFCT" ,1 , &hdr))) +return false; +if (tbl_size <sizeof (UEFI_ACPI_VFCT )) { +DRM_ERROR ("ACPI VFCT table present but broken (too short #1)\n" ); + goto out_unmap; + } + + vfct = (UEFI_ACPI_VFCT *)hdr; +if (vfct->VBIOSImageOffset +sizeof (VFCT_IMAGE_HEADER ) > tbl_size) { +DRM_ERROR ("ACPI VFCT table present but broken (too short #2)\n" ); + goto out_unmap; + } + + vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + vfct->VBIOSImageOffset); + vhdr = &vbios->VbiosHeader; +DRM_INFO ("ACPI VFCT contains a BIOS for %02x:%02x.%d %04x:%04x, size %d\n" , + vhdr->PCIBus, vhdr->PCIDevice, vhdr->PCIFunction, + vhdr->VendorID, vhdr->DeviceID, vhdr->ImageLength); + +if (vhdr->PCIBus != rdev->pdev->bus->number || + vhdr->PCIDevice !=PCI_SLOT (rdev->pdev->devfn) || + vhdr->PCIFunction !=PCI_FUNC (rdev->pdev->devfn) || + vhdr->VendorID != rdev->pdev->vendor || + vhdr->DeviceID != rdev->pdev->device) { +DRM_INFO ("ACPI VFCT table is not for this card\n" ); + goto out_unmap; + }; + +if (vfct->VBIOSImageOffset +sizeof (VFCT_IMAGE_HEADER ) + vhdr->ImageLength > tbl_size) { +DRM_ERROR ("ACPI VFCT image truncated\n" ); + goto out_unmap; + } + + rdev->bios =kmemdup (&vbios->VbiosContent, vhdr->ImageLength,GFP_KERNEL ); + ret = !!rdev->bios; + +out_unmap: +/* uh, no idea what to do here... */ +return ret; +} +#else +static inline bool radeon_acpi_vfct_bios (struct radeon_device *rdev) +{ +return false; +} +#endif bool radeon_get_bios (struct radeon_device *rdev) {
@@ -556,6 +614,8 @@ bool radeon_get_bios(struct radeon_devic r =radeon_atrm_get_bios (rdev);if (r == false) + r =radeon_acpi_vfct_bios (rdev); +if (r == false) r =igp_read_bios_from_vram (rdev);if (r == false) r =radeon_read_bios (rdev);
Greg Kroah-Hartman
maintainerPATCH 150/218 drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit 52e9b39d9a89ae33662596bd30e62dd56bddbe73 upstream.
There is a more recent APU stepping with a new PCI ID shipping in the same board by Fujitsu which needs the same quirk to correctly mark the back plane connectors.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_atombios.c +1 -1
@@ -452,7 +452,7 @@ static bool radeon_atom_apply_quirks(str }/* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */ -if ((dev->pdev->device ==0x9802 ) && +if (((dev->pdev->device ==0x9802 ) || (dev->pdev->device ==0x9806 )) && (dev->pdev->subsystem_vendor ==0x1734 ) && (dev->pdev->subsystem_device ==0x11bd )) {if (*connector_type ==DRM_MODE_CONNECTOR_VGA ) {
Greg Kroah-Hartman
maintainerPATCH 151/218 drm/i915: extract connector update from intel_ddc_get_modes() for reuse
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
commit 4eab81366465aedcfd26de960c595bc03599c09f upstream.
Refactor the connector update part of intel_ddc_get_modes() into a separate intel_connector_update_modes() function for reuse. No functional changes.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=45881
--- drivers/gpu/drm/i915/intel_drv.h | 2 ++ drivers/gpu/drm/i915/intel_modes.c | 31 ++++++++++++++++++++++--------- 2 files changed, 24 insertions(+), 9 deletions(-)
drivers/gpu/drm/i915/intel_drv.h +2 -0
@@ -288,6 +288,8 @@ struct intel_fbc_work {int interval; }; +int intel_connector_update_modes (struct drm_connector *connector, +struct edid *edid);int intel_ddc_get_modes (struct drm_connector *c,struct i2c_adapter *adapter);extern bool intel_ddc_probe (struct intel_encoder *intel_encoder,int ddc_bus);
drivers/gpu/drm/i915/intel_modes.c +22 -9
@@ -60,6 +60,25 @@ bool intel_ddc_probe(struct intel_encode }/** +* intel_connector_update_modes - update connector from edid +* @connector: DRM connector device to use +* @edid: previously read EDID information +*/ +int intel_connector_update_modes (struct drm_connector *connector, +struct edid *edid) +{ +int ret; + +drm_mode_connector_update_edid_property (connector, edid); + ret =drm_add_edid_modes (connector, edid); +drm_edid_to_eld (connector, edid); + connector->display_info.raw_edid =NULL ; +kfree (edid); + +return ret; +} + +/** * intel_ddc_get_modes - get modelist from monitor * @connector: DRM connector device to use * @adapter: i2c adapter
@@ -70,18 +89,12 @@ int intel_ddc_get_modes(struct drm_conne struct i2c_adapter *adapter) {struct edid *edid; -int ret =0 ; edid =drm_get_edid (connector, adapter); -if (edid) { -drm_mode_connector_update_edid_property (connector, edid); - ret =drm_add_edid_modes (connector, edid); -drm_edid_to_eld (connector, edid); - connector->display_info.raw_edid =NULL ; -kfree (edid); - } +if (!edid) +return 0 ; -return ret; +return intel_connector_update_modes (connector, edid); }static const struct drm_prop_enum_list force_audio_names[] = {
Greg Kroah-Hartman
maintainerPATCH 152/218 asus-laptop: HRWS/HWRS typo
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Chary <[email protected]>
commit 8871e99f89b7d7b1ea99de550eea2a56273f42ab upstream.
Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=24222
--- drivers/platform/x86/asus-laptop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/platform/x86/asus-laptop.c +4 -4
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device* The significance of others is yet to be found. * If we don't find the method, we assume the device are present. */ - rv =acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &temp); + rv =acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &temp);if (!ACPI_FAILURE (rv)) - len +=sprintf (page + len,"HRWS value : %#x\n" , + len +=sprintf (page + len,"HWRS value : %#x\n" , (uint ) temp);/* * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct a* The significance of others is yet to be found. */ status = -acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &hwrs_result); +acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &hwrs_result);if (!ACPI_FAILURE (status)) -pr_notice (" HRWS returned %x" , (int )hwrs_result); +pr_notice (" HWRS returned %x" , (int )hwrs_result);if (!acpi_check_handle (asus->handle,METHOD_WL_STATUS ,NULL )) asus->have_rsts = true;
Greg Kroah-Hartman
maintainerPATCH 153/218 asus-nb-wmi: add some video toggle keys
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: AceLan Kao <[email protected]>
commit 3766054fff4af1b58a1440a284907887f4d2e8be upstream.
There are some new video switch keys that used by newer machines. 0xA0 - SDSP HDMI only0xA1 - SDSP LCD + HDMI0xA2 - SDSP CRT + HDMI0xA3 - SDSP TV + HDMI
But in Linux, there is no suitable userspace application to handle this, so, mapping them all to KEY_SWITCHVIDEOMODE.
--- drivers/platform/x86/asus-nb-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/asus-nb-wmi.c +4 -0
@@ -94,6 +94,10 @@ static const struct key_entry asus_nb_wm { KE_KEY, 0x8A, { KEY_PROG1 } }, { KE_KEY, 0x95, { KEY_MEDIA } }, { KE_KEY, 0x99, { KEY_PHONE } }, + { KE_KEY, 0xA0, { KEY_SWITCHVIDEOMODE } }, /* SDSP HDMI only */ + { KE_KEY, 0xA1, { KEY_SWITCHVIDEOMODE } }, /* SDSP LCD + HDMI */ + { KE_KEY, 0xA2, { KEY_SWITCHVIDEOMODE } }, /* SDSP CRT + HDMI */ + { KE_KEY, 0xA3, { KEY_SWITCHVIDEOMODE } }, /* SDSP TV + HDMI */ { KE_KEY, 0xb5, { KEY_CALC } }, { KE_KEY, 0xc4, { KEY_KBDILLUMUP } }, { KE_KEY, 0xc5, { KEY_KBDILLUMDOWN } },
Greg Kroah-Hartman
maintainerPATCH 154/218 drm: Check for invalid cursor flags
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Bornecrantz <[email protected]>
commit 7c4eaca4162d0b5ad4fb39f974d7ffd71b9daa09 upstream.
--- drivers/gpu/drm/drm_crtc.c | 2 +- include/drm/drm_mode.h | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_crtc.c +1 -1
@@ -1981,7 +1981,7 @@ int drm_mode_cursor_ioctl(struct drm_devif (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EINVAL ; -if (!req->flags) +if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))return -EINVAL ;mutex_lock (&dev->mode_config.mutex);
include/drm/drm_mode.h +3 -2
@@ -343,8 +343,9 @@ struct drm_mode_mode_cmd {struct drm_mode_modeinfo mode; }; -#define DRM_MODE_CURSOR_BO (1<<0) -#define DRM_MODE_CURSOR_MOVE (1<<1) +#define DRM_MODE_CURSOR_BO 0x01 +#define DRM_MODE_CURSOR_MOVE 0x02 +#define DRM_MODE_CURSOR_FLAGS 0x03/* * depending on the value in flags different members are used.
Greg Kroah-Hartman
maintainerPATCH 155/218 drm/radeon/atom: rework DIG modesetting on DCE3+
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8d1af57ae3c4458ed0de93ef97f388dd1b3239c7 upstream.
The ordering is important and the current drm code wasn't cutting it for modern DIG encoders. We need to have information about crtc before setting up the encoders so I've shifted the ordering a bit. Probably we'll need a full rework akin to danvet's recent intel patchs. This patch fixes numerous issues with DP bridge chips and makes link training much more reliable.
--- drivers/gpu/drm/radeon/atombios_encoders.c | 109 ++++++++++++----------------- 1 file changed, 47 insertions(+), 62 deletions(-)
drivers/gpu/drm/radeon/atombios_encoders.c +47 -62
@@ -1379,6 +1379,8 @@ radeon_atom_encoder_dpms_dig(struct drm_struct drm_device *dev = encoder->dev;struct radeon_device *rdev = dev->dev_private;struct radeon_encoder *radeon_encoder =to_radeon_encoder (encoder); +struct drm_encoder *ext_encoder =radeon_get_external_encoder (encoder); +struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;struct drm_connector *connector =radeon_get_connector_for_encoder (encoder);struct radeon_connector *radeon_connector =NULL ;struct radeon_connector_atom_dig *radeon_dig_connector =NULL ;
@@ -1390,19 +1392,37 @@ radeon_atom_encoder_dpms_dig(struct drm_switch (mode) {case DRM_MODE_DPMS_ON : -/* some early dce3.2 boards have a bug in their transmitter control table */ -if ((rdev->family ==CHIP_RV710 ) || (rdev->family ==CHIP_RV730 ) || -ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE5 (rdev)) { -if (ASIC_IS_DCE6 (rdev)) { -/* It seems we need to call ATOM_ENCODER_CMD_SETUP again -* before reenabling encoder on DPMS ON, otherwise we never -* get picture -*/ -atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_SETUP ,0 ); +if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE5 (rdev)) { +if (!connector) + dig->panel_mode =DP_PANEL_MODE_EXTERNAL_DP_MODE ; +else + dig->panel_mode =radeon_dp_get_panel_mode (encoder, connector); + +/* setup and enable the encoder */ +atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_SETUP ,0 ); +atombios_dig_encoder_setup (encoder, +ATOM_ENCODER_CMD_SETUP_PANEL_MODE , + dig->panel_mode); +if (ext_encoder) { +if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE61 (rdev)) +atombios_external_encoder_setup (encoder, ext_encoder, +EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP ); }atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE ,0 ,0 ); - }else { + }else if (ASIC_IS_DCE4 (rdev)) { +/* setup and enable the encoder */ +atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_SETUP ,0 ); +/* enable the transmitter */ +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE ,0 ,0 );atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT ,0 ,0 ); + }else { +/* setup and enable the encoder and transmitter */ +atombios_dig_encoder_setup (encoder,ATOM_ENABLE ,0 ); +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_SETUP ,0 ,0 ); +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE ,0 ,0 ); +/* some early dce3.2 boards have a bug in their transmitter control table */ +if ((rdev->family !=CHIP_RV710 ) || (rdev->family !=CHIP_RV730 )) +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT ,0 ,0 ); }if (ENCODER_MODE_IS_DP (atombios_get_encoder_mode (encoder)) && connector) {if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
@@ -1420,10 +1440,19 @@ radeon_atom_encoder_dpms_dig(struct drm_case DRM_MODE_DPMS_STANDBY :case DRM_MODE_DPMS_SUSPEND :case DRM_MODE_DPMS_OFF : -if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE5 (rdev)) +if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE5 (rdev)) { +/* disable the transmitter */ atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); -else + }else if (ASIC_IS_DCE4 (rdev)) { +/* disable the transmitter */ +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT ,0 ,0 ); +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); + }else { +/* disable the encoder and transmitter */ atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT ,0 ,0 ); +atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); +atombios_dig_encoder_setup (encoder,ATOM_DISABLE ,0 ); + }if (ENCODER_MODE_IS_DP (atombios_get_encoder_mode (encoder)) && connector) {if (ASIC_IS_DCE4 (rdev))atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_DP_VIDEO_OFF ,0 );
@@ -1848,10 +1877,12 @@ radeon_atom_encoder_mode_set(struct drm_struct drm_device *dev = encoder->dev;struct radeon_device *rdev = dev->dev_private;struct radeon_encoder *radeon_encoder =to_radeon_encoder (encoder); -struct drm_encoder *ext_encoder =radeon_get_external_encoder (encoder); radeon_encoder->pixel_clock = adjusted_mode->clock; +/* need to call this here rather than in prepare() since we need some crtc info */ +radeon_atom_encoder_dpms (encoder,DRM_MODE_DPMS_OFF ); +if (ASIC_IS_AVIVO (rdev) && !ASIC_IS_DCE4 (rdev)) {if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT |ATOM_DEVICE_TV_SUPPORT ))atombios_yuv_setup (encoder, true);
@@ -1870,38 +1901,7 @@ radeon_atom_encoder_mode_set(struct drm_case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 :case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 :case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA : -if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE5 (rdev)) { -struct drm_connector *connector =radeon_get_connector_for_encoder (encoder); -struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; - -if (!connector) - dig->panel_mode =DP_PANEL_MODE_EXTERNAL_DP_MODE ; -else - dig->panel_mode =radeon_dp_get_panel_mode (encoder, connector); - -/* setup and enable the encoder */ -atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_SETUP ,0 ); -atombios_dig_encoder_setup (encoder, -ATOM_ENCODER_CMD_SETUP_PANEL_MODE , - dig->panel_mode); - }else if (ASIC_IS_DCE4 (rdev)) { -/* disable the transmitter */ -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); -/* setup and enable the encoder */ -atombios_dig_encoder_setup (encoder,ATOM_ENCODER_CMD_SETUP ,0 ); - -/* enable the transmitter */ -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE ,0 ,0 ); - }else { -/* disable the encoder and transmitter */ -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); -atombios_dig_encoder_setup (encoder,ATOM_DISABLE ,0 ); - -/* setup and enable the encoder and transmitter */ -atombios_dig_encoder_setup (encoder,ATOM_ENABLE ,0 ); -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_SETUP ,0 ,0 ); -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_ENABLE ,0 ,0 ); - } +/* handled in dpms */ break ;case ENCODER_OBJECT_ID_INTERNAL_DDI :case ENCODER_OBJECT_ID_INTERNAL_DVO1 :
@@ -1922,14 +1922,6 @@ radeon_atom_encoder_mode_set(struct drm_break ; } -if (ext_encoder) { -if (ASIC_IS_DCE41 (rdev) ||ASIC_IS_DCE61 (rdev)) -atombios_external_encoder_setup (encoder, ext_encoder, -EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP ); -else -atombios_external_encoder_setup (encoder, ext_encoder,ATOM_ENABLE ); - } -atombios_apply_encoder_quirks (encoder, adjusted_mode);if (atombios_get_encoder_mode (encoder) ==ATOM_ENCODER_MODE_HDMI ) {
@@ -2102,7 +2094,6 @@ static void radeon_atom_encoder_prepare( }radeon_atom_output_lock (encoder, true); -radeon_atom_encoder_dpms (encoder,DRM_MODE_DPMS_OFF );if (connector) {struct radeon_connector *radeon_connector =to_radeon_connector (connector);
@@ -2123,6 +2114,7 @@ static void radeon_atom_encoder_prepare(static void radeon_atom_encoder_commit (struct drm_encoder *encoder) { +/* need to call this here as we need the crtc set up */ radeon_atom_encoder_dpms (encoder,DRM_MODE_DPMS_ON );radeon_atom_output_lock (encoder, false); }
@@ -2163,14 +2155,7 @@ static void radeon_atom_encoder_disable(case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 :case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 :case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA : -if (ASIC_IS_DCE4 (rdev)) -/* disable the transmitter */ -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); -else { -/* disable the encoder and transmitter */ -atombios_dig_transmitter_setup (encoder,ATOM_TRANSMITTER_ACTION_DISABLE ,0 ,0 ); -atombios_dig_encoder_setup (encoder,ATOM_DISABLE ,0 ); - } +/* handled in dpms */ break ;case ENCODER_OBJECT_ID_INTERNAL_DDI :case ENCODER_OBJECT_ID_INTERNAL_DVO1 :
Greg Kroah-Hartman
maintainerPATCH 156/218 drm/radeon/atom: powergating fixes for DCE6
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c205b232a64fed6d26edd7e40985b396de99a27f upstream.
Power gating is per crtc pair, but the powergating registers should be called individually. The hw handles power up/down properly. The pair is powered up if either crtc in the pair is powered up and the pair is not powered down until both crtcs in the pair are powered down. This simplifies programming and should save additional power as the previous code never actually power gated the crtc pair.
--- drivers/gpu/drm/radeon/atombios_crtc.c | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-)
drivers/gpu/drm/radeon/atombios_crtc.c +2 -20
@@ -258,7 +258,6 @@ void atombios_crtc_dpms(struct drm_crtc radeon_crtc->enabled = true;/* adjust pm to dpms changes BEFORE enabling crtcs */ radeon_pm_compute_clocks (rdev); -/* disable crtc pair power gating before programming */ if (ASIC_IS_DCE6 (rdev) && !radeon_crtc->in_mode_set)atombios_powergate_crtc (crtc,ATOM_DISABLE );atombios_enable_crtc (crtc,ATOM_ENABLE );
@@ -278,25 +277,8 @@ void atombios_crtc_dpms(struct drm_crtcatombios_enable_crtc_memreq (crtc,ATOM_DISABLE );atombios_enable_crtc (crtc,ATOM_DISABLE ); radeon_crtc->enabled = false; -/* power gating is per-pair */ -if (ASIC_IS_DCE6 (rdev) && !radeon_crtc->in_mode_set) { -struct drm_crtc *other_crtc; -struct radeon_crtc *other_radeon_crtc; -list_for_each_entry (other_crtc, &rdev->ddev->mode_config.crtc_list, head) { - other_radeon_crtc =to_radeon_crtc (other_crtc); -if (((radeon_crtc->crtc_id ==0 ) && (other_radeon_crtc->crtc_id ==1 )) || - ((radeon_crtc->crtc_id ==1 ) && (other_radeon_crtc->crtc_id ==0 )) || - ((radeon_crtc->crtc_id ==2 ) && (other_radeon_crtc->crtc_id ==3 )) || - ((radeon_crtc->crtc_id ==3 ) && (other_radeon_crtc->crtc_id ==2 )) || - ((radeon_crtc->crtc_id ==4 ) && (other_radeon_crtc->crtc_id ==5 )) || - ((radeon_crtc->crtc_id ==5 ) && (other_radeon_crtc->crtc_id ==4 ))) { -/* if both crtcs in the pair are off, enable power gating */ -if (other_radeon_crtc->enabled == false) -atombios_powergate_crtc (crtc,ATOM_ENABLE ); -break ; - } - } - } +if (ASIC_IS_DCE6 (rdev) && !radeon_crtc->in_mode_set) +atombios_powergate_crtc (crtc,ATOM_ENABLE );/* adjust pm to dpms changes AFTER disabling crtcs */ radeon_pm_compute_clocks (rdev);break ;
Greg Kroah-Hartman
maintainerPATCH 157/218 drm/i915: fix wrong order of parameters in port checking functions
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Xu, Anhua" <[email protected]>
commit b70ad586162609141f0aa9eb34790f31a8954f89 upstream.
Wrong order of parameters passed-in when calling hdmi/adpa /lvds_pipe_enabled(), 2nd and 3rd parameters are reversed.
This bug was indroduced by
commit 1519b9956eb4b4180fa3f47c73341463cdcfaa37
Author: Keith Packard <[email protected]> Date: Sat Aug 6 10:35:34 2011 -0700
drm/i915: Fix PCH port pipe select in CPT disable paths
The reachable tag for this commit is v3.1-rc1-3-g1519b99
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44876
--- drivers/gpu/drm/i915/intel_display.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/intel_display.c +6 -6
@@ -1099,7 +1099,7 @@ static void assert_pch_hdmi_disabled(str enum pipe pipe, int reg) {u32 val =I915_READ (reg); -WARN (hdmi_pipe_enabled (dev_priv, val, pipe), +WARN (hdmi_pipe_enabled (dev_priv, pipe, val),"PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n" , reg,pipe_name (pipe)); }
@@ -1116,13 +1116,13 @@ static void assert_pch_ports_disabled(st reg =PCH_ADPA ; val =I915_READ (reg); -WARN (adpa_pipe_enabled (dev_priv, val, pipe), +WARN (adpa_pipe_enabled (dev_priv, pipe, val),"PCH VGA enabled on transcoder %c, should be disabled\n" ,pipe_name (pipe)); reg =PCH_LVDS ; val =I915_READ (reg); -WARN (lvds_pipe_enabled (dev_priv, val, pipe), +WARN (lvds_pipe_enabled (dev_priv, pipe, val),"PCH LVDS enabled on transcoder %c, should be disabled\n" ,pipe_name (pipe));
@@ -1487,7 +1487,7 @@ static void disable_pch_hdmi(struct drm_ enum pipe pipe, int reg) {u32 val =I915_READ (reg); -if (hdmi_pipe_enabled (dev_priv, val, pipe)) { +if (hdmi_pipe_enabled (dev_priv, pipe, val)) {DRM_DEBUG_KMS ("Disabling pch HDMI %x on pipe %d\n" , reg, pipe);I915_WRITE (reg, val & ~PORT_ENABLE );
@@ -1509,12 +1509,12 @@ static void intel_disable_pch_ports(stru reg =PCH_ADPA ; val =I915_READ (reg); -if (adpa_pipe_enabled (dev_priv, val, pipe)) +if (adpa_pipe_enabled (dev_priv, pipe, val))I915_WRITE (reg, val & ~ADPA_DAC_ENABLE ); reg =PCH_LVDS ; val =I915_READ (reg); -if (lvds_pipe_enabled (dev_priv, val, pipe)) { +if (lvds_pipe_enabled (dev_priv, pipe, val)) {DRM_DEBUG_KMS ("disable lvds on pipe %d val 0x%08x\n" , pipe, val);I915_WRITE (reg, val & ~LVDS_PORT_EN );POSTING_READ (reg);
Greg Kroah-Hartman
maintainerPATCH 158/218 drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 7c3906d04a4587dceaa78cc1ae6b14e6454ee02a upstream.
Allows us to verify the table size.
--- drivers/gpu/drm/radeon/radeon_bios.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/radeon_bios.c +2 -4
@@ -554,13 +554,12 @@ static bool radeon_acpi_vfct_bios(struct {bool ret = false;struct acpi_table_header *hdr; -/* acpi_get_table_with_size is not exported :( */ -acpi_size tbl_size =0x7fffffff ; +acpi_size tbl_size;UEFI_ACPI_VFCT *vfct;GOP_VBIOS_CONTENT *vbios;VFCT_IMAGE_HEADER *vhdr; -if (!ACPI_SUCCESS (acpi_get_table ("VFCT" ,1 , &hdr))) +if (!ACPI_SUCCESS (acpi_get_table_with_size ("VFCT" ,1 , &hdr, &tbl_size)))return false;if (tbl_size <sizeof (UEFI_ACPI_VFCT )) {DRM_ERROR ("ACPI VFCT table present but broken (too short #1)\n" );
@@ -597,7 +596,6 @@ static bool radeon_acpi_vfct_bios(struct ret = !!rdev->bios; out_unmap: -/* uh, no idea what to do here... */ return ret; }#else
Greg Kroah-Hartman
maintainerPATCH 159/218 drm/radeon: dont disable plls that are in use by other crtcs
In reply to Greg Kroah-Hartman3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 4e58591c8961b3e31709313f75819f2eec06e322 upstream.
Some plls are shared for DP.
--- drivers/gpu/drm/radeon/atombios_crtc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/radeon/atombios_crtc.c +14 -0
@@ -1663,9 +1663,22 @@ static void atombios_crtc_disable(structstruct drm_device *dev = crtc->dev;struct radeon_device *rdev = dev->dev_private;struct radeon_atom_ss ss; +int i;atombios_crtc_dpms (crtc,DRM_MODE_DPMS_OFF ); +for (i =0 ; i < rdev->num_crtc; i++) { +if (rdev->mode_info.crtcs[i] && + rdev->mode_info.crtcs[i]->enabled && + i != radeon_crtc->crtc_id && + radeon_crtc->pll_id == rdev->mode_info.crtcs[i]->pll_id) { +/* one other crtc is using this pll don't turn +* off the pll +*/ + goto done; + } + } +switch (radeon_crtc->pll_id) {case ATOM_PPLL1 :case ATOM_PPLL2 :
@@ -1682,6 +1695,7 @@ static void atombios_crtc_disable(structdefault :break ; } +done: radeon_crtc->pll_id =-1 ; }