3.14.20-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 3.14.20-stable review
This is the start of the stable review cycle for the 3.14.20 release. There are 238 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Oct 5 21:28:26 UTC 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.14.20-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.14.20-rc1
Stephen Boyd <[email protected]>
clk: qcom: mdp_lut_clk is a child of mdp_src
Stephen Boyd <[email protected]>
clk: qcom: Fix MN frequency tables, parent map, and jpegd
Arnd Bergmann <[email protected]>
staging/lustre: disable virtual block device for 64K pages
Gu Zheng <[email protected]>
aio: block exit_aio() until all context requests are completed
Tero Kristo <[email protected]>
clk: prevent erronous parsing of children during rate change
Venkatesh Srinivas <[email protected]>
perf/x86/intel: Use rdmsrl_safe() when initializing RAPL PMU
Dan Carpenter <[email protected]>
partitions: aix.c: off by one bug
Andy Shevchenko <[email protected]>
dmaengine: dw: don't perform DMA when dmaengine_submit is called
Andy Shevchenko <[email protected]>
dmaengine: dw: introduce dwc_dostart_first_queued() helper
Heikki Krogerus <[email protected]>
serial: 8250_dma: check the result of TX buffer mapping
Rafael J. Wysocki <[email protected]>
PM / sleep: Use valid_state() for platform-dependent sleep states only
Rafael J. Wysocki <[email protected]>
PM / sleep: Add state field to pm_states[] entries
Julian Anastasov <[email protected]>
ipvs: fix ipv6 hook registration for local replies
Daniel Borkmann <[email protected]>
netfilter: x_tables: allow to use default cgroup match
Alex Gartrell <[email protected]>
ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding
Eric Dumazet <[email protected]>
netfilter: xt_hashlimit: perform garbage collection from process context
Julian Anastasov <[email protected]>
ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack
NeilBrown <[email protected]>
md/raid1: intialise start_next_window for READ case to avoid hang
NeilBrown <[email protected]>
md/raid1: fix_read_error should act on all non-faulty devices.
NeilBrown <[email protected]>
md/raid1: count resync requests in nr_pending.
NeilBrown <[email protected]>
md/raid1: update next_resync under resync_lock.
NeilBrown <[email protected]>
md/raid1: Don't use next_resync to determine how far resync has progressed
NeilBrown <[email protected]>
md/raid1: make sure resync waits for conflicting writes to complete.
NeilBrown <[email protected]>
md/raid1: be more cautious where we read-balance during resync.
NeilBrown <[email protected]>
md/raid1: clean up request counts properly in close_sync()
Hans Verkuil <[email protected]>
media: adv7604: fix inverted condition
Hans Verkuil <[email protected]>
media: cx18: fix kernel oops with tda8290 tuner
Malcolm Priestley <[email protected]>
media: af9035: new IDs: add support for PCTV 78e and PCTV 79e
Prarit Bhargava <[email protected]>
cpufreq: release policy->rwsem on error
Johannes Berg <[email protected]>
nl80211: clear skb cb before passing to netlink
Anton Altaparmakov <[email protected]>
Fix nasty 32-bit overflow bug in buffer i/o code.
Alex Deucher <[email protected]>
drm/radeon/px: fix module unload
Alex Deucher <[email protected]>
drm/nouveau/runpm: fix module unload
Alex Deucher <[email protected]>
vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops
Cong Wang <[email protected]>
perf: Fix a race condition in perf_remove_from_context()
Matan Barak <[email protected]>
IB/core: When marshaling uverbs path, clear unused fields
Moni Shoua <[email protected]>
IB/mlx4: Don't duplicate the default RoCE GID
Moni Shoua <[email protected]>
IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
Mike Marciniszyn <[email protected]>
IB/qib: Correct reference counting in debugfs qp_stats
Al Viro <[email protected]>
GFS2: fix d_splice_alias() misuses
Richard Larocque <[email protected]>
alarmtimer: Lock k_itimer during timer callback
Richard Larocque <[email protected]>
alarmtimer: Do not signal SIGEV_NONE timers
Richard Larocque <[email protected]>
alarmtimer: Return relative times in timer_gettime
John David Anglin <[email protected]>
parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
Guy Martin <[email protected]>
parisc: Implement new LWS CAS supporting 64 bit operations.
Al Viro <[email protected]>
don't bugger nd->seq on set_root_rcu() from follow_dotdot_rcu()
Michael Ellerman <[email protected]>
powerpc: Add smp_mb()s to arch_spin_unlock_wait()
Michael Ellerman <[email protected]>
powerpc: Add smp_mb() to arch_spin_is_locked()
Anton Blanchard <[email protected]>
powerpc/perf: Fix ABIv2 kernel backtraces
Arend van Spriel <[email protected]>
brcmfmac: handle IF event for P2P_DEVICE interface
Wanpeng Li <[email protected]>
sched: Fix unreleased llc_shared_mask bit during CPU hotplug
Peter Feiner <[email protected]>
mm: softdirty: keep bit when zapping file pte
David Rientjes <[email protected]>
mm, slab: initialize object alignment on cache creation
Joseph Qi <[email protected]>
ocfs2/dlm: do not get resource spinlock if lockres is new
Andreas Rohner <[email protected]>
nilfs2: fix data loss with mmap()
Andrey Vagin <[email protected]>
fs/notify: don't show f_handle if exportfs_encode_inode_fh failed
Andrey Vagin <[email protected]>
fsnotify/fdinfo: use named constants instead of hardcoded values
Rasmus Villemoes <[email protected]>
kcmp: fix standard comparison bug
Nicolas Iooss <[email protected]>
eventpoll: fix uninitialized variable in epoll_ctl
Johannes Berg <[email protected]>
Revert "mac80211: disable uAPSD if all ACs are under ACM"
Felipe Balbi <[email protected]>
usb: dwc3: core: fix ordering for PHY suspend
Felipe Balbi <[email protected]>
usb: dwc3: core: fix order of PM runtime calls
Jens Axboe <[email protected]>
genhd: fix leftover might_sleep() in blk_free_devt()
Trond Myklebust <[email protected]>
lockdep: Revert lockdep check in raw_seqcount_begin()
J. Bruce Fields <[email protected]>
lockd: fix rpcbind crash on lockd startup failure
Larry Finger <[email protected]>
rtlwifi: rtl8192cu: Add new ID
Eliad Peller <[email protected]>
regulatory: add NUL to alpha2
Tejun Heo <[email protected]>
percpu: perform tlb flush after pcpu_map_pages() failure
Tejun Heo <[email protected]>
percpu: fix pcpu_alloc_pages() failure path
Honggang Li <[email protected]>
percpu: free percpu allocation info for uniprocessor system
James Ralston <[email protected]>
ata_piix: Add Device IDs for Intel 9 Series PCH
Robert Coulson <[email protected]>
hwmon: (ds1621) Update zbits after conversion rate change
Hans de Goede <[email protected]>
Input: i8042 - add nomux quirk for Avatar AVIU-145A6
Hans de Goede <[email protected]>
Input: i8042 - add Fujitsu U574 to no_timeout dmi table
Dmitry Torokhov <[email protected]>
Input: atkbd - do not try 'deactivate' keyboard on any LG laptops
Hans de Goede <[email protected]>
Input: elantech - fix detection of touchpad on ASUS s301l
Dmitry Torokhov <[email protected]>
Input: synaptics - add support for ForcePads
John Sung <[email protected]>
Input: serport - add compat handling for SPIOCSTYPE ioctl
Mikulas Patocka <[email protected]>
dm crypt: fix access beyond the end of allocated space
Anssi Hannula <[email protected]>
dm cache: fix race causing dirty blocks to be marked as clean
Keith Busch <[email protected]>
block: Fix dev_t minor allocation lifetime
Thomas Gleixner <[email protected]>
futex: Unlock hb->lock in futex_wait_requeue_pi() error path
Tejun Heo <[email protected]>
workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
Eyal Shapira <[email protected]>
iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate
Eliad Peller <[email protected]>
iwlwifi: increase DEFAULT_MAX_TX_POWER
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix endianity issues with Smart Fifo commands
Emmanuel Grumbach <[email protected]>
Revert "iwlwifi: dvm: don't enable CTS to self"
Mike Christie <[email protected]>
SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
Dan Carpenter <[email protected]>
NFC: microread: Potential overflows in microread_target_discovered()
Nicholas Bellinger <[email protected]>
iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
Joern Engel <[email protected]>
iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
Sebastian Herbszt <[email protected]>
target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE
Sagi Grimberg <[email protected]>
Target/iser: Don't put isert_conn inside disconnected handler
Sagi Grimberg <[email protected]>
Target/iser: Get isert_conn reference once got to connected_handler
Johannes Pointner <[email protected]>
iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
Denis CIOCCA <[email protected]>
iio:magnetometer: bugfix magnetometers gain values
Srinivas Pandruvada <[email protected]>
iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: st_sensors: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: meter: ade7758: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: inv_mpu6050: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: gyro: itg3200: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: hid_sensor_hub: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: accel: bma180: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio:trigger: modify return value for iio_trigger_get
Steve French <[email protected]>
SMB3: Fix oops when creating symlinks on smb3
Peter Ujfalusi <[email protected]>
ASoC: davinci-mcasp: Correct rx format unit configuration
Miklos Szeredi <[email protected]>
shmem: fix nlink for rename overwrite directory
Kees Cook <[email protected]>
x86/kaslr: Avoid the setup_data area when picking location
Dave Young <[email protected]>
x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
Stefan Bader <[email protected]>
x86/xen: don't copy bogus duplicate entries into kernel page tables
Ross Lagerwall <[email protected]>
xen/manage: Always freeze/thaw processes when suspend/resuming
Christian Borntraeger <[email protected]>
KVM: s390/mm: try a cow on read only pages for key ops
Zefan Li <[email protected]>
cgroup: fix unbalanced locking
Mark Brown <[email protected]>
regmap: Don't attempt block writes when syncing cache on single_rw devices
Mark Brown <[email protected]>
regmap: Fix handling of volatile registers for format_write() chips
Tang Chen <[email protected]>
memblock, memhotplug: fix wrong type in memblock_find_in_range_node().
Mika Westerberg <[email protected]>
ACPI / scan: Correct error return value of create_modalias()
Rafael J. Wysocki <[email protected]>
ACPI / hotplug: Generate online uevents for ACPI containers
Bob Moore <[email protected]>
ACPICA: Update to GPIO region handler interface.
Markos Chandras <[email protected]>
MIPS: mcount: Adjust stack pointer for static trace in MIPS32
Aurelien Jarno <[email protected]>
MIPS: ZBOOT: add missing <linux/string.h> include
Nathan Lynch <[email protected]>
ARM: 8178/1: fix set_tls for !CONFIG_KUSER_HELPERS
Robin Murphy <[email protected]>
ARM: 8165/1: alignment: don't break misaligned NEON load/store
Nathan Lynch <[email protected]>
ARM: 8148/1: flush TLS and thumbee register state during exec
Sudeep Holla <[email protected]>
ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
Nishanth Menon <[email protected]>
ARM: dts: dra7-evm: Fix spi1 mux documentation
Nishanth Menon <[email protected]>
ARM: dts: DRA7: fix interrupt-cells for GPIO
Rajendra Nayak <[email protected]>
ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
Mark Rutland <[email protected]>
ARM: 8128/1: abort: don't clear the exclusive monitors
Andy Shevchenko <[email protected]>
spi: dw-pci: fix bug when regs left uninitialized
Jorge A. Ventura <[email protected]>
spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
Trond Myklebust <[email protected]>
NFSv4: Fix another bug in the close/open_downgrade code
Steve Dickson <[email protected]>
NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
Olav Haugan <[email protected]>
iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1
Varun Sethi <[email protected]>
iommu/fsl: Fix warning resulting from adding PCI device twice
Lee, Chun-Yi <[email protected]>
ACPI / RTC: Fix CMOS RTC opregion handler accesses to wrong addresses
Felipe Balbi <[email protected]>
usb: dwc3: omap: fix ordering for runtime pm calls
Alan Stern <[email protected]>
USB: EHCI: unlink QHs even after the controller has stopped
Mark <[email protected]>
USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
Mark <[email protected]>
USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
Mark <[email protected]>
USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
Mark <[email protected]>
storage: Add single-LUN quirk for Jaz USB Adapter
Joe Lawrence <[email protected]>
usb: hub: take hub->hdev reference when processing from eventlist
Mathias Nyman <[email protected]>
xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
Mathias Nyman <[email protected]>
xhci: Fix null pointer dereference if xhci initialization fails
Felipe Balbi <[email protected]>
usb: host: xhci: fix compliance mode workaround
Thomas Pugliese <[email protected]>
uwb: init beacon cache entry before registering uwb device
Johan Hovold <[email protected]>
USB: zte_ev: fix removed PIDs
Johan Hovold <[email protected]>
USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
Taylor Braun-Jones <[email protected]>
USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device
Ivan T. Ivanov <[email protected]>
usb: chipidea: msm: Initialize PHY on reset event
Ivan T. Ivanov <[email protected]>
usb: chipidea: msm: Use USB PHY API to control PHY state
Tony Lindgren <[email protected]>
usb: phy: twl4030-usb: Fix regressions to runtime PM on omaps
Tony Lindgren <[email protected]>
usb: phy: twl4030-usb: Fix lost interrupts after ID pin goes down
Thierry Reding <[email protected]>
usb: phy: tegra: Avoid use of sizeof(void)
Bjørn Mork <[email protected]>
USB: sierra: add 1199:68AA device ID
Bjørn Mork <[email protected]>
USB: sierra: avoid CDC class functions on "68A3" devices
Karol Lewandowski <[email protected]>
usb: gadget: f_fs: drop duplicate usb_functionfs_descs_head declaration
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Qualcom PID
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Gobi PID
Johan Hovold <[email protected]>
Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
Brennan Ashton <[email protected]>
USB: option: add VIA Telecom CDS7 chipset device id
Johan Hovold <[email protected]>
USB: option: reduce interrupt-urb logging verbosity
Johan Hovold <[email protected]>
USB: serial: fix potential heap buffer overflow
Stephen Hemminger <[email protected]>
USB: sisusb: add device id for Magic Control USB video
Johan Hovold <[email protected]>
USB: serial: fix potential stack buffer overflow
Greg KH <[email protected]>
USB: serial: pl2303: add device id for ztek device
Max Filippov <[email protected]>
xtensa: fix a6 and a7 handling in fast_syscall_xtensa
Max Filippov <[email protected]>
xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
Max Filippov <[email protected]>
xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
Alan Douglas <[email protected]>
xtensa: fix address checks in dma_{alloc,free}_coherent
Max Filippov <[email protected]>
xtensa: replace IOCTL code definitions with constants
Alex Deucher <[email protected]>
drm/radeon/cik: use a separate counter for CP init timeout
Alex Deucher <[email protected]>
drm/radeon: don't reset dma on r6xx-evergreen init
Alex Deucher <[email protected]>
drm/radeon: don't reset sdma on CIK init
Alex Deucher <[email protected]>
drm/radeon: don't reset dma on NI/SI init
Alex Deucher <[email protected]>
drm/radeon: add connector quirk for fujitsu board
Alex Deucher <[email protected]>
drm/radeon/dpm: set the thermal type properly for special configs
Christian König <[email protected]>
drm/radeon: fix semaphore value init
Alex Deucher <[email protected]>
drm/radeon: fix pm handling in radeon_gpu_reset
Oleg Chernovskiy <[email protected]>
drm/radeon: Add missing lines to ci_set_thermal_temperature_range
Pali Rohár <[email protected]>
drm/radeon: Add ability to get and change dpm state when radeon PX card is turned off
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
Russell King <[email protected]>
imx-drm: ipuv3-plane: fix ipu_plane_dpms()
Y.C. Chen <[email protected]>
drm/ast: AST2000 cannot be detected correctly
Ville Syrjälä <[email protected]>
drm/i915: Wait for vblank before enabling the TV encoder
Daniel Vetter <[email protected]>
drm/i915: Fix EIO/wedged handling in gem fault handler
Mathias Krause <[email protected]>
drm/i915: Remove bogus __init annotation from DMI callbacks
Filipe Brandenburger <[email protected]>
xattr: fix check for simultaneous glibc header inclusion
Benjamin Tissoires <[email protected]>
HID: logitech-dj: prevent false errors to be shown
Jiri Kosina <[email protected]>
HID: magicmouse: sanity check report size in raw_event() callback
Jiri Kosina <[email protected]>
HID: picolcd: sanity check report size in raw_event() callback
Toshiaki Makita <[email protected]>
cfq-iosched: Fix wrong children_weight calculation
Clemens Ladisch <[email protected]>
ALSA: pcm: fix fifo_size frame calculation
Takashi Iwai <[email protected]>
ALSA: hda - Fix invalid pin powermap without jack detection
Takashi Iwai <[email protected]>
ALSA: hda - Fix COEF setups for ALC1150 codec
Takashi Iwai <[email protected]>
ALSA: hda - Fix digital mic on Acer Aspire 3830TG
Clemens Ladisch <[email protected]>
ALSA: core: fix buffer overflow in snd_info_get_line()
Will Deacon <[email protected]>
arm64: ptrace: fix compat hardware watchpoint reporting
Josef Bacik <[email protected]>
trace: Fix epoll hang when we race with new entries
Fan Du <[email protected]>
i2c: ismt: use correct length when copy buffer
Simon Lindgren <[email protected]>
i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
Marek Roszko <[email protected]>
i2c: at91: add bound checking on SMBus block length bytes
Chen-Yu Tsai <[email protected]>
i2c: mv64xxx: continue probe when clock-frequency is missing
Pranavkumar Sawargaonkar <[email protected]>
ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU
Christoffer Dall <[email protected]>
arm/arm64: KVM: Complete WFI/WFE instructions
Sudeep Holla <[email protected]>
arm64: use irq_set_affinity with force=false when migrating irqs
Will Deacon <[email protected]>
arm64: flush TLS registers during exec
Jeff Moyer <[email protected]>
aio: add missing smp_rmb() in read_events_ring
Benjamin LaHaise <[email protected]>
aio: fix reqs_available handling
Anton Blanchard <[email protected]>
ibmveth: Fix endian issues with rx_no_buffer statistic
Murali Karicheri <[email protected]>
ahci: add pcid for Marvel 0x9182 controller
James Ralston <[email protected]>
ahci: Add Device IDs for Intel 9 Series PCH
Arjun Sreedharan <[email protected]>
pata_scc: propagate return value of scc_wait_after_reset
Tejun Heo <[email protected]>
libata: widen Crucial M550 blacklist matching
Florian Fainelli <[email protected]>
of/irq: Fix lookup to use 'interrupts-extended' property first
Alex Deucher <[email protected]>
drm/radeon/TN: only enable bapm on MSI systems
Alex Deucher <[email protected]>
drm/radeon: enable bapm by default on desktop TN/RL boards
Jiri Kosina <[email protected]>
drm/i915: read HEAD register back in init_ring_common() to enforce ordering
Alex Deucher <[email protected]>
drm/radeon: tweak ACCEL_WORKING2 query for hawaii
Alex Deucher <[email protected]>
drm/radeon/atom: add new voltage fetch function for hawaii
Christian König <[email protected]>
drm/radeon: set VM base addr using the PFP v2
Alex Deucher <[email protected]>
drm/radeon: load the lm63 driver for an lm64 thermal chip.
Alex Deucher <[email protected]>
drm/radeon: re-enable dpm by default on BTC
Alex Deucher <[email protected]>
drm/radeon: re-enable dpm by default on cayman
Alex Deucher <[email protected]>
drm/radeon/dpm: handle voltage info fetching on hawaii
Tetsuo Handa <[email protected]>
drm/ttm: Pass GFP flags in order to avoid deadlock.
Tetsuo Handa <[email protected]>
drm/ttm: Fix possible stack overflow by recursive shrinker calls.
Tetsuo Handa <[email protected]>
drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
Tetsuo Handa <[email protected]>
drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
Tetsuo Handa <[email protected]>
drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
Guido Martínez <[email protected]>
drm/tilcdc: fix double kfree
Guido Martínez <[email protected]>
drm/tilcdc: fix release order on exit
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix leak when unloading the module
Guido Martínez <[email protected]>
drm/tilcdc: tfp410: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: slave: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix dangling sysfs connector node
Ronald Wahl <[email protected]>
carl9170: fix sending URBs with wrong type when using full-speed
-------------
Diffstat:
.../bindings/interrupt-controller/interrupts.txt | 12 +- Makefile | 4 +- arch/arm/boot/dts/dra7-evm.dts | 14 +- arch/arm/boot/dts/dra7.dtsi | 16 +- arch/arm/include/asm/tls.h | 64 ++++++ arch/arm/kernel/irq.c | 2 +- arch/arm/kernel/process.c | 2 + arch/arm/kernel/thumbee.c | 2 +- arch/arm/kernel/traps.c | 17 +- arch/arm/kvm/handle_exit.c | 2 + arch/arm/kvm/init.S | 4 + arch/arm/mach-omap2/omap_hwmod.c | 3 + arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 22 +- arch/arm/mm/abort-ev6.S | 6 - arch/arm/mm/abort-ev7.S | 6 - arch/arm/mm/alignment.c | 3 + arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/kernel/irq.c | 12 +- arch/arm64/kernel/process.c | 18 ++ arch/arm64/kernel/ptrace.c | 3 +- arch/arm64/kernel/sys_compat.c | 6 + arch/arm64/kvm/handle_exit.c | 2 + arch/arm64/kvm/hyp-init.S | 4 + arch/mips/boot/compressed/decompress.c | 1 + arch/mips/kernel/mcount.S | 12 ++ arch/parisc/Makefile | 7 +- arch/parisc/kernel/syscall.S | 233 ++++++++++++++++++++- arch/powerpc/include/asm/ptrace.h | 7 + arch/powerpc/include/asm/spinlock.h | 1 + arch/powerpc/lib/locks.c | 4 + arch/powerpc/perf/callchain.c | 2 +- arch/s390/mm/pgtable.c | 10 + arch/x86/boot/compressed/aslr.c | 15 ++ arch/x86/include/asm/fixmap.h | 6 +- arch/x86/include/asm/pgtable_64.h | 1 + arch/x86/kernel/cpu/perf_event_intel_rapl.c | 12 +- arch/x86/kernel/smpboot.c | 3 + arch/x86/xen/mmu.c | 27 ++- arch/xtensa/include/asm/pgtable.h | 7 +- arch/xtensa/include/asm/uaccess.h | 5 + arch/xtensa/include/uapi/asm/ioctls.h | 19 +- arch/xtensa/kernel/entry.S | 26 +-- arch/xtensa/kernel/pci-dma.c | 12 +- block/cfq-iosched.c | 11 +- block/genhd.c | 26 +-- block/partition-generic.c | 2 +- block/partitions/aix.c | 2 +- drivers/acpi/acpi_cmos_rtc.c | 2 +- drivers/acpi/acpica/aclocal.h | 1 + drivers/acpi/acpica/acobject.h | 1 + drivers/acpi/acpica/dsfield.c | 2 + drivers/acpi/acpica/evregion.c | 47 +++-- drivers/acpi/acpica/exfield.c | 67 ++++++ drivers/acpi/acpica/exprep.c | 2 + drivers/acpi/container.c | 8 + drivers/acpi/scan.c | 5 +- drivers/ata/ahci.c | 10 + drivers/ata/ata_piix.c | 8 + drivers/ata/libata-core.c | 2 +- drivers/ata/pata_scc.c | 15 +- drivers/base/regmap/regcache.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/clk/clk.c | 7 +- drivers/clk/qcom/mmcc-msm8960.c | 84 ++++---- drivers/cpufreq/cpufreq.c | 2 + drivers/dma/TODO | 1 - drivers/dma/dw/core.c | 38 ++-- drivers/gpu/drm/ast/ast_main.c | 2 +- drivers/gpu/drm/i915/i915_gem.c | 11 +- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 + drivers/gpu/drm/i915/intel_tv.c | 4 + drivers/gpu/drm/nouveau/nouveau_vga.c | 9 + drivers/gpu/drm/radeon/ci_dpm.c | 16 +- drivers/gpu/drm/radeon/cik.c | 9 +- drivers/gpu/drm/radeon/cik_sdma.c | 7 - drivers/gpu/drm/radeon/ni_dma.c | 6 - drivers/gpu/drm/radeon/r600_dma.c | 9 - drivers/gpu/drm/radeon/radeon.h | 3 + drivers/gpu/drm/radeon/radeon_atombios.c | 72 ++++++- drivers/gpu/drm/radeon/radeon_device.c | 29 ++- drivers/gpu/drm/radeon/radeon_kms.c | 9 +- drivers/gpu/drm/radeon/radeon_pm.c | 24 +-- drivers/gpu/drm/radeon/radeon_semaphore.c | 2 +- drivers/gpu/drm/radeon/si.c | 2 +- drivers/gpu/drm/radeon/trinity_dpm.c | 11 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 7 +- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 5 +- drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 + drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 + drivers/gpu/drm/ttm/ttm_page_alloc.c | 29 +-- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 34 +-- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 +- drivers/gpu/vga/vga_switcheroo.c | 6 + drivers/hid/hid-logitech-dj.c | 43 ++-- drivers/hid/hid-logitech-dj.h | 1 + drivers/hid/hid-magicmouse.c | 10 + drivers/hid/hid-picolcd_core.c | 6 + drivers/hwmon/ds1621.c | 1 + drivers/i2c/busses/i2c-at91.c | 32 ++- drivers/i2c/busses/i2c-ismt.c | 4 +- drivers/i2c/busses/i2c-mv64xxx.c | 3 +- drivers/iio/accel/bma180.c | 2 +- drivers/iio/adc/ad_sigma_delta.c | 2 +- .../iio/common/hid-sensors/hid-sensor-trigger.c | 3 +- drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +- drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/magnetometer/st_magn_core.c | 52 +++-- drivers/infiniband/core/uverbs_marshall.c | 4 + drivers/infiniband/hw/mlx4/main.c | 53 +++-- drivers/infiniband/hw/qib/qib_debugfs.c | 3 +- drivers/infiniband/hw/qib/qib_qp.c | 8 - drivers/infiniband/ulp/isert/ib_isert.c | 7 +- drivers/input/keyboard/atkbd.c | 8 - drivers/input/mouse/elantech.c | 7 + drivers/input/mouse/synaptics.c | 68 ++++-- drivers/input/mouse/synaptics.h | 11 + drivers/input/serio/i8042-x86ia64io.h | 15 ++ drivers/input/serio/serport.c | 45 +++- drivers/iommu/arm-smmu.c | 7 +- drivers/iommu/fsl_pamu_domain.c | 10 +- drivers/md/dm-cache-target.c | 4 +- drivers/md/dm-crypt.c | 20 +- drivers/md/raid1.c | 40 ++-- drivers/media/dvb-core/dvb-usb-ids.h | 2 + drivers/media/i2c/adv7604.c | 2 +- drivers/media/pci/cx18/cx18-driver.c | 1 + drivers/media/usb/dvb-usb-v2/af9035.c | 4 + drivers/net/ethernet/ibm/ibmveth.c | 18 +- drivers/net/wireless/ath/carl9170/carl9170.h | 1 + drivers/net/wireless/ath/carl9170/usb.c | 31 ++- drivers/net/wireless/brcm80211/brcmfmac/fweh.c | 12 +- drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 2 + drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++ drivers/net/wireless/iwlwifi/iwl-config.h | 2 + drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 4 +- drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 +- drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 8 +- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + drivers/nfc/microread/microread.c | 16 +- drivers/of/irq.c | 17 +- drivers/phy/phy-twl4030-usb.c | 121 ++++++----- drivers/scsi/libiscsi.c | 10 + drivers/spi/spi-dw-pci.c | 2 + drivers/spi/spi-omap2-mcspi.c | 3 +- drivers/staging/iio/meter/ade7758_trigger.c | 2 +- drivers/staging/imx-drm/ipuv3-plane.c | 3 +- drivers/staging/lustre/lustre/Kconfig | 1 + drivers/target/iscsi/iscsi_target.c | 4 +- drivers/target/iscsi/iscsi_target_parameters.c | 2 +- drivers/target/target_core_configfs.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 17 +- drivers/usb/chipidea/ci_hdrc_msm.c | 7 +- drivers/usb/core/hub.c | 4 +- drivers/usb/dwc3/core.c | 13 +- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 - drivers/usb/host/xhci-hub.c | 8 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 12 +- drivers/usb/misc/sisusbvga/sisusb.c | 1 + drivers/usb/phy/phy-tegra-usb.c | 4 +- drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 12 ++ drivers/usb/serial/option.c | 31 ++- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/sierra.c | 9 +- drivers/usb/serial/usb-serial.c | 37 +++- drivers/usb/serial/zte_ev.c | 24 +-- drivers/usb/storage/unusual_devs.h | 38 ++++ drivers/uwb/lc-dev.c | 13 +- drivers/xen/manage.c | 7 - fs/aio.c | 91 +++++++- fs/buffer.c | 6 +- fs/cifs/link.c | 8 +- fs/eventpoll.c | 3 +- fs/gfs2/inode.c | 5 +- fs/lockd/svc.c | 4 +- fs/namei.c | 33 +-- fs/nfs/nfs4client.c | 38 ++-- fs/nfs/nfs4proc.c | 30 +-- fs/nilfs2/inode.c | 7 +- fs/notify/fdinfo.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 18 +- include/acpi/acpi_bus.h | 1 + include/linux/iio/trigger.h | 4 +- include/linux/seqlock.h | 2 - include/linux/vga_switcheroo.h | 2 + include/linux/workqueue.h | 2 +- include/net/regulatory.h | 2 +- include/uapi/linux/usb/functionfs.h | 10 +- include/uapi/linux/xattr.h | 2 +- kernel/cgroup.c | 1 - kernel/events/core.c | 10 + kernel/futex.c | 1 + kernel/kcmp.c | 7 +- kernel/power/main.c | 21 +- kernel/power/power.h | 9 +- kernel/power/suspend.c | 66 +++--- kernel/power/suspend_test.c | 24 +-- kernel/time/alarmtimer.c | 34 ++- kernel/trace/ring_buffer.c | 16 +- mm/memblock.c | 3 +- mm/memory.c | 2 +- mm/percpu-vm.c | 22 +- mm/percpu.c | 2 + mm/shmem.c | 4 +- mm/slab.c | 11 +- net/mac80211/mlme.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 1 - net/netfilter/ipvs/ip_vs_core.c | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/xt_cgroup.c | 2 +- net/netfilter/xt_hashlimit.c | 31 +-- net/wireless/nl80211.c | 6 + sound/core/info.c | 4 +- sound/core/pcm_lib.c | 8 +- sound/pci/hda/patch_conexant.c | 9 +- sound/pci/hda/patch_realtek.c | 2 + sound/pci/hda/patch_sigmatel.c | 17 +- sound/soc/davinci/davinci-mcasp.c | 11 +- 227 files changed, 2066 insertions(+), 853 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/238 carl9170: fix sending URBs with wrong type when using full-speed
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
The driver assumes that endpoint 4 is always an interrupt endpoint. Unfortunately the type differs between high-speed and full-speed configurations while in the former case it is indeed an interrupt endpoint this is not true for the latter case - here it is a bulk endpoint. When sending URBs with the wrong type the kernel will generate a warning message including backtrace. In this specific case there will be a huge amount of warnings which can bring the system to freeze.
To fix this we are now sending URBs to endpoint 4 using the type found in the endpoint descriptor.
A side note: The carl9170 firmware currently specifies endpoint 4 as interrupt endpoint even in the full-speed configuration but this has no relevance because before this firmware is loaded the endpoint type is as described above and after the firmware is running the stick is not reenumerated and so the old descriptor is used.
--- drivers/net/wireless/ath/carl9170/carl9170.h | 1 drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/carl9170/carl9170.h +1 -0
@@ -256,6 +256,7 @@ struct ar9170 {atomic_t rx_work_urbs;atomic_t rx_pool_urbs;kernel_ulong_t features; +bool usb_ep_cmd_is_bulk;/* firmware settings */ struct completion fw_load_wait;
drivers/net/wireless/ath/carl9170/usb.c +27 -4
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a goto err_free; } -usb_fill_int_urb (urb, ar->udev,usb_sndintpipe (ar->udev, -AR9170_USB_EP_CMD ), cmd, cmd->hdr.len +4 , - carl9170_usb_cmd_complete, ar,1 ); +if (ar->usb_ep_cmd_is_bulk) +usb_fill_bulk_urb (urb, ar->udev, +usb_sndbulkpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar); +else +usb_fill_int_urb (urb, ar->udev, +usb_sndintpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar,1 );if (free_buf) urb->transfer_flags |=URB_FREE_BUFFER ;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(static int carl9170_usb_probe (struct usb_interface *intf,const struct usb_device_id *id) { +struct usb_endpoint_descriptor *ep;struct ar9170 *ar;struct usb_device *udev; -int err; +int i, err; err =usb_reset_device (interface_to_usbdev (intf));if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb ar->intf = intf; ar->features = id->driver_info; +/* We need to remember the type of endpoint 4 because it differs +* between high- and full-speed configuration. The high-speed +* configuration specifies it as interrupt and the full-speed +* configuration as bulk endpoint. This information is required +* later when sending urbs to that endpoint. +*/ +for (i =0 ; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) { + ep = &intf->cur_altsetting->endpoint[i].desc; + +if (usb_endpoint_num (ep) ==AR9170_USB_EP_CMD && +usb_endpoint_dir_out (ep) && +usb_endpoint_type (ep) ==USB_ENDPOINT_XFER_BULK ) + ar->usb_ep_cmd_is_bulk = true; + } +usb_set_intfdata (intf, ar);SET_IEEE80211_DEV (ar->hw, &intf->dev);
Greg Kroah-Hartman
maintainerPATCH 8/238 drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
list_empty(&_manager->pools) being false before taking _manager->lock does not guarantee that _manager->npools != 0 after taking _manager->lock because _manager->npools is updated under _manager->lock.
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -0
@@ -1015,6 +1015,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerreturn SHRINK_STOP ;mutex_lock (&_manager->lock); +if (!_manager->npools) + goto out; pool_offset = pool_offset % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
@@ -1034,6 +1036,7 @@ ttm_dma_pool_shrink_scan(struct shrinker p->pool->dev_name, p->pool->name, current->pid, nr_free, shrink_pages); } +out:mutex_unlock (&_manager->lock);return freed; }
Greg Kroah-Hartman
maintainerPATCH 9/238 drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
We can use "unsigned int" instead of "atomic_t" by updating start_pool variable under _manager->lock. This patch will make it possible to avoid skipping when choosing a pool to shrink in round-robin style, after next patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -3
@@ -1004,9 +1004,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);static unsigned long ttm_dma_pool_shrink_scan (struct shrinker *shrink,struct shrink_control *sc) { -static atomic_t start_pool =ATOMIC_INIT (0 ); +static unsigned start_pool;unsigned idx =0 ; -unsigned pool_offset =atomic_add_return (1 , &start_pool); +unsigned pool_offset;unsigned shrink_pages = sc->nr_to_scan;struct device_pools *p;unsigned long freed =0 ;
@@ -1017,7 +1017,7 @@ ttm_dma_pool_shrink_scan(struct shrinkermutex_lock (&_manager->lock);if (!_manager->npools) goto out; - pool_offset = pool_offset % _manager->npools; + pool_offset = ++start_pool % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
Greg Kroah-Hartman
maintainerPATCH 10/238 drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 22e71691fd54c637800d10816bbeba9cf132d218 upstream.
I can observe that RHEL7 environment stalls with 100% CPU usage when a certain type of memory pressure is given. While the shrinker functions are called by shrink_slab() before the OOM killer is triggered, the stall lasts for many minutes.
One of reasons of this stall is that ttm_dma_pool_shrink_count()/ttm_dma_pool_shrink_scan() are called and are blocked at mutex_lock(&_manager->lock). GFP_KERNEL allocation with _manager->lock held causes someone (including kswapd) to deadlock when these functions are called due to memory pressure. This patch changes "mutex_lock();" to "if (!mutex_trylock()) return ...;" in order to avoid deadlock.
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +4 -2
@@ -1014,7 +1014,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerif (list_empty (&_manager->pools))return SHRINK_STOP ; -mutex_lock (&_manager->lock); +if (!mutex_trylock (&_manager->lock)) +return SHRINK_STOP ;if (!_manager->npools) goto out; pool_offset = ++start_pool % _manager->npools;
@@ -1047,7 +1048,8 @@ ttm_dma_pool_shrink_count(struct shrinkestruct device_pools *p;unsigned long count =0 ; -mutex_lock (&_manager->lock); +if (!mutex_trylock (&_manager->lock)) +return 0 ;list_for_each_entry (p, &_manager->pools, pools) count += p->pool->npages_free;mutex_unlock (&_manager->lock);
Greg Kroah-Hartman
maintainerPATCH 12/238 drm/ttm: Pass GFP flags in order to avoid deadlock.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit a91576d7916f6cce76d30303e60e1ac47cf4a76d upstream.
Commit 7dc19d5a "drivers: convert shrinkers to new count/scan API" added deadlock warnings that ttm_page_pool_free() and ttm_dma_page_pool_free() are currently doing GFP_KERNEL allocation.
But these functions did not get updated to receive gfp_t argument. This patch explicitly passes sc->gfp_mask or GFP_KERNEL to these functions, and removes the deadlock warning.
--- drivers/gpu/drm/ttm/ttm_page_alloc.c | 19 ++++++++++--------- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 19 +++++++++---------- 2 files changed, 19 insertions(+), 19 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc.c +10 -9
@@ -297,8 +297,10 @@ static void ttm_pool_update_free_locked(* * @pool: to free the pages from * @free_all: If set to true will free all pages in pool +* @gfp: GFP flags. **/ -static int ttm_page_pool_free (struct ttm_page_pool *pool,unsigned nr_free) +static int ttm_page_pool_free (struct ttm_page_pool *pool,unsigned nr_free, +gfp_t gfp) {unsigned long irq_flags;struct page *p;
@@ -309,8 +311,7 @@ static int ttm_page_pool_free(struct ttmif (NUM_PAGES_TO_ALLOC < nr_free) npages_to_free =NUM_PAGES_TO_ALLOC ; - pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), -GFP_KERNEL ); + pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), gfp);if (!pages_to_free) {pr_err ("Failed to allocate memory for pool free operation\n" );return 0 ;
@@ -382,9 +383,7 @@ out:* * XXX: (dchinner) Deadlock warning! * -* ttm_page_pool_free() does memory allocation using GFP_KERNEL. that means -* this can deadlock when called a sc->gfp_mask that is not equal to -* GFP_KERNEL. +* We need to pass sc->gfp_mask to ttm_page_pool_free(). * * This code is crying out for a shrinker per pool.... */
@@ -408,7 +407,8 @@ ttm_pool_shrink_scan(struct shrinker *shif (shrink_pages ==0 )break ; pool = &_manager->pools[(i + pool_offset)%NUM_POOLS ]; - shrink_pages =ttm_page_pool_free (pool, nr_free); + shrink_pages =ttm_page_pool_free (pool, nr_free, + sc->gfp_mask); freed += nr_free - shrink_pages; }mutex_unlock (&lock);
@@ -710,7 +710,7 @@ static void ttm_put_pages(struct page ** }spin_unlock_irqrestore (&pool->lock, irq_flags);if (npages) -ttm_page_pool_free (pool, npages); +ttm_page_pool_free (pool, npages,GFP_KERNEL ); }/*
@@ -850,7 +850,8 @@ void ttm_page_alloc_fini(void)ttm_pool_mm_shrink_fini (_manager);for (i =0 ; i <NUM_POOLS ; ++i) -ttm_page_pool_free (&_manager->pools[i],FREE_ALL_PAGES ); +ttm_page_pool_free (&_manager->pools[i],FREE_ALL_PAGES , +GFP_KERNEL );kobject_put (&_manager->kobj); _manager =NULL ;
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +9 -10
@@ -411,8 +411,10 @@ static void ttm_dma_page_put(struct dma_* * @pool: to free the pages from * @nr_free: If set to true will free all pages in pool +* @gfp: GFP flags. **/ -static unsigned ttm_dma_page_pool_free (struct dma_pool *pool,unsigned nr_free) +static unsigned ttm_dma_page_pool_free (struct dma_pool *pool,unsigned nr_free, +gfp_t gfp) {unsigned long irq_flags;struct dma_page *dma_p, *tmp;
@@ -430,8 +432,7 @@ static unsigned ttm_dma_page_pool_free(s npages_to_free, nr_free); }#endif - pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), -GFP_KERNEL ); + pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), gfp);if (!pages_to_free) { pr_err("%s: Failed to allocate memory for pool free operation\n",
@@ -530,7 +531,7 @@ static void ttm_dma_free_pool(struct devif (pool->type != type)continue ;/* Takes a spinlock.. */ -ttm_dma_page_pool_free (pool,FREE_ALL_PAGES ); +ttm_dma_page_pool_free (pool,FREE_ALL_PAGES ,GFP_KERNEL );WARN_ON (((pool->npages_in_use + pool->npages_free) !=0 ));/* This code path is called after _all_ references to the * struct device has been dropped - so nobody should be
@@ -983,7 +984,7 @@ void ttm_dma_unpopulate(struct ttm_dma_t/* shrink pool if necessary (only on !is_cached pools)*/ if (npages) -ttm_dma_page_pool_free (pool, npages); +ttm_dma_page_pool_free (pool, npages,GFP_KERNEL ); ttm->state = tt_unpopulated; }EXPORT_SYMBOL_GPL (ttm_dma_unpopulate);
@@ -993,10 +994,7 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);* * XXX: (dchinner) Deadlock warning! * -* ttm_dma_page_pool_free() does GFP_KERNEL memory allocation, and so attention -* needs to be paid to sc->gfp_mask to determine if this can be done or not. -* GFP_KERNEL memory allocation in a GFP_ATOMIC reclaim context woul dbe really -* bad. +* We need to pass sc->gfp_mask to ttm_dma_page_pool_free(). * * I'm getting sadder as I hear more pathetical whimpers about needing per-pool * shrinkers
@@ -1030,7 +1028,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerif (++idx < pool_offset)continue ; nr_free = shrink_pages; - shrink_pages =ttm_dma_page_pool_free (p->pool, nr_free); + shrink_pages =ttm_dma_page_pool_free (p->pool, nr_free, + sc->gfp_mask); freed += nr_free - shrink_pages; pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
Greg Kroah-Hartman
maintainerPATCH 13/238 drm/radeon/dpm: handle voltage info fetching on hawaii
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 6b57f20cb5b708415fbab63847f8f8429b051af8 upstream.
Some hawaii cards use a different method to fetch the voltage info from the vbios.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=74250
--- drivers/gpu/drm/radeon/ci_dpm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/ci_dpm.c +12 -1
@@ -922,7 +922,18 @@ static void ci_get_leakage_voltages(stru pi->vddc_leakage.count =0 ; pi->vddci_leakage.count =0 ; -if (radeon_atom_get_leakage_id_from_vbios (rdev, &leakage_id) ==0 ) { +if (rdev->pm.dpm.platform_caps &ATOM_PP_PLATFORM_CAP_EVV ) { +for (i =0 ; i <CISLANDS_MAX_LEAKAGE_COUNT ; i++) { + virtual_voltage_id =ATOM_VIRTUAL_VOLTAGE_ID0 + i; +if (radeon_atom_get_voltage_evv (rdev, virtual_voltage_id, &vddc) !=0 ) +continue ; +if (vddc !=0 && vddc != virtual_voltage_id) { + pi->vddc_leakage.actual_voltage[pi->vddc_leakage.count] = vddc; + pi->vddc_leakage.leakage_id[pi->vddc_leakage.count] = virtual_voltage_id; + pi->vddc_leakage.count++; + } + } + }else if (radeon_atom_get_leakage_id_from_vbios (rdev, &leakage_id) ==0 ) {for (i =0 ; i <CISLANDS_MAX_LEAKAGE_COUNT ; i++) { virtual_voltage_id =ATOM_VIRTUAL_VOLTAGE_ID0 + i; if (radeon_atom_get_leakage_vddc_based_on_leakage_params(rdev, &vddc, &vddci,
Greg Kroah-Hartman
maintainerPATCH 14/238 drm/radeon: re-enable dpm by default on cayman
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8f500af4efe347d1a8ac674d115220e8caa84559 upstream.
This patch depends on:b0880e87c1fd038b84498944f52e52c3e86ebe59
(drm/radeon/dpm: fix vddci setup typo on cayman)
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=69723
--- drivers/gpu/drm/radeon/radeon_pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_pm.c +1 -1
@@ -1279,7 +1279,6 @@ int radeon_pm_init(struct radeon_devicecase CHIP_BARTS :case CHIP_TURKS :case CHIP_CAICOS : -case CHIP_CAYMAN :/* DPM requires the RLC, RV770+ dGPU requires SMC */ if (!rdev->rlc_fw) rdev->pm.pm_method =PM_METHOD_PROFILE ;
@@ -1303,6 +1302,7 @@ int radeon_pm_init(struct radeon_devicecase CHIP_PALM :case CHIP_SUMO :case CHIP_SUMO2 : +case CHIP_CAYMAN :case CHIP_ARUBA :case CHIP_TAHITI :case CHIP_PITCAIRN :
Greg Kroah-Hartman
maintainerPATCH 15/238 drm/radeon: re-enable dpm by default on BTC
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c08abf11900e19b14dd3a0cc3d105bd74519cd18 upstream.
This patch depends on:e07929810f0a19ddd756558290c7d72827cbfcd9 (drm/radeon/dpm: fix typo in vddci setup for eg/btc)
bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=73053
https://bugzilla.kernel.org/show_bug.cgi?id=68571
--- drivers/gpu/drm/radeon/radeon_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/radeon_pm.c +3 -3
@@ -1276,9 +1276,6 @@ int radeon_pm_init(struct radeon_devicecase CHIP_RS780 :case CHIP_RS880 :case CHIP_RV770 : -case CHIP_BARTS : -case CHIP_TURKS : -case CHIP_CAICOS :/* DPM requires the RLC, RV770+ dGPU requires SMC */ if (!rdev->rlc_fw) rdev->pm.pm_method =PM_METHOD_PROFILE ;
@@ -1302,6 +1299,9 @@ int radeon_pm_init(struct radeon_devicecase CHIP_PALM :case CHIP_SUMO :case CHIP_SUMO2 : +case CHIP_BARTS : +case CHIP_TURKS : +case CHIP_CAICOS :case CHIP_CAYMAN :case CHIP_ARUBA :case CHIP_TAHITI :
Greg Kroah-Hartman
maintainerPATCH 16/238 drm/radeon: load the lm63 driver for an lm64 thermal chip.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
Looks like the lm63 driver supports the lm64 as well.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +2 -2
@@ -1955,7 +1955,7 @@ static const char *thermal_controller_na"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" , "asc7xxx", };
@@ -1966,7 +1966,7 @@ static const char *pp_lib_thermal_contro"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" ,"RV6xx" , "RV770",
Greg Kroah-Hartman
maintainerPATCH 18/238 drm/radeon/atom: add new voltage fetch function for hawaii
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e9f274b2a1bd4ecc569b823b1e7942e9bf92593e upstream.
Some hawaii boards use a different method for fetching the voltage information from the vbios.
--- drivers/gpu/drm/radeon/radeon.h | 3 ++ drivers/gpu/drm/radeon/radeon_atombios.c | 35 +++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+)
drivers/gpu/drm/radeon/radeon.h +3 -0
@@ -294,6 +294,9 @@ int radeon_atom_get_leakage_vddc_based_o u16 *vddc, u16 *vddci, u16 virtual_voltage_id, u16 vbios_voltage_id); +int radeon_atom_get_voltage_evv (struct radeon_device *rdev, +u16 virtual_voltage_id, +u16 *voltage); int radeon_atom_round_to_true_voltage(struct radeon_device *rdev, u8 voltage_type, u16 nominal_voltage,
drivers/gpu/drm/radeon/radeon_atombios.c +35 -0
@@ -3228,6 +3228,41 @@ int radeon_atom_get_leakage_vddc_based_oreturn 0 ; } +union get_voltage_info { +struct _GET_VOLTAGE_INFO_INPUT_PARAMETER_V1_2 in; +struct _GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 evv_out; +}; + +int radeon_atom_get_voltage_evv (struct radeon_device *rdev, +u16 virtual_voltage_id, +u16 *voltage) +{ +int index =GetIndexIntoMasterTable (COMMAND , GetVoltageInfo); +u32 entry_id; +u32 count = rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.count; +union get_voltage_info args; + +for (entry_id =0 ; entry_id < count; entry_id++) { +if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].v == + virtual_voltage_id) +break ; + } + +if (entry_id >= count) +return -EINVAL ; + + args.in.ucVoltageType =VOLTAGE_TYPE_VDDC ; + args.in.ucVoltageMode =ATOM_GET_VOLTAGE_EVV_VOLTAGE ; + args.in.ulSCLKFreq = +cpu_to_le32 (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk); + +atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args); + + *voltage =le16_to_cpu (args.evv_out.usVoltageLevel); + +return 0 ; +} +int radeon_atom_get_voltage_gpio_settings (struct radeon_device *rdev,u16 voltage_level,u8 voltage_type,u32 *gpio_value,u32 *gpio_mask)
Greg Kroah-Hartman
maintainerPATCH 19/238 drm/radeon: tweak ACCEL_WORKING2 query for hawaii
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 3c64bd26f7e9bd589ebe0d1ebec69ef2f784c12d upstream.
Return 2 so we can be sure the kernel has the necessary changes for acceleration to work.
Note: This patch depends on these two commits:
- drm/radeon: fix cut and paste issue for hawaii.
- drm/radeon: use packet2 for nop on hawaii with old firmware
--- drivers/gpu/drm/radeon/radeon_kms.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_kms.c +8 -1
@@ -254,7 +254,14 @@ static int radeon_info_ioctl(struct drm_ }break ;case RADEON_INFO_ACCEL_WORKING2 : - *value = rdev->accel_working; +if (rdev->family ==CHIP_HAWAII ) { +if (rdev->accel_working) + *value =2 ; +else + *value =0 ; + }else { + *value = rdev->accel_working; + }break ;case RADEON_INFO_TILING_CONFIG :if (rdev->family >=CHIP_BONAIRE )
Greg Kroah-Hartman
maintainerPATCH 20/238 drm/i915: read HEAD register back in init_ring_common() to enforce ordering
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit ece4a17d237a79f63fbfaf3f724a12b6d500555c upstream.
Withtout this, ring initialization fails reliabily during resume with
[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head ffffff8804 tail 00000000 start 000e4000
This is not a complete fix, but it is verified to make the ring initialization failures during resume much less likely.
We were not able to root-cause this bug (likely HW-specific to Gen4 chips) yet. This is therefore used as a ducttape before problem is fully understood and proper fix created, so that people don't suffer from completely unusable systems in the meantime.
The discussion and debugging is happening at
https://bugs.freedesktop.org/show_bug.cgi?id=76554
--- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/i915/intel_ringbuffer.c +3 -0
@@ -475,6 +475,9 @@ static int init_ring_common(struct intel } } +/* Enforce ordering by reading HEAD register back */ +I915_READ_HEAD (ring); +/* Initialize the ring. This must happen _after_ we've cleared the ring * registers with the above sequence (the readback of the HEAD registers * also enforces ordering), otherwise the hw might lose the new ring
Greg Kroah-Hartman
maintainerPATCH 21/238 drm/radeon: enable bapm by default on desktop TN/RL boards
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 0c78a44964db3d483b0c09a8236e0fe123aa9cfc upstream.
bapm enabled the GPU and CPU to share TDP headroom. It was disabled by default since some laptops hung when it was enabled in conjunction with dpm. It seems to be stable on desktop boards and fixes hangs on boot with dpm enabled on certain boards, so enable it by default on desktop boards.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=72921
--- drivers/gpu/drm/radeon/trinity_dpm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/trinity_dpm.c +9 -1
@@ -1877,7 +1877,15 @@ int trinity_dpm_init(struct radeon_devicfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) pi->at[i] =TRINITY_AT_DFLT ; - pi->enable_bapm = false; +/* There are stability issues reported on latops with +* bapm installed when switching between AC and battery +* power. At the same time, some desktop boards hang +* if it's not enabled and dpm is enabled. +*/ +if (rdev->flags &RADEON_IS_MOBILITY ) + pi->enable_bapm = false; +else + pi->enable_bapm = true; pi->enable_nbps_policy = true; pi->enable_sclk_ds = true; pi->enable_gfx_power_gating = true;
Greg Kroah-Hartman
maintainerPATCH 22/238 drm/radeon/TN: only enable bapm on MSI systems
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 730a336c33a3398d65896e8ee3ef9f5679fe30a9 upstream.
There still seem to be stability problems with other systems.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=72921
--- drivers/gpu/drm/radeon/trinity_dpm.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/trinity_dpm.c +8 -7
@@ -1877,15 +1877,16 @@ int trinity_dpm_init(struct radeon_devicfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) pi->at[i] =TRINITY_AT_DFLT ; -/* There are stability issues reported on latops with -* bapm installed when switching between AC and battery -* power. At the same time, some desktop boards hang -* if it's not enabled and dpm is enabled. +/* There are stability issues reported on with +* bapm enabled when switching between AC and battery +* power. At the same time, some MSI boards hang +* if it's not enabled and dpm is enabled. Just enable +* it for MSI boards right now. */ -if (rdev->flags &RADEON_IS_MOBILITY ) - pi->enable_bapm = false; -else +if (rdev->pdev->subsystem_vendor ==0x1462 ) pi->enable_bapm = true; +else + pi->enable_bapm = false; pi->enable_nbps_policy = true; pi->enable_sclk_ds = true; pi->enable_gfx_power_gating = true;
Greg Kroah-Hartman
maintainerPATCH 23/238 of/irq: Fix lookup to use interrupts-extended property first
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit a9ecdc0fdc54aa499604dbd43132988effcac9b4 upstream.
In case the Device Tree blob passed by the boot agent supplies both an 'interrupts-extended' and an 'interrupts' property in order to allow for older kernels to be usable, prefer the new-style 'interrupts-extended' property which conveys a lot more information.
This allows us to have bootloaders willingly maintaining backwards compatibility with older kernels without entirely deprecating the 'interrupts' property.
Update the bindings documentation to describe a situation where both the 'interrupts-extended' and the 'interrupts' property are present, and which one takes precedence over the other.
--- Documentation/devicetree/bindings/interrupt-controller/interrupts.txt | 12 ++++--- drivers/of/irq.c | 17 +++++----- 2 files changed, 16 insertions(+), 13 deletions(-)
Documentation/devicetree/bindings/interrupt-controller/interrupts.txt +7 -5
@@ -4,11 +4,13 @@ Specifying interrupt information for dev 1) Interrupt client nodes ------------------------- -Nodes that describe devices which generate interrupts must contain an either an -"interrupts" property or an "interrupts-extended" property. These properties -contain a list of interrupt specifiers, one per output interrupt. The format of -the interrupt specifier is determined by the interrupt controller to which the -interrupts are routed; see section 2 below for details. +Nodes that describe devices which generate interrupts must contain an +"interrupts" property, an "interrupts-extended" property, or both. If both are +present, the latter should take precedence; the former may be provided simply +for compatibility with software that does not recognize the latter. These +properties contain a list of interrupt specifiers, one per output interrupt. The +format of the interrupt specifier is determined by the interrupt controller to +which the interrupts are routed; see section 2 below for details. Example: interrupt-parent = <&intc1>;
drivers/of/irq.c +9 -8
@@ -301,16 +301,17 @@ int of_irq_parse_one(struct device_node/* Get the reg property (if any) */ addr =of_get_property (device,"reg" ,NULL ); +/* Try the new-style interrupts-extended first */ + res =of_parse_phandle_with_args (device,"interrupts-extended" , +"#interrupt-cells" , index, out_irq); +if (!res) +return of_irq_parse_raw (addr, out_irq); +/* Get the interrupts property */ intspec =of_get_property (device,"interrupts" , &intlen); -if (intspec ==NULL ) { -/* Try the new-style interrupts-extended */ - res =of_parse_phandle_with_args (device,"interrupts-extended" , -"#interrupt-cells" , index, out_irq); -if (res) -return -EINVAL ; -return of_irq_parse_raw (addr, out_irq); - } +if (intspec ==NULL ) +return -EINVAL ; + intlen /=sizeof (*intspec);pr_debug (" intspec=%d intlen=%d\n" ,be32_to_cpup (intspec), intlen);
Greg Kroah-Hartman
maintainerPATCH 24/238 libata: widen Crucial M550 blacklist matching
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 2a13772a144d2956a7fedd18685921d0a9b8b783 upstream.
Crucial M550 may cause data corruption on queued trims and is blacklisted. The pattern used for it fails to match 1TB one as the capacity section will be four chars instead of three. Widen the pattern.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81071
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -4227,7 +4227,7 @@ static const struct ata_blacklist_entry { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },/* * Some WD SATA-I drives spin up and down erratically when the link
Greg Kroah-Hartman
maintainerPATCH 25/238 pata_scc: propagate return value of scc_wait_after_reset
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arjun Sreedharan <[email protected]>
commit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.
scc_bus_softreset not necessarily should return zero. Propagate the error code.
--- drivers/ata/pata_scc.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/ata/pata_scc.c +7 -8
@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct a* Note: Original code is ata_bus_softreset(). */ -static unsigned int scc_bus_softreset (struct ata_port *ap,unsigned int devmask, +static int scc_bus_softreset (struct ata_port *ap,unsigned int devmask,unsigned long deadline) {struct ata_ioports *ioaddr = &ap->ioaddr;
@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(studelay (20 );out_be32 (ioaddr->ctl_addr, ap->ctl); -scc_wait_after_reset (&ap->link, devmask, deadline); - -return 0 ; +return scc_wait_after_reset (&ap->link, devmask, deadline); }/**
@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link {struct ata_port *ap = link->ap;unsigned int slave_possible = ap->flags &ATA_FLAG_SLAVE_POSS ; -unsigned int devmask =0 , err_mask; +unsigned int devmask =0 ; +int rc;u8 err;DPRINTK ("ENTER\n" );
@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link/* issue bus reset */ DPRINTK ("about to softreset, devmask=%x\n" , devmask); - err_mask =scc_bus_softreset (ap, devmask, deadline); -if (err_mask) { -ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , err_mask); + rc =scc_bus_softreset (ap, devmask, deadline); +if (rc) { +ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , rc);return -EIO ; }
Greg Kroah-Hartman
maintainerPATCH 26/238 ahci: Add Device IDs for Intel 9 Series PCH
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <[email protected]>
commit 1b071a0947dbce5c184c12262e02540fbc493457 upstream.
This patch adds the AHCI mode SATA Device IDs for the Intel 9 Series PCH.
--- drivers/ata/ahci.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ahci.c +8 -0
@@ -306,6 +306,14 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID *//* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
Greg Kroah-Hartman
maintainerPATCH 27/238 ahci: add pcid for Marvel 0x9182 controller
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murali Karicheri <[email protected]>
commit c5edfff9db6f4d2c35c802acb4abe0df178becee upstream.
Keystone K2E EVM uses Marvel 0x9182 controller. This requires support for the ID in the ahci driver.
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -451,6 +451,8 @@ static const struct pci_device_id ahci_p { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172), + .driver_data = board_ahci_yes_fbs }, /* 88se9182 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
Greg Kroah-Hartman
maintainerPATCH 28/238 ibmveth: Fix endian issues with rx_no_buffer statistic
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.
Hidden away in the last 8 bytes of the buffer_list page is a solitary statistic. It needs to be byte swapped or else ethtool -S will produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a comment explaining what is going on.
--- drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +14 -4
@@ -292,6 +292,18 @@ failure:atomic_add (buffers_added, &(pool->available)); } +/* +* The final 8 bytes of the buffer list is a counter of frames dropped +* because there was not a buffer in the buffer list capable of holding +* the frame. +*/ +static void ibmveth_update_rx_no_buffer (struct ibmveth_adapter *adapter) +{ +__be64 *p = adapter->buffer_list_addr +4096 -8 ; + + adapter->rx_no_buffer =be64_to_cpup (p); +} +/* replenish routine */ static void ibmveth_replenish_task (struct ibmveth_adapter *adapter) {
@@ -307,8 +319,7 @@ static void ibmveth_replenish_task(strucibmveth_replenish_buffer_pool (adapter, pool); } - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter); }/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -698,8 +709,7 @@ static int ibmveth_close(struct net_devifree_irq (netdev->irq, netdev); - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter);ibmveth_cleanup (adapter);
Greg Kroah-Hartman
maintainerPATCH 29/238 aio: fix reqs_available handling
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin LaHaise <[email protected]>
commit d856f32a86b2b015ab180ab7a55e455ed8d3ccc5 upstream.
As reported by Dan Aloni, commit f8567a3845ac ("aio: fix aio request leak when events are reaped by userspace") introduces a regression when user code attempts to perform io_submit() with more events than are available in the ring buffer. Reverting that commit would reintroduce a regression when user space event reaping is used.
Fixing this bug is a bit more involved than the previous attempts to fix this regression. Since we do not have a single point at which we can count events as being reaped by user space and io_getevents(), we have to track event completion by looking at the number of events left in the event ring. So long as there are as many events in the ring buffer as there have been completion events generate, we cannot call put_reqs_available(). The code to check for this is now placed in refill_reqs_available().
A test program from Dan and modified by me for verifying this bug is available at http://www.kvack.org/~bcrl/20140824-aio_bug.c .
--- fs/aio.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 4 deletions(-)
fs/aio.c +73 -4
@@ -141,6 +141,7 @@ struct kioctx {struct {unsigned tail; +unsigned completed_events;spinlock_t completion_lock; }____cacheline_aligned_in_smp ;
@@ -880,6 +881,68 @@ out:return ret; } +/* refill_reqs_available +* Updates the reqs_available reference counts used for tracking the +* number of free slots in the completion ring. This can be called +* from aio_complete() (to optimistically update reqs_available) or +* from aio_get_req() (the we're out of events case). It must be +* called holding ctx->completion_lock. +*/ +static void refill_reqs_available (struct kioctx *ctx,unsigned head, +unsigned tail) +{ +unsigned events_in_ring, completed; + +/* Clamp head since userland can write to it. */ + head %= ctx->nr_events; +if (head <= tail) + events_in_ring = tail - head; +else + events_in_ring = ctx->nr_events - (head - tail); + + completed = ctx->completed_events; +if (events_in_ring < completed) + completed -= events_in_ring; +else + completed =0 ; + +if (!completed) +return ; + + ctx->completed_events -= completed; +put_reqs_available (ctx, completed); +} + +/* user_refill_reqs_available +* Called to refill reqs_available when aio_get_req() encounters an +* out of space in the completion ring. +*/ +static void user_refill_reqs_available (struct kioctx *ctx) +{ +spin_lock_irq (&ctx->completion_lock); +if (ctx->completed_events) { +struct aio_ring *ring; +unsigned head; + +/* Access of ring->head may race with aio_read_events_ring() +* here, but that's okay since whether we read the old version +* or the new version, and either will be valid. The important +* part is that head cannot pass tail since we prevent +* aio_complete() from updating tail by holding +* ctx->completion_lock. Even if head is invalid, the check +* against ctx->completed_events below will make sure we do the +* safe/right thing. +*/ + ring =kmap_atomic (ctx->ring_pages[0 ]); + head = ring->head; +kunmap_atomic (ring); + +refill_reqs_available (ctx, head, ctx->tail); + } + +spin_unlock_irq (&ctx->completion_lock); +} +/* aio_get_req * Allocate a slot for an aio request. * Returns NULL if no requests are free.
@@ -888,8 +951,11 @@ static inline struct kiocb *aio_get_req( {struct kiocb *req; -if (!get_reqs_available (ctx)) -return NULL ; +if (!get_reqs_available (ctx)) { +user_refill_reqs_available (ctx); +if (!get_reqs_available (ctx)) +return NULL ; + } req =kmem_cache_alloc (kiocb_cachep,GFP_KERNEL |__GFP_ZERO);if (unlikely (!req))
@@ -948,8 +1014,8 @@ void aio_complete(struct kiocb *iocb, lostruct kioctx *ctx = iocb->ki_ctx;struct aio_ring *ring;struct io_event *ev_page, *event; +unsigned tail, pos, head;unsigned long flags; -unsigned tail, pos;/* * Special case handling for sync iocbs:
@@ -1010,10 +1076,14 @@ void aio_complete(struct kiocb *iocb, lo ctx->tail = tail; ring =kmap_atomic (ctx->ring_pages[0 ]); + head = ring->head; ring->tail = tail;kunmap_atomic (ring);flush_dcache_page (ctx->ring_pages[0 ]); + ctx->completed_events++; +if (ctx->completed_events >1 ) +refill_reqs_available (ctx, head, tail);spin_unlock_irqrestore (&ctx->completion_lock, flags);pr_debug ("added to ring %p at [%u]\n" , iocb, tail);
@@ -1028,7 +1098,6 @@ void aio_complete(struct kiocb *iocb, lo/* everything turned out well, dispose of the aiocb. */ kiocb_free (iocb); -put_reqs_available (ctx,1 );/* * We have to order our ring_info tail store above and test
Greg Kroah-Hartman
maintainerPATCH 30/238 aio: add missing smp_rmb() in read_events_ring
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Moyer <[email protected]>
commit 2ff396be602f10b5eab8e73b24f20348fa2de159 upstream.
We ran into a case on ppc64 running mariadb where io_getevents would return zeroed out I/O events. After adding instrumentation, it became clear that there was some missing synchronization between reading the tail pointer and the events themselves. This small patch fixes the problem in testing.
Thanks to Zach for helping to look into this, and suggesting the fix.
--- fs/aio.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/aio.c +6 -0
@@ -1134,6 +1134,12 @@ static long aio_read_events_ring(struct tail = ring->tail;kunmap_atomic (ring); +/* +* Ensure that once we've read the current tail pointer, that +* we also see the events that were stored up to the tail. +*/ +smp_rmb (); +pr_debug ("h%u t%u m%u\n" , head, tail, ctx->nr_events);if (head == tail)
Greg Kroah-Hartman
maintainerPATCH 31/238 arm64: flush TLS registers during exec
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream.
Nathan reports that we leak TLS information from the parent context during an exec, as we don't clear the TLS registers when flushing the thread state.
This patch updates the flushing code so that we:
(1) Unconditionally zero the tpidr_el0 register (since this is fully context switched for native tasks and zeroed for compat tasks)
(2) Zero the tp_value state in thread_info before clearing the tpidrr0_el0 register for compat tasks (since this is only writable by the set_tls compat syscall and therefore not fully switched).
A missing compiler barrier is also added to the compat set_tls syscall.
--- arch/arm64/kernel/process.c | 18 ++++++++++++++++++ arch/arm64/kernel/sys_compat.c | 6 ++++++ 2 files changed, 24 insertions(+)
arch/arm64/kernel/process.c +18 -0
@@ -187,9 +187,27 @@ void exit_thread(void) { } +static void tls_thread_flush (void ) +{ + asm ("msr tpidr_el0, xzr" ); + +if (is_compat_task ()) { + current->thread.tp_value =0 ; + +/* +* We need to ensure ordering between the shadow state and the +* hardware state, so that we don't corrupt the hardware state +* with a stale shadow state during context switch. +*/ +barrier (); + asm ("msr tpidrro_el0, xzr" ); + } +} +void flush_thread (void ) {fpsimd_flush_thread (); +tls_thread_flush ();flush_ptrace_hw_breakpoint (current); }
arch/arm64/kernel/sys_compat.c +6 -0
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *case __ARM_NR_compat_set_tls: current->thread.tp_value = regs->regs[0 ]; + +/* +* Protect against register corruption from context switch. +* See comment in tls_thread_flush. +*/ +barrier (); asm ("msr tpidrro_el0, %0" : :"r" (regs->regs[0 ]));return 0 ;
Greg Kroah-Hartman
maintainerPATCH 32/238 arm64: use irq_set_affinity with force=false when migrating irqs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit 3d8afe3099ebc602848aa7f09235cce3a9a023ce upstream.
The arm64 interrupt migration code on cpu offline calls irqchip.irq_set_affinity() with the argument force=true. Originally this argument had no effect because it was not used by any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu affinity of interrupts") which made the force argument useful to route interrupts to not yet online cpus without checking the target cpu against the cpu online mask. The following commit ffde1de64012 ("irqchip: gic: Support forced affinity setting") implemented this for the GIC interrupt controller.
As a consequence the cpu offline irq migration fails if CPU0 is offlined, because CPU0 is still set in the affinity mask and the validation against cpu online mask is skipped to the force argument being true. The following first_cpu(mask) selection always selects CPU0 as the target.
Commit 601c942176d8("arm64: use cpu_online_mask when using forced irq_set_affinity") intended to fix the above mentioned issue but introduced another issue where affinity can be migrated to a wrong CPU due to unconditional copy of cpu_online_mask.
As with for arm, solve the issue by calling irq_set_affinity() with force=false from the CPU offline irq migration code so the GIC driver validates the affinity mask against CPU online mask and therefore removes CPU0 from the possible target candidates. Also revert the changes done in the commit 601c942176d8 as it's no longer needed.
Tested on Juno platform.
irq_set_affinity")
--- arch/arm64/kernel/irq.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/arm64/kernel/irq.c +4 -8
@@ -97,19 +97,15 @@ static bool migrate_one_irq(struct irq_dif (irqd_is_per_cpu (d) || !cpumask_test_cpu (smp_processor_id (), affinity))return false; -if (cpumask_any_and (affinity, cpu_online_mask) >= nr_cpu_ids) +if (cpumask_any_and (affinity, cpu_online_mask) >= nr_cpu_ids) { + affinity = cpu_online_mask; ret = true; + } -/* -* when using forced irq_set_affinity we must ensure that the cpu -* being offlined is not present in the affinity mask, it may be -* selected as the target CPU otherwise -*/ - affinity = cpu_online_mask; c =irq_data_get_irq_chip (d);if (!c->irq_set_affinity)pr_debug ("IRQ%u: unable to set affinity\n" , d->irq); -else if (c->irq_set_affinity (d, affinity, true) ==IRQ_SET_MASK_OK && ret) +else if (c->irq_set_affinity (d, affinity, false) ==IRQ_SET_MASK_OK && ret)cpumask_copy (d->affinity, affinity);return ret;
Greg Kroah-Hartman
maintainerPATCH 33/238 arm/arm64: KVM: Complete WFI/WFE instructions
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <[email protected]>
commit 05e0127f9e362b36aa35f17b1a3d52bca9322a3a upstream.
The architecture specifies that when the processor wakes up from a WFE or WFI instruction, the instruction is considered complete, however we currrently return to EL1 (or EL0) at the WFI/WFE instruction itself.
While most guests may not be affected by this because their local exception handler performs an exception returning setting the event bit or with an interrupt pending, some guests like UEFI will get wedged due this little mishap.
Simply skip the instruction when we have completed the emulation.
--- arch/arm/kvm/handle_exit.c | 2 ++ arch/arm64/kvm/handle_exit.c | 2 ++ 2 files changed, 4 insertions(+)
arch/arm/kvm/handle_exit.c +2 -0
@@ -89,6 +89,8 @@ static int kvm_handle_wfx(struct kvm_vcpelse kvm_vcpu_block (vcpu); +kvm_skip_instr (vcpu,kvm_vcpu_trap_il_is32bit (vcpu)); +return 1 ; }
arch/arm64/kvm/handle_exit.c +2 -0
@@ -62,6 +62,8 @@ static int kvm_handle_wfx(struct kvm_vcpelse kvm_vcpu_block (vcpu); +kvm_skip_instr (vcpu,kvm_vcpu_trap_il_is32bit (vcpu)); +return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 34/238 ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranavkumar Sawargaonkar <[email protected]>
commit f6edbbf36da3a27b298b66c7955fc84e1dcca305 upstream.
X-Gene u-boot runs in EL2 mode with MMU enabled hence we might have stale EL2 tlb enteris when we enable EL2 MMU on each host CPU.
This can happen on any ARM/ARM64 board running bootloader in Hyp-mode (or EL2-mode) with MMU enabled.
This patch ensures that we flush all Hyp-mode (or EL2-mode) TLBs on each host CPU before enabling Hyp-mode (or EL2-mode) MMU.
--- arch/arm/kvm/init.S | 4 ++++ arch/arm64/kvm/hyp-init.S | 4 ++++ 2 files changed, 8 insertions(+)
arch/arm/kvm/init.S +4 -0
@@ -98,6 +98,10 @@ __do_hyp_init: mrc p15, 0, r0, c10, c2, 1 mcr p15, 4, r0, c10, c2, 1 + @ Invalidate the stale TLBs from Bootloader + mcr p15, 4, r0, c8, c7, 0 @ TLBIALLH + dsb ish + @ Set the HSCTLR to: @ - ARM/THUMB exceptions: Kernel config (Thumb-2 kernel) @ - Endianness: Kernel config
arch/arm64/kvm/hyp-init.S +4 -0
@@ -74,6 +74,10 @@ __do_hyp_init: msr mair_el2, x4 isb + /* Invalidate the stale TLBs from Bootloader */ + tlbi alle2 + dsb sy + mrs x4, sctlr_el2 and x4, x4, #SCTLR_EL2_EE // preserve endianness of EL2 ldr x5, =SCTLR_EL2_FLAGS
Greg Kroah-Hartman
maintainerPATCH 35/238 i2c: mv64xxx: continue probe when clock-frequency is missing
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit 0ce4bc1dbdd911ae1763e2d4ff36bd1b214a59f7 upstream.
The "clock-frequency" DT property is listed as optional, However, the current code stores the return value of of_property_read_u32 in the return code of mv64xxx_of_config, but then forgets to clear it after setting the default value of "clock-frequency". It is then passed out to the main probe function, resulting in a probe failure when "clock-frequency" is missing.
This patch checks and then throws away the return value of of_property_read_u32, instead of storing it and having to clear it afterwards.
This issue was discovered after the property was removed from all sunxi DTs.
--- drivers/i2c/busses/i2c-mv64xxx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/i2c/busses/i2c-mv64xxx.c +1 -2
@@ -748,8 +748,7 @@ mv64xxx_of_config(struct mv64xxx_i2c_dat } tclk =clk_get_rate (drv_data->clk); - rc =of_property_read_u32 (np,"clock-frequency" , &bus_freq); -if (rc) +if (of_property_read_u32 (np,"clock-frequency" , &bus_freq)) bus_freq =100000 ;/* 100kHz by default */ if (!mv64xxx_find_baud_factors(bus_freq, tclk,
Greg Kroah-Hartman
maintainerPATCH 36/238 i2c: at91: add bound checking on SMBus block length bytes
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Roszko <[email protected]>
commit 75b81f339c6af43f6f4a1b3eabe0603321dade65 upstream.
The driver was not bound checking the received length byte to ensure it was within the the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up in an infinite loop as the at91_twi_read_next_byte function returned immediately without allowing RHR to be read to clear the RXRDY interrupt.
Tested agaisnt a SMBus compliant battery.
--- drivers/i2c/busses/i2c-at91.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-at91.c +24 -4
@@ -101,6 +101,7 @@ struct at91_twi_dev {unsigned twi_cwgr_reg;struct at91_twi_pdata *pdata;bool use_dma; +bool recv_len_abort;struct at91_twi_dma dma; };
@@ -267,12 +268,24 @@ static void at91_twi_read_next_byte(stru *dev->buf =at91_twi_read (dev,AT91_TWI_RHR ) &0xff ; --dev->buf_len; +/* return if aborting, we only needed to read RHR to clear RXRDY*/ +if (dev->recv_len_abort) +return ; +/* handle I2C_SMBUS_BLOCK_DATA */ if (unlikely (dev->msg->flags &I2C_M_RECV_LEN )) { - dev->msg->flags &= ~I2C_M_RECV_LEN ; - dev->buf_len += *dev->buf; - dev->msg->len = dev->buf_len +1 ; -dev_dbg (dev->dev,"received block length %d\n" , dev->buf_len); +/* ensure length byte is a valid value */ +if (*dev->buf <=I2C_SMBUS_BLOCK_MAX && *dev->buf >0 ) { + dev->msg->flags &= ~I2C_M_RECV_LEN ; + dev->buf_len += *dev->buf; + dev->msg->len = dev->buf_len +1 ; +dev_dbg (dev->dev,"received block length %d\n" , + dev->buf_len); + }else { +/* abort and send the stop by reading one more byte */ + dev->recv_len_abort = true; + dev->buf_len =1 ; + } }/* send stop if second but last byte has been read */
@@ -444,6 +457,12 @@ static int at91_do_twi_transfer(struct a ret = -EIO ; goto error; } +if (dev->recv_len_abort) { +dev_err (dev->dev,"invalid smbus block length recvd\n" ); + ret = -EPROTO ; + goto error; + } +dev_dbg (dev->dev,"transfer complete\n" );return 0 ;
@@ -500,6 +519,7 @@ static int at91_twi_xfer(struct i2c_adap dev->buf_len = m_start->len; dev->buf = m_start->buf; dev->msg = m_start; + dev->recv_len_abort = false; ret =at91_do_twi_transfer (dev);
Greg Kroah-Hartman
maintainerPATCH 37/238 i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Lindgren <[email protected]>
commit 6721f28a26efd6368497abbdef5dcfc59608d899 upstream.
There is a race condition in at91_do_twi_xfer when signals arrive. If a signal is recieved while waiting for a transfer to complete wait_for_completion_interruptible_timeout() will return -ERESTARTSYS. This is not handled correctly resulting in interrupts still being enabled and a transfer being in flight when we return.
Symptoms include a range of oopses and bus lockups. Oopses can happen when the transfer completes because the interrupt handler will corrupt the stack. If a new transfer is started before the interrupt fires the controller will start a new transfer in the middle of the old one, resulting in confused slaves and a locked bus.
To avoid this, use wait_for_completion_io_timeout instead so that we don't have to deal with gracefully shutting down the transfer and disabling the interrupts.
--- drivers/i2c/busses/i2c-at91.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-at91.c +2 -2
@@ -434,8 +434,8 @@ static int at91_do_twi_transfer(struct a } } - ret =wait_for_completion_interruptible_timeout (&dev->cmd_complete, - dev->adapter.timeout); + ret =wait_for_completion_io_timeout (&dev->cmd_complete, + dev->adapter.timeout);if (ret ==0 ) {dev_err (dev->dev,"controller timed out\n" );at91_init_twi_bus (dev);
Greg Kroah-Hartman
maintainerPATCH 38/238 i2c: ismt: use correct length when copy buffer
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Du <[email protected]>
commit 979bbf7b7ae75cfc06e09d09eda38009a3bdc4a4 upstream.
In block write mode, when encapsulating dma_buffer, first element is 'command', the rest is data buffer, so only copy actual data buffer starting from block[1] with the size indicating by block[0].
--- drivers/i2c/busses/i2c-ismt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-ismt.c +2 -2
@@ -497,7 +497,7 @@ static int ismt_access(struct i2c_adapte desc->wr_len_cmd = dma_size; desc->control |=ISMT_DESC_BLK ; priv->dma_buffer[0 ] = command; -memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size); +memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size -1 ); }else {/* Block Read */ dev_dbg (dev,"I2C_SMBUS_BLOCK_DATA: READ\n" );
@@ -525,7 +525,7 @@ static int ismt_access(struct i2c_adapte desc->wr_len_cmd = dma_size; desc->control |=ISMT_DESC_I2C ; priv->dma_buffer[0 ] = command; -memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size); +memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size -1 ); }else {/* i2c Block Read */ dev_dbg (dev,"I2C_SMBUS_I2C_BLOCK_DATA: READ\n" );
Greg Kroah-Hartman
maintainerPATCH 39/238 trace: Fix epoll hang when we race with new entries
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 4ce97dbf50245227add17c83d87dc838e7ca79d0 upstream.
Epoll on trace_pipe can sometimes hang in a weird case. If the ring buffer is empty when we set waiters_pending but an event shows up exactly at that moment we can miss being woken up by the ring buffers irq work. Since ring_buffer_empty() is inherently racey we will sometimes think that the buffer is not empty. So we don't get woken up and we don't think there are any events even though there were some ready when we added the watch, which makes us hang. This patch fixes this by making sure that we are actually on the wait list before we set waiters_pending, and add a memory barrier to make sure ring_buffer_empty() is going to be correct.
--- kernel/trace/ring_buffer.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +15 -1
@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_bu work = &cpu_buffer->irq_work; } - work->waiters_pending = true;poll_wait (filp, &work->waiters, poll_table); + work->waiters_pending = true; +/* +* There's a tight race between setting the waiters_pending and +* checking if the ring buffer is empty. Once the waiters_pending bit +* is set, the next event will wake the task up, but we can get stuck +* if there's only a single event in. +* +* FIXME: Ideally, we need a memory barrier on the writer side as well, +* but adding a memory barrier to all events will cause too much of a +* performance hit in the fast path. We only need a memory barrier when +* the buffer goes from empty to having content. But as this race is +* extremely small, and it's not a problem if another event comes in, we +* will fix it later. +*/ +smp_mb ();if ((cpu ==RING_BUFFER_ALL_CPUS && !ring_buffer_empty (buffer)) || (cpu !=RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu (buffer, cpu)))
Greg Kroah-Hartman
maintainerPATCH 40/238 arm64: ptrace: fix compat hardware watchpoint reporting
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 27d7ff273c2aad37b28f6ff0cab2cfa35b51e648 upstream.
I'm not sure what I was on when I wrote this, but when iterating over the hardware watchpoint array (hbp_watch_array), our index is off by ARM_MAX_BRP, so we walk off the end of our thread_struct...
... except, a dodgy condition in the loop means that it never executes at all (bp cannot be NULL).
This patch fixes the code so that we remove the bp check and use the correct index for accessing the watchpoint structures.
--- arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/kernel/ptrace.c | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/hw_breakpoint.h +0 -1
@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 r*/ #define ARM_MAX_BRP 16#define ARM_MAX_WRP 16 -#define ARM_MAX_HBP_SLOTS (ARM_MAX_BRP + ARM_MAX_WRP)/* Virtual debug register bases. */ #define AARCH64_DBG_REG_BVR 0
arch/arm64/kernel/ptrace.c +2 -1
@@ -81,7 +81,8 @@ static void ptrace_hbptriggered(struct pbreak ; } } -for (i =ARM_MAX_BRP ; i <ARM_MAX_HBP_SLOTS && !bp; ++i) { + +for (i =0 ; i <ARM_MAX_WRP ; ++i) {if (current->thread.debug.hbp_watch[i] == bp) { info.si_errno = -((i <<1 ) +1 );break ;
Greg Kroah-Hartman
maintainerPATCH 41/238 ALSA: core: fix buffer overflow in snd_info_get_line()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream.
snd_info_get_line() documents that its last parameter must be one less than the buffer size, but this API design guarantees that (literally) every caller gets it wrong.
Just change this parameter to have its obvious meaning.
--- sound/core/info.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/info.c +2 -2
@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card ** snd_info_get_line - read one line from the procfs buffer * @buffer: the procfs buffer * @line: the buffer to store -* @len: the max. buffer size - 1 +* @len: the max. buffer size * * Reads one line from the buffer and stores the string. *
@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_bu buffer->stop =1 ;if (c =='\n' )break ; -if (len) { +if (len >1 ) { len--; *line++ = c; }
Greg Kroah-Hartman
maintainerPATCH 42/238 ALSA: hda - Fix digital mic on Acer Aspire 3830TG
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ff50479ad61069f3ee14863225aebe36d598e93e upstream.
Acer Aspire 3830TG with CX20588 codec has a digital built-in mic that has the same problem like many others, the inverted signal in stereo. Apply the same fixup to this machine, too.
--- sound/pci/hda/patch_conexant.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +8 -1
@@ -3237,6 +3237,7 @@ enum {CXT_FIXUP_HEADPHONE_MIC_PIN ,CXT_FIXUP_HEADPHONE_MIC ,CXT_FIXUP_GPIO1 , +CXT_FIXUP_ASPIRE_DMIC , CXT_FIXUP_THINKPAD_ACPI, };
@@ -3397,6 +3398,12 @@ static const struct hda_fixup cxt_fixups { } }, }, + [CXT_FIXUP_ASPIRE_DMIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_stereo_dmic, + .chained = true, + .chain_id = CXT_FIXUP_GPIO1, + }, [CXT_FIXUP_THINKPAD_ACPI] = { .type = HDA_FIXUP_FUNC, .v.func = hda_fixup_thinkpad_acpi,
@@ -3410,7 +3417,7 @@ static const struct snd_pci_quirk cxt505static const struct snd_pci_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x1025 ,0x0543 ,"Acer Aspire One 522" ,CXT_FIXUP_STEREO_DMIC ), -SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_GPIO1 ), +SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1043 ,0x138d ,"Asus" ,CXT_FIXUP_HEADPHONE_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x20f2 ,"Lenovo T400" ,CXT_PINCFG_LENOVO_TP410 ),SND_PCI_QUIRK (0x17aa ,0x215e ,"Lenovo T410" ,CXT_PINCFG_LENOVO_TP410 ),
Greg Kroah-Hartman
maintainerPATCH 43/238 ALSA: hda - Fix COEF setups for ALC1150 codec
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit acf08081adb5e8fe0519eb97bb49797ef52614d6 upstream.
ALC1150 codec seems to need the COEF- and PLL-setups just like its compatible ALC882 codec. Some machines (e.g. SunMicro X10SAT) show the problem like too low output volumes unless the COEF setup is applied.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -327,6 +327,7 @@ static void alc_auto_init_amp(struct hdacase 0x10ec0885 :case 0x10ec0887 :/*case 0x10ec0889:*/ /* this causes an SPDIF problem */ +case 0x10ec0900 :alc889_coef_init (codec);break ;case 0x10ec0888 :
@@ -2330,6 +2331,7 @@ static int patch_alc882(struct hda_codecswitch (codec->vendor_id) {case 0x10ec0882 :case 0x10ec0885 : +case 0x10ec0900 :break ;default :/* ALC883 and variants */
Greg Kroah-Hartman
maintainerPATCH 44/238 ALSA: hda - Fix invalid pin powermap without jack detection
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7a9744cb455e6faa287e148394b4b422a6f3c5c4 upstream.
When a driver is set up without the jack detection explicitly (either by passing a model option or via a specific fixup), the pin powermap of IDT/STAC codecs is set up wrongly, resulting in the silence output. It's because of a logic failure in stac_init_power_map(). It tries to avoid creating a callback for the pins that have other auto-hp and auto-mic callbacks, but the check is done in a wrong way at a wrong time. The stac_init_power_map() should be called after creating other jack detection ctls, and the jack callback should be created only for jack-detectable widgets.
This patch fixes the check in stac_init_power_map() and its callee at the right place, after snd_hda_gen_build_controls().
--- sound/pci/hda/patch_sigmatel.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/pci/hda/patch_sigmatel.c +12 -5
@@ -559,8 +559,8 @@ static void stac_init_power_map(struct hif (snd_hda_jack_tbl_get (codec, nid))continue ;if (def_conf ==AC_JACK_PORT_COMPLEX && - !(spec->vref_mute_led_nid == nid || -is_jack_detectable (codec, nid))) { + spec->vref_mute_led_nid != nid && +is_jack_detectable (codec, nid)) {snd_hda_jack_detect_enable_callback (codec, nid,STAC_PWR_EVENT , jack_update_power);
@@ -4212,11 +4212,18 @@ static int stac_parse_auto_config(structreturn err; } -stac_init_power_map (codec); -return 0 ; } +static int stac_build_controls (struct hda_codec *codec) +{ +int err =snd_hda_gen_build_controls (codec); + +if (err <0 ) +return err; +stac_init_power_map (codec); +return 0 ; +}static int stac_init (struct hda_codec *codec) {
@@ -4328,7 +4335,7 @@ static int stac_suspend(struct hda_codec#endif /* CONFIG_PM */ static const struct hda_codec_ops stac_patch_ops = { - .build_controls = snd_hda_gen_build_controls, + .build_controls = stac_build_controls, .build_pcms = snd_hda_gen_build_pcms, .init = stac_init, .free = stac_free,
Greg Kroah-Hartman
maintainerPATCH 45/238 ALSA: pcm: fix fifo_size frame calculation
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit a9960e6a293e6fc3ed414643bb4e4106272e4d0a upstream.
The calculated frame size was wrong because snd_pcm_format_physical_width() actually returns the number of bits, not bytes.
Use snd_pcm_format_size() instead, which not only returns bytes, but also simplifies the calculation.
--- sound/core/pcm_lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/pcm_lib.c +5 -3
@@ -1783,14 +1783,16 @@ static int snd_pcm_lib_ioctl_fifo_size(s {struct snd_pcm_hw_params *params = arg;snd_pcm_format_t format; -int channels, width; +int channels; +ssize_t frame_size; params->fifo_size = substream->runtime->hw.fifo_size;if (!(substream->runtime->hw.info &SNDRV_PCM_INFO_FIFO_IN_FRAMES )) { format =params_format (params); channels =params_channels (params); - width =snd_pcm_format_physical_width (format); - params->fifo_size /= width * channels; + frame_size =snd_pcm_format_size (format, channels); +if (frame_size >0 ) + params->fifo_size /= (unsigned )frame_size; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 46/238 cfq-iosched: Fix wrong children_weight calculation
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshiaki Makita <[email protected]>
commit e15693ef18e13e3e6bffe891fe140f18b8ff6d07 upstream.
cfq_group_service_tree_add() is applying new_weight at the beginning of the function via cfq_update_group_weight().
This actually allows weight to change between adding it to and subtracting it from children_weight, and triggers WARN_ON_ONCE() in cfq_group_service_tree_del(), or even causes oops by divide error during vfr calculation in cfq_group_service_tree_add().
The detailed scenario is as follows:
1. Create blkio cgroups X and Y as a child of X.
Set X's weight to 500 and perform some I/O to apply new_weight. This X's I/O completes before starting Y's I/O.
2. Y starts I/O and cfq_group_service_tree_add() is called with Y.
3. cfq_group_service_tree_add() walks up the tree during children_weight calculation and adds parent X's weight (500) to children_weight of root. children_weight becomes 500.
4. Set X's weight to 1000.
5. X starts I/O and cfq_group_service_tree_add() is called with X.
6. cfq_group_service_tree_add() applies its new_weight (1000).
7. I/O of Y completes and cfq_group_service_tree_del() is called with Y.
8. I/O of X completes and cfq_group_service_tree_del() is called with X.
9. cfq_group_service_tree_del() subtracts X's weight (1000) from children_weight of root. children_weight becomes -500.
This triggers WARN_ON_ONCE().
10. Set X's weight to 500.
11. X starts I/O and cfq_group_service_tree_add() is called with X.
12. cfq_group_service_tree_add() applies its new_weight (500) and adds it to children_weight of root. children_weight becomes 0. Calcularion of vfr triggers oops by divide error.
weight should be updated right before adding it to children_weight.
--- block/cfq-iosched.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
block/cfq-iosched.c +8 -3
@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_static void cfq_update_group_weight (struct cfq_group *cfqg) { -BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -if (cfqg->new_weight) { cfqg->weight = cfqg->new_weight; cfqg->new_weight =0 ; } +} + +static void +cfq_update_group_leaf_weight (struct cfq_group *cfqg) +{ +BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node));if (cfqg->new_leaf_weight) { cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb/* add to the service tree */ BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -cfq_update_group_weight (cfqg); +cfq_update_group_leaf_weight (cfqg);__cfq_group_service_tree_add (st, cfqg);/*
@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb*/ while ((parent =cfqg_parent (pos))) {if (propagate) { +cfq_update_group_weight (pos); propagate = !parent->nr_active++; parent->children_weight += pos->weight; }
Greg Kroah-Hartman
maintainerPATCH 47/238 HID: picolcd: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that raw_data that we hold in picolcd_pending structure are always kept within proper bounds.
--- drivers/hid/hid-picolcd_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-picolcd_core.c +6 -0
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_if (!data)return 1 ; +if (size >64 ) { +hid_warn (hdev,"invalid size value (%d) for picolcd raw event\n" , + size); +return 0 ; + } +if (report->id ==REPORT_KEY_STATE ) {if (data->input_keys) ret =picolcd_raw_keypad (data, report, raw_data+1 , size-1 );
Greg Kroah-Hartman
maintainerPATCH 48/238 HID: magicmouse: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that magicmouse_emit_touch() gets only valid values of raw_id.
--- drivers/hid/hid-magicmouse.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/hid-magicmouse.c +10 -0
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hif (size <4 || ((size -4 ) %9 ) !=0 )return 0 ; npoints = (size -4 ) /9 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for TRACKPAD_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *9 +4 );
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hif (size <6 || ((size -6 ) %8 ) !=0 )return 0 ; npoints = (size -6 ) /8 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for MOUSE_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *8 +6 );
Greg Kroah-Hartman
maintainerPATCH 49/238 HID: logitech-dj: prevent false errors to be shown
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 5abfe85c1d4694d5d4bbd13ecc166262b937adf0 upstream.
Commit "HID: logitech: perform bounds checking on device_id early enough" unfortunately leaks some errors to dmesg which are not real ones:
- if the report is not a DJ one, then there is not point in checking the device_id
- the receiver (index 0) can also receive some notifications which can be safely ignored given the current implementation
Move out the test regarding the report_id and also discards printing errors when the receiver got notified.
--- drivers/hid/hid-logitech-dj.c | 43 ++++++++++++++++++++++++------------------ drivers/hid/hid-logitech-dj.h | 1 2 files changed, 26 insertions(+), 18 deletions(-)
drivers/hid/hid-logitech-dj.c +25 -18
@@ -687,7 +687,6 @@ static int logi_dj_raw_event(struct hid_struct dj_receiver_dev *djrcv_dev =hid_get_drvdata (hdev);struct dj_report *dj_report = (struct dj_report *) data;unsigned long flags; -bool report_processed = false;dbg_hid ("%s, size:%d\n" , __func__, size);
@@ -714,34 +713,42 @@ static int logi_dj_raw_event(struct hid_* device (via hid_input_report() ) and return 1 so hid-core does not do * anything else with it. */ + +/* case 1) */ +if (data[0 ] !=REPORT_ID_DJ_SHORT ) +return false; +if ((dj_report->device_index <DJ_DEVICE_INDEX_MIN ) || (dj_report->device_index >DJ_DEVICE_INDEX_MAX )) { -dev_err (&hdev->dev,"%s: invalid device index:%d\n" , +/* +* Device index is wrong, bail out. +* This driver can ignore safely the receiver notifications, +* so ignore those reports too. +*/ +if (dj_report->device_index !=DJ_RECEIVER_INDEX ) +dev_err (&hdev->dev,"%s: invalid device index:%d\n" , __func__, dj_report->device_index);return false; }spin_lock_irqsave (&djrcv_dev->lock, flags); -if (dj_report->report_id ==REPORT_ID_DJ_SHORT ) { -switch (dj_report->report_type) { -case REPORT_TYPE_NOTIF_DEVICE_PAIRED : -case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : -logi_dj_recv_queue_notification (djrcv_dev, dj_report); -break ; -case REPORT_TYPE_NOTIF_CONNECTION_STATUS : -if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == -STATUS_LINKLOSS ) { -logi_dj_recv_forward_null_report (djrcv_dev, dj_report); - } -break ; -default : -logi_dj_recv_forward_report (djrcv_dev, dj_report); +switch (dj_report->report_type) { +case REPORT_TYPE_NOTIF_DEVICE_PAIRED : +case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : +logi_dj_recv_queue_notification (djrcv_dev, dj_report); +break ; +case REPORT_TYPE_NOTIF_CONNECTION_STATUS : +if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == +STATUS_LINKLOSS ) { +logi_dj_recv_forward_null_report (djrcv_dev, dj_report); } - report_processed = true; +break ; +default : +logi_dj_recv_forward_report (djrcv_dev, dj_report); }spin_unlock_irqrestore (&djrcv_dev->lock, flags); -return report_processed; +return true; } static int logi_dj_probe(struct hid_device *hdev,
drivers/hid/hid-logitech-dj.h +1 -0
@@ -27,6 +27,7 @@#define DJ_MAX_PAIRED_DEVICES 6#define DJ_MAX_NUMBER_NOTIFICATIONS 8 +#define DJ_RECEIVER_INDEX 0#define DJ_DEVICE_INDEX_MIN 1#define DJ_DEVICE_INDEX_MAX 6
Greg Kroah-Hartman
maintainerPATCH 50/238 xattr: fix check for simultaneous glibc header inclusion
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Brandenburger <[email protected]>
commit bfcfd44cce2774f19daeb59fb4e43fc9aa80e7b8 upstream.
The guard was introduced in commit ea1a8217b06b ("xattr: guard against simultaneous glibc header inclusion") but it is using #ifdef to check for a define that is either set to 1 or 0. Fix it to use #if instead.
* Without this patch:
$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
include/uapi/linux/xattr.h:19:0: warning: "XATTR_CREATE" redefined [enabled by default]
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
^
/usr/include/x86_64-linux-gnu/sys/xattr.h:32:0: note: this is the location of the previous definition
#define XATTR_CREATE XATTR_CREATE
^* With this patch:
$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
(no warnings)--- include/uapi/linux/xattr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/xattr.h +1 -1
@@ -13,7 +13,7 @@#ifndef _UAPI_LINUX_XATTR_H#define _UAPI_LINUX_XATTR_H -#ifdef __UAPI_DEF_XATTR +#if __UAPI_DEF_XATTR#define __USE_KERNEL_XATTR_DEFS#define XATTR_CREATE 0x1/* set value, fail if attr already exists */
Greg Kroah-Hartman
maintainerPATCH 51/238 drm/i915: Remove bogus __init annotation from DMI callbacks
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit bbe1c2740d3a25aa1dbe5d842d2ff09cddcdde0a upstream.
The __init annotations for the DMI callback functions are wrong as this code can be called even after the module has been initialized, e.g. like this:
# echo 1 > /sys/bus/pci/devices/0000:00:02.0/remove # modprobe i915 # echo 1 > /sys/bus/pci/rescan
The first command will remove the PCI device from the kernel's device list so the second command won't see it right away. But as it registers a PCI driver it'll see it on the third command. If the system happens to match one of the DMI table entries we'll try to call a function in long released memory and generate an Oops, at best.
Fix this by removing the bogus annotation.
Modpost should have caught that one but it ignores section reference mismatches from the .rodata section. :/
--- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_bios.c +1 -1
@@ -839,7 +839,7 @@ init_vbt_defaults(struct drm_i915_privat } } -static int __init intel_no_opregion_vbt_callback (const struct dmi_system_id *id) +static int intel_no_opregion_vbt_callback (const struct dmi_system_id *id) { DRM_DEBUG_KMS("Falling back to manually reading VBT from " "VBIOS ROM for %s\n",
drivers/gpu/drm/i915/intel_crt.c +1 -1
@@ -750,7 +750,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_crt_dmi_callback (const struct dmi_system_id *id) +static int intel_no_crt_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping CRT initialization for %s\n" , id->ident);return 1 ;
drivers/gpu/drm/i915/intel_lvds.c +1 -1
@@ -544,7 +544,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_lvds_dmi_callback (const struct dmi_system_id *id) +static int intel_no_lvds_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping LVDS initialization for %s\n" , id->ident);return 1 ;
Greg Kroah-Hartman
maintainerPATCH 52/238 drm/i915: Fix EIO/wedged handling in gem fault handler
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit 2232f0315c6688f5ff6b2067ea88d97542034873 upstream.
In
commit 1f83fee08d625f8d0130f9fe5ef7b17c2e022f3c
Author: Daniel Vetter <[email protected]> Date: Thu Nov 15 17:17:22 2012 +0100
drm/i915: clear up wedged transitions
I've accidentally inverted the EIO/wedged handling in the fault
handler: We want to return the EIO as a SIGBUS only if it's not because of the gpu having died, to prevent userspace from unduly dying.
In my defence the comment right above is completely misleading, so fix both.
v2: Drop the WARN_ON, it's not actually a bug to e.g. receive an -EIO when swap-in fails.
v3: Don't remove too much ... oops.
--- drivers/gpu/drm/i915/i915_gem.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/i915_gem.c +7 -4
@@ -1426,10 +1426,13 @@ unlock: out:switch (ret) {case -EIO : -/* If this -EIO is due to a gpu hang, give the reset code a -* chance to clean up the mess. Otherwise return the proper -* SIGBUS. */ -if (i915_terminally_wedged (&dev_priv->gpu_error)) { +/* +* We eat errors when the gpu is terminally wedged to avoid +* userspace unduly crashing (gl has no provisions for mmaps to +* fail). But any other -EIO isn't ours (e.g. swap in failure) +* and so needs to be reported. +*/ +if (!i915_terminally_wedged (&dev_priv->gpu_error)) { ret =VM_FAULT_SIGBUS ;break ; }
Greg Kroah-Hartman
maintainerPATCH 54/238 drm/ast: AST2000 cannot be detected correctly
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Y.C. Chen" <[email protected]>
commit 83502a5d34386f7c6973bc70e1c423f55f5a2e3a upstream.
Type error and cause AST2000 cannot be detected correctly
--- drivers/gpu/drm/ast/ast_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_main.c +1 -1
@@ -100,7 +100,7 @@ static int ast_detect_chip(struct drm_de } ast->vga2_clone = false; }else { - ast->chip =2000 ; + ast->chip =AST2000 ;DRM_INFO ("AST 2000 detected\n" ); } }
Greg Kroah-Hartman
maintainerPATCH 55/238 imx-drm: ipuv3-plane: fix ipu_plane_dpms()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 3a44a2058747d71385eb69691c7f977cb58cc293 upstream.
When unbinding imx-drm, the following oops was observed:
Unable to handle kernel NULL pointer dereference at virtual address 00000004 pgd = e995c000 [00000004] *pgd=4fea5831 Internal error: Oops: 817 [#1] SMP ARM Modules linked in: bnep rfcomm bluetooth nfsd exportfs hid_cypress brcmfmac brcmutil snd_soc_fsl_ssi snd_soc_fsl_spdif imx_pcm_fiq imx_pcm_dma snd_soc_sgtl5000 imx_sdma imx2_wdt imx_ldb(C) imx_thermal snd_soc_imx_sgtl5000 snd_soc_imx_spdif snd_soc_imx_audmux CPU: 1 PID: 779 Comm: bash Tainted: G C 3.16.0-rc2+ #1230 task: ea9eb180 ti: ea378000 task.ti: ea378000 PC is at ipu_dp_put+0x10/0x18 LR is at ipu_plane_dpms+0x60/0x8c pc : [<c0350d20>] lr : [<c04bd9e8>] psr: 200f0013
sp : ea379d80 ip : ea379d90 fp : ea379d8c
r10: 00100100 r9 : 00000000 r8 : 00200200
r7 : e9ba0264 r6 : e9ba01f8 r5 : 00000000 r4 : ea34b800 r3 : 00000000 r2 : 00000000 r1 : 0000009b r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 3995c04a DAC: 00000015 Process bash (pid: 779, stack limit = 0xea378240)
Stack: (0xea379d80 to 0xea37a000) ... Backtrace: [<c0350d10>] (ipu_dp_put) from [<c04bd9e8>] (ipu_plane_dpms+0x60/0x8c) [<c04bd988>] (ipu_plane_dpms) from [<c04bda40>] (ipu_disable_plane+0x2c/0x60) [<c04bda14>] (ipu_disable_plane) from [<c04bda9c>] (ipu_plane_destroy+0x28/0x60) [<c04bda74>] (ipu_plane_destroy) from [<c033ff84>] (drm_mode_config_cleanup+0x1b8/0x250) [<c033fdcc>] (drm_mode_config_cleanup) from [<c04bc234>] (imx_drm_driver_unload+0x44/0x4c) [<c04bc1f0>] (imx_drm_driver_unload) from [<c03394a4>] (drm_dev_unregister+0x2c/0xa0) [<c0339478>] (drm_dev_unregister) from [<c0339f8c>] (drm_put_dev+0x30/0x6c) [<c0339f5c>] (drm_put_dev) from [<c04bc1cc>] (imx_drm_unbind+0x14/0x18) [<c04bc1b8>] (imx_drm_unbind) from [<c03530b4>] (component_master_del+0xbc/0xd8) ... Code: e1a0c00d e92dd800 e24cb004 e3a03000 (e5c03004)
This is caused by a missing check in ipu_plane_dpms for a NULL pointer.
--- drivers/staging/imx-drm/ipuv3-plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/imx-drm/ipuv3-plane.c +2 -1
@@ -277,7 +277,8 @@ static void ipu_plane_dpms(struct ipu_plipu_idmac_put (ipu_plane->ipu_ch);ipu_dmfc_put (ipu_plane->dmfc); -ipu_dp_put (ipu_plane->dp); +if (ipu_plane->dp) +ipu_dp_put (ipu_plane->dp); } }
Greg Kroah-Hartman
maintainerPATCH 56/238 drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit f01ea0c3d9db536c64d47922716d8b3b8f21d850 upstream.
The code waiting for fifo idle was incorrect and could possibly spin forever under certain circumstances.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +2 -1
@@ -180,8 +180,9 @@ void vmw_fifo_release(struct vmw_privatemutex_lock (&dev_priv->hw_mutex); +vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC );while (vmw_read (dev_priv,SVGA_REG_BUSY ) !=0 ) -vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC ); + ; dev_priv->last_read_seqno =ioread32 (fifo_mem +SVGA_FIFO_FENCE );
Greg Kroah-Hartman
maintainerPATCH 58/238 drm/radeon: Add missing lines to ci_set_thermal_temperature_range
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Chernovskiy <[email protected]>
commit 6bce8d9772c1c606921a9c99e566eb14202f6669 upstream.
Properly set the thermal min and max temp on CI. Otherwise, we end up setting the thermal ranges to 0 on resume and end up in the lowest power state.
--- drivers/gpu/drm/radeon/ci_dpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/radeon/ci_dpm.c +3 -0
@@ -851,6 +851,9 @@ static int ci_set_thermal_temperature_raWREG32_SMC (CG_THERMAL_CTRL , tmp);#endif + rdev->pm.dpm.thermal.min_temp = low_temp; + rdev->pm.dpm.thermal.max_temp = high_temp; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 61/238 drm/radeon/dpm: set the thermal type properly for special configs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit ff4377924f7e587c61bcbc704eafecf6c7bd2e00 upstream.
On systems with special thermal configurations make sure we make note of the thermal setup. This is required for proper firmware configuration on these systems.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +19 -7
@@ -2273,19 +2273,31 @@ static void radeon_atombios_add_pplib_th (controller->ucFanParameters & ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); rdev->pm.int_thermal_type =THERMAL_TYPE_KV ; - }else if ((controller->ucType == -ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO ) || - (controller->ucType == -ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL ) || - (controller->ucType == -ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL )) { -DRM_INFO ("Special thermal controller config\n" ); + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO ) { +DRM_INFO ("External GPIO thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EXTERNAL_GPIO ; + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL ) { +DRM_INFO ("ADT7473 with internal thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_ADT7473_WITH_INTERNAL ; + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL ) { +DRM_INFO ("EMC2103 with internal thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EMC2103_WITH_INTERNAL ; }else if (controller->ucType <ARRAY_SIZE (pp_lib_thermal_controller_names)) {DRM_INFO ("Possible %s thermal controller at 0x%02x %s fan control\n" , pp_lib_thermal_controller_names[controller->ucType], controller->ucI2cAddress >>1 , (controller->ucFanParameters &ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EXTERNAL ; i2c_bus =radeon_lookup_i2c_gpio (rdev, controller->ucI2cLine); rdev->pm.i2c_bus =radeon_i2c_lookup (rdev, &i2c_bus);if (rdev->pm.i2c_bus) {
Greg Kroah-Hartman
maintainerPATCH 62/238 drm/radeon: add connector quirk for fujitsu board
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 1952f24d0fa6292d65f886887af87ba8ac79b3ba upstream.
Vbios connector table lists non-existent VGA port.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=83184
--- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/radeon/radeon_atombios.c +7 -0
@@ -447,6 +447,13 @@ static bool radeon_atom_apply_quirks(str } } +/* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ +if ((dev->pdev->device ==0x9805 ) && + (dev->pdev->subsystem_vendor ==0x1734 ) && + (dev->pdev->subsystem_device ==0x11bd )) { +if (*connector_type ==DRM_MODE_CONNECTOR_VGA ) +return false; + }return true; }
Greg Kroah-Hartman
maintainerPATCH 67/238 xtensa: replace IOCTL code definitions with constants
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.
This fixes userspace code that builds on other architectures but fails on xtensa due to references to structures that other architectures don't refer to. E.g. this fixes the following issue with python-2.7.8:
python-2.7.8/Modules/termios.c:861:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERGETMULTI", TIOCSERGETMULTI},
python-2.7.8/Modules/termios.c:870:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERSETMULTI", TIOCSERSETMULTI},
python-2.7.8/Modules/termios.c:900:24: error: invalid application
of 'sizeof' to incomplete type 'struct tty_struct' {"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},
--- arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/xtensa/include/uapi/asm/ioctls.h +10 -9
@@ -28,17 +28,17 @@#define TCSETSW 0x5403#define TCSETSF 0x5404 -#define TCGETA _IOR('t', 23, struct termio) -#define TCSETA _IOW('t', 24, struct termio) -#define TCSETAW _IOW('t', 25, struct termio) -#define TCSETAF _IOW('t', 28, struct termio) +#define TCGETA 0x80127417/* _IOR('t', 23, struct termio) */ +#define TCSETA 0x40127418/* _IOW('t', 24, struct termio) */ +#define TCSETAW 0x40127419/* _IOW('t', 25, struct termio) */ +#define TCSETAF 0x4012741C/* _IOW('t', 28, struct termio) */ #define TCSBRK _IO('t', 29)#define TCXONC _IO('t', 30)#define TCFLSH _IO('t', 31) -#define TIOCSWINSZ _IOW('t', 103, struct winsize) -#define TIOCGWINSZ _IOR('t', 104, struct winsize) +#define TIOCSWINSZ 0x40087467/* _IOW('t', 103, struct winsize) */ +#define TIOCGWINSZ 0x80087468/* _IOR('t', 104, struct winsize) */ #define TIOCSTART _IO('t', 110)/* start output, like ^Q */ #define TIOCSTOP _IO('t', 111)/* stop output, like ^S */ #define TIOCOUTQ _IOR('t', 115, int)/* output queue size */
@@ -88,7 +88,6 @@#define TIOCSETD _IOW('T', 35, int)#define TIOCGETD _IOR('T', 36, int)#define TCSBRKP _IOW('T', 37, int)/* Needed for POSIX tcsendbreak()*/ -#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct)/* For debugging only*/ #define TIOCSBRK _IO('T', 39)/* BSD compatibility */ #define TIOCCBRK _IO('T', 40)/* BSD compatibility */ #define TIOCGSID _IOR('T', 41, pid_t)/* Return the session ID of FD*/
@@ -114,8 +113,10 @@#define TIOCSERGETLSR _IOR('T', 89, unsigned int)/* Get line status reg. */ /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */ # define TIOCSER_TEMT 0x01/* Transmitter physically empty */ -#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct)/* Get multiport config */ -#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct)/* Set multiport config */ +#define TIOCSERGETMULTI 0x80a8545a/* Get multiport config */ +/* _IOR('T', 90, struct serial_multiport_struct) */ +#define TIOCSERSETMULTI 0x40a8545b/* Set multiport config */ +/* _IOW('T', 91, struct serial_multiport_struct) */ #define TIOCMIWAIT _IO('T', 92)/* wait for a change on serial input line(s) */ #define TIOCGICOUNT 0x545D/* read serial port inline interrupt counts */
Greg Kroah-Hartman
maintainerPATCH 68/238 xtensa: fix address checks in dma_{alloc,free}_coherent
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Douglas <[email protected]>
commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.
Virtual address is translated to the XCHAL_KSEG_CACHED region in the dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE range.
Change check for end of the range from 'addr >= X' to 'addr > X - 1' to handle the case of X == 0.
Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.
--- arch/xtensa/kernel/pci-dma.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/xtensa/kernel/pci-dma.c +6 -6
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si/* We currently don't support coherent memory outside KSEG */ -if (ret <XCHAL_KSEG_CACHED_VADDR - || ret >=XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (ret <XCHAL_KSEG_CACHED_VADDR || + ret >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );if (ret !=0 ) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);void dma_free_coherent (struct device *hwdev,size_t size,void *vaddr,dma_addr_t dma_handle) { -long addr=(long )vaddr+XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; +unsigned long addr = (unsigned long )vaddr + +XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; -if (addr <0 || addr >=XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (addr <XCHAL_KSEG_CACHED_VADDR || + addr >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );free_pages (addr,get_order (size)); }
Greg Kroah-Hartman
maintainerPATCH 69/238 xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.
With SMP and a lot of debug options enabled task_struct::thread gets out of reach of s32i/l32i instructions with base pointing at task_struct, breaking build with the following messages:
arch/xtensa/kernel/entry.S: Assembler messages:
arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048' arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040' arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'
Change base to point to task_struct::thread in such cases. Don't use a10 in _switch_to to save/restore prev pointer as a2 is not clobbered.
--- arch/xtensa/include/asm/uaccess.h | 5 +++++ arch/xtensa/kernel/entry.S | 12 ++++++++---- 2 files changed, 13 insertions(+), 4 deletions(-)
arch/xtensa/include/asm/uaccess.h +5 -0
@@ -52,7 +52,12 @@*/ .macro get_fs ad, sp GET_CURRENT(\ad,\sp) +#if THREAD_CURRENT_DS >1020 + addi \ad, \ad, TASK_THREAD + l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD +#else l32i \ad, \ad, THREAD_CURRENT_DS +#endif .endm/*
arch/xtensa/kernel/entry.S +8 -4
@@ -1820,7 +1820,6 @@ ENTRY(_switch_to) entry a1, 16 - mov a10, a2 # preserve 'prev' (a2) mov a11, a3 # and 'next' (a3) l32i a4, a2, TASK_THREAD_INFO
@@ -1828,8 +1827,14 @@ ENTRY(_switch_to) save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER - s32i a0, a10, THREAD_RA # save return address - s32i a1, a10, THREAD_SP # save stack pointer +#if THREAD_RA > 1020 || THREAD_SP > 1020 + addi a10, a2, TASK_THREAD + s32i a0, a10, THREAD_RA - TASK_THREAD # save return address + s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer +#else + s32i a0, a2, THREAD_RA # save return address + s32i a1, a2, THREAD_SP # save stack pointer +#endif /* Disable ints while we manipulate the stack pointer. */
@@ -1870,7 +1875,6 @@ ENTRY(_switch_to) load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER wsr a14, ps - mov a2, a10 # return 'prev' rsync retw
Greg Kroah-Hartman
maintainerPATCH 70/238 xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.
Current definition of TLBTEMP_BASE_2 is always 32K above the TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER) to determine TLBTEMP region where the fault happened. The size of the TLBTEMP region is also checked incorrectly: not 64K, but twice data cache way size (whicht may as well be less than the instruction cache way size).
Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size. Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or the instruction cache way size, and use it to determine if the second level TLB miss occured in the TLBTEMP region.
Practical occurence of page faults in the TLBTEMP area is extremely rare, this code can be tested by deletion of all w[di]tlb instructions in the tlbtemp_mapping region.
--- arch/xtensa/include/asm/pgtable.h | 7 ++++++- arch/xtensa/kernel/entry.S | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/xtensa/include/asm/pgtable.h +6 -1
@@ -67,7 +67,12 @@#define VMALLOC_START 0xC0000000#define VMALLOC_END 0xC7FEFFFF#define TLBTEMP_BASE_1 0xC7FF0000 -#define TLBTEMP_BASE_2 0xC7FF8000 +#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE) +#if 2 *DCACHE_WAY_SIZE >ICACHE_WAY_SIZE +#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE) +#else +#define TLBTEMP_SIZE ICACHE_WAY_SIZE +#endif /* * For the Xtensa architecture, the PTE layout is as follows:
arch/xtensa/kernel/entry.S +1 -1
@@ -1565,7 +1565,7 @@ ENTRY(fast_second_level_miss) rsr a0, excvaddr bltu a0, a3, 2f - addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT)) + addi a1, a0, -TLBTEMP_SIZE bgeu a1, a3, 2f /* Check if we have to restore an ITLB mapping. */
Greg Kroah-Hartman
maintainerPATCH 71/238 xtensa: fix a6 and a7 handling in fast_syscall_xtensa
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.
Remove restoring a6 on some return paths and instead modify and restore it in a single place, using symbolic name.
Correctly restore a7 from PT_AREG7 in case of illegal a6 value.
--- arch/xtensa/kernel/entry.S | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
arch/xtensa/kernel/entry.S +5 -7
@@ -1001,9 +1001,8 @@ ENTRY(fast_syscall_xtensa) movi a7, 4 # sizeof(unsigned int) access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp - addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1 - _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill - _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp + _bgeui a6, SYS_XTENSA_COUNT, .Lill + _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp /* Fall through for ATOMIC_CMP_SWP. */
@@ -1015,27 +1014,26 @@ TRY s32i a5, a3, 0 # different, modify l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 1 # and return 1 - addi a6, a6, 1 # restore a6 (really necessary?) rfe 1: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 0 # return 0 (note that we cannot set - addi a6, a6, 1 # restore a6 (really necessary?) rfe .Lnswp: /* Atomic set, add, and exg_add. */ TRY l32i a7, a3, 0 # orig + addi a6, a6, -SYS_XTENSA_ATOMIC_SET add a0, a4, a7 # + arg moveqz a0, a4, a6 # set + addi a6, a6, SYS_XTENSA_ATOMIC_SET TRY s32i a0, a3, 0 # write new value mov a0, a2 mov a2, a7 l32i a7, a0, PT_AREG7 # restore a7 l32i a0, a0, PT_AREG0 # restore a0 - addi a6, a6, 1 # restore a6 (really necessary?) rfe CATCH
@@ -1044,7 +1042,7 @@ CATCH movi a2, -EFAULT rfe -.Lill: l32i a7, a2, PT_AREG0 # restore a7 +.Lill: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, -EINVAL rfe
Greg Kroah-Hartman
maintainerPATCH 72/238 USB: serial: pl2303: add device id for ztek device
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <[email protected]>
commit 91fcb1ce420e0a5f8d92d556d7008a78bc6ce1eb upstream.
This adds a new device id to the pl2303 driver for the ZTEK device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -45,6 +45,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -22,6 +22,7 @@#define PL2303_PRODUCT_ID_GPRS 0x0609#define PL2303_PRODUCT_ID_HCR331 0x331a#define PL2303_PRODUCT_ID_MOTOROLA 0x0307 +#define PL2303_PRODUCT_ID_ZTEK 0xe1f1#define ATEN_VENDOR_ID 0x0557#define ATEN_VENDOR_ID2 0x0547
Greg Kroah-Hartman
maintainerPATCH 73/238 USB: serial: fix potential stack buffer overflow
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d979e9f9ecab04c1ecca741370e30a8a498893f5 upstream.
Make sure to verify the maximum number of endpoints per type to avoid writing beyond the end of a stack-allocated array.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of endpoints of a certain type reported by a device did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/usb/serial/usb-serial.c +22 -10
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_bulk_in (endpoint)) {/* we found a bulk in endpoint */ dev_dbg (ddev,"found bulk in on endpoint %d\n" , i); - bulk_in_endpoint[num_bulk_in] = endpoint; - ++num_bulk_in; +if (num_bulk_in <MAX_NUM_PORTS ) { + bulk_in_endpoint[num_bulk_in] = endpoint; + ++num_bulk_in; + } }if (usb_endpoint_is_bulk_out (endpoint)) {/* we found a bulk out endpoint */ dev_dbg (ddev,"found bulk out on endpoint %d\n" , i); - bulk_out_endpoint[num_bulk_out] = endpoint; - ++num_bulk_out; +if (num_bulk_out <MAX_NUM_PORTS ) { + bulk_out_endpoint[num_bulk_out] = endpoint; + ++num_bulk_out; + } }if (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in on endpoint %d\n" , i); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = + endpoint; + ++num_interrupt_in; + } }if (usb_endpoint_is_int_out (endpoint)) {/* we found an interrupt out endpoint */ dev_dbg (ddev,"found interrupt out on endpoint %d\n" , i); - interrupt_out_endpoint[num_interrupt_out] = endpoint; - ++num_interrupt_out; +if (num_interrupt_out <MAX_NUM_PORTS ) { + interrupt_out_endpoint[num_interrupt_out] = + endpoint; + ++num_interrupt_out; + } } }
@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in for Prolific device on separate interface\n" ); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = endpoint; + ++num_interrupt_in; + } } } }
Greg Kroah-Hartman
maintainerPATCH 74/238 USB: sisusb: add device id for Magic Control USB video
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <[email protected]>
commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.
I have a j5 create (JUA210) USB 2 video device and adding it device id to SIS USB video gets it to work.
--- drivers/usb/misc/sisusbvga/sisusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/sisusbvga/sisusb.c +1 -0
@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb { USB_DEVICE(0x0711, 0x0918) }, { USB_DEVICE(0x0711, 0x0920) }, { USB_DEVICE(0x0711, 0x0950) }, + { USB_DEVICE(0x0711, 0x5200) }, { USB_DEVICE(0x182d, 0x021c) }, { USB_DEVICE(0x182d, 0x0269) }, { }
Greg Kroah-Hartman
maintainerPATCH 75/238 USB: serial: fix potential heap buffer overflow
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.
Make sure to verify the number of ports requested by subdriver to avoid writing beyond the end of fixed-size array in interface data.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of ports requested by a subdriver (which could have been determined from device descriptors) did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/usb-serial.c +5 -0
@@ -862,6 +862,11 @@ static int usb_serial_probe(struct usb_i num_ports = type->num_ports; } +if (num_ports >MAX_NUM_PORTS ) { +dev_warn (ddev,"too many ports requested: %d\n" , num_ports); + num_ports =MAX_NUM_PORTS ; + } + serial->num_ports = num_ports; serial->num_bulk_in = num_bulk_in; serial->num_bulk_out = num_bulk_out;
Greg Kroah-Hartman
maintainerPATCH 76/238 USB: option: reduce interrupt-urb logging verbosity
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit f0e4cba2534cd88476dff920727c81350130f3c5 upstream.
Do not log normal interrupt-urb shutdowns as errors.
The option driver has always been logging any nonzero interrupt-urb status as an error, including when the urb is killed during normal operation.
Commit 9096f1fbba91 ("USB: usb_wwan: fix potential NULL-deref at resume") moved the interrupt urb submission from port probe and release to open and close, thus potentially increasing the number of these false-positive error messages dramatically.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1917,6 +1917,8 @@ static void option_instat_callback(strucdev_dbg (dev,"%s: type %x req %x\n" , __func__, req_pkt->bRequestType, req_pkt->bRequest); } + }else if (status == -ENOENT || status == -ESHUTDOWN ) { +dev_dbg (dev,"%s: urb stopped: %d\n" , __func__, status); }else dev_err (dev,"%s: error %d\n" , __func__, status);
Greg Kroah-Hartman
maintainerPATCH 78/238 Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 63a901c06e3c2c45bd601916fe04e870e9ccae1e upstream.
This reverts commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev").
Move the IDs of the devices that were previously driven by the option driver back to that driver.
As several users have reported, the zte_ev driver is causing random disconnects as well as reconnect failures.
A closer analysis of the zte_ev setup code reveals that it consists of standard CDC requests (SET/GET_LINE_CODING and SET_CONTROL_LINE_STATE) but unfortunately fails to get some of those right. In particular, as reported by Liu Lei, it fails to lower DTR/RTS on close. It also appears that the control requests lack the interface argument.
Note that the zte_ev driver is based on code (once) distributed by ZTE that still appears to originally have been reverse-engineered and bolted onto the generic driver.
Since line control is already handled properly by the option driver, and the SET/GET_LINE_CODING requests appears to be redundant (amounts to a SET 9600 8N1), this is a first step in ultimately removing the redundant zte_ev driver.
Note that AC2726 had already been moved back to option, and that some IDs were in the device table of both drivers prior to the commit being reverted.
--- drivers/usb/serial/option.c | 24 +++++++++++++++++++++--- drivers/usb/serial/zte_ev.c | 18 ------------------ 2 files changed, 21 insertions(+), 21 deletions(-)
drivers/usb/serial/option.c +21 -3
@@ -275,8 +275,12 @@ static void option_instat_callback(struc#define ZTE_PRODUCT_MF622 0x0001#define ZTE_PRODUCT_MF628 0x0015#define ZTE_PRODUCT_MF626 0x0031 -#define ZTE_PRODUCT_MC2718 0xffe8#define ZTE_PRODUCT_AC2726 0xfff1 +#define ZTE_PRODUCT_CDMA_TECH 0xfffe +#define ZTE_PRODUCT_AC8710T 0xffff +#define ZTE_PRODUCT_MC2718 0xffe8 +#define ZTE_PRODUCT_AD3812 0xffeb +#define ZTE_PRODUCT_MC2716 0xffed#define BENQ_VENDOR_ID 0x04a5#define BENQ_PRODUCT_H10 0x4068
@@ -531,10 +535,18 @@ static const struct option_blacklist_inf .reserved = BIT(4), }; +static const struct option_blacklist_info zte_ad3812_z_blacklist = { + .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), +}; +static const struct option_blacklist_info zte_mc2718_z_blacklist = { .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ) |BIT (4 ), }; +static const struct option_blacklist_info zte_mc2716_z_blacklist = { + .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct option_blacklist_info huawei_cdc12_blacklist = { .reserved =BIT (1 ) |BIT (2 ), };
@@ -1074,6 +1086,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1548,13 +1561,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, -/* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
drivers/usb/serial/zte_ev.c +0 -18
@@ -272,27 +272,9 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { -/* AC8710, AC8710T */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffff ,0xff ,0xff ,0xff ) }, -/* AC8700 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xfffe ,0xff ,0xff ,0xff ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x19d2 ,0xfffc ) }, - {USB_DEVICE (0x19d2 ,0xfffb ) }, -/* AC8710_V3 */ - {USB_DEVICE (0x19d2 ,0xfff6 ) }, - {USB_DEVICE (0x19d2 ,0xfff7 ) }, - {USB_DEVICE (0x19d2 ,0xfff8 ) }, - {USB_DEVICE (0x19d2 ,0xfff9 ) }, - {USB_DEVICE (0x19d2 ,0xffee ) }, -/* AC2716, MC2716 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffed ,0xff ,0xff ,0xff ) }, -/* AD3812 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffeb ,0xff ,0xff ,0xff ) }, - {USB_DEVICE (0x19d2 ,0xffec ) }, {USB_DEVICE (0x05C6 ,0x3197 ) }, - {USB_DEVICE (0x05C6 ,0x6000 ) }, {USB_DEVICE (0x05C6 ,0x9008 ) }, { }, };
Greg Kroah-Hartman
maintainerPATCH 79/238 USB: zte_ev: remove duplicate Gobi PID
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 95be5739588c56a9327e477aa0ba3c81c5cf8631 upstream.
Remove dublicate Gobi PID 0x9008 which is already handled by the qcserial driver since commit f05932c0caf4 ("USB: qcserial: Add extra device IDs").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -275,7 +275,6 @@ static const struct usb_device_id id_tab/* MG880 */ { USB_DEVICE(0x19d2, 0xfffd) }, { USB_DEVICE(0x05C6, 0x3197) }, - { USB_DEVICE(0x05C6, 0x9008) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 80/238 USB: zte_ev: remove duplicate Qualcom PID
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 754eb21c0bbbbc4b8830a9a864b286323b84225f upstream.
Remove dublicate Qualcom PID 0x3197 which is already handled by the moto-modem driver since commit 6986a978eec7 ("USB: add new moto_modem driver for some Morotola phones").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -274,7 +274,6 @@ static void zte_ev_usb_serial_close(strustatic const struct usb_device_id id_table[] = {/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x05C6 ,0x3197 ) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 84/238 usb: phy: tegra: Avoid use of sizeof(void)
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
commit 9ce9ec95fb9b82e09b55a52f1bb8a362bf8f74d8 upstream.
The PHY configuration is stored in an opaque "config" field, but when allocating the structure, its proper size needs to be known. In the case of UTMI, the proper structure is tegra_utmip_config of which a local variable already exists, so we can use that to obtain the size from.
Fixes the following warning from the sparse checker:
drivers/usb/phy/phy-tegra-usb.c:882:17: warning: expression using sizeof(void)
--- drivers/usb/phy/phy-tegra-usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/phy/phy-tegra-usb.c +2 -2
@@ -881,8 +881,8 @@ static int utmi_phy_probe(struct tegra_ureturn -ENOMEM ; } - tegra_phy->config =devm_kzalloc (&pdev->dev, -sizeof (*tegra_phy->config),GFP_KERNEL ); + tegra_phy->config =devm_kzalloc (&pdev->dev,sizeof (*config), +GFP_KERNEL );if (!tegra_phy->config) {dev_err (&pdev->dev,"unable to allocate memory for USB UTMIP config\n" );
Greg Kroah-Hartman
maintainerPATCH 85/238 usb: phy: twl4030-usb: Fix lost interrupts after ID pin goes down
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 85601b8d81e24ce9ae2d31e93f35468ab7616b18 upstream.
Commit 249751f22380 ("usb: phy: twl4030-usb: poll for ID disconnect") added twl4030_id_workaround_work() to deal with lost interrupts after ID pin goes down. Looks like commit f1ddc24c9e33 ("usb: phy:
twl4030-usb: remove *set_suspend* and *phy_init* ops") changed things around for the generic phy framework, and delayed work no longer got called except initially during boot.
The PHY connect and disconnect interrupts for twl4030-usb are not working after disconnecting a USB-A cable from the board, and the deeper idle states for omap are blocked as the USB controller stays busy.
The issue can be solved by calling delayed work from twl4030_usb_irq() when ID pin is down and the PHY is not asleep like we already do in twl4030_id_workaround_work().
But as both twl4030_usb_irq() and twl4030_id_workaround_work() already do pretty much the same thing, let's call twl4030_usb_irq() from twl4030_id_workaround_work() instead of adding some more duplicate code. We also must call sysfs_notify() only when we have an interrupt and not from the delayed work as notified by Grazvydas Ignotas <[email protected]>.
--- drivers/phy/phy-twl4030-usb.c | 33 ++++++++++----------------------- 1 file changed, 10 insertions(+), 23 deletions(-)
drivers/phy/phy-twl4030-usb.c +10 -23
@@ -560,7 +560,15 @@ static irqreturn_t twl4030_usb_irq(int i*/ omap_musb_mailbox (status); } -sysfs_notify (&twl->dev->kobj,NULL ,"vbus" ); + +/* don't schedule during sleep - irq works right then */ +if (status ==OMAP_MUSB_ID_GROUND && !twl->asleep) { +cancel_delayed_work (&twl->id_workaround_work); +schedule_delayed_work (&twl->id_workaround_work,HZ ); + } + +if (irq) +sysfs_notify (&twl->dev->kobj,NULL ,"vbus" );return IRQ_HANDLED ; }
@@ -569,29 +577,8 @@ static void twl4030_id_workaround_work(s { struct twl4030_usb *twl = container_of(work, struct twl4030_usb, id_workaround_work.work); -enum omap_musb_vbus_id_status status; -bool status_changed = false; - - status =twl4030_usb_linkstat (twl); - -spin_lock_irq (&twl->lock); -if (status >=0 && status != twl->linkstat) { - twl->linkstat = status; - status_changed = true; - } -spin_unlock_irq (&twl->lock); -if (status_changed) { -dev_dbg (twl->dev,"handle missing status change to %d\n" , - status); -omap_musb_mailbox (status); - } - -/* don't schedule during sleep - irq works right then */ -if (status ==OMAP_MUSB_ID_GROUND && !twl->asleep) { -cancel_delayed_work (&twl->id_workaround_work); -schedule_delayed_work (&twl->id_workaround_work,HZ ); - } +twl4030_usb_irq (0 , twl); }static int twl4030_phy_init (struct phy *phy)
Greg Kroah-Hartman
maintainerPATCH 86/238 usb: phy: twl4030-usb: Fix regressions to runtime PM on omaps
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4 upstream.
Commit 30a70b026b4cd ("usb: musb: fix obex in g_nokia.ko causing kernel panic") attempted to fix runtime PM handling for PHYs that are on the I2C bus. Commit 3063a12be2b0 ("usb: musb: fix PHY power on/off") then changed things around to enable of PHYs that rely on runtime PM.
These changes however broke idling of the PHY and causes at least 100 mW extra power consumption on omaps, which is a lot with the idle power consumption being below 10 mW range on many devices.
As calling phy_power_on/off from runtime PM calls in the USB causes complicated issues with I2C connected PHYs, let's just let the PHY do it's own runtime PM as needed. This leaves out the dependency between PHYs and USB controller drivers for runtime PM.
Let's fix the regression for twl4030-usb by adding minimal runtime PM support. This allows idling the PHY on disconnect.
Note that we are changing to use standard runtime PM handling for twl4030_phy_init() as that function just checks the state and does not initialize the PHY. The PHY won't get initialized until in twl4030_phy_power_on().
--- drivers/phy/phy-twl4030-usb.c | 88 ++++++++++++++++++++++++++++++------------ 1 file changed, 63 insertions(+), 25 deletions(-)
drivers/phy/phy-twl4030-usb.c +63 -25
@@ -34,6 +34,7 @@#include <linux/delay.h> #include <linux/usb/otg.h> #include <linux/phy/phy.h> +#include <linux/pm_runtime.h> #include <linux/usb/musb-omap.h> #include <linux/usb/ulpi.h> #include <linux/i2c/twl.h>
@@ -422,37 +423,55 @@ static void twl4030_phy_power(struct twl } } -static int twl4030_phy_power_off (struct phy *phy) +static int twl4030_usb_runtime_suspend (struct device *dev) { -struct twl4030_usb *twl =phy_get_drvdata (phy); +struct twl4030_usb *twl =dev_get_drvdata (dev); +dev_dbg (twl->dev,"%s\n" , __func__);if (twl->asleep)return 0 ;twl4030_phy_power (twl,0 ); twl->asleep =1 ; -dev_dbg (twl->dev,"%s\n" , __func__); +return 0 ; } -static void __twl4030_phy_power_on (struct twl4030_usb *twl) +static int twl4030_usb_runtime_resume (struct device *dev) { +struct twl4030_usb *twl =dev_get_drvdata (dev); + +dev_dbg (twl->dev,"%s\n" , __func__); +if (!twl->asleep) +return 0 ; +twl4030_phy_power (twl,1 ); -twl4030_i2c_access (twl,1 ); -twl4030_usb_set_mode (twl, twl->usb_mode); -if (twl->usb_mode ==T2_USB_MODE_ULPI ) -twl4030_i2c_access (twl,0 ); + twl->asleep =0 ; + +return 0 ; +} + +static int twl4030_phy_power_off (struct phy *phy) +{ +struct twl4030_usb *twl =phy_get_drvdata (phy); + +dev_dbg (twl->dev,"%s\n" , __func__); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); + +return 0 ; }static int twl4030_phy_power_on (struct phy *phy) {struct twl4030_usb *twl =phy_get_drvdata (phy); -if (!twl->asleep) -return 0 ; -__twl4030_phy_power_on (twl); - twl->asleep =0 ;dev_dbg (twl->dev,"%s\n" , __func__); +pm_runtime_get_sync (twl->dev); +twl4030_i2c_access (twl,1 ); +twl4030_usb_set_mode (twl, twl->usb_mode); +if (twl->usb_mode ==T2_USB_MODE_ULPI ) +twl4030_i2c_access (twl,0 );/* * XXX When VBUS gets driven after musb goes to A mode,
@@ -558,6 +577,16 @@ static irqreturn_t twl4030_usb_irq(int i* USB_LINK_VBUS state. musb_hdrc won't care until it * starts to handle softconnect right. */ +if ((status ==OMAP_MUSB_VBUS_VALID ) || + (status ==OMAP_MUSB_ID_GROUND )) { +if (twl->asleep) +pm_runtime_get_sync (twl->dev); + }else { +if (!twl->asleep) { +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); + } + }omap_musb_mailbox (status); }
@@ -586,22 +615,17 @@ static int twl4030_phy_init(struct phy *struct twl4030_usb *twl =phy_get_drvdata (phy);enum omap_musb_vbus_id_status status; -/* -* Start in sleep state, we'll get called through set_suspend() -* callback when musb is runtime resumed and it's time to start. -*/ -__twl4030_phy_power (twl,0 ); - twl->asleep =1 ; - +pm_runtime_get_sync (twl->dev); status =twl4030_usb_linkstat (twl); twl->linkstat = status; -if (status ==OMAP_MUSB_ID_GROUND || status ==OMAP_MUSB_VBUS_VALID ) { +if (status ==OMAP_MUSB_ID_GROUND || status ==OMAP_MUSB_VBUS_VALID )omap_musb_mailbox (twl->linkstat); -twl4030_phy_power_on (phy); - }sysfs_notify (&twl->dev->kobj,NULL ,"vbus" ); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); +return 0 ; }
@@ -637,6 +661,11 @@ static const struct phy_ops ops = { .owner = THIS_MODULE, }; +static const struct dev_pm_ops twl4030_usb_pm_ops = { +SET_RUNTIME_PM_OPS (twl4030_usb_runtime_suspend, + twl4030_usb_runtime_resume,NULL ) +}; +static int twl4030_usb_probe (struct platform_device *pdev) {struct twl4030_usb_data *pdata =dev_get_platdata (&pdev->dev);
@@ -713,6 +742,11 @@ static int twl4030_usb_probe(struct platATOMIC_INIT_NOTIFIER_HEAD (&twl->phy.notifier); +pm_runtime_use_autosuspend (&pdev->dev); +pm_runtime_set_autosuspend_delay (&pdev->dev,2000 ); +pm_runtime_enable (&pdev->dev); +pm_runtime_get_sync (&pdev->dev); +/* Our job is to use irqs and status from the power module * to keep the transceiver disabled when nothing's connected. *
@@ -731,6 +765,9 @@ static int twl4030_usb_probe(struct platreturn status; } +pm_runtime_mark_last_busy (&pdev->dev); +pm_runtime_put_autosuspend (twl->dev); +dev_info (&pdev->dev,"Initialized TWL4030 USB module\n" );return 0 ; }
@@ -740,6 +777,7 @@ static int twl4030_usb_remove(struct plastruct twl4030_usb *twl =platform_get_drvdata (pdev);int val; +pm_runtime_get_sync (twl->dev);cancel_delayed_work (&twl->id_workaround_work);device_remove_file (twl->dev, &dev_attr_vbus);
@@ -759,9 +797,8 @@ static int twl4030_usb_remove(struct pla/* disable complete OTG block */ twl4030_usb_clear_bits (twl,POWER_CTRL ,POWER_CTRL_OTG_ENAB ); - -if (!twl->asleep) -twl4030_phy_power (twl,0 ); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put (twl->dev);return 0 ; }
@@ -779,6 +816,7 @@ static struct platform_driver twl4030_us .remove = twl4030_usb_remove, .driver = { .name = "twl4030_usb", + .pm = &twl4030_usb_pm_ops, .owner = THIS_MODULE, .of_match_table = of_match_ptr(twl4030_usb_id_table), },
Greg Kroah-Hartman
maintainerPATCH 87/238 usb: chipidea: msm: Use USB PHY API to control PHY state
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ivan T. Ivanov" <[email protected]>
commit ea290056d7c46f7781ff13801048ed957b96d1a5 upstream.
PHY drivers keep track of the current state of the hardware, so don't change PHY settings under it.
--- drivers/usb/chipidea/ci_hdrc_msm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/chipidea/ci_hdrc_msm.c +1 -5
@@ -20,7 +20,6 @@static void ci_hdrc_msm_notify_event (struct ci_hdrc *ci,unsigned event) {struct device *dev = ci->gadget.dev.parent; -int val;switch (event) {case CI_HDRC_CONTROLLER_RESET_EVENT :
@@ -34,10 +33,7 @@ static void ci_hdrc_msm_notify_event(str* Put the transceiver in non-driving mode. Otherwise host * may not detect soft-disconnection. */ - val =usb_phy_io_read (ci->transceiver,ULPI_FUNC_CTRL ); - val &= ~ULPI_FUNC_CTRL_OPMODE_MASK ; - val |=ULPI_FUNC_CTRL_OPMODE_NONDRIVING ; -usb_phy_io_write (ci->transceiver, val,ULPI_FUNC_CTRL ); +usb_phy_notify_disconnect (ci->transceiver,USB_SPEED_UNKNOWN );break ;default :dev_dbg (dev,"unknown ci_hdrc event\n" );
Greg Kroah-Hartman
maintainerPATCH 88/238 usb: chipidea: msm: Initialize PHY on reset event
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ivan T. Ivanov" <[email protected]>
commit 233c7daf4eecd1e992dc42591182cd4a892e687c upstream.
Initialize USB PHY after every Link controller reset
--- drivers/usb/chipidea/ci_hdrc_msm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/chipidea/ci_hdrc_msm.c +1 -0
@@ -26,6 +26,7 @@ static void ci_hdrc_msm_notify_event(strdev_dbg (dev,"CI_HDRC_CONTROLLER_RESET_EVENT received\n" );writel (0 ,USB_AHBBURST );writel (0 ,USB_AHBMODE ); +usb_phy_init (ci->transceiver);break ;case CI_HDRC_CONTROLLER_STOPPED_EVENT :dev_dbg (dev,"CI_HDRC_CONTROLLER_STOPPED_EVENT received\n" );
Greg Kroah-Hartman
maintainerPATCH 89/238 USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taylor Braun-Jones <[email protected]>
commit 9c491c372d677b6420e0f8c6361fe422791662cc upstream.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -952,6 +952,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },/* Infineon Devices */ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, +/* GE Healthcare devices */ + { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1385,3 +1385,9 @@* ekey biometric systems GmbH (http://ekey.net/) */ #define FTDI_EKEY_CONV_USB_PID 0xCB08/* Converter USB */ + +/* +* GE Healthcare devices +*/ +#define GE_HEALTHCARE_VID 0x1901 +#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
Greg Kroah-Hartman
maintainerPATCH 90/238 USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ee444609dbae8afee420c3243ce4c5f442efb622 upstream.
Add device id for NOVITUS Bono E thermal printer.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -741,6 +741,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -837,6 +837,12 @@#define TELLDUS_TELLSTICK_PID 0x0C30/* RF control dongle 433 MHz using FT232RL */ /* +* NOVITUS printers +*/ +#define NOVITUS_VID 0x1a28 +#define NOVITUS_BONO_E_PID 0x6010 + +/* * RT Systems programming cables for various ham radios */ #define RTSYSTEMS_VID 0x2100/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 91/238 USB: zte_ev: fix removed PIDs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3096691011d01cef56b243a5e65431405c07d574 upstream.
Add back some PIDs that were mistakingly remove when reverting commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"), which apparently did more than its commit message claimed in that it not only moved some PIDs from option to zte_ev but also added some new ones.
devices to zte_ev"")
--- drivers/usb/serial/zte_ev.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/zte_ev.c +8 -0
@@ -272,6 +272,14 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { + {USB_DEVICE (0x19d2 ,0xffec ) }, + {USB_DEVICE (0x19d2 ,0xffee ) }, + {USB_DEVICE (0x19d2 ,0xfff6 ) }, + {USB_DEVICE (0x19d2 ,0xfff7 ) }, + {USB_DEVICE (0x19d2 ,0xfff8 ) }, + {USB_DEVICE (0x19d2 ,0xfff9 ) }, + {USB_DEVICE (0x19d2 ,0xfffb ) }, + {USB_DEVICE (0x19d2 ,0xfffc ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, { },
Greg Kroah-Hartman
maintainerPATCH 92/238 uwb: init beacon cache entry before registering uwb device
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Pugliese <[email protected]>
commit 675f0ab2fe5a0f7325208e60b617a5f32b86d72c upstream.
Make sure the uwb_dev->bce entry is set before calling uwb_dev_add in uwbd_dev_onair so that usermode will only see the device after it is properly initialized. This fixes a kernel panic that can occur if usermode tries to access the IEs sysfs attribute of a UWB device before the driver has had a chance to set the beacon cache entry.
--- drivers/uwb/lc-dev.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/uwb/lc-dev.c +9 -4
@@ -431,16 +431,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, s uwb_dev->mac_addr = *bce->mac_addr; uwb_dev->dev_addr = bce->dev_addr;dev_set_name (&uwb_dev->dev,"%s" , macbuf); + +/* plug the beacon cache */ + bce->uwb_dev = uwb_dev; + uwb_dev->bce = bce; +uwb_bce_get (bce);/* released in uwb_dev_sys_release() */ + result =uwb_dev_add (uwb_dev, &rc->uwb_dev.dev, rc);if (result <0 ) {dev_err (dev,"new device %s: cannot instantiate device\n" , macbuf); goto error_dev_add; } -/* plug the beacon cache */ - bce->uwb_dev = uwb_dev; - uwb_dev->bce = bce; -uwb_bce_get (bce);/* released in uwb_dev_sys_release() */ +dev_info (dev,"uwb device (mac %s dev %s) connected to %s %s\n" , macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,dev_name (rc->uwb_dev.dev.parent));
@@ -448,6 +451,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, sreturn ; error_dev_add: + bce->uwb_dev =NULL ; +uwb_bce_put (bce);kfree (uwb_dev);return ; }
Greg Kroah-Hartman
maintainerPATCH 93/238 usb: host: xhci: fix compliance mode workaround
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 96908589a8b2584b1185f834d365f5cc360e8226 upstream.
Commit 71c731a (usb: host: xhci: Fix Compliance Mode on SN65LVP3502CP Hardware) implemented a workaround for a known issue with Texas Instruments' USB 3.0 redriver IC but it left a condition where any xHCI host would be taken out of reset if port was placed in compliance mode and there was no device connected to the port.
That condition would trigger a fake connection to a non-existent device so that usbcore would trigger a warm reset of the port, thus taking the link out of reset.
This has the side-effect of preventing any xHCI host connected to a Linux machine from starting and running the USB 3.0 Electrical Compliance Suite because the port will mysteriously taken out of compliance mode and, thus, xHCI won't step through the necessary compliance patterns for link validation.
This patch fixes the issue by just adding a missing check for XHCI_COMP_MODE_QUIRK inside xhci_hub_report_usb3_link_state() when PORT_CAS isn't set.
This patch should be backported to all kernels containing commit 71c731a.
--- drivers/usb/host/xhci-hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +5 -3
@@ -470,7 +470,8 @@ static void xhci_hub_report_usb2_link_st }/* Updates Link Status for super Speed port */ -static void xhci_hub_report_usb3_link_state (u32 *status,u32 status_reg) +static void xhci_hub_report_usb3_link_state (struct xhci_hcd *xhci, +u32 *status,u32 status_reg) {u32 pls = status_reg &PORT_PLS_MASK ;
@@ -509,7 +510,8 @@ static void xhci_hub_report_usb3_link_st* in which sometimes the port enters compliance mode * caused by a delay on the host-device negotiation. */ -if (pls ==USB_SS_PORT_LS_COMP_MOD ) +if ((xhci->quirks &XHCI_COMP_MODE_QUIRK ) && + (pls ==USB_SS_PORT_LS_COMP_MOD )) pls |=USB_PORT_STAT_CONNECTION ; }
@@ -668,7 +670,7 @@ static u32 xhci_get_port_status(struct u }/* Update Port Link State */ if (hcd->speed ==HCD_USB3 ) { -xhci_hub_report_usb3_link_state (&status, raw_port_status); +xhci_hub_report_usb3_link_state (xhci, &status, raw_port_status);/* * Verify if all USB3 Ports Have entered U0 already. * Delete Compliance Mode Timer if so.
Greg Kroah-Hartman
maintainerPATCH 94/238 xhci: Fix null pointer dereference if xhci initialization fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit c207e7c50f31113c24a9f536fcab1e8a256985d7 upstream.
If xhci initialization fails before the roothub bandwidth domains (xhci->rh_bw[i]) are allocated it will oops when trying to access rh_bw members in xhci_mem_cleanup().
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1723,7 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *x } num_ports =HCS_MAX_PORTS (xhci->hcs_params1); -for (i =0 ; i < num_ports; i++) { +for (i =0 ; i < num_ports && xhci->rh_bw; i++) {struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;for (j =0 ; j <XHCI_MAX_INTERVAL ; j++) {struct list_head *ep = &bwt->interval_bw[j].endpoints;
Greg Kroah-Hartman
maintainerPATCH 95/238 xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 96044694b8511bc2b04df0776b4ba295cfe005c0 upstream.
Resuming from hibernate (S4) will restart and re-initialize xHC.
The device contexts are freed and will be re-allocated later during device reset.
Usb core will disable link pm in device resume before device reset, which will try to change the max exit latency, accessing the device contexts before they are re-allocated.
There is no need to zero (disable) the max exit latency when disabling hw lpm for a freshly re-initialized xHC. So check that device context exists before doing anything. The max exit latency will be set again after device reset when usb core enables the link pm.
--- drivers/usb/host/xhci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +10 -2
@@ -3928,13 +3928,21 @@ static int __maybe_unused xhci_change_maint ret;spin_lock_irqsave (&xhci->lock, flags); -if (max_exit_latency == xhci->devs[udev->slot_id]->current_mel) { + + virt_dev = xhci->devs[udev->slot_id]; + +/* +* virt_dev might not exists yet if xHC resumed from hibernate (S4) and +* xHC was re-initialized. Exit latency will be set later after +* hub_port_finish_reset() is done and xhci->devs[] are re-allocated +*/ + +if (!virt_dev || max_exit_latency == virt_dev->current_mel) {spin_unlock_irqrestore (&xhci->lock, flags);return 0 ; }/* Attempt to issue an Evaluate Context command to change the MEL. */ - virt_dev = xhci->devs[udev->slot_id]; command = xhci->lpm_command; ctrl_ctx =xhci_get_input_control_ctx (xhci, command->in_ctx);if (!ctrl_ctx) {
Greg Kroah-Hartman
maintainerPATCH 96/238 usb: hub: take hub->hdev reference when processing from eventlist
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <[email protected]>
commit c605f3cdff53a743f6d875b76956b239deca1272 upstream.
During surprise device hotplug removal tests, it was observed that hub_events may try to call usb_lock_device on a device that has already been freed. Protect the usb_device by taking out a reference (under the hub_event_lock) when hub_events pulls it off the list, returning the reference after hub_events is finished using it.
--- drivers/usb/core/hub.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +3 -1
@@ -4764,9 +4764,10 @@ static void hub_events(void) hub = list_entry(tmp, struct usb_hub, event_list);kref_get (&hub->kref); + hdev = hub->hdev; +usb_get_dev (hdev);spin_unlock_irq (&hub_event_lock); - hdev = hub->hdev; hub_dev = hub->intfdev; intf =to_usb_interface (hub_dev); dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
@@ -4979,6 +4980,7 @@ static void hub_events(void)usb_autopm_put_interface (intf); loop_disconnected:usb_unlock_device (hdev); +usb_put_dev (hdev);kref_put (&hub->kref, hub_release); }/* end while (1) */
Greg Kroah-Hartman
maintainerPATCH 97/238 storage: Add single-LUN quirk for Jaz USB Adapter
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c66f1c62e85927357e7b3f4c701614dcb5c498a2 upstream.
The Iomega Jaz USB Adapter is a SCSI-USB converter cable. The hardware seems to be identical to e.g. the Microtech XpressSCSI, using a Shuttle/ SCM chip set. However its firmware restricts it to only work with Jaz drives.
On connecting the cable a message like this appears four times in the log:
reset full speed USB device number 4 using uhci_hcd
That's non-fatal but the US_FL_SINGLE_LUN quirk fixes it.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -741,6 +741,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_SINGLE_LUN ), +UNUSUAL_DEV (0x059b ,0x0040 ,0x0100 ,0x0100 , +"Iomega" , +"Jaz USB Adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_SINGLE_LUN ), +/* Reported by <[email protected]> */ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, "LaCie",
Greg Kroah-Hartman
maintainerPATCH 98/238 USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit 67d365a57a51fb9dece6a5ceb504aa381cae1e5b upstream.
The Adaptec USBConnect 2000 is another SCSI-USB converter which uses Shuttle Technology/SCM Microsystems chips. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have a USBConnect 2000, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the product uses.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -101,6 +101,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x "PhotoSmart R707", USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY), +UNUSUAL_DEV (0x03f3 ,0x0001 ,0x0000 ,0x9999 , +"Adaptec" , +"USBConnect 2000" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Sebastian Kapfer <[email protected]> * and Olaf Hering <[email protected]> (different bcd's, same vendor/product) * for USB floppies that need the SINGLE_LUN enforcement.
Greg Kroah-Hartman
maintainerPATCH 99/238 USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit b6a3ed677991558ce09046397a7c4d70530d15b3 upstream.
Hi,
The Ariston Technologies iConnect 025 and iConnect 050 (also known as e.g. iSCSI-50) are SCSI-USB converters which use Shuttle Technology/SCM Microsystems chips. Only the connectors differ; both have the same USB ID. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have one of these, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the products use.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -1979,6 +1979,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), +UNUSUAL_DEV (0x1822 ,0x0001 ,0x0000 ,0x9999 , +"Ariston Technologies" , +"iConnect USB to SCSI adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Hans de Goede <[email protected]> * These Appotech controllers are found in Picture Frames, they provide a * (buggy) emulation of a cdrom drive which contains the windows software
Greg Kroah-Hartman
maintainerPATCH 100/238 USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c80b4495c61636edc58fe1ce300f09f24db28e10 upstream.
This patch adds quirks for Entrega Technologies (later Xircom PortGear) USB- SCSI converters. They use Shuttle Technology EUSB-01/EUSB-S1 chips. The US_FL_SCM_MULT_TARG quirk is needed to allow multiple devices on the SCSI chain to be accessed. Without it only the (single) device with SCSI ID 0 can be used.
The standalone converter sold by Entrega had model number U1-SC25. Xircom acquired Entrega and re-branded the product line PortGear. The PortGear USB to SCSI Converter (model PGSCSI) is internally identical to the Entrega product, but later models may use a different USB ID. The Entrega-branded units have USB ID 1645:0007, as does my Xircom PGSCSI, but the Windows and Macintosh drivers also support 085A:0028.
Entrega also sold the "Mac USB Dock", which provides two USB ports, a Mac (8-pin mini-DIN) serial port and a SCSI port. It appears to the computer as a four-port hub, USB-serial, and USB-SCSI converters. The USB-SCSI part may have initially used the same ID as the standalone U1-SC25 (1645:0007), but later production used 085A:0026.
My Xircom PortGear PGSCSI has bcdDevice=0x0100. Units with bcdDevice=0x0133 probably also exist.
This patch adds quirks for 1645:0007, 085A:0026 and 085A:0028. The Windows driver INF file also mentions 085A:0032 "PortStation SCSI Module", but I couldn't find any mention of that actually existing in the wild; perhaps it was cancelled before release?
--- drivers/usb/storage/unusual_devs.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/usb/storage/unusual_devs.h +20 -0
@@ -1125,6 +1125,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), +UNUSUAL_DEV (0x085a ,0x0026 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB-SCSI (Mac USB Dock)" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), + +UNUSUAL_DEV (0x085a ,0x0028 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Submitted by Jan De Luyck <[email protected]> */ UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000, "CITIZEN",
@@ -1957,6 +1969,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), +/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) +* and Mac USB Dock USB-SCSI */ +UNUSUAL_DEV (0x1645 ,0x0007 ,0x0100 ,0x0133 , +"Entrega Technologies" , +"USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Reported by Robert Schedel <[email protected]> * Note: this is a 'super top' device like the above 14cd/6600 device */ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
Greg Kroah-Hartman
maintainerPATCH 101/238 USB: EHCI: unlink QHs even after the controller has stopped
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7312b5ddd47fee2356baa78c5516ef8e04eed452 upstream.
Old code in ehci-hcd tries to expedite disabling endpoints after the controller has stopped, by destroying the endpoint's associated QH without first unlinking the QH. This was necessary back when the driver wasn't so careful about keeping track of the controller's state.
But now we are careful about it, and the driver knows that when the controller isn't running, no unlinking delay is needed. Furthermore, skipping the unlink step will trigger a BUG() in qh_destroy() when the preceding QH is released, because the link pointer will be non-NULL.
Removing the lines that skip the unlinking step and go directly to QH_STATE_IDLE fixes the problem.
--- drivers/usb/host/ehci-hcd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/host/ehci-hcd.c +0 -2
@@ -965,8 +965,6 @@ rescan: } qh->exception =1 ; -if (ehci->rh_state <EHCI_RH_RUNNING ) - qh->qh_state =QH_STATE_IDLE ;switch (qh->qh_state) {case QH_STATE_LINKED :WARN_ON (!list_empty (&qh->qtd_list));
Greg Kroah-Hartman
maintainerPATCH 102/238 usb: dwc3: omap: fix ordering for runtime pm calls
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 81a60b7f5c143ab3cdcd9943c9b4b7c63c32fc31 upstream.
we don't to gate clocks until our children are
done with their remove path.
--- drivers/usb/dwc3/dwc3-omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-omap.c +1 -1
@@ -582,9 +582,9 @@ static int dwc3_omap_remove(struct platfif (omap->extcon_id_dev.edev)extcon_unregister_interest (&omap->extcon_id_dev);dwc3_omap_disable_irqs (omap); +device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); -device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 103/238 ACPI / RTC: Fix CMOS RTC opregion handler accesses to wrong addresses
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Lee, Chun-Yi" <[email protected]>
commit 9389f46e9782ea5e56fbd7b2e59ba7c08f3ba86b upstream.
The value64 parameter is an u64 point that used to transfer the value for write to CMOS, or used to return the value that's read from CMOS.
The value64 is an u64 point, so don't need get address again. It causes acpi_cmos_rtc_space_handler always return 0 to reader and didn't write expected value to CMOS.
--- drivers/acpi/acpi_cmos_rtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_cmos_rtc.c +1 -1
@@ -35,7 +35,7 @@ acpi_cmos_rtc_space_handler(u32 function void *handler_context, void *region_context) { int i; -u8 *value = (u8 *)&value64; +u8 *value = (u8 *)value64;if (address >0xff || !value64)return AE_BAD_PARAMETER ;
Greg Kroah-Hartman
maintainerPATCH 104/238 iommu/fsl: Fix warning resulting from adding PCI device twice
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varun Sethi <[email protected]>
commit 5a9137a66b521d667236e95c307b92af532fe600 upstream.
iommu_group_get_for_dev determines the iommu group for the PCI device and adds the device to the group.
In the PAMU driver we were again adding the device to the same group without checking if the device already had an iommu group. This resulted in the following warning.
sysfs: cannot create duplicate filename '/devices/ffe200000.pcie/pci0000:00/0000:00:00.0/iommu_group'
------------[ cut here ]------------ WARNING: at fs/sysfs/dir.c:31 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.17.0-rc3-00002-g7505cea-dirty #126 task: c0000001fe0a0000 ti: c0000001fe044000 task.ti: c0000001fe044000 NIP: c00000000018879c LR: c000000000188798 CTR: c00000000001ea50 REGS: c0000001fe047040 TRAP: 0700 Not tainted (3.17.0-rc3-00002-g7505cea-dirty) MSR: 0000000080029000 <CE,EE,ME> CR: 24ad8e22 XER: 20000000
SOFTE: 1
GPR00: c000000000188798 c0000001fe0472c0 c0000000009a52e0 0000000000000065
GPR04: 0000000000000001 0000000000000000 3a30303a00000000 0000000027000000
GPR08: 2f696f6d00000000 c0000000008d3830 c0000000009b3938 c0000000009bb3d0
GPR12: 0000000028ad8e24 c00000000fff4000 c00000000000205c 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 c0000000008a4c70
GPR24: c0000000007e9010 c0000001fe0140a8 ffffffffffffffef 0000000000000001
GPR28: c0000001fe22ebb8 c0000000007e9010 c00000000090bf10 c0000001fe220000 NIP [c00000000018879c] .sysfs_warn_dup+0x74/0xa4
LR [c000000000188798] .sysfs_warn_dup+0x70/0xa4
Call Trace: [c0000001fe0472c0] [c000000000188798] .sysfs_warn_dup+0x70/0xa4 (unreliable) [c0000001fe047350] [c000000000188d34] .sysfs_do_create_link_sd.clone.2+0x168/0x174 [c0000001fe047400] [c0000000004b3cf8] .iommu_group_add_device+0x78/0x244 [c0000001fe0474b0] [c0000000004b6964] .fsl_pamu_add_device+0x88/0x1a8 [c0000001fe047570] [c0000000004b3960] .iommu_bus_notifier+0xdc/0x15c [c0000001fe047600] [c000000000059848] .notifier_call_chain+0x8c/0xe8 [c0000001fe0476a0] [c000000000059d04] .__blocking_notifier_call_chain+0x58/0x84 [c0000001fe047750] [c00000000036619c] .device_add+0x464/0x5c8 [c0000001fe047820] [c000000000300ebc] .pci_device_add+0x14c/0x17c [c0000001fe0478c0] [c000000000300fbc] .pci_scan_single_device+0xd0/0xf4 [c0000001fe047970] [c00000000030104c] .pci_scan_slot+0x6c/0x18c [c0000001fe047a10] [c00000000030226c] .pci_scan_child_bus+0x40/0x114 [c0000001fe047ac0] [c000000000021974] .pcibios_scan_phb+0x240/0x2c8 [c0000001fe047b70] [c00000000085a970] .pcibios_init+0x64/0xc8 [c0000001fe047c00] [c000000000001884] .do_one_initcall+0xbc/0x224 [c0000001fe047d00] [c000000000852d50] .kernel_init_freeable+0x14c/0x21c [c0000001fe047db0] [c000000000002078] .kernel_init+0x1c/0xfa4 [c0000001fe047e30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4
Instruction dump:7c7f1b79 4182001c 7fe4fb78 7f83e378 38a01000 4bffc905 60000000 7c641b78 e87e8008 7fa5eb78 48482ff5 60000000 <0fe00000> 7fe3fb78 4bf7bd39 60000000
--- drivers/iommu/fsl_pamu_domain.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/iommu/fsl_pamu_domain.c +8 -2
@@ -1050,7 +1050,7 @@ static int fsl_pamu_add_device(struct destruct iommu_group *group =NULL ;struct pci_dev *pdev;const u32 *prop; -int ret, len; +int ret =0 , len;/* * For platform devices we allocate a separate group for
@@ -1073,7 +1073,13 @@ static int fsl_pamu_add_device(struct deif (!group ||IS_ERR (group))return PTR_ERR (group); - ret =iommu_group_add_device (group, dev); +/* +* Check if device has already been added to an iommu group. +* Group could have already been created for a PCI device in +* the iommu_group_get_for_dev path. +*/ +if (!dev->iommu_group) + ret =iommu_group_add_device (group, dev);iommu_group_put (group);return ret;
RE: [PATCH 3.14 104/238] iommu/fsl: Fix warning resulting from adding PCI device twice
Hi Greg,
This fix is not required on 3.14. Fix was required to address an issue, introduced by the iommu_group_get_for_dev API in the PAMU driver code.
Regards
Varun
Quoted 112 lines
-----Original Message-----
From: Greg Kroah-Hartman [mailto:[email protected]]
Sent: Saturday, October 04, 2014 3:00 AM
To: [email protected]
Cc: Greg Kroah-Hartman; [email protected]; Sethi Varun-B16395; Joerg Roedel
Subject: [PATCH 3.14 104/238] iommu/fsl: Fix warning resulting from adding PCI device twice3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varun Sethi <[email protected]>
commit
5a9137a66b521d667236e95c307b92af532fe600upstream.
iommu_group_get_for_devdetermines the iommu group for the PCI device and adds the device to the group.In the PAMU driver we were again adding the device to the same group without checking if the device already had an iommu group. This resulted in the following warning.
sysfs: cannot create duplicate filename '/devices/ffe200000.pcie/pci0000:00/0000:00:00.0/iommu_group'
------------[ cut here ]------------ WARNING: at fs/sysfs/dir.c:31 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.17.0-rc3-00002-g7505cea-dirty#126
task:c0000001fe0a0000ti:c0000001fe044000task.ti:c0000001fe044000
NIP:c00000000018879cLR:c000000000188798CTR:c00000000001ea50
REGS:c0000001fe047040TRAP: 0700 Not tainted (3.17.0-rc3-00002-g7505cea-
dirty)
MSR: 0000000080029000 <CE,EE,ME> CR:24ad8e22XER: 20000000
SOFTE: 1
GPR00:c000000000188798c0000001fe0472c0c0000000009a52e00000000000000065
GPR04: 0000000000000001 00000000000000003a30303a000000000000000027000000
GPR08:2f696f6d00000000c0000000008d3830c0000000009b3938c0000000009bb3d0
GPR12:0000000028ad8e24c00000000fff4000c00000000000205c0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000c0000000008a4c70
GPR24:c0000000007e9010c0000001fe0140a8ffffffffffffffef 0000000000000001
GPR28:c0000001fe22ebb8c0000000007e9010c00000000090bf10c0000001fe220000NIP [c00000000018879c] .sysfs_warn_dup+0x74/0xa4 LR [c000000000188798] .sysfs_warn_dup+0x70/0xa4 Call Trace:
[c0000001fe0472c0] [c000000000188798] .sysfs_warn_dup+0x70/0xa4 (unreliable) [c0000001fe047350] [c000000000188d34] .sysfs_do_create_link_sd.clone.2+0x168/0x174 [c0000001fe047400] [c0000000004b3cf8].iommu_group_add_device+0x78/0x244 [c0000001fe0474b0] [c0000000004b6964] .fsl_pamu_add_device+0x88/0x1a8 [c0000001fe047570] [c0000000004b3960] .iommu_bus_notifier+0xdc/0x15c [c0000001fe047600] [c000000000059848] .notifier_call_chain+0x8c/0xe8 [c0000001fe0476a0] [c000000000059d04] .__blocking_notifier_call_chain+0x58/0x84 [c0000001fe047750] [c00000000036619c] .device_add+0x464/0x5c8 [c0000001fe047820] [c000000000300ebc] .pci_device_add+0x14c/0x17c [c0000001fe0478c0] [c000000000300fbc] .pci_scan_single_device+0xd0/0xf4 [c0000001fe047970] [c00000000030104c] .pci_scan_slot+0x6c/0x18c [c0000001fe047a10] [c00000000030226c] .pci_scan_child_bus+0x40/0x114 [c0000001fe047ac0] [c000000000021974] .pcibios_scan_phb+0x240/0x2c8 [c0000001fe047b70] [c00000000085a970] .pcibios_init+0x64/0xc8 [c0000001fe047c00] [c000000000001884] .do_one_initcall+0xbc/0x224 [c0000001fe047d00] [c000000000852d50] .kernel_init_freeable+0x14c/0x21c [c0000001fe047db0] [c000000000002078] .kernel_init+0x1c/0xfa4 [c0000001fe047e30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4Instruction dump:
7c7f1b794182001c7fe4fb787f83e37838a010004bffc905600000007c641b78e87e80087fa5eb7848482ff560000000 <0fe00000>7fe3fb784bf7bd3960000000Signed-off-by Varun Sethi <[email protected]>Signed-off-by Joerg Roedel <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/iommu/fsl_pamu_domain.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)drivers/iommu/fsl_pamu_domain.c +9
-2@@ -1050,7 +1050,7 @@ static int fsl_pamu_add_device(struct destruct iommu_group *group =NULL ;struct pci_dev *pdev;const u32 *prop; -int ret, len; +int ret =0 , len;/* * For platform devices we allocate a separate group for @@ -1073,7 +1073,13 @@ static int fsl_pamu_add_device(struct de if (!group || IS_ERR(group)) return PTR_ERR(group); -ret = iommu_group_add_device(group, dev); +/* +* Check if device has already been added to an iommu group. +* Group could have already been created for a PCI device in +* the iommu_group_get_for_dev path. +*/ +if (!dev->iommu_group) + ret =iommu_group_add_device (group, dev);iommu_group_put (group);return ret;
Greg Kroah-Hartman
maintainerRe: [PATCH 3.14 104/238] iommu/fsl: Fix warning resulting from adding PCI device twice
Quoted 4 lines · Varun Sethi
Hi Greg,
This fix is not required on 3.14. Fix was required to address an issue, introduced by theiommu_group_get_for_devAPI in the PAMU driver code.
Thanks for letting me know, now dropped from 3.14.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 105/238 iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olav Haugan <[email protected]>
commit 1fc870c7efa364862c3bc792cfbdb38afea26742 upstream.
Stage-1 context banks do not have the SMMU_CBn_TCR[SL0] field since it is only applicable to stage-2 context banks.
This patch ensures that we don't set the reserved TCR bits for stage-1 translations.
--- drivers/iommu/arm-smmu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iommu/arm-smmu.c +5 -2
@@ -794,8 +794,11 @@ static void arm_smmu_init_context_bank(s reg |=TTBCR_EAE | (TTBCR_SH_IS <<TTBCR_SH0_SHIFT ) | (TTBCR_RGN_WBWA <<TTBCR_ORGN0_SHIFT ) | - (TTBCR_RGN_WBWA <<TTBCR_IRGN0_SHIFT ) | - (TTBCR_SL0_LVL_1 <<TTBCR_SL0_SHIFT ); + (TTBCR_RGN_WBWA <<TTBCR_IRGN0_SHIFT ); + +if (!stage1) + reg |= (TTBCR_SL0_LVL_1 <<TTBCR_SL0_SHIFT ); +writel_relaxed (reg, cb_base +ARM_SMMU_CB_TTBCR );/* MAIR0 (stage-1 only) */
Greg Kroah-Hartman
maintainerPATCH 106/238 NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Dickson <[email protected]>
commit 080af20cc945d110f9912d01cf6b66f94a375b8d upstream.
There is a race between nfs4_state_manager() and nfs_server_remove_lists() that happens during a nfsv3 mount.
The v3 mount notices there is already a supper block so nfs_server_remove_lists() called which uses the nfs_client_lock spin lock to synchronize access to the client list.
At the same time nfs4_state_manager() is running through the client list looking for work to do, using the same lock. When nfs4_state_manager() wins the race to the list, a v3 client pointer is found and not ignored properly which causes the panic.
Moving some protocol checks before the state checking avoids the panic.
--- fs/nfs/nfs4client.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)
fs/nfs/nfs4client.c +20 -18
@@ -482,6 +482,16 @@ int nfs40_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos" */ if (pos->cl_cons_state >NFS_CS_READY ) {
@@ -501,15 +511,6 @@ int nfs40_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (pos->cl_clientid != new->cl_clientid)continue ;
@@ -615,6 +616,16 @@ int nfs41_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos", especially the client * ID and serverowner fields. Wait for CREATE_SESSION
@@ -640,15 +651,6 @@ int nfs41_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (!nfs4_match_clientids (pos, new))continue ;
Greg Kroah-Hartman
maintainerPATCH 107/238 NFSv4: Fix another bug in the close/open_downgrade code
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit cd9288ffaea4359d5cfe2b8d264911506aed26a4 upstream.
James Drew reports another bug whereby the NFS client is now sending an OPEN_DOWNGRADE in a situation where it should really have sent a
CLOSE: the client is opening the file for O_RDWR, but then trying to do a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.
--- fs/nfs/nfs4proc.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
fs/nfs/nfs4proc.c +15 -15
@@ -2558,23 +2558,23 @@ static void nfs4_close_prepare(struct rp is_rdwr =test_bit (NFS_O_RDWR_STATE , &state->flags); is_rdonly =test_bit (NFS_O_RDONLY_STATE , &state->flags); is_wronly =test_bit (NFS_O_WRONLY_STATE , &state->flags); -/* Calculate the current open share mode */ - calldata->arg.fmode =0 ; -if (is_rdonly || is_rdwr) - calldata->arg.fmode |=FMODE_READ ; -if (is_wronly || is_rdwr) - calldata->arg.fmode |=FMODE_WRITE ;/* Calculate the change in open mode */ + calldata->arg.fmode =0 ;if (state->n_rdwr ==0 ) { -if (state->n_rdonly ==0 ) { - call_close |= is_rdonly || is_rdwr; - calldata->arg.fmode &= ~FMODE_READ ; - } -if (state->n_wronly ==0 ) { - call_close |= is_wronly || is_rdwr; - calldata->arg.fmode &= ~FMODE_WRITE ; - } - } +if (state->n_rdonly ==0 ) + call_close |= is_rdonly; +else if (is_rdonly) + calldata->arg.fmode |=FMODE_READ ; +if (state->n_wronly ==0 ) + call_close |= is_wronly; +else if (is_wronly) + calldata->arg.fmode |=FMODE_WRITE ; + }else if (is_rdwr) + calldata->arg.fmode |=FMODE_READ |FMODE_WRITE ; + +if (calldata->arg.fmode ==0 ) + call_close |= is_rdwr; +if (!nfs4_valid_open_stateid (state)) call_close =0 ;spin_unlock (&state->owner->so_lock);
Greg Kroah-Hartman
maintainerPATCH 108/238 spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jorge A. Ventura" <[email protected]>
commit 3d0763c006f8da1b44a9f5f9a21187f5b8f674f4 upstream.
The spi hangs waiting the completion of omap2_mcspi_rx_callback.
--- drivers/spi/spi-omap2-mcspi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-omap2-mcspi.c +2 -1
@@ -321,7 +321,8 @@ static void omap2_mcspi_set_fifo(const s disable_fifo:if (t->rx_buf !=NULL ) chconf &= ~OMAP2_MCSPI_CHCONF_FFER ; -else + +if (t->tx_buf !=NULL ) chconf &= ~OMAP2_MCSPI_CHCONF_FFET ;mcspi_write_chconf0 (spi, chconf);
Greg Kroah-Hartman
maintainerPATCH 109/238 spi: dw-pci: fix bug when regs left uninitialized
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit c9d5d6fe168fd45a4dfdd0116affe708789b4702 upstream.
The commit 04f421e7 "spi: dw: use managed resources" changes drivers to use managed functions, but seems wasn't properly tested in PCI case. The regs field of struct dw_spi left uninitialized. Thus, kernel crashes when tries to access to the SPI controller registers. This patch fixes the issue.
--- drivers/spi/spi-dw-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-dw-pci.c +2 -0
@@ -62,6 +62,8 @@ static int spi_pci_probe(struct pci_devif (ret)return ret; + dws->regs =pcim_iomap_table (pdev)[pci_bar]; + dws->bus_num =0 ; dws->num_cs =4 ; dws->irq = pdev->irq;
Greg Kroah-Hartman
maintainerPATCH 110/238 ARM: 8128/1: abort: dont clear the exclusive monitors
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 85868313177700d20644263a782351262d2aff84 upstream.
The ARMv6 and ARMv7 early abort handlers clear the exclusive monitors upon entry to the kernel, but this is redundant:
- We clear the monitors on every exception return since commit 200b812d0084 ("Clear the exclusive monitor when returning from an exception"), so this is not necessary to ensure the monitors are cleared before returning from a fault handler.
- Any dummy STREX will target a temporary scratch area in memory, and may succeed or fail without corrupting useful data. Its status value will not be used.
- Any other STREX in the kernel must be preceded by an LDREX, which will initialise the monitors consistently and will not depend on the earlier state of the monitors.
Therefore we have no reason to care about the initial state of the exclusive monitors when a data abort is taken, and clearing the monitors prior to exception return (as we already do) is sufficient.
This patch removes the redundant clearing of the exclusive monitors from the early abort handlers.
--- arch/arm/mm/abort-ev6.S | 6 ------ arch/arm/mm/abort-ev7.S | 6 ------ 2 files changed, 12 deletions(-)
arch/arm/mm/abort-ev6.S +0 -6
@@ -17,12 +17,6 @@ */ .align 5 ENTRY(v6_early_abort) -#ifdef CONFIG_CPU_V6 - sub r1, sp, #4 @ Get unused stack location - strex r0, r1, [r1] @ Clear the exclusive monitor -#elif defined(CONFIG_CPU_32v6K) - clrex -#endif mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR /*
arch/arm/mm/abort-ev7.S +0 -6
@@ -13,12 +13,6 @@ */ .align 5 ENTRY(v7_early_abort) - /* - * The effect of data aborts on on the exclusive access monitor are - * UNPREDICTABLE. Do a CLREX to clear the state - */ - clrex - mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR
Greg Kroah-Hartman
maintainerPATCH 111/238 ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <[email protected]>
commit f7f7a29bf0cf25af23f37e5b5bf1368b85705286 upstream.
To deal with IPs which are specific to dra74x and dra72x, maintain seperate ocp interface lists, while keeping the common list for all common IPs.
Move USB OTG SS4 to dra74x only list since its unavailable in dra72x and is giving an abort during boot. The dra72x only list is empty for now and a placeholder for future hwmod additions which are specific to dra72x.
--- arch/arm/mach-omap2/omap_hwmod.c | 3 +++ arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 22 ++++++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/omap_hwmod.c +3 -0
@@ -3349,6 +3349,9 @@ int __init omap_hwmod_register_links(strif (!ois)return 0 ; +if (ois[0 ] ==NULL )/* Empty list */ +return 0 ; +if (!linkspace) {if (_alloc_linkspace (ois)) {pr_err ("omap_hwmod: could not allocate link space\n" );
arch/arm/mach-omap2/omap_hwmod_7xx_data.c +20 -2
@@ -35,6 +35,7 @@#include "i2c.h" #include "mmc.h" #include "wd_timer.h" +#include "soc.h" /* Base offset for all DRA7XX interrupts external to MPUSS */ #define DRA7XX_IRQ_GIC_START 32
@@ -2707,7 +2708,6 @@ static struct omap_hwmod_ocp_if *dra7xx_ &dra7xx_l4_per3__usb_otg_ss1, &dra7xx_l4_per3__usb_otg_ss2, &dra7xx_l4_per3__usb_otg_ss3, - &dra7xx_l4_per3__usb_otg_ss4, &dra7xx_l3_main_1__vcp1, &dra7xx_l4_per2__vcp1, &dra7xx_l3_main_1__vcp2,
@@ -2716,8 +2716,26 @@ static struct omap_hwmod_ocp_if *dra7xx_ NULL, }; +static struct omap_hwmod_ocp_if *dra74x_hwmod_ocp_ifs[]__initdata = { + &dra7xx_l4_per3__usb_otg_ss4, +NULL , +}; + +static struct omap_hwmod_ocp_if *dra72x_hwmod_ocp_ifs[]__initdata = { +NULL , +}; +int __init dra7xx_hwmod_init (void ) { +int ret; +omap_hwmod_init (); -return omap_hwmod_register_links (dra7xx_hwmod_ocp_ifs); + ret =omap_hwmod_register_links (dra7xx_hwmod_ocp_ifs); + +if (!ret &&soc_is_dra74x ()) +return omap_hwmod_register_links (dra74x_hwmod_ocp_ifs); +else if (!ret &&soc_is_dra72x ()) +return omap_hwmod_register_links (dra72x_hwmod_ocp_ifs); + +return ret; }
Greg Kroah-Hartman
maintainerPATCH 112/238 ARM: dts: DRA7: fix interrupt-cells for GPIO
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
commit e49d519c456f4fb6f4a0473bc04ba30bb805fce5 upstream.
GPIO modules are also interrupt sources. However, they require both the GPIO number and IRQ type to function properly.
By declaring that GPIO uses interrupt-cells=<1>, we essentially do not allow users of the nodes to use the interrupt property appropritely.
With this change, the following now works:
interrupt-parent = <&gpio6>;
interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
--- arch/arm/boot/dts/dra7.dtsi | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm/boot/dts/dra7.dtsi +8 -8
@@ -178,7 +178,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio2: gpio@48055000 {
@@ -189,7 +189,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio3: gpio@48057000 {
@@ -200,7 +200,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio4: gpio@48059000 {
@@ -211,7 +211,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio5: gpio@4805b000 {
@@ -222,7 +222,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio6: gpio@4805d000 {
@@ -233,7 +233,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio7: gpio@48051000 {
@@ -244,7 +244,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio8: gpio@48053000 {
@@ -255,7 +255,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; uart1: serial@4806a000 {
Greg Kroah-Hartman
maintainerPATCH 113/238 ARM: dts: dra7-evm: Fix spi1 mux documentation
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
commit 68e4d9e58dbae2fb178e8b74806f521adb16f0d3 upstream.
While auditing the various pin ctrl configurations using the following command:
grep PIN_ arch/arm/boot/dts/dra7-evm.dts|(while read line; do
v=`echo "$line" | sed -e "s/\s\s*/|/g" | cut -d '|' -f1 | cut -d 'x' -f2|tr [a-z] [A-Z]`; HEX=`echo "obase=16;ibase=16;4A003400+$v"| bc`; echo "$HEX ===> $line";
done)
against DRA75x/74x NDA TRM revision S(SPRUHI2S August 2014), documentation errors were found for spi1 pinctrl. Fix the same.
--- arch/arm/boot/dts/dra7-evm.dts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm/boot/dts/dra7-evm.dts +7 -7
@@ -50,13 +50,13 @@ mcspi1_pins: pinmux_mcspi1_pins { pinctrl-single,pins = < - 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi2_clk */ - 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi2_d1 */ - 0x3ac (PIN_INPUT | MUX_MODE0) /* spi2_d0 */ - 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs0 */ - 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs1 */ - 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs2 */ - 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs3 */ + 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi1_sclk */ + 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi1_d1 */ + 0x3ac (PIN_INPUT | MUX_MODE0) /* spi1_d0 */ + 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs0 */ + 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs1 */ + 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs2.hdmi1_hpd */ + 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs3.hdmi1_cec */ >; };
Greg Kroah-Hartman
maintainerPATCH 114/238 ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit a040803a9d6b8c1876d3487a5cb69602ebcbb82c upstream.
Since commit 1dbfa187dad ("ARM: irq migration: force migration off CPU going down") the ARM interrupt migration code on cpu offline calls irqchip.irq_set_affinity() with the argument force=true. At the point of this change the argument had no effect because it was not used by any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu affinity of interrupts") which made the force argument useful to route interrupts to not yet online cpus without checking the target cpu against the cpu online mask. The following commit ffde1de64012 ("irqchip: gic: Support forced affinity setting") implemented this for the GIC interrupt controller.
As a consequence the ARM cpu offline irq migration fails if CPU0 is offlined, because CPU0 is still set in the affinity mask and the validataion against cpu online mask is skipped to the force argument being true. The following first_cpu(mask) selection always selects CPU0 as the target.
Solve the issue by calling irq_set_affinity() with force=false from the CPU offline irq migration code so the GIC driver validates the affinity mask against CPU online mask and therefore removes CPU0 from the possible target candidates.
Tested on TC2 hotpluging CPU0 in and out. Without this patch the system locks up as the IRQs are not migrated away from CPU0.
--- arch/arm/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/irq.c +1 -1
@@ -163,7 +163,7 @@ static bool migrate_one_irq(struct irq_d c =irq_data_get_irq_chip (d);if (!c->irq_set_affinity)pr_debug ("IRQ%u: unable to set affinity\n" , d->irq); -else if (c->irq_set_affinity (d, affinity, true) ==IRQ_SET_MASK_OK && ret) +else if (c->irq_set_affinity (d, affinity, false) ==IRQ_SET_MASK_OK && ret)cpumask_copy (d->affinity, affinity);return ret;
Greg Kroah-Hartman
maintainerPATCH 115/238 ARM: 8148/1: flush TLS and thumbee register state during exec
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit fbfb872f5f417cea48760c535e0ff027c88b507a upstream.
The TPIDRURO and TPIDRURW registers need to be flushed during exec; otherwise TLS information is potentially leaked. TPIDRURO in particular needs careful treatment. Since flush_thread basically needs the same code used to set the TLS in arm_syscall, pull that into a common set_tls helper in tls.h and use it in both places.
Similarly, TEEHBR needs to be cleared during exec as well. Clearing its save slot in thread_info isn't right as there is no guarantee that a thread switch will occur before the new program runs. Just setting the register directly is sufficient.
--- arch/arm/include/asm/tls.h | 62 +++++++++++++++++++++++++++++++++++++++++++++ arch/arm/kernel/process.c | 2 + arch/arm/kernel/thumbee.c | 2 - arch/arm/kernel/traps.c | 17 ------------ 4 files changed, 66 insertions(+), 17 deletions(-)
arch/arm/include/asm/tls.h +62 -0
@@ -1,6 +1,9 @@#ifndef __ASMARM_TLS_H#define __ASMARM_TLS_H +#include <linux/compiler.h> +#include <asm/thread_info.h> +#ifdef __ASSEMBLY__#include <asm/asm-offsets.h> .macro switch_tls_none, base, tp, tpuser, tmp1, tmp2
@@ -50,6 +53,47 @@#endif #ifndef __ASSEMBLY__ + +static inline void set_tls (unsigned long val) +{ +struct thread_info *thread; + + thread =current_thread_info (); + + thread->tp_value[0 ] = val; + +/* +* This code runs with preemption enabled and therefore must +* be reentrant with respect to switch_tls. +* +* We need to ensure ordering between the shadow state and the +* hardware state, so that we don't corrupt the hardware state +* with a stale shadow state during context switch. +* +* If we're preempted here, switch_tls will load TPIDRURO from +* thread_info upon resuming execution and the following mcr +* is merely redundant. +*/ +barrier (); + +if (!tls_emu) { +if (has_tls_reg) { + asm("mcr p15, 0, %0, c13, c0, 3" + : :"r" (val)); + }else { +/* +* User space must never try to access this +* directly. Expect your app to break +* eventually if you do so. The user helper +* at 0xffff0fe0 must be used instead. (see +* entry-armv.S for details) +*/ + *((unsigned int *)0xffff0ff0 ) = val; + } + + } +} +static inline unsigned long get_tpuser (void ) {unsigned long reg =0 ;
@@ -59,5 +103,23 @@ static inline unsigned long get_tpuser(vreturn reg; } + +static inline void set_tpuser (unsigned long val) +{ +/* Since TPIDRURW is fully context-switched (unlike TPIDRURO), +* we need not update thread_info. +*/ +if (has_tls_reg && !tls_emu) { + asm("mcr p15, 0, %0, c13, c0, 2" + : :"r" (val)); + } +} + +static inline void flush_tls (void ) +{ +set_tls (0 ); +set_tpuser (0 ); +} +#endif #endif /* __ASMARM_TLS_H */
arch/arm/kernel/process.c +2 -0
@@ -334,6 +334,8 @@ void flush_thread(void)memset (&tsk->thread.debug,0 ,sizeof (struct debug_info ));memset (&thread->fpstate,0 ,sizeof (union fp_state )); +flush_tls (); +thread_notify (THREAD_NOTIFY_FLUSH , thread); }
arch/arm/kernel/thumbee.c +1 -1
@@ -45,7 +45,7 @@ static int thumbee_notifier(struct notifswitch (cmd) {case THREAD_NOTIFY_FLUSH : - thread->thumbee_state =0 ; +teehbr_write (0 );break ;case THREAD_NOTIFY_SWITCH :current_thread_info ()->thumbee_state =teehbr_read ();
arch/arm/kernel/traps.c +1 -16
@@ -578,7 +578,6 @@ do_cache_op(unsigned long start, unsigne#define NR (x) ((__ARM_NR_##x) - __ARM_NR_BASE) asmlinkage int arm_syscall(int no, struct pt_regs *regs) { -struct thread_info *thread =current_thread_info ();siginfo_t info;if ((no >>16 ) != (__ARM_NR_BASE>>16 ))
@@ -629,21 +628,7 @@ asmlinkage int arm_syscall(int no, strucreturn regs->ARM_r0;case NR (set_tls): - thread->tp_value[0 ] = regs->ARM_r0; -if (tls_emu) -return 0 ; -if (has_tls_reg) { - asm ("mcr p15, 0, %0, c13, c0, 3" - : :"r" (regs->ARM_r0)); - }else { -/* -* User space must never try to access this directly. -* Expect your app to break eventually if you do so. -* The user helper at 0xffff0fe0 must be used instead. -* (see entry-armv.S for details) -*/ - *((unsigned int *)0xffff0ff0 ) = regs->ARM_r0; - } +set_tls (regs->ARM_r0);return 0 ;#ifdef CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG
Greg Kroah-Hartman
maintainerPATCH 116/238 ARM: 8165/1: alignment: dont break misaligned NEON load/store
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 5ca918e5e3f9df4634077c06585c42bc6a8d699a upstream.
The alignment fixup incorrectly decodes faulting ARM VLDn/VSTn instructions (where the optional alignment hint is given but incorrect) as LDR/STR, leading to register corruption. Detect these and correctly treat them as unhandled, so that userspace gets the fault it expects.
--- arch/arm/mm/alignment.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/mm/alignment.c +3 -0
@@ -40,6 +40,7 @@* This code is not portable to processors with late data abort handling. */ #define CODING_BITS (i) (i & 0x0e000000) +#define COND_BITS (i) (i & 0xf0000000)#define LDST_I_BIT (i) (i & (1 << 26))/* Immediate constant */ #define LDST_P_BIT (i) (i & (1 << 24))/* Preindex */
@@ -817,6 +818,8 @@ do_alignment(unsigned long addr, unsignebreak ;case 0x04000000 :/* ldr or str immediate */ +if (COND_BITS (instr) ==0xf0000000 )/* NEON VLDn, VSTn */ + goto bad; offset.un =OFFSET_BITS (instr); handler = do_alignment_ldrstr;break ;
Greg Kroah-Hartman
maintainerPATCH 117/238 ARM: 8178/1: fix set_tls for !CONFIG_KUSER_HELPERS
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit 9cc6d9e5daaa147a9a3e31557efcb331989e77be upstream.
Joachim Eastwood reports that commit fbfb872f5f41 "ARM: 8148/1: flush TLS and thumbee register state during exec" causes a boot-time crash on a Cortex-M4 nommu system:
Freeing unused kernel memory: 68K (281e5000 - 281f6000) Unhandled exception: IPSR = 00000005 LR = fffffff1
CPU: 0 PID: 1 Comm: swapper Not tainted 3.17.0-rc6-00313-gd2205fa30aa7 #191 task: 29834000 ti: 29832000 task.ti: 29832000 PC is at flush_thread+0x2e/0x40 LR is at flush_thread+0x21/0x40 pc : [<2800954a>] lr : [<2800953d>] psr: 4100000b
sp : 29833d60 ip : 00000000 fp : 00000001
r10: 00003cf8 r9 : 29b1f000 r8 : 00000000
r7 : 29b0bc00 r6 : 29834000 r5 : 29832000 r4 : 29832000 r3 : ffff0ff0 r2 : 29832000 r1 : 00000000 r0 : 282121f0
xPSR: 4100000b
CPU: 0 PID: 1 Comm: swapper Not tainted 3.17.0-rc6-00313-gd2205fa30aa7 #191 [<2800afa5>] (unwind_backtrace) from [<2800a327>] (show_stack+0xb/0xc) [<2800a327>] (show_stack) from [<2800a963>] (__invalid_entry+0x4b/0x4c)
The problem is that set_tls is attempting to clear the TLS location in the kernel-user helper page, which isn't set up on V7M.
Fix this by guarding the write to the kuser helper page with a CONFIG_KUSER_HELPERS ifdef.
--- arch/arm/include/asm/tls.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/include/asm/tls.h +2 -0
@@ -81,6 +81,7 @@ static inline void set_tls(unsigned long asm("mcr p15, 0, %0, c13, c0, 3" : :"r" (val)); }else { +#ifdef CONFIG_KUSER_HELPERS /* * User space must never try to access this * directly. Expect your app to break
@@ -89,6 +90,7 @@ static inline void set_tls(unsigned long* entry-armv.S for details) */ *((unsigned int *)0xffff0ff0 ) = val; +#endif } }
Greg Kroah-Hartman
maintainerPATCH 118/238 MIPS: ZBOOT: add missing <linux/string.h> include
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <[email protected]>
commit 29593fd5a8149462ed6fad0d522234facdaee6c8 upstream.
Commit dc4d7b37 (MIPS: ZBOOT: gather string functions into string.c) moved the string related functions into a separate file, which might cause the following build error, depending on the configuration:
| CC arch/mips/boot/compressed/decompress.o | In file included from linux/arch/mips/boot/compressed/../../../../lib/decompress_unxz.c:234:0, | from linux/arch/mips/boot/compressed/decompress.c:67: | linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c: In function 'fill_temp': | linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c:162:2: error: implicit declaration of function 'memcpy' [-Werror=implicit-function-declaration] | cc1: some warnings being treated as errors | linux/scripts/Makefile.build:308: recipe for target 'arch/mips/boot/compressed/decompress.o' failed | make[6]: *** [arch/mips/boot/compressed/decompress.o] Error 1 | linux/arch/mips/Makefile:308: recipe for target 'vmlinuz' failed
It does not fail with the standard configuration, as when CONFIG_DYNAMIC_DEBUG is not enabled <linux/string.h> gets included in include/linux/dynamic_debug.h. There might be other ways for it to get indirectly included.
We can't add the include directly in xz_dec_stream.c as some architectures might want to use a different version for the boot/ directory (see for example arch/x86/boot/string.h).
Patchwork: https://patchwork.linux-mips.org/patch/7420/
--- arch/mips/boot/compressed/decompress.c | 1 + 1 file changed, 1 insertion(+)
arch/mips/boot/compressed/decompress.c +1 -0
@@ -13,6 +13,7 @@#include <linux/types.h> #include <linux/kernel.h> +#include <linux/string.h> #include <asm/addrspace.h>
Greg Kroah-Hartman
maintainerPATCH 119/238 MIPS: mcount: Adjust stack pointer for static trace in MIPS32
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <[email protected]>
commit 8a574cfa2652545eb95595d38ac2a0bb501af0ae upstream.
Every mcount() call in the MIPS 32-bit kernel is done as follows:
[...]
move at, ra
jal _mcount
addiu sp, sp, -8
[...]
but upon returning from the mcount() function, the stack pointer is not adjusted properly. This is explained in details in 58b69401c797 (MIPS: Function tracer: Fix broken function tracing).
Commit ad8c396936e3 ("MIPS: Unbreak function tracer for 64-bit kernel.) fixed the stack manipulation for 64-bit but it didn't fix it completely for MIPS32.
Patchwork: https://patchwork.linux-mips.org/patch/7792/
--- arch/mips/kernel/mcount.S | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/mips/kernel/mcount.S +12 -0
@@ -123,7 +123,11 @@ NESTED(_mcount, PT_SIZE, ra) nop #endif b ftrace_stub +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#else nop +#endif static_trace: MCOUNT_SAVE_REGS
@@ -133,6 +137,9 @@ static_trace: move a1, AT /* arg2: parent's return address */ MCOUNT_RESTORE_REGS +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#endif .globl ftrace_stub ftrace_stub: RETURN_BACK
@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra) jal prepare_ftrace_return nop MCOUNT_RESTORE_REGS +#ifndef CONFIG_DYNAMIC_FTRACE +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#endif +#endif RETURN_BACK END(ftrace_graph_caller)
Greg Kroah-Hartman
maintainerPATCH 120/238 ACPICA: Update to GPIO region handler interface.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Moore <[email protected]>
commit 75ec6e55f1384548311a13ce4fcb39c516053314 upstream.
Changes to correct several GPIO issues:
1) The update_rule in a GPIO field definition is now ignored; a read-modify-write operation is never performed for GPIO fields. (Internally, this means that the field assembly/disassembly code is completely bypassed for GPIO.)
2) The Address parameter passed to a GPIO region handler is now the bit offset of the field from a previous Connection() operator. Thus, it becomes a "Pin Number Index" into the Connection() resource descriptor.
3) The bit_width parameter passed to a GPIO region handler is now the exact bit width of the GPIO field. Thus, it can be interpreted as "number of pins".
Overall, we can now say that the region handler interface to GPIO handlers is a raw "bit/pin" addressed interface, not a byte-addressed interface like the system_memory handler interface.
--- drivers/acpi/acpica/aclocal.h | 1 drivers/acpi/acpica/acobject.h | 1 drivers/acpi/acpica/dsfield.c | 2 + drivers/acpi/acpica/evregion.c | 47 ++++++++++++++++++---------- drivers/acpi/acpica/exfield.c | 67 +++++++++++++++++++++++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 2 + 6 files changed, 104 insertions(+), 16 deletions(-)
drivers/acpi/acpica/aclocal.h +1 -0
@@ -254,6 +254,7 @@ struct acpi_create_field_info {u32 field_bit_position;u32 field_bit_length;u16 resource_length; +u16 pin_number_index;u8 field_flags;u8 attribute;u8 field_type;
drivers/acpi/acpica/acobject.h +1 -0
@@ -263,6 +263,7 @@ struct acpi_object_region_field { ACPI_OBJECT_COMMON_HEADER ACPI_COMMON_FIELD_INFO u16 resource_length;union acpi_operand_object *region_obj;/* Containing op_region object */ u8 *resource_buffer;/* resource_template for serial regions/fields */ +u16 pin_number_index;/* Index relative to previous Connection/Template */ };struct acpi_object_bank_field {
drivers/acpi/acpica/dsfield.c +2 -0
@@ -360,6 +360,7 @@ acpi_ds_get_field_names(struct acpi_crea*/ info->resource_buffer =NULL ; info->connection_node =NULL ; + info->pin_number_index =0 ;/* * A Connection() is either an actual resource descriptor (buffer)
@@ -437,6 +438,7 @@ acpi_ds_get_field_names(struct acpi_crea } info->field_bit_position += info->field_bit_length; + info->pin_number_index++;/* Index relative to previous Connection() */ break ;default :
drivers/acpi/acpica/evregion.c +31 -16
79 lines not on this page · raw message
drivers/acpi/acpica/exfield.c +67 -0
79 lines not on this page · raw message
drivers/acpi/acpica/exprep.c +2 -0
@@ -484,6 +484,8 @@ acpi_status acpi_ex_prep_field_value(str obj_desc->field.resource_length = info->resource_length; } + obj_desc->field.pin_number_index = info->pin_number_index; +/* Allow full data read from EC address space */ if ((obj_desc->field.region_obj->region.space_id ==
Greg Kroah-Hartman
maintainerPATCH 121/238 ACPI / hotplug: Generate online uevents for ACPI containers
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 8ab17fc92e49bc2b8fff9d220c19bf50ec9c1158 upstream.
Commit 46394fd01 (ACPI / hotplug: Move container-specific code out of the core) removed the generation of "online" uevents for containers, because "add" uevents are now generated for them automatically when container system devices are registered. However, there are user space tools that need to be notified when the container and all of its children have been enumerated, which doesn't happen any more.
For this reason, add a mechanism allowing "online" uevents to be generated for ACPI containers after enumerating the container along with all of its children.
--- drivers/acpi/container.c | 8 ++++++++ drivers/acpi/scan.c | 3 +++ include/acpi/acpi_bus.h | 1 + 3 files changed, 12 insertions(+)
drivers/acpi/container.c +8 -0
@@ -96,6 +96,13 @@ static void container_device_detach(strudevice_unregister (dev); } +static void container_device_online (struct acpi_device *adev) +{ +struct device *dev =acpi_driver_data (adev); + +kobject_uevent (&dev->kobj,KOBJ_ONLINE ); +} +static struct acpi_scan_handler container_handler = { .ids = container_device_ids, .attach = container_device_attach,
@@ -103,6 +110,7 @@ static struct acpi_scan_handler containe .hotplug = { .enabled = true, .demand_offline = true, + .notify_online = container_device_online, }, };
drivers/acpi/scan.c +3 -0
@@ -2068,6 +2068,9 @@ static void acpi_bus_attach(struct acpi_ ok:list_for_each_entry (child, &device->children, node)acpi_bus_attach (child); + +if (device->handler && device->handler->hotplug.notify_online) + device->handler->hotplug.notify_online (device); }/**
include/acpi/acpi_bus.h +1 -0
@@ -118,6 +118,7 @@ struct acpi_device;struct acpi_hotplug_profile {struct kobject kobj;int (*scan_dependent)(struct acpi_device *adev); +void (*notify_online)(struct acpi_device *adev);bool enabled:1 ;bool demand_offline:1 ; };
Greg Kroah-Hartman
maintainerPATCH 122/238 ACPI / scan: Correct error return value of create_modalias()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
commit 98d28d0e59160d2d6cb3f6a9050723ac40f89669 upstream.
There is a typo, it should be negative -errno instead.
--- drivers/acpi/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/scan.c +1 -1
@@ -106,7 +106,7 @@ static int create_modalias(struct acpi_dlist_for_each_entry (id, &acpi_dev->pnp.ids, list) { count =snprintf (&modalias[len], size,"%s:" , id->id);if (count <0 ) -return EINVAL ; +return -EINVAL ;if (count >= size)return -ENOMEM ; len += count;
Greg Kroah-Hartman
maintainerPATCH 123/238 memblock, memhotplug: fix wrong type in memblock_find_in_range_node().
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Chen <[email protected]>
commit 0cfb8f0c3e21e36d4a6e472e4c419d58ba848698 upstream.
In memblock_find_in_range_node(), we defined ret as int. But it should be phys_addr_t because it is used to store the return value from __memblock_find_range_bottom_up().
The bug has not been triggered because when allocating low memory near the kernel end, the "int ret" won't turn out to be negative. When we started to allocate memory on other nodes, and the "int ret" could be minus. Then the kernel will panic.
A simple way to reproduce this: comment out the following code in numa_init(),
memblock_set_bottom_up(false);
and the kernel won't boot.
--- mm/memblock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
mm/memblock.c +1 -2
@@ -183,8 +183,7 @@ phys_addr_t __init_memblock memblock_fin phys_addr_t align, phys_addr_t start, phys_addr_t end, int nid) { - int ret; -phys_addr_t kernel_end; + phys_addr_t kernel_end, ret;/* pump up @end */ if (end ==MEMBLOCK_ALLOC_ACCESSIBLE )
Greg Kroah-Hartman
maintainerPATCH 124/238 regmap: Fix handling of volatile registers for format_write() chips
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 5844a8b9d98ec11ce1d77610daacf3f0a0e14715 upstream.
A previous over-zealous factorisation of code means that we only treat registers as volatile if they are readable. For most devices this is fine since normally most registers can be read and volatility implies readability but for format_write() devices where there is no readback from the hardware and we use volatility to mean simply uncacheability this means that we end up treating all registers as cacheble.
A bigger refactoring of the code to clarify this is in order but as a fix make a minimal change and only check readability when checking volatility if there is no format_write() operation defined for the device.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -105,7 +105,7 @@ bool regmap_readable(struct regmap *map,bool regmap_volatile (struct regmap *map,unsigned int reg) { -if (!regmap_readable (map, reg)) +if (!map->format.format_write && !regmap_readable (map, reg))return false;if (map->volatile_reg)
Greg Kroah-Hartman
maintainerPATCH 125/238 regmap: Dont attempt block writes when syncing cache on single_rw devices
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 5c1ebe7f73f9166893c3459915db8a09d6d1d715 upstream.
If the device can't support block writes then don't attempt to use raw syncing which will automatically generate block writes for adjacent registers, use the existing _single() block syncing implementation.
--- drivers/base/regmap/regcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regcache.c +1 -1
@@ -701,7 +701,7 @@ int regcache_sync_block(struct regmap *m unsigned int block_base, unsigned int start, unsigned int end) { - if (regmap_can_raw_write(map)) + if (regmap_can_raw_write(map) && !map->use_single_rw) return regcache_sync_block_raw(map, block, cache_present, block_base, start, end); else
Greg Kroah-Hartman
maintainerPATCH 126/238 cgroup: fix unbalanced locking
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zefan Li <[email protected]>
commit eb4aec84d6bdf98d00cedb41c18000f7a31e648a upstream.
cgroup_pidlist_start() holds cgrp->pidlist_mutex and then calls pidlist_array_load(), and cgroup_pidlist_stop() releases the mutex.
It is wrong that we release the mutex in the failure path in pidlist_array_load(), because cgroup_pidlist_stop() will be called no matter if cgroup_pidlist_start() returns errno or not.
--- kernel/cgroup.c | 1 - 1 file changed, 1 deletion(-)
kernel/cgroup.c +0 -1
@@ -3663,7 +3663,6 @@ static int pidlist_array_load(struct cgr l =cgroup_pidlist_find_create (cgrp, type);if (!l) { -mutex_unlock (&cgrp->pidlist_mutex);pidlist_free (array);return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 127/238 KVM: s390/mm: try a cow on read only pages for key ops
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
commit ab3f285f227fec62868037e9b1b1fd18294a83b8 upstream.
The PFMF instruction handler blindly wrote the storage key even if the page was mapped R/O in the host. Lets try a COW before continuing and bail out in case of errors.
--- arch/s390/mm/pgtable.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/s390/mm/pgtable.c +10 -0
@@ -810,11 +810,21 @@ int set_guest_storage_key(struct mm_strupte_t *ptep;down_read (&mm->mmap_sem); +retry: ptep =get_locked_pte (current->mm, addr, &ptl);if (unlikely (!ptep)) {up_read (&mm->mmap_sem);return -EFAULT ; } +if (!(pte_val (*ptep) & _PAGE_INVALID) && + (pte_val (*ptep) & _PAGE_PROTECT)) { +pte_unmap_unlock (*ptep, ptl); +if (fixup_user_fault (current, mm, addr,FAULT_FLAG_WRITE )) { +up_read (&mm->mmap_sem); +return -EFAULT ; + } + goto retry; + } new = old =pgste_get_lock (ptep); pgste_val(new) &= ~(PGSTE_GR_BIT | PGSTE_GC_BIT |
Greg Kroah-Hartman
maintainerPATCH 128/238 xen/manage: Always freeze/thaw processes when suspend/resuming
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <[email protected]>
commit 61a734d305e16944b42730ef582a7171dc733321 upstream.
Always freeze processes when suspending and thaw processes when resuming to prevent a race noticeable with HVM guests.
This prevents a deadlock where the khubd kthread (which is designed to be freezable) acquires a usb device lock and then tries to allocate memory which requires the disk which hasn't been resumed yet. Meanwhile, the xenwatch thread deadlocks waiting for the usb device lock.
Freezing processes fixes this because the khubd thread is only thawed after the xenwatch thread finishes resuming all the devices.
--- drivers/xen/manage.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/xen/manage.c +0 -7
@@ -111,16 +111,11 @@ static void do_suspend(void) shutting_down =SHUTDOWN_SUSPEND ; -#ifdef CONFIG_PREEMPT -/* If the kernel is preemptible, we need to freeze all the processes -to prevent them from being in the middle of a pagetable update -during suspend. */ err =freeze_processes ();if (err) {pr_err ("%s: freeze failed %d\n" , __func__, err); goto out; } -#endif err =dpm_suspend_start (PMSG_FREEZE );if (err) {
@@ -169,10 +164,8 @@ out_resume:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw: -#ifdef CONFIG_PREEMPTthaw_processes (); out: -#endif shutting_down = SHUTDOWN_INVALID; }#endif /* CONFIG_HIBERNATE_CALLBACKS */
Greg Kroah-Hartman
maintainerPATCH 129/238 x86/xen: dont copy bogus duplicate entries into kernel page tables
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Bader <[email protected]>
commit 0b5a50635fc916cf46e3de0b819a61fc3f17e7ee upstream.
When RANDOMIZE_BASE (KASLR) is enabled; or the sum of all loaded modules exceeds 512 MiB, then loading modules fails with a warning (and hence a vmalloc allocation failure) because the PTEs for the newly-allocated vmalloc address space are not zero.
WARNING: CPU: 0 PID: 494 at linux/mm/vmalloc.c:128
vmap_page_range_noflush+0x2a1/0x360()This is caused by xen_setup_kernel_pagetables() copying level2_kernel_pgt into level2_fixmap_pgt, overwriting many non-present entries.
Without KASLR, the normal kernel image size only covers the first half of level2_kernel_pgt and module space starts after that.
L4[511]->level3_kernel_pgt[510]->level2_kernel_pgt[ 0..255]->kernel
[256..511]->module
[511]->level2_fixmap_pgt[ 0..505]->moduleThis allows 512 MiB of of module vmalloc space to be used before having to use the corrupted level2_fixmap_pgt entries.
With KASLR enabled, the kernel image uses the full PUD range of 1G and module space starts in the level2_fixmap_pgt. So basically:
L4[511]->level3_kernel_pgt[510]->level2_kernel_pgt[0..511]->kernel
[511]->level2_fixmap_pgt[0..505]->module
And now no module vmalloc space can be used without using the corrupt level2_fixmap_pgt entries.
Fix this by properly converting the level2_fixmap_pgt entries to MFNs, and setting level1_fixmap_pgt as read-only.
A number of comments were also using the the wrong L3 offset for level2_kernel_pgt. These have been corrected.
--- arch/x86/include/asm/pgtable_64.h | 1 + arch/x86/xen/mmu.c | 27 ++++++++++++--------------- 2 files changed, 13 insertions(+), 15 deletions(-)
arch/x86/include/asm/pgtable_64.h +1 -0
@@ -19,6 +19,7 @@ extern pud_t level3_ident_pgt[512];extern pmd_t level2_kernel_pgt[512 ];extern pmd_t level2_fixmap_pgt[512 ];extern pmd_t level2_ident_pgt[512 ]; +extern pte_t level1_fixmap_pgt[512 ];extern pgd_t init_level4_pgt[];#define swapper_pg_dir init_level4_pgt
arch/x86/xen/mmu.c +12 -15
@@ -1866,12 +1866,11 @@ static void __init check_pt_base(unsigne* * We can construct this by grafting the Xen provided pagetable into * head_64.S's preconstructed pagetables. We copy the Xen L2's into -* level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt. This -* means that only the kernel has a physical mapping to start with - -* but that's enough to get __va working. We need to fill in the rest -* of the physical mapping once some sort of allocator has been set -* up. -* NOTE: for PVH, the page tables are native. +* level2_ident_pgt, and level2_kernel_pgt. This means that only the +* kernel has a physical mapping to start with - but that's enough to +* get __va working. We need to fill in the rest of the physical +* mapping once some sort of allocator has been set up. NOTE: for +* PVH, the page tables are native. */ void __init xen_setup_kernel_pagetable (pgd_t *pgd,unsigned long max_pfn) {
@@ -1902,8 +1901,11 @@ void __init xen_setup_kernel_pagetable(p/* L3_i[0] -> level2_ident_pgt */ convert_pfn_mfn (level3_ident_pgt);/* L3_k[510] -> level2_kernel_pgt -* L3_i[511] -> level2_fixmap_pgt */ +* L3_k[511] -> level2_fixmap_pgt */ convert_pfn_mfn (level3_kernel_pgt); + +/* L3_k[511][506] -> level1_fixmap_pgt */ +convert_pfn_mfn (level2_fixmap_pgt); }/* We get [511][511] and have Xen's version of level2_kernel_pgt */ l3 =m2v (pgd[pgd_index (__START_KERNEL_map)].pgd);
@@ -1913,21 +1915,15 @@ void __init xen_setup_kernel_pagetable(p addr[1 ] = (unsigned long )l3; addr[2 ] = (unsigned long )l2;/* Graft it onto L4[272][0]. Note that we creating an aliasing problem: -* Both L4[272][0] and L4[511][511] have entries that point to the same +* Both L4[272][0] and L4[511][510] have entries that point to the same * L2 (PMD) tables. Meaning that if you modify it in __va space * it will be also modified in the __ka space! (But if you just * modify the PMD table to point to other PTE's or none, then you * are OK - which is what cleanup_highmap does) */ copy_page (level2_ident_pgt, l2); -/* Graft it onto L4[511][511] */ +/* Graft it onto L4[511][510] */ copy_page (level2_kernel_pgt, l2); -/* Get [511][510] and graft that in level2_fixmap_pgt */ - l3 =m2v (pgd[pgd_index (__START_KERNEL_map +PMD_SIZE )].pgd); - l2 =m2v (l3[pud_index (__START_KERNEL_map +PMD_SIZE )].pud); -copy_page (level2_fixmap_pgt, l2); -/* Note that we don't do anything with level1_fixmap_pgt which -* we don't need. */ if (!xen_feature (XENFEAT_auto_translated_physmap)) {/* Make pagetable pieces RO */ set_page_prot (init_level4_pgt,PAGE_KERNEL_RO );
@@ -1937,6 +1933,7 @@ void __init xen_setup_kernel_pagetable(pset_page_prot (level2_ident_pgt,PAGE_KERNEL_RO );set_page_prot (level2_kernel_pgt,PAGE_KERNEL_RO );set_page_prot (level2_fixmap_pgt,PAGE_KERNEL_RO ); +set_page_prot (level1_fixmap_pgt,PAGE_KERNEL_RO );/* Pin down new L4 */ pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
Greg Kroah-Hartman
maintainerPATCH 130/238 x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Young <[email protected]>
commit 3eddc69ffeba092d288c386646bfa5ec0fce25fd upstream.
3.16 kernel boot fail with earlyprintk=efi, it keeps scrolling at the bottom line of screen.
Bisected, the first bad commit is below:
commit 86dfc6f339886559d80ee0d4bd20fe5ee90450f0
Author: Lv Zheng <[email protected]> Date: Fri Apr 4 12:38:57 2014 +0800
ACPICA: Tables: Fix table checksums verification before installation.
I did some debugging by enabling both serial and efi earlyprintk, below is some debug dmesg, seems early_ioremap fails in scroll up function due to no free slot, see below dmesg output:
WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:116 __early_ioremap+0x90/0x1c4()
__early_ioremap(ed00c800, 00000c80) not found slot
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-rc1+ #204
Hardware name: Hewlett-Packard HP Z420 Workstation/1589, BIOS J61 v03.15 05/09/2013
Call Trace:
dump_stack+0x4e/0x7a
warn_slowpath_common+0x75/0x8e
? __early_ioremap+0x90/0x1c4
warn_slowpath_fmt+0x47/0x49
__early_ioremap+0x90/0x1c4
? sprintf+0x46/0x48
early_ioremap+0x13/0x15
early_efi_map+0x24/0x26
early_efi_scroll_up+0x6d/0xc0
early_efi_write+0x1b0/0x214
call_console_drivers.constprop.21+0x73/0x7e
console_unlock+0x151/0x3b2
? vprintk_emit+0x49f/0x532
vprintk_emit+0x521/0x532
? console_unlock+0x383/0x3b2
printk+0x4f/0x51
acpi_os_vprintf+0x2b/0x2d
acpi_os_printf+0x43/0x45
acpi_info+0x5c/0x63
? __acpi_map_table+0x13/0x18
? acpi_os_map_iomem+0x21/0x147
acpi_tb_print_table_header+0x177/0x186
acpi_tb_install_table_with_override+0x4b/0x62
acpi_tb_install_standard_table+0xd9/0x215
? early_ioremap+0x13/0x15
? __acpi_map_table+0x13/0x18
acpi_tb_parse_root_table+0x16e/0x1b4
acpi_initialize_tables+0x57/0x59
acpi_table_init+0x50/0xce
acpi_boot_table_init+0x1e/0x85
setup_arch+0x9b7/0xcc4
start_kernel+0x94/0x42d
? early_idt_handlers+0x120/0x120
x86_64_start_reservations+0x2a/0x2c
x86_64_start_kernel+0xf3/0x100Quote reply from Lv.zheng about the early ioremap slot usage in this case:
"""
In early_efi_scroll_up(), 2 mapping entries will be used for the src/dst screen buffer.
In drivers/acpi/acpica/tbutils.c, we've improved the early table loading code in acpi_tb_parse_root_table(). We now need 2 mapping entries:
1. One mapping entry is used for RSDT table mapping. Each RSDT entry contains an address for another ACPI table.
2. For each entry in RSDP, we need another mapping entry to map the table to perform necessary check/override before installing it.
When acpi_tb_parse_root_table() prints something through EFI earlyprintk console, we'll have 4 mapping entries used. The current 4 slots setting of early_ioremap() seems to be too small for such a use case.
"""
Thus increase the slot to 8 in this patch to fix this issue. boot-time mappings become 512 page with this patch.
--- arch/x86/include/asm/fixmap.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/include/asm/fixmap.h +3 -3
@@ -123,14 +123,14 @@ enum fixed_addresses { __end_of_permanent_fixed_addresses,/* -* 256 temporary boot-time mappings, used by early_ioremap(), +* 512 temporary boot-time mappings, used by early_ioremap(), * before ioremap() is functional. * -* If necessary we round it up to the next 256 pages boundary so +* If necessary we round it up to the next 512 pages boundary so * that we can have a single pgd entry and a single pte table: */ #define NR_FIX_BTMAPS 64 -#define FIX_BTMAPS_SLOTS 4 +#define FIX_BTMAPS_SLOTS 8#define TOTAL_FIX_BTMAPS (NR_FIX_BTMAPS * FIX_BTMAPS_SLOTS) FIX_BTMAP_END = (__end_of_permanent_fixed_addresses ^
Greg Kroah-Hartman
maintainerPATCH 131/238 x86/kaslr: Avoid the setup_data area when picking location
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 0cacbfbeb5077b63d5d3cf6df88b14ac12ad584b upstream.
The KASLR location-choosing logic needs to avoid the setup_data list memory areas as well. Without this, it would be possible to have the ASLR position stomp on the memory, ultimately causing the boot to fail.
--- arch/x86/boot/compressed/aslr.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/x86/boot/compressed/aslr.c +15 -0
@@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned longstatic bool mem_avoid_overlap (struct mem_vector *img) {int i; +struct setup_data *ptr;for (i =0 ; i <MEM_AVOID_MAX ; i++) {if (mem_overlaps (img, &mem_avoid[i]))return true; } +/* Avoid all entries in the setup_data linked list. */ + ptr = (struct setup_data *)(unsigned long )real_mode->hdr.setup_data; +while (ptr) { +struct mem_vector avoid; + + avoid.start = (u64 )ptr; + avoid.size =sizeof (*ptr) + ptr->len; + +if (mem_overlaps (img, &avoid)) +return true; + + ptr = (struct setup_data *)(unsigned long )ptr->next; + } +return false; }
Greg Kroah-Hartman
maintainerPATCH 132/238 shmem: fix nlink for rename overwrite directory
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit b928095b0a7cff7fb9fcf4c706348ceb8ab2c295 upstream.
If overwriting an empty directory with rename, then need to drop the extra nlink.
Test prog:
#include <stdio.h>
#include <fcntl.h>
#include <err.h>
#include <sys/stat.h>
int main(void)
{
const char *test_dir1 = "test-dir1";
const char *test_dir2 = "test-dir2";
int res;
int fd;
struct stat statbuf;
res = mkdir(test_dir1, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir1);
res = mkdir(test_dir2, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir2);
fd = open(test_dir2, O_RDONLY);
if (fd == -1)
err(1, "open(\"%s\")", test_dir2);
res = rename(test_dir1, test_dir2);
if (res == -1)
err(1, "rename(\"%s\", \"%s\")", test_dir1, test_dir2);
res = fstat(fd, &statbuf);
if (res == -1)
err(1, "fstat(%i)", fd);
if (statbuf.st_nlink != 0) {
fprintf(stderr, "nlink is %lu, should be 0\n", statbuf.st_nlink);
return 1;
}
return 0;
}--- mm/shmem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/shmem.c +3 -1
@@ -2143,8 +2143,10 @@ static int shmem_rename(struct inode *olif (new_dentry->d_inode) { (void )shmem_unlink (new_dir, new_dentry); -if (they_are_dirs) +if (they_are_dirs) { +drop_nlink (new_dentry->d_inode);drop_nlink (old_dir); + } }else if (they_are_dirs) {drop_nlink (old_dir);inc_nlink (new_dir);
Greg Kroah-Hartman
maintainerPATCH 133/238 ASoC: davinci-mcasp: Correct rx format unit configuration
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit fe0a29e163a5d045c73faab682a8dac71c2f8012 upstream.
In case of capture we should not use rotation. The reverse and mask is enough to get the data align correctly from the bus to MCU:
Format data from bus after reverse (XRBUF) S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB| S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB|
With this patch all supported formats will work for playback and capture.
--- sound/soc/davinci/davinci-mcasp.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
sound/soc/davinci/davinci-mcasp.c +10 -1
@@ -418,8 +418,17 @@ static int davinci_config_channel_size(s {u32 fmt;u32 tx_rotate = (word_length /4 ) &0x7 ; -u32 rx_rotate = (32 - word_length) /4 ;u32 mask = (1ULL << word_length) -1 ; +/* +* For captured data we should not rotate, inversion and masking is +* enoguh to get the data to the right position: +* Format data from bus after reverse (XRBUF) +* S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB| +* S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| +* S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| +* S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB| +*/ +u32 rx_rotate =0 ;/* * if s BCLK-to-LRCLK ratio has been configured via the set_clkdiv()
Greg Kroah-Hartman
maintainerPATCH 134/238 SMB3: Fix oops when creating symlinks on smb3
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit da80659d4aa758dc6935b10ec64513f0b67bc969 upstream.
We were not checking for symlink support properly for SMB2/SMB3 mounts so could oops when mounted with mfsymlinks when try to create symlink when mfsymlinks on smb2/smb3 mounts
--- fs/cifs/link.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/cifs/link.c +6 -2
@@ -213,8 +213,12 @@ create_mf_symlink(const unsigned int xidif (rc) goto out; - rc = tcon->ses->server->ops->create_mf_symlink (xid, tcon, cifs_sb, - fromName, buf, &bytes_written); +if (tcon->ses->server->ops->create_mf_symlink) + rc = tcon->ses->server->ops->create_mf_symlink (xid, tcon, + cifs_sb, fromName, buf, &bytes_written); +else + rc = -EOPNOTSUPP ; +if (rc) goto out;
Greg Kroah-Hartman
maintainerPATCH 135/238 iio:trigger: modify return value for iio_trigger_get
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit f153566570fb9e32c2f59182883f4f66048788fb upstream.
Instead of a void function, return the trigger pointer.
Whilst not in of itself a fix, this makes the following set of 7 fixes cleaner than they would otherwise be.
--- include/linux/iio/trigger.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/iio/trigger.h +3 -1
@@ -84,10 +84,12 @@ static inline void iio_trigger_put(strucput_device (&trig->dev); } -static inline void iio_trigger_get (struct iio_trigger *trig) +static inline struct iio_trigger *iio_trigger_get (struct iio_trigger *trig) {get_device (&trig->dev);__module_get (trig->ops->owner); + +return trig; }/**
Greg Kroah-Hartman
maintainerPATCH 136/238 iio: accel: bma180: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 0668a4e4d297328ce08b44d91d160537596115e2 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/accel/bma180.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/accel/bma180.c +1 -1
@@ -571,7 +571,7 @@ static int bma180_probe(struct i2c_clien trig->ops = &bma180_trigger_ops;iio_trigger_set_drvdata (trig, indio_dev); data->trig = trig; - indio_dev->trig = trig; + indio_dev->trig =iio_trigger_get (trig); ret =iio_trigger_register (trig);if (ret)
Greg Kroah-Hartman
maintainerPATCH 137/238 iio: hid_sensor_hub: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 55a6f9ddfdea0d2d343cd1b39baf8aa752664b6e upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/common/hid-sensors/hid-sensor-trigger.c +2 -1
@@ -99,7 +99,8 @@ int hid_sensor_setup_trigger(struct iio_dev_err (&indio_dev->dev,"Trigger Register Failed\n" ); goto error_free_trig; } - indio_dev->trig = attrb->trigger = trig; + attrb->trigger = trig; + indio_dev->trig =iio_trigger_get (trig);return ret;
Greg Kroah-Hartman
maintainerPATCH 138/238 iio: gyro: itg3200: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 0b4dce2ee694a991ef38203ec5ff91a738518cb3 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/gyro/itg3200_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/gyro/itg3200_buffer.c +1 -1
@@ -132,7 +132,7 @@ int itg3200_probe_trigger(struct iio_dev goto error_free_irq;/* select default trigger */ - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 139/238 iio: inv_mpu6050: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit b07e3b3850b2e1f09c19f54d3ed7210d9f529e2c upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +1 -1
@@ -135,7 +135,7 @@ int inv_mpu6050_probe_trigger(struct iio ret =iio_trigger_register (st->trig);if (ret) goto error_free_irq; - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 140/238 iio: meter: ade7758: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 0495081179212b758775df752e657ea71dcae020 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/staging/iio/meter/ade7758_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/meter/ade7758_trigger.c +1 -1
@@ -85,7 +85,7 @@ int ade7758_probe_trigger(struct iio_dev ret =iio_trigger_register (st->trig);/* select default trigger */ - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);if (ret) goto error_free_irq;
Greg Kroah-Hartman
maintainerPATCH 141/238 iio: st_sensors: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit f0e84acd7056e6d7ade551c6439531606ae30a46 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/st_sensors/st_sensors_trigger.c +1 -1
@@ -49,7 +49,7 @@ int st_sensors_allocate_trigger(struct idev_err (&indio_dev->dev,"failed to register iio trigger.\n" ); goto iio_trigger_register_error; } - indio_dev->trig = sdata->trig; + indio_dev->trig =iio_trigger_get (sdata->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 142/238 iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 9e5846be33277802c0c76e5c12825d0e4d27f639 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad_sigma_delta.c +1 -1
@@ -472,7 +472,7 @@ static int ad_sd_probe_trigger(struct ii goto error_free_irq;/* select default trigger */ - indio_dev->trig = sigma_delta->trig; + indio_dev->trig =iio_trigger_get (sigma_delta->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 143/238 iio:magnetometer: bugfix magnetometers gain values
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis CIOCCA <[email protected]>
commit a31d0928999fbf33b3a6042e8bcb7b7f7e07d094 upstream.
This patch fix gains values. The first driver was designed using engineering samples, in mass production the values are changed.
--- drivers/iio/magnetometer/st_magn_core.c | 52 ++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 22 deletions(-)
drivers/iio/magnetometer/st_magn_core.c +30 -22
@@ -42,7 +42,8 @@#define ST_MAGN_FS_AVL_5600MG 5600#define ST_MAGN_FS_AVL_8000MG 8000#define ST_MAGN_FS_AVL_8100MG 8100 -#define ST_MAGN_FS_AVL_10000MG 10000 +#define ST_MAGN_FS_AVL_12000MG 12000 +#define ST_MAGN_FS_AVL_16000MG 16000/* CUSTOM VALUES FOR SENSOR 1 */ #define ST_MAGN_1_WAI_EXP 0x3c
@@ -69,20 +70,20 @@#define ST_MAGN_1_FS_AVL_4700_VAL 0x05#define ST_MAGN_1_FS_AVL_5600_VAL 0x06#define ST_MAGN_1_FS_AVL_8100_VAL 0x07 -#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 1100 -#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 855 -#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 670 -#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 450 -#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 400 -#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 330 -#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 230 -#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 980 -#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 760 -#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 600 -#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 400 -#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 355 -#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 295 -#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 205 +#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 909 +#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 1169 +#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 1492 +#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 2222 +#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 2500 +#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 3030 +#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 4347 +#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 1020 +#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 1315 +#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 1666 +#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 2500 +#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 2816 +#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 3389 +#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 4878#define ST_MAGN_1_MULTIREAD_BIT false/* CUSTOM VALUES FOR SENSOR 2 */
@@ -105,10 +106,12 @@#define ST_MAGN_2_FS_MASK 0x60#define ST_MAGN_2_FS_AVL_4000_VAL 0x00#define ST_MAGN_2_FS_AVL_8000_VAL 0x01 -#define ST_MAGN_2_FS_AVL_10000_VAL 0x02 -#define ST_MAGN_2_FS_AVL_4000_GAIN 430 -#define ST_MAGN_2_FS_AVL_8000_GAIN 230 -#define ST_MAGN_2_FS_AVL_10000_GAIN 230 +#define ST_MAGN_2_FS_AVL_12000_VAL 0x02 +#define ST_MAGN_2_FS_AVL_16000_VAL 0x03 +#define ST_MAGN_2_FS_AVL_4000_GAIN 146 +#define ST_MAGN_2_FS_AVL_8000_GAIN 292 +#define ST_MAGN_2_FS_AVL_12000_GAIN 438 +#define ST_MAGN_2_FS_AVL_16000_GAIN 584#define ST_MAGN_2_MULTIREAD_BIT false#define ST_MAGN_2_OUT_X_L_ADDR 0x28#define ST_MAGN_2_OUT_Y_L_ADDR 0x2a
@@ -266,9 +269,14 @@ static const struct st_sensors st_magn_s .gain = ST_MAGN_2_FS_AVL_8000_GAIN, }, [2] = { - .num = ST_MAGN_FS_AVL_10000MG, - .value = ST_MAGN_2_FS_AVL_10000_VAL, - .gain = ST_MAGN_2_FS_AVL_10000_GAIN, + .num = ST_MAGN_FS_AVL_12000MG, + .value = ST_MAGN_2_FS_AVL_12000_VAL, + .gain = ST_MAGN_2_FS_AVL_12000_GAIN, + }, + [3] = { + .num = ST_MAGN_FS_AVL_16000MG, + .value = ST_MAGN_2_FS_AVL_16000_VAL, + .gain = ST_MAGN_2_FS_AVL_16000_GAIN, }, }, },
Greg Kroah-Hartman
maintainerPATCH 145/238 Target/iser: Get isert_conn reference once got to connected_handler
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit c2f88b17a1d97ca4ecd96cc22333a7a4f1407d39 upstream.
In case the connection didn't reach connected state, disconnected handler will never be invoked thus the second kref_put on isert_conn will be missing.
--- drivers/infiniband/ulp/isert/ib_isert.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +3 -2
@@ -511,7 +511,6 @@ isert_connect_request(struct rdma_cm_idinit_completion (&isert_conn->conn_wait);init_completion (&isert_conn->conn_wait_comp_err);kref_init (&isert_conn->conn_kref); -kref_get (&isert_conn->conn_kref);mutex_init (&isert_conn->conn_mutex);spin_lock_init (&isert_conn->conn_lock);INIT_LIST_HEAD (&isert_conn->conn_fr_pool);
@@ -663,7 +662,9 @@ isert_connect_release(struct isert_connstatic void isert_connected_handler (struct rdma_cm_id *cma_id) { -return ; +struct isert_conn *isert_conn = cma_id->context; + +kref_get (&isert_conn->conn_kref); } static void
Greg Kroah-Hartman
maintainerPATCH 146/238 Target/iser: Dont put isert_conn inside disconnected handler
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 0fc4ea701fcf5bc51ace4e288af5be741465f776 upstream.
disconnected_handler is invoked on several CM events (such as DISCONNECTED, DEVICE_REMOVAL, TIMEWAIT_EXIT...). Since multiple events can occur while before isert_free_conn is invoked, we might put all isert_conn references and free the connection too early.
--- drivers/infiniband/ulp/isert/ib_isert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +1 -1
@@ -716,7 +716,6 @@ isert_disconnect_work(struct work_struct wake_up:complete (&isert_conn->conn_wait); -isert_put_conn (isert_conn); } static void
@@ -2801,6 +2800,7 @@ static void isert_wait_conn(struct iscsiwait_for_completion (&isert_conn->conn_wait_comp_err);wait_for_completion (&isert_conn->conn_wait); +isert_put_conn (isert_conn); }static void isert_free_conn (struct iscsi_conn *conn)
Greg Kroah-Hartman
maintainerPATCH 147/238 target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Herbszt <[email protected]>
commit 1f0b030c45c781f9fe568e5e2a813d6c8567a051 upstream.
Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE for setting the supported ALUA access states via configfs, originally introduced in commit b0a382c5.
A value of 1 should enable the support, not disable it.
--- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_configfs.c +1 -1
@@ -2359,7 +2359,7 @@ static ssize_t target_core_alua_tg_pt_gppr_err ("Invalid value '%ld', must be '0' or '1'\n" , tmp); \return -EINVAL ; \ } \ -if (!tmp) \ +if (tmp) \ t->_var |= _bit; \else \ t->_var &= ~_bit; \
Greg Kroah-Hartman
maintainerPATCH 148/238 iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joern Engel <[email protected]>
commit 8ae757d09c45102b347a1bc2867f54ffc1ab8fda upstream.
In iscsi_copy_param_list() a failed iscsi_param_list memory allocation currently invokes iscsi_release_param_list() to cleanup, and will promptly trigger a NULL pointer dereference.
Instead, go ahead and return for the first iscsi_copy_param_list() failure case.
Found by coverity.
--- drivers/target/iscsi/iscsi_target_parameters.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_parameters.c +1 -1
@@ -601,7 +601,7 @@ int iscsi_copy_param_list( param_list =kzalloc (sizeof (struct iscsi_param_list ),GFP_KERNEL );if (!param_list) {pr_err ("Unable to allocate memory for struct iscsi_param_list.\n" ); - goto err_out; +return -1 ; }INIT_LIST_HEAD (¶m_list->param_list);INIT_LIST_HEAD (¶m_list->extra_response_list);
Greg Kroah-Hartman
maintainerPATCH 149/238 iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit b53b0d99d6fbf7d44330395349a895521cfdbc96 upstream.
This patch fixes a bug in iscsit_logout_post_handler_diffcid() where a pointer used as storage for list_for_each_entry() was incorrectly being used to determine if no matching entry had been found.
This patch changes iscsit_logout_post_handler_diffcid() to key off bool conn_found to determine if the function needs to exit early.
--- drivers/target/iscsi/iscsi_target.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target.c +3 -1
@@ -4513,6 +4513,7 @@ static void iscsit_logout_post_handler_d {struct iscsi_conn *l_conn;struct iscsi_session *sess = conn->sess; +bool conn_found = false;if (!sess)return ;
@@ -4521,12 +4522,13 @@ static void iscsit_logout_post_handler_dlist_for_each_entry (l_conn, &sess->sess_conn_list, conn_list) {if (l_conn->cid == cid) {iscsit_inc_conn_usage_count (l_conn); + conn_found = true;break ; } }spin_unlock_bh (&sess->conn_lock); -if (!l_conn) +if (!conn_found)return ;if (l_conn->sock)
Greg Kroah-Hartman
maintainerPATCH 150/238 NFC: microread: Potential overflows in microread_target_discovered()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit d07f1e8600ccb885c8f4143402b8912f7d827bcb upstream.
Smatch says that skb->data is untrusted so we need to check to make sure that the memcpy() doesn't overflow.
--- drivers/nfc/microread/microread.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/nfc/microread/microread.c +12 -4
@@ -501,9 +501,13 @@ static void microread_target_discovered( targets->sens_res =be16_to_cpu (*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA ]); targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK ]; -memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID ], - skb->data[MICROREAD_EMCF_A_LEN ]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN ]; +if (targets->nfcid1_len >sizeof (targets->nfcid1)) { + r = -EINVAL ; + goto exit_free; + } +memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID ], + targets->nfcid1_len);break ;case MICROREAD_GATE_ID_MREAD_ISO_A_3 : targets->supported_protocols =
@@ -511,9 +515,13 @@ static void microread_target_discovered( targets->sens_res =be16_to_cpu (*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA ]); targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK ]; -memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID ], - skb->data[MICROREAD_EMCF_A3_LEN ]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN ]; +if (targets->nfcid1_len >sizeof (targets->nfcid1)) { + r = -EINVAL ; + goto exit_free; + } +memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID ], + targets->nfcid1_len);break ;case MICROREAD_GATE_ID_MREAD_ISO_B : targets->supported_protocols =NFC_PROTO_ISO14443_B_MASK ;
Greg Kroah-Hartman
maintainerPATCH 151/238 SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.
This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu. This function is used by iscsi drivers and userspace to send iscsi PDUs/ commands. For login commands, we have a set buffer size. For all other commands we do not support data buffers.
This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html
--- drivers/scsi/libiscsi.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/libiscsi.c +10 -0
@@ -717,11 +717,21 @@ __iscsi_conn_send_pdu(struct iscsi_connreturn NULL ; } +if (data_size >ISCSI_DEF_MAX_RECV_SEG_LEN ) { +iscsi_conn_printk (KERN_ERR , conn,"Invalid buffer len of %u for login task. Max len is %u\n" , data_size,ISCSI_DEF_MAX_RECV_SEG_LEN ); +return NULL ; + } + task = conn->login_task; }else {if (session->state !=ISCSI_STATE_LOGGED_IN )return NULL ; +if (data_size !=0 ) { +iscsi_conn_printk (KERN_ERR , conn,"Can not send data buffer of len %u for op 0x%x\n" , data_size, opcode); +return NULL ; + } +BUG_ON (conn->c_stage ==ISCSI_CONN_INITIAL_STAGE );BUG_ON (conn->c_stage ==ISCSI_CONN_STOPPED );
Greg Kroah-Hartman
maintainerPATCH 152/238 Revert "iwlwifi: dvm: dont enable CTS to self"
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit f47f46d7b09cf1d09e4b44b6cc4dd7d68a08028c upstream.
This reverts commit 43d826ca5979927131685cc2092c7ce862cb91cd.
This commit caused packet loss.
--- drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/iwlwifi/dvm/rxon.c +12 -0
@@ -1068,6 +1068,13 @@ int iwlagn_commit_rxon(struct iwl_priv */* recalculate basic rates */ iwl_calc_basic_rates (priv, ctx); +/* +* force CTS-to-self frames protection if RTS-CTS is not preferred +* one aggregation protection method +*/ +if (!priv->hw_params.use_rts_for_aggregation) + ctx->staging.flags |=RXON_FLG_SELF_CTS_EN ; +if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) || !(ctx->staging.flags &RXON_FLG_BAND_24G_MSK )) ctx->staging.flags |=RXON_FLG_SHORT_SLOT_MSK ;
@@ -1473,6 +1480,11 @@ void iwlagn_bss_info_changed(struct ieeeelse ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK ; +if (bss_conf->use_cts_prot) + ctx->staging.flags |=RXON_FLG_SELF_CTS_EN ; +else + ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN ; +memcpy (ctx->staging.bssid_addr, bss_conf->bssid,ETH_ALEN ); if (vif->type == NL80211_IFTYPE_AP ||
Greg Kroah-Hartman
maintainerPATCH 153/238 iwlwifi: mvm: fix endianity issues with Smart Fifo commands
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit 86974bff066dd8b98be46d7c7d3aba89034f0833 upstream.
This code was broken on big endian systems. Sparse didn't catch the bug since the firmware command was not tagged as little endian.
Fix the bug for big endian systems and tag the field in the firmware command to prevent such issues in the future.
--- drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 ++-- drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/iwlwifi/mvm/fw-api.h +2 -2
@@ -1415,14 +1415,14 @@ enum iwl_sf_scenario {/** * Smart Fifo configuration command. -* @state: smart fifo state, types listed in iwl_sf_sate. +* @state: smart fifo state, types listed in enum %iwl_sf_sate. * @watermark: Minimum allowed availabe free space in RXF for transient state. * @long_delay_timeouts: aging and idle timer values for each scenario * in long delay state. * @full_on_timeouts: timer values for each scenario in full on state. */ struct iwl_sf_cfg_cmd { -enum iwl_sf_state state; +__le32 state;__le32 watermark[SF_TRANSIENT_STATES_NUMBER ];__le32 long_delay_timeouts[SF_NUM_SCENARIO ][SF_NUM_TIMEOUT_TYPES ];__le32 full_on_timeouts[SF_NUM_SCENARIO ][SF_NUM_TIMEOUT_TYPES ];
drivers/net/wireless/iwlwifi/mvm/sf.c +1 -1
@@ -172,7 +172,7 @@ static int iwl_mvm_sf_config(struct iwl_ enum iwl_sf_state new_state) {struct iwl_sf_cfg_cmd sf_cmd = { - .state = new_state, + .state =cpu_to_le32 (new_state), };struct ieee80211_sta *sta;int ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 154/238 iwlwifi: increase DEFAULT_MAX_TX_POWER
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <[email protected]>
commit 22d059a5c7c5de61e53c88e30b65e55fbfd91e91 upstream.
The chip is able to transmit up to 22dBm, so set
the constant appropriately.
--- drivers/net/wireless/iwlwifi/iwl-config.h | 2 ++ drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 4 +--- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/iwlwifi/iwl-config.h +2 -0
@@ -119,6 +119,8 @@ enum iwl_led_mode {#define IWL_LONG_WD_TIMEOUT 10000#define IWL_MAX_WD_TIMEOUT 120000 +#define IWL_DEFAULT_MAX_TX_POWER 22 +/* Antenna presence definitions */ #define ANT_NONE 0x0#define ANT_A BIT(0)
drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +1 -3
@@ -118,8 +118,6 @@ static const u8 iwl_nvm_channels[] = {#define LAST_2GHZ_HT_PLUS 9#define LAST_5GHZ_HT 161 -#define DEFAULT_MAX_TX_POWER 16 -/* rate data (static) */ static struct ieee80211_rate iwl_cfg80211_rates[] = { { .bitrate =1 *10 , .hw_value =0 , .hw_value_short =0 , },
@@ -242,7 +240,7 @@ static int iwl_init_channel_map(struct d* Default value - highest tx power value. max_power * is not used in mvm, and is used for backwards compatibility */ - channel->max_power =DEFAULT_MAX_TX_POWER ; + channel->max_power =IWL_DEFAULT_MAX_TX_POWER ; is_5ghz = channel->band ==IEEE80211_BAND_5GHZ ; IWL_DEBUG_EEPROM(dev, "Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x %ddBm): Ad-Hoc %ssupported\n",
Greg Kroah-Hartman
maintainerPATCH 155/238 iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Shapira <[email protected]>
commit aa11bbf3df026d6b1c6b528bef634fd9de7c2619 upstream.
Using the LQ table which is initially set according to the rssi could lead to EAPOLs being sent in high legacy rates like 54mbps.
It's better to avoid sending EAPOLs in high rates as it reduces the chances of a successful 4-Way handshake.
Avoid this and treat them like other mgmt frames which would initially get sent at the basic rate.
--- drivers/net/wireless/iwlwifi/mvm/tx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/iwlwifi/mvm/tx.c +6 -2
@@ -173,10 +173,14 @@ static void iwl_mvm_set_tx_cmd_rate(stru/* * for data packets, rate info comes from the table inside the fw. This -* table is controlled by LINK_QUALITY commands +* table is controlled by LINK_QUALITY commands. Exclude ctrl port +* frames like EAPOLs which should be treated as mgmt frames. This +* avoids them being sent initially in high rates which increases the +* chances for completion of the 4-Way handshake. */ -if (ieee80211_is_data (fc) && sta) { +if (ieee80211_is_data (fc) && sta && + !(info->control.flags &IEEE80211_TX_CTRL_PORT_CTRL_PROTO )) { tx_cmd->initial_rate_index =0 ; tx_cmd->tx_flags |=cpu_to_le32 (TX_CMD_FLG_STA_RATE );return ;
Greg Kroah-Hartman
maintainerPATCH 156/238 workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit e09c2c295468476a239d13324ce9042ec4de05eb upstream.
create_singlethread_workqueue() is a compat interface for single threaded workqueue which maps to ordered workqueue w/ rescuer in the current implementation. create_singlethread_workqueue() currently implemented by invoking alloc_workqueue() w/ appropriate parameters.
8719dceae2f9 ("workqueue: reject adjusting max_active or applying attrs to ordered workqueues") introduced __WQ_ORDERED to protect ordered workqueues against dynamic attribute changes which can break ordering guarantees but forgot to apply it to create_singlethread_workqueue(). This in itself is okay as nobody currently uses dynamic attribute change on workqueues created with create_singlethread_workqueue().
However, 4c16bd327c ("workqueue: implement NUMA affinity for unbound workqueues") broke singlethreaded guarantee for ordered workqueues through allocating a separate pool_workqueue on each NUMA node by default. A later change 8a2b75384444 ("workqueue: fix ordered workqueues in NUMA setups") fixed it by allocating only one global pool_workqueue if __WQ_ORDERED is set.
Combined, the __WQ_ORDERED omission in create_singlethread_workqueue() became critical breaking its single threadedness and ordering guarantee.
Let's make create_singlethread_workqueue() wrap alloc_ordered_workqueue() instead so that it inherits __WQ_ORDERED and can implicitly track future ordered_workqueue changes.
v2: I missed that __WQ_ORDERED now protects against pwq splitting
across NUMA nodes and incorrectly described the patch as a nice-to-have fix to protect against future dynamic attribute usages. Oleg pointed out that this is actually a critical breakage due to 8a2b75384444 ("workqueue: fix ordered workqueues in NUMA setups").
--- include/linux/workqueue.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/workqueue.h +1 -1
@@ -452,7 +452,7 @@ __alloc_workqueue_key(const char *fmt, ualloc_workqueue ("%s" ,WQ_FREEZABLE |WQ_UNBOUND |WQ_MEM_RECLAIM , \ 1, (name))#define create_singlethread_workqueue (name) \ - alloc_workqueue("%s", WQ_UNBOUND | WQ_MEM_RECLAIM, 1, (name)) + alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name)extern void destroy_workqueue (struct workqueue_struct *wq);
Greg Kroah-Hartman
maintainerPATCH 157/238 futex: Unlock hb->lock in futex_wait_requeue_pi() error path
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 13c42c2f43b19aab3195f2d357db00d1e885eaa8 upstream.
futex_wait_requeue_pi() calls futex_wait_setup(). If futex_wait_setup() succeeds it returns with hb->lock held and preemption disabled. Now the sanity check after this does:
if (match_futex(&q.key, &key2)) {
ret = -EINVAL;
goto out_put_keys;
}which releases the keys but does not release hb->lock.
So we happily return to user space with hb->lock held and therefor preemption disabled.
Unlock hb->lock before taking the exit route.
--- kernel/futex.c | 1 + 1 file changed, 1 insertion(+)
kernel/futex.c +1 -0
@@ -2614,6 +2614,7 @@ static int futex_wait_requeue_pi(u32 __u* shared futexes. We need to compare the keys: */ if (match_futex (&q.key, &key2)) { +queue_unlock (hb); ret = -EINVAL ; goto out_put_keys; }
Greg Kroah-Hartman
maintainerPATCH 158/238 block: Fix dev_t minor allocation lifetime
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
commit 2da78092dda13f1efd26edbbf99a567776913750 upstream.
Releases the dev_t minor when all references are closed to prevent another device from acquiring the same major/minor.
Since the partition's release may be invoked from call_rcu's soft-irq context, the ext_dev_idr's mutex had to be replaced with a spinlock so as not so sleep.
--- block/genhd.c | 24 ++++++++++++++---------- block/partition-generic.c | 2 +- 2 files changed, 15 insertions(+), 11 deletions(-)
block/genhd.c +14 -10
@@ -28,10 +28,10 @@ struct kobject *block_depr;/* for extended dynamic devt allocation, currently only one major is used */ #define NR_EXT_DEVT (1 << MINORBITS) -/* For extended devt allocation. ext_devt_mutex prevents look up +/* For extended devt allocation. ext_devt_lock prevents look up * results from going away underneath its user. */ -static DEFINE_MUTEX (ext_devt_mutex); +static DEFINE_SPINLOCK (ext_devt_lock);static DEFINE_IDR (ext_devt_idr);static struct device_type disk_type;
@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *par }/* allocate ext devt */ -mutex_lock (&ext_devt_mutex); - idx =idr_alloc (&ext_devt_idr, part,0 ,NR_EXT_DEVT ,GFP_KERNEL ); -mutex_unlock (&ext_devt_mutex); +idr_preload (GFP_KERNEL ); + +spin_lock (&ext_devt_lock); + idx =idr_alloc (&ext_devt_idr, part,0 ,NR_EXT_DEVT ,GFP_NOWAIT ); +spin_unlock (&ext_devt_lock); + +idr_preload_end ();if (idx <0 )return idx == -ENOSPC ? -EBUSY : idx;
@@ -447,9 +451,9 @@ void blk_free_devt(dev_t devt)return ;if (MAJOR (devt) ==BLOCK_EXT_MAJOR ) { -mutex_lock (&ext_devt_mutex); +spin_lock (&ext_devt_lock);idr_remove (&ext_devt_idr,blk_mangle_minor (MINOR (devt))); -mutex_unlock (&ext_devt_mutex); +spin_unlock (&ext_devt_lock); } }
@@ -665,7 +669,6 @@ void del_gendisk(struct gendisk *disk)sysfs_remove_link (block_depr,dev_name (disk_to_dev (disk)));pm_runtime_set_memalloc_noio (disk_to_dev (disk), false);device_del (disk_to_dev (disk)); -blk_free_devt (disk_to_dev (disk)->devt); }EXPORT_SYMBOL (del_gendisk);
@@ -690,13 +693,13 @@ struct gendisk *get_gendisk(dev_t devt, }else {struct hd_struct *part; -mutex_lock (&ext_devt_mutex); +spin_lock (&ext_devt_lock); part =idr_find (&ext_devt_idr,blk_mangle_minor (MINOR (devt)));if (part &&get_disk (part_to_disk (part))) { *partno = part->partno; disk =part_to_disk (part); } -mutex_unlock (&ext_devt_mutex); +spin_unlock (&ext_devt_lock); }return disk;
@@ -1098,6 +1101,7 @@ static void disk_release(struct device * {struct gendisk *disk =dev_to_disk (dev); +blk_free_devt (dev->devt);disk_release_events (disk);kfree (disk->random);disk_replace_part_tbl (disk,NULL );
block/partition-generic.c +1 -1
@@ -211,6 +211,7 @@ static const struct attribute_group *parstatic void part_release (struct device *dev) {struct hd_struct *p =dev_to_part (dev); +blk_free_devt (dev->devt);free_part_stats (p);free_part_info (p);kfree (p);
@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *dircu_assign_pointer (ptbl->last_lookup,NULL );kobject_put (part->holder_dir);device_del (part_to_dev (part)); -blk_free_devt (part_devt (part));hd_struct_put (part); }
Greg Kroah-Hartman
maintainerPATCH 159/238 dm cache: fix race causing dirty blocks to be marked as clean
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anssi Hannula <[email protected]>
commit 40aa978eccec61347cd47b97c598df49acde8be5 upstream.
When a writeback or a promotion of a block is completed, the cell of that block is removed from the prison, the block is marked as clean, and the clear_dirty() callback of the cache policy is called.
Unfortunately, performing those actions in this order allows an incoming new write bio for that block to come in before clearing the dirty status is completed and therefore possibly causing one of these two scenarios:
Scenario A:
Thread 1 Thread 2 cell_defer() . - cell removed from prison . - detained bios queued . . incoming write bio . remapped to cache . set_dirty() called,
. but block already dirty
. => it does nothingclear_dirty() .
- block marked clean .
- policy clear_dirty() called .
Result: Block is marked clean even though it is actually dirty. No writeback will occur.
Scenario B:
Thread 1 Thread 2 cell_defer() . - cell removed from prison . - detained bios queued . clear_dirty() . - block marked clean . . incoming write bio . remapped to cache . set_dirty() called . - block marked dirty . - policy set_dirty() called
- policy clear_dirty() called .
Result: Block is properly marked as dirty, but policy thinks it is clean and therefore never asks us to writeback it.
This case is visible in "dmsetup status" dirty block count (which normally decreases to 0 on a quiet device).
Fix these issues by calling clear_dirty() before calling cell_defer(). Incoming bios for that block will then be detained in the cell and released only after clear_dirty() has completed, so the race will not occur.
Found by inspecting the code after noticing spurious dirty counts (scenario B).
--- drivers/md/dm-cache-target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-cache-target.c +2 -2
@@ -890,8 +890,8 @@ static void migration_success_pre_commitstruct cache *cache = mg->cache;if (mg->writeback) { -cell_defer (cache, mg->old_ocell, false);clear_dirty (cache, mg->old_oblock, mg->cblock); +cell_defer (cache, mg->old_ocell, false);cleanup_migration (mg);return ;
@@ -946,13 +946,13 @@ static void migration_success_post_commi } }else { +clear_dirty (cache, mg->new_oblock, mg->cblock);if (mg->requeue_holder)cell_defer (cache, mg->new_ocell, true);else {bio_endio (mg->new_ocell->holder,0 );cell_defer (cache, mg->new_ocell, false); } -clear_dirty (cache, mg->new_oblock, mg->cblock);cleanup_migration (mg); } }
Greg Kroah-Hartman
maintainerPATCH 160/238 dm crypt: fix access beyond the end of allocated space
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.
The DM crypt target accesses memory beyond allocated space resulting in a crash on 32 bit x86 systems.
This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm
crypt: use async crypto"). However, this bug was masked by the fact that kmalloc rounds the size up to the next power of two. This bug wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio data"). By switching to using per-bio data there was no longer any padding beyond the end of a dm-crypt allocated memory block.
To minimize allocation overhead dm-crypt puts several structures into one block allocated with kmalloc. The block holds struct ablkcipher_request, cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))), struct dm_crypt_request and an initialization vector.
The variable dmreq_start is set to offset of struct dm_crypt_request within this memory block. dm-crypt allocates the block with this size:cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.
When accessing the initialization vector, dm-crypt uses the function iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).
dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request structure. However, when dm-crypt accesses the initialization vector, it takes a pointer to the end of dm_crypt_request, aligns it, and then uses it as the initialization vector. If the end of dm_crypt_request is not aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the alignment causes the initialization vector to point beyond the allocated space.
Fix this bug by calculating the variable iv_size_padding and adding it to the allocated size.
Also correct the alignment of dm_crypt_request. struct dm_crypt_request is specific to dm-crypt (it isn't used by the crypto subsystem at all), so it is aligned on __alignof__(struct dm_crypt_request).
Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is aligned as if the block was allocated with kmalloc.
--- drivers/md/dm-crypt.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/md/dm-crypt.c +16 -4
@@ -1681,6 +1681,7 @@ static int crypt_ctr(struct dm_target *tunsigned int key_size, opt_params;unsigned long long tmpll;int ret; +size_t iv_size_padding;struct dm_arg_set as;const char *opt_string;char dummy;
@@ -1717,12 +1718,23 @@ static int crypt_ctr(struct dm_target *t cc->dmreq_start =sizeof (struct ablkcipher_request ); cc->dmreq_start +=crypto_ablkcipher_reqsize (any_tfm (cc)); - cc->dmreq_start =ALIGN (cc->dmreq_start,crypto_tfm_ctx_alignment ()); - cc->dmreq_start +=crypto_ablkcipher_alignmask (any_tfm (cc)) & - ~(crypto_tfm_ctx_alignment () -1 ); + cc->dmreq_start =ALIGN (cc->dmreq_start, __alignof__(struct dm_crypt_request )); + +if (crypto_ablkcipher_alignmask (any_tfm (cc)) <CRYPTO_MINALIGN ) { +/* Allocate the padding exactly */ + iv_size_padding = -(cc->dmreq_start +sizeof (struct dm_crypt_request )) + &crypto_ablkcipher_alignmask (any_tfm (cc)); + }else { +/* +* If the cipher requires greater alignment than kmalloc +* alignment, we don't know the exact position of the +* initialization vector. We must assume worst case. +*/ + iv_size_padding =crypto_ablkcipher_alignmask (any_tfm (cc)); + } cc->req_pool =mempool_create_kmalloc_pool (MIN_IOS , cc->dmreq_start + -sizeof (struct dm_crypt_request ) + cc->iv_size); +sizeof (struct dm_crypt_request ) + iv_size_padding + cc->iv_size);if (!cc->req_pool) { ti->error ="Cannot allocate crypt request mempool" ; goto bad;
Greg Kroah-Hartman
maintainerPATCH 161/238 Input: serport - add compat handling for SPIOCSTYPE ioctl
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Sung <[email protected]>
commit a80d8b02751060a178bb1f7a6b7a93645a7a308b upstream.
When running a 32-bit inputattach utility in a 64-bit system, there will be error code "inputattach: can't set device type". This is caused by the serport device driver not supporting compat_ioctl, so that SPIOCSTYPE ioctl fails.
--- drivers/input/serio/serport.c | 45 +++++++++++++++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 7 deletions(-)
drivers/input/serio/serport.c +38 -7
@@ -21,6 +21,7 @@#include <linux/init.h> #include <linux/serio.h> #include <linux/tty.h> +#include <linux/compat.h> MODULE_AUTHOR ("Vojtech Pavlik <[email protected]>" );MODULE_DESCRIPTION ("Input device TTY line discipline" );
@@ -198,28 +199,55 @@ static ssize_t serport_ldisc_read(structreturn 0 ; } +static void serport_set_type (struct tty_struct *tty,unsigned long type) +{ +struct serport *serport = tty->disc_data; + + serport->id.proto = type &0x000000ff ; + serport->id.id = (type &0x0000ff00 ) >>8 ; + serport->id.extra = (type &0x00ff0000 ) >>16 ; +} +/* * serport_ldisc_ioctl() allows to set the port protocol, and device ID */ -static int serport_ldisc_ioctl (struct tty_struct * tty,struct file * file,unsigned int cmd,unsigned long arg) +static int serport_ldisc_ioctl (struct tty_struct *tty,struct file *file, +unsigned int cmd,unsigned long arg) { -struct serport *serport = (struct serport *) tty->disc_data; -unsigned long type; -if (cmd ==SPIOCSTYPE ) { +unsigned long type; +if (get_user (type, (unsigned long __user *) arg))return -EFAULT ; - serport->id.proto = type &0x000000ff ; - serport->id.id = (type &0x0000ff00 ) >>8 ; - serport->id.extra = (type &0x00ff0000 ) >>16 ; +serport_set_type (tty, type); +return 0 ; + } + +return -EINVAL ; +} + +#ifdef CONFIG_COMPAT +#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t) +static long serport_ldisc_compat_ioctl (struct tty_struct *tty, +struct file *file, +unsigned int cmd,unsigned long arg) +{ +if (cmd ==COMPAT_SPIOCSTYPE ) { +void __user *uarg =compat_ptr (arg); +compat_ulong_t compat_type; + +if (get_user (compat_type, (compat_ulong_t __user *)uarg)) +return -EFAULT ; +serport_set_type (tty, compat_type);return 0 ; }return -EINVAL ; } +#endif static void serport_ldisc_write_wakeup (struct tty_struct * tty) {
@@ -243,6 +271,9 @@ static struct tty_ldisc_ops serport_ldis .close = serport_ldisc_close, .read = serport_ldisc_read, .ioctl = serport_ldisc_ioctl, +#ifdef CONFIG_COMPAT + .compat_ioctl = serport_ldisc_compat_ioctl, +#endif .receive_buf = serport_ldisc_receive, .write_wakeup = serport_ldisc_write_wakeup };
Greg Kroah-Hartman
maintainerPATCH 162/238 Input: synaptics - add support for ForcePads
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 5715fc764f7753d464dbe094b5ef9cffa6e479a4 upstream.
ForcePads are found on HP EliteBook 1040 laptops. They lack any kind of physical buttons, instead they generate primary button click when user presses somewhat hard on the surface of the touchpad. Unfortunately they also report primary button click whenever there are 2 or more contacts on the pad, messing up all multi-finger gestures (2-finger scrolling, multi-finger tapping, etc). To cope with this behavior we introduce a delay (currently 50 msecs) in reporting primary press in case more contacts appear.
--- drivers/input/mouse/synaptics.c | 68 ++++++++++++++++++++++++++++++---------- drivers/input/mouse/synaptics.h | 11 ++++++ 2 files changed, 63 insertions(+), 16 deletions(-)
drivers/input/mouse/synaptics.c +52 -16
@@ -626,10 +626,61 @@ static int synaptics_parse_hw_state(cons ((buf[0 ] &0x04 ) >>1 ) | ((buf[3] & 0x04) >> 2)); +if ((SYN_CAP_ADV_GESTURE (priv->ext_cap_0c) || +SYN_CAP_IMAGE_SENSOR (priv->ext_cap_0c)) && + hw->w ==2 ) { +synaptics_parse_agm (buf, priv, hw); +return 1 ; + } + + hw->x = (((buf[3 ] &0x10 ) <<8 ) | + ((buf[1 ] &0x0f ) <<8 ) | + buf[4 ]); + hw->y = (((buf[3 ] &0x20 ) <<7 ) | + ((buf[1 ] &0xf0 ) <<4 ) | + buf[5 ]); + hw->z = buf[2 ]; + hw->left = (buf[0 ] &0x01 ) ?1 :0 ; hw->right = (buf[0 ] &0x02 ) ?1 :0 ; -if (SYN_CAP_CLICKPAD (priv->ext_cap_0c)) { +if (SYN_CAP_FORCEPAD (priv->ext_cap_0c)) { +/* +* ForcePads, like Clickpads, use middle button +* bits to report primary button clicks. +* Unfortunately they report primary button not +* only when user presses on the pad above certain +* threshold, but also when there are more than one +* finger on the touchpad, which interferes with +* out multi-finger gestures. +*/ +if (hw->z ==0 ) { +/* No contacts */ + priv->press = priv->report_press = false; + }else if (hw->w >=4 && ((buf[0 ] ^ buf[3 ]) &0x01 )) { +/* +* Single-finger touch with pressure above +* the threshold. If pressure stays long +* enough, we'll start reporting primary +* button. We rely on the device continuing +* sending data even if finger does not +* move. +*/ +if (!priv->press) { + priv->press_start = jiffies; + priv->press = true; + }else if (time_after (jiffies, + priv->press_start + +msecs_to_jiffies (50 ))) { + priv->report_press = true; + } + }else { + priv->press = false; + } + + hw->left = priv->report_press; + + }else if (SYN_CAP_CLICKPAD (priv->ext_cap_0c)) {/* * Clickpad's button is transmitted as middle button, * however, since it is primary button, we will report
@@ -648,21 +699,6 @@ static int synaptics_parse_hw_state(cons hw->down = ((buf[0 ] ^ buf[3 ]) &0x02 ) ?1 :0 ; } -if ((SYN_CAP_ADV_GESTURE (priv->ext_cap_0c) || -SYN_CAP_IMAGE_SENSOR (priv->ext_cap_0c)) && - hw->w ==2 ) { -synaptics_parse_agm (buf, priv, hw); -return 1 ; - } - - hw->x = (((buf[3 ] &0x10 ) <<8 ) | - ((buf[1 ] &0x0f ) <<8 ) | - buf[4 ]); - hw->y = (((buf[3 ] &0x20 ) <<7 ) | - ((buf[1 ] &0xf0 ) <<4 ) | - buf[5 ]); - hw->z = buf[2 ]; -if (SYN_CAP_MULTI_BUTTON_NO (priv->ext_cap) && ((buf[0 ] ^ buf[3 ]) &0x02 )) {switch (SYN_CAP_MULTI_BUTTON_NO (priv->ext_cap) & ~0x01 ) {
drivers/input/mouse/synaptics.h +11 -0
@@ -78,6 +78,11 @@* 2 0x08 image sensor image sensor tracks 5 fingers, but only * reports 2. * 2 0x20 report min query 0x0f gives min coord reported +* 2 0x80 forcepad forcepad is a variant of clickpad that +* does not have physical buttons but rather +* uses pressure above certain threshold to +* report primary clicks. Forcepads also have +* clickpad bit set. */ #define SYN_CAP_CLICKPAD (ex0c) ((ex0c) & 0x100000)/* 1-button ClickPad */ #define SYN_CAP_CLICKPAD2BTN (ex0c) ((ex0c) & 0x000100)/* 2-button ClickPad */
@@ -86,6 +91,7 @@#define SYN_CAP_ADV_GESTURE (ex0c) ((ex0c) & 0x080000)#define SYN_CAP_REDUCED_FILTERING (ex0c) ((ex0c) & 0x000400)#define SYN_CAP_IMAGE_SENSOR (ex0c) ((ex0c) & 0x000800) +#define SYN_CAP_FORCEPAD (ex0c) ((ex0c) & 0x008000)/* synaptics modes query bits */ #define SYN_MODE_ABSOLUTE (m) ((m) & (1 << 7))
@@ -177,6 +183,11 @@ struct synaptics_data {*/ struct synaptics_hw_state agm;bool agm_pending;/* new AGM packet received */ + +/* ForcePad handling */ +unsigned long press_start; +bool press; +bool report_press; };void synaptics_module_init (void );
Greg Kroah-Hartman
maintainerPATCH 164/238 Input: atkbd - do not try deactivate keyboard on any LG laptops
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit c01206796139e2b1feb7539bc72174fef1c6dc6e upstream.
We are getting more and more reports about LG laptops not having functioning keyboard if we try to deactivate keyboard during probe. Given that having keyboard deactivated is merely "nice to have" instead of a hard requirement for probing, let's disable it on all LG boxes instead of trying to hunt down particular models.
This change is prompted by patches trying to add "LG Electronics"/"ROCKY" and "LG Electronics"/"LW60-F27B" to the DMI list.
https://bugzilla.kernel.org/show_bug.cgi?id=77051
--- drivers/input/keyboard/atkbd.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/input/keyboard/atkbd.c +0 -8
@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_ { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), - DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"), - }, - .callback = atkbd_deactivate_fixup, - }, - { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), - DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"), }, .callback = atkbd_deactivate_fixup, },
Greg Kroah-Hartman
maintainerPATCH 165/238 Input: i8042 - add Fujitsu U574 to no_timeout dmi table
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream.
https://bugzilla.kernel.org/show_bug.cgi?id=69731
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +8 -0
@@ -601,6 +601,14 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), }, }, + { + /* Fujitsu U574 laptop */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 166/238 Input: i8042 - add nomux quirk for Avatar AVIU-145A6
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit d2682118f4bb3ceb835f91c1a694407a31bb7378 upstream.
The sys_vendor / product_name are somewhat generic unfortunately, so this may lead to some false positives. But nomux usually does no harm, where as not having it clearly is causing problems on the Avatar AVIU-145A6.
https://bugzilla.kernel.org/show_bug.cgi?id=77391
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -458,6 +458,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), }, }, + { + /* Avatar AVIU-145A6 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel"), + DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 167/238 hwmon: (ds1621) Update zbits after conversion rate change
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Coulson <[email protected]>
commit 39c627a084475e8a690a4a9e7601410ca173ddd2 upstream.
After the conversion rate is changed, the zbits are not updated, but should be, since they are used later in the set_temp function.
--- drivers/hwmon/ds1621.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ds1621.c +1 -0
@@ -309,6 +309,7 @@ static ssize_t set_convrate(struct devic data->conf |= (resol <<DS1621_REG_CONFIG_RESOL_SHIFT );i2c_smbus_write_byte_data (client,DS1621_REG_CONF , data->conf); data->update_interval = ds1721_convrates[resol]; + data->zbits =7 - resol;mutex_unlock (&data->update_lock);return count;
Greg Kroah-Hartman
maintainerPATCH 168/238 ata_piix: Add Device IDs for Intel 9 Series PCH
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <[email protected]>
commit 6cad1376954e591c3c41500c4e586e183e7ffe6d upstream.
This patch adds the IDE mode SATA Device IDs for the Intel 9 Series PCH.
--- drivers/ata/ata_piix.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ata_piix.c +8 -0
@@ -340,6 +340,14 @@ static const struct pci_device_id piix_p { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },/* SATA Controller IDE (Coleto Creek) */ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, { } /* terminate list */ };
Greg Kroah-Hartman
maintainerPATCH 169/238 percpu: free percpu allocation info for uniprocessor system
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang Li <[email protected]>
commit 3189eddbcafcc4d827f7f19facbeddec4424eba8 upstream.
Currently, only SMP system free the percpu allocation info. Uniprocessor system should free it too. For example, one x86 UML virtual machine with 256MB memory, UML kernel wastes one page memory.
--- mm/percpu.c | 2 ++ 1 file changed, 2 insertions(+)
mm/percpu.c +2 -0
@@ -1917,6 +1917,8 @@ void __init setup_per_cpu_areas(void)if (pcpu_setup_first_chunk (ai, fc) <0 )panic ("Failed to initialize percpu areas." ); + + pcpu_free_alloc_info(ai); }#endif /* CONFIG_SMP */
Greg Kroah-Hartman
maintainerPATCH 170/238 percpu: fix pcpu_alloc_pages() failure path
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit f0d279654dea22b7a6ad34b9334aee80cda62cde upstream.
When pcpu_alloc_pages() fails midway, pcpu_free_pages() is invoked to free what has already been allocated. The invocation is across the whole requested range and pcpu_free_pages() will try to free all non-NULL pages; unfortunately, this is incorrect as pcpu_get_pages_and_bitmap(), unlike what its comment suggests, doesn't clear the pages array and thus the array may have entries from the previous invocations making the partial failure path free incorrect pages.
Fix it by open-coding the partial freeing of the already allocated pages.
--- mm/percpu-vm.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
mm/percpu-vm.c +15 -6
@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_ int page_start, int page_end) {const gfp_t gfp =GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; -unsigned int cpu; +unsigned int cpu, tcpu;int i;for_each_possible_cpu (cpu) {
@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_struct page **pagep = &pages[pcpu_page_idx (cpu, i)]; *pagep =alloc_pages_node (cpu_to_node (cpu), gfp,0 ); -if (!*pagep) { -pcpu_free_pages (chunk, pages, populated, - page_start, page_end); -return -ENOMEM ; - } +if (!*pagep) + goto err; } }return 0 ; + +err: +while (--i >= page_start) +__free_page (pages[pcpu_page_idx (cpu, i)]); + +for_each_possible_cpu (tcpu) { +if (tcpu == cpu) +break ; +for (i = page_start; i < page_end; i++) +__free_page (pages[pcpu_page_idx (tcpu, i)]); + } +return -ENOMEM ; }/**
Greg Kroah-Hartman
maintainerPATCH 171/238 percpu: perform tlb flush after pcpu_map_pages() failure
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream.
If pcpu_map_pages() fails midway, it unmaps the already mapped pages. Currently, it doesn't flush tlb after the partial unmapping. This may be okay in most cases as the established mapping hasn't been used at that point but it can go wrong and when it goes wrong it'd be extremely difficult to track down.
Flush tlb after the partial unmapping.
--- mm/percpu-vm.c | 1 + 1 file changed, 1 insertion(+)
mm/percpu-vm.c +1 -0
@@ -272,6 +272,7 @@ err:__pcpu_unmap_pages (pcpu_chunk_addr (chunk, tcpu, page_start), page_end - page_start); } +pcpu_post_unmap_tlb_flush (chunk, page_start, page_end);return err; }
Greg Kroah-Hartman
maintainerPATCH 172/238 regulatory: add NUL to alpha2
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <[email protected]>
commit a5fe8e7695dc3f547e955ad2b662e3e72969e506 upstream.
alpha2 is defined as 2-chars array, but is used in multiple places as string (e.g. with nla_put_string calls), which might leak kernel data.
Solve it by simply adding an extra char for the NULL terminator, making such operations safe.
--- include/net/regulatory.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/regulatory.h +1 -1
@@ -160,7 +160,7 @@ struct ieee80211_reg_rule {struct ieee80211_regdomain {struct rcu_head rcu_head;u32 n_reg_rules; -char alpha2[2 ]; +char alpha2[3 ];enum nl80211_dfs_regions dfs_region;struct ieee80211_reg_rule reg_rules[]; };
Greg Kroah-Hartman
maintainerPATCH 173/238 rtlwifi: rtl8192cu: Add new ID
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream.
The Sitecom WLA-2102 adapter uses this driver.
--- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +1 -0
@@ -317,6 +317,7 @@ static struct usb_device_id rtl8192c_usb {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
Greg Kroah-Hartman
maintainerPATCH 174/238 lockd: fix rpcbind crash on lockd startup failure
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.
Nikita Yuschenko reported that booting a kernel with init=/bin/sh and then nfs mounting without portmap or rpcbind running using a busybox mount resulted in:
# mount -t nfs 10.30.130.21:/opt /mnt svc: failed to register lockdv1 RPC service (errno 111). lockd_up: makesock failed, error=-111 Unable to handle kernel paging request for data at address 0x00000030 Faulting instruction address: 0xc055e65c Oops: Kernel access of bad area, sig: 11 [#1] MPC85xx CDS Modules linked in: CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117 task: cf29cea0 ti: cf35c000 task.ti: cf35c000 NIP: c055e65c LR: c0566490 CTR: c055e648 REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge) MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000 DEAR: 00000030, ESR: 00000000
GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086 00000000
GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000 10090ae8
GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000 bfa46ef0
GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000 cf0ded80
NIP [c055e65c] call_start+0x14/0x34
LR [c0566490] __rpc_execute+0x70/0x250
Call Trace: [cf35db80] [00000080] 0x80 (unreliable) [cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4 [cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8 [cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84 [cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c [cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108 [cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30 [cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0 [cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8 [cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec [cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4 [cf35dd90] [c0171590] nfs3_create_server+0x10/0x44 [cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4 [cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8 [cf35de70] [c00cd3bc] mount_fs+0x20/0xbc [cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104 [cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0 [cf35df10] [c00e75ac] SyS_mount+0x90/0xd0 [cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c
The addition of svc_shutdown_net() resulted in two calls to svc_rpcb_cleanup(); the second is no longer necessary and crashes when it calls rpcb_register_call with clnt=NULL.
--- fs/lockd/svc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/lockd/svc.c +1 -3
@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv error =make_socks (serv, net);if (error <0 ) - goto err_socks; + goto err_bind;set_grace_period (net);dprintk ("lockd_up_net: per-net data created; net=%p\n" , net);return 0 ; -err_socks: -svc_rpcb_cleanup (serv, net); err_bind: ln->nlmsvc_users--;return error;
Greg Kroah-Hartman
maintainerPATCH 175/238 lockdep: Revert lockdep check in raw_seqcount_begin()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 22fdcf02f6e80d64a927f702dd9d631a927d87d4 upstream.
This commit reverts the addition of lockdep checking to raw_seqcount_begin for the following reasons:
1) It violates the naming convention that raw_* functions should not do lockdep checks (a convention that is also followed by the other raw_*_seqcount_begin functions).
2) raw_seqcount_begin does not spin, so it can only be part of an ABBA deadlock in very special circumstances (for instance if a lock is held across the entire raw_seqcount_begin()+read_seqcount_retry() loop while also being taken inside the write_seqcount protected area).
3) It is causing false positives with some existing callers, and there is no non-lockdep alternative for those callers to use.
None of the three existing callers (__d_lookup_rcu, netdev_get_name, and the NFS state code) appear to use the function in a manner that is ABBA deadlock prone.
--- include/linux/seqlock.h | 2 -- 1 file changed, 2 deletions(-)
include/linux/seqlock.h +0 -2
@@ -164,8 +164,6 @@ static inline unsigned read_seqcount_begstatic inline unsigned raw_seqcount_begin (const seqcount_t *s) {unsigned ret =ACCESS_ONCE (s->sequence); - -seqcount_lockdep_reader_access (s);smp_rmb ();return ret & ~1 ; }
Greg Kroah-Hartman
maintainerPATCH 176/238 genhd: fix leftover might_sleep() in blk_free_devt()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62 upstream.
Commit 2da78092 changed the locking from a mutex to a spinlock, so we now longer sleep in this context. But there was a leftover might_sleep() in there, which now triggers since we do the final free from an RCU callback. Get rid of it.
--- block/genhd.c | 2 -- 1 file changed, 2 deletions(-)
block/genhd.c +0 -2
@@ -445,8 +445,6 @@ int blk_alloc_devt(struct hd_struct *par*/ void blk_free_devt (dev_t devt) { -might_sleep (); -if (devt ==MKDEV (0 ,0 ))return ;
Greg Kroah-Hartman
maintainerPATCH 177/238 usb: dwc3: core: fix order of PM runtime calls
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit fed33afce0eda44a46ae24d93aec1b5198c0bac4 upstream.
Currently, we disable pm_runtime before all register accesses are done, this is dangerous and might lead to abort exceptions due to the driver trying to access a register which is clocked by a clock which was long gated.
Fix that by moving pm_runtime_put_sync() and pm_runtime_disable() as the last thing we do before returning from our ->remove() method.
--- drivers/usb/dwc3/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/dwc3/core.c +3 -3
@@ -586,9 +586,6 @@ static int dwc3_remove(struct platform_dusb_phy_set_suspend (dwc->usb2_phy,1 );usb_phy_set_suspend (dwc->usb3_phy,1 ); -pm_runtime_put_sync (&pdev->dev); -pm_runtime_disable (&pdev->dev); -dwc3_debugfs_exit (dwc);switch (dwc->dr_mode) {
@@ -611,6 +608,9 @@ static int dwc3_remove(struct platform_ddwc3_free_event_buffers (dwc);dwc3_core_exit (dwc); +pm_runtime_put_sync (&pdev->dev); +pm_runtime_disable (&pdev->dev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 178/238 usb: dwc3: core: fix ordering for PHY suspend
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit dc99f16f076559235c92d3eb66d03d1310faea08 upstream.
We can't suspend the PHYs before dwc3_core_exit_mode() has been called, that's because the host and/or device sides might still need to communicate with the far end link partner.
--- drivers/usb/dwc3/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/dwc3/core.c +4 -3
@@ -583,9 +583,6 @@ static int dwc3_remove(struct platform_d {struct dwc3 *dwc =platform_get_drvdata (pdev); -usb_phy_set_suspend (dwc->usb2_phy,1 ); -usb_phy_set_suspend (dwc->usb3_phy,1 ); -dwc3_debugfs_exit (dwc);switch (dwc->dr_mode) {
@@ -606,6 +603,10 @@ static int dwc3_remove(struct platform_ddwc3_event_buffers_cleanup (dwc);dwc3_free_event_buffers (dwc); + +usb_phy_set_suspend (dwc->usb2_phy,1 ); +usb_phy_set_suspend (dwc->usb3_phy,1 ); +dwc3_core_exit (dwc);pm_runtime_put_sync (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 179/238 Revert "mac80211: disable uAPSD if all ACs are under ACM"
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit bb512ad0732232f1d2693bb68f31a76bed8f22ae upstream.
This reverts commit 24aa11ab8ae03292d38ec0dbd9bc2ac49fe8a6dd.
That commit was wrong since it uses data that hasn't even been set up yet, but might be a hold-over from a previous connection.
Additionally, it seems like a driver-specific workaround that shouldn't have been in mac80211 to start with.
--- net/mac80211/mlme.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/mac80211/mlme.c +1 -2
@@ -4240,8 +4240,7 @@ int ieee80211_mgd_assoc(struct ieee80211rcu_read_unlock ();if (bss->wmm_used && bss->uapsd_supported && - (sdata->local->hw.flags &IEEE80211_HW_SUPPORTS_UAPSD ) && - sdata->wmm_acm !=0xff ) { + (sdata->local->hw.flags &IEEE80211_HW_SUPPORTS_UAPSD )) { assoc_data->uapsd = true; ifmgd->flags |=IEEE80211_STA_UAPSD_ENABLED ; }else {
Greg Kroah-Hartman
maintainerPATCH 181/238 kcmp: fix standard comparison bug
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rasmus Villemoes <[email protected]>
commit acbbe6fbb240a927ee1f5994f04d31267d422215 upstream.
The C operator <= defines a perfectly fine total ordering on the set of values representable in a long. However, unlike its namesake in the integers, it is not translation invariant, meaning that we do not have "b <= c" iff "a+b <= a+c" for all a,b,c.
This means that it is always wrong to try to boil down the relationship between two longs to a question about the sign of their difference, because the resulting relation [a LEQ b iff a-b <= 0] is neither anti-symmetric or transitive. The former is due to -LONG_MIN==LONG_MIN (take any two a,b with a-b = LONG_MIN; then a LEQ b and b LEQ a, but a != b). The latter can either be seen observing that x LEQ x+1 for all x, implying x LEQ x+1 LEQ x+2 ... LEQ x-1 LEQ x; or more directly with the simple example a=LONG_MIN, b=0, c=1, for which a-b < 0, b-c < 0, but a-c > 0.
Note that it makes absolutely no difference that a transmogrying bijection has been applied before the comparison is done. In fact, had the obfuscation not been done, one could probably not observe the bug (assuming all values being compared always lie in one half of the address space, the mathematical value of a-b is always representable in a long). As it stands, one can easily obtain three file descriptors exhibiting the non-transitivity of kcmp().
Side note 1: I can't see that ensuring the MSB of the multiplier is set serves any purpose other than obfuscating the obfuscating code.
Side note 2:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
#include <sys/syscall.h>
enum kcmp_type {
KCMP_FILE,
KCMP_VM,
KCMP_FILES,
KCMP_FS,
KCMP_SIGHAND,
KCMP_IO,
KCMP_SYSVSEM,
KCMP_TYPES,
};pid_t pid;
int kcmp(pid_t pid1, pid_t pid2, int type,
unsigned long idx1, unsigned long idx2)
{
return syscall(SYS_kcmp, pid1, pid2, type, idx1, idx2);
}
int cmp_fd(int fd1, int fd2)
{
int c = kcmp(pid, pid, KCMP_FILE, fd1, fd2);
if (c < 0) {
perror("kcmp");
exit(1);
}
assert(0 <= c && c < 3);
return c;
}
int cmp_fdp(const void *a, const void *b)
{
static const int normalize[] = {0, -1, 1};
return normalize[cmp_fd(*(int*)a, *(int*)b)];
}
#define MAX 100 /* This is plenty; I've seen it trigger for MAX==3 */
int main(int argc, char *argv[])
{
int r, s, count = 0;
int REL[3] = {0,0,0};
int fd[MAX];
pid = getpid();
while (count < MAX) {
r = open("/dev/null", O_RDONLY);
if (r < 0)
break;
fd[count++] = r;
}
printf("opened %d file descriptors\n", count);
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
qsort(fd, count, sizeof(fd[0]), cmp_fdp);
memset(REL, 0, sizeof(REL));
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
return (REL[0] + REL[2] != 0);
}"Eric W. Biederman" <[email protected]>
--- kernel/kcmp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/kcmp.c +4 -3
@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int t*/ static int kcmp_ptr (void *v1,void *v2,enum kcmp_type type) { -long ret; +long t1, t2; - ret =kptr_obfuscate ((long )v1, type) -kptr_obfuscate ((long )v2, type); + t1 =kptr_obfuscate ((long )v1, type); + t2 =kptr_obfuscate ((long )v2, type); -return (ret <0 ) | ((ret >0 ) <<1 ); +return (t1 < t2) | ((t1 > t2) <<1 ); }/* The caller must have pinned the task */
Greg Kroah-Hartman
maintainerPATCH 182/238 fsnotify/fdinfo: use named constants instead of hardcoded values
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <[email protected]>
commit 1fc98d11cac6dd66342e5580cb2687e5b1e9a613 upstream.
MAX_HANDLE_SZ is equal to 128, but currently the size of pad is only 64 bytes, so exportfs_encode_inode_fh can return an error.
--- fs/notify/fdinfo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/notify/fdinfo.c +2 -2
@@ -42,7 +42,7 @@ static int show_mark_fhandle(struct seq_ {struct {struct file_handle handle; -u8 pad[64 ]; +u8 pad[MAX_HANDLE_SZ ]; } f;int size, ret, i;
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_ size = f.handle.handle_bytes >>2 ; ret =exportfs_encode_inode_fh (inode, (struct fid *)f.handle.f_handle, &size,0 ); -if ((ret ==255 ) || (ret == -ENOSPC )) { +if ((ret ==FILEID_INVALID ) || (ret == -ENOSPC )) {WARN_ONCE (1 ,"Can't encode file handler for inotify: %d\n" , ret);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 183/238 fs/notify: dont show f_handle if exportfs_encode_inode_fh failed
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <[email protected]>
commit 7e8824816bda16bb11ff5ff1e1212d642e57b0b3 upstream.
Currently we handle only ENOSPC. In case of other errors the file_handle variable isn't filled properly and we will show a part of stack.
--- fs/notify/fdinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/notify/fdinfo.c +1 -1
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_ size = f.handle.handle_bytes >>2 ; ret =exportfs_encode_inode_fh (inode, (struct fid *)f.handle.f_handle, &size,0 ); -if ((ret ==FILEID_INVALID ) || (ret == -ENOSPC )) { +if ((ret ==FILEID_INVALID ) || (ret <0 )) {WARN_ONCE (1 ,"Can't encode file handler for inotify: %d\n" , ret);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 184/238 nilfs2: fix data loss with mmap()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Rohner <[email protected]>
commit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.
This bug leads to reproducible silent data loss, despite the use of msync(), sync() and a clean unmount of the file system. It is easily reproducible with the following script:
----------------[BEGIN SCRIPT]-------------------- mkfs.nilfs2 -f /dev/sdb
mount /dev/sdb /mnt
dd if=/dev/zero bs=1M count=30 of=/mnt/testfile
umount /mnt mount /dev/sdb /mnt CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"
/root/mmaptest/mmaptest /mnt/testfile 30 10 5
sync CHECKSUM_AFTER="$(md5sum /mnt/testfile)" umount /mnt mount /dev/sdb /mnt CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)" umount /mnt
echo "BEFORE MMAP:\t$CHECKSUM_BEFORE" echo "AFTER MMAP:\t$CHECKSUM_AFTER"
echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT" ----------------[END SCRIPT]--------------------
The mmaptest tool looks something like this (very simplified, with error checking removed):
----------------[BEGIN mmaptest]-------------------- data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, file_offset);
for (i = 0; i < write_count; ++i) {
memcpy(data + i * 4096, buf, sizeof(buf));
msync(data, file_size - file_offset, MS_SYNC))
}
----------------[END mmaptest]--------------------The output of the script looks something like this:
BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
So it is clear, that the changes done using mmap() do not survive a remount. This can be reproduced a 100% of the time. The problem was introduced in commit 136e8770cd5d ("nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary").
If the page was read with mpage_readpage() or mpage_readpages() for example, then it has no buffers attached to it. In that case page_has_buffers(page) in nilfs_set_page_dirty() will be false. Therefore nilfs_set_file_dirty() is never called and the pages are never collected and never written to disk.
This patch fixes the problem by also calling nilfs_set_file_dirty() if the page has no buffers attached to it.
--- fs/nilfs2/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nilfs2/inode.c +6 -1
@@ -24,6 +24,7 @@#include <linux/buffer_head.h> #include <linux/gfp.h> #include <linux/mpage.h> +#include <linux/pagemap.h> #include <linux/writeback.h> #include <linux/aio.h> #include "nilfs.h"
@@ -219,10 +220,10 @@ static int nilfs_writepage(struct page *static int nilfs_set_page_dirty (struct page *page) { +struct inode *inode = page->mapping->host;int ret =__set_page_dirty_nobuffers (page);if (page_has_buffers (page)) { -struct inode *inode = page->mapping->host;unsigned nr_dirty =0 ;struct buffer_head *bh, *head;
@@ -245,6 +246,10 @@ static int nilfs_set_page_dirty(struct pif (nr_dirty)nilfs_set_file_dirty (inode, nr_dirty); + }else if (ret) { +unsigned nr_dirty =1 << (PAGE_CACHE_SHIFT - inode->i_blkbits); + +nilfs_set_file_dirty (inode, nr_dirty); }return ret; }
Greg Kroah-Hartman
maintainerPATCH 185/238 ocfs2/dlm: do not get resource spinlock if lockres is new
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 5760a97c7143c208fa3a8f8cad0ed7dd672ebd28 upstream.
There is a deadlock case which reported by Guozhonghua:
https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html
This case is caused by &res->spinlock and &dlm->master_lock misordering in different threads.
It was introduced by commit 8d400b81cc83 ("ocfs2/dlm: Clean up refmap helpers"). Since lockres is new, it doesn't not require the &res->spinlock. So remove it.
--- fs/ocfs2/dlm/dlmmaster.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +10 -8
@@ -650,12 +650,9 @@ void dlm_lockres_clear_refmap_bit(structclear_bit (bit, res->refmap); } - -void dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm, +static void __dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm,struct dlm_lock_resource *res) { -assert_spin_locked (&res->spinlock); - res->inflight_locks++; mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
@@ -663,6 +660,13 @@ void dlm_lockres_grab_inflight_ref(struc __builtin_return_address(0)); } +void dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm, +struct dlm_lock_resource *res) +{ +assert_spin_locked (&res->spinlock); +__dlm_lockres_grab_inflight_ref (dlm, res); +} +void dlm_lockres_drop_inflight_ref (struct dlm_ctxt *dlm,struct dlm_lock_resource *res) {
@@ -852,10 +856,8 @@ lookup:/* finally add the lockres to its hash bucket */ __dlm_insert_lockres (dlm, res); -/* Grab inflight ref to pin the resource */ -spin_lock (&res->spinlock); -dlm_lockres_grab_inflight_ref (dlm, res); -spin_unlock (&res->spinlock); +/* since this lockres is new it doesn't not require the spinlock */ +__dlm_lockres_grab_inflight_ref (dlm, res);/* get an extra ref on the mle in case this is a BLOCK * if so, the creator of the BLOCK may try to put the last
Greg Kroah-Hartman
maintainerPATCH 186/238 mm, slab: initialize object alignment on cache creation
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <[email protected]>
commit d4a5fca592b9ab52b90bb261a90af3c8f53be011 upstream.
Since commit 4590685546a3 ("mm/sl[aou]b: Common alignment code"), the "ralign" automatic variable in __kmem_cache_create() may be used as uninitialized.
The proper alignment defaults to BYTES_PER_WORD and can be overridden by SLAB_RED_ZONE or the alignment specified by the caller.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=85031
--- mm/slab.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
mm/slab.c +2 -9
@@ -2189,7 +2189,8 @@ static int __init_refok setup_cpu_cache(int __kmem_cache_create (struct kmem_cache *cachep,unsigned long flags) { -size_t left_over, freelist_size, ralign; +size_t left_over, freelist_size; +size_t ralign =BYTES_PER_WORD ;gfp_t gfp;int err;size_t size = cachep->size;
@@ -2222,14 +2223,6 @@ __kmem_cache_create (struct kmem_cache * size &= ~(BYTES_PER_WORD -1 ); } -/* -* Redzoning and user store require word alignment or possibly larger. -* Note this will be overridden by architecture or caller mandated -* alignment if either is greater than BYTES_PER_WORD. -*/ -if (flags &SLAB_STORE_USER ) - ralign =BYTES_PER_WORD ; -if (flags &SLAB_RED_ZONE ) { ralign =REDZONE_ALIGN ;/* If redzoning, ensure that the second redzone is suitably
Greg Kroah-Hartman
maintainerPATCH 187/238 mm: softdirty: keep bit when zapping file pte
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Feiner <[email protected]>
commit dbab31aa2ceec2d201966fa0b552f151310ba5f4 upstream.
This fixes the same bug as b43790eedd31 ("mm: softdirty: don't forget to save file map softdiry bit on unmap") and 9aed8614af5a ("mm/memory.c:
don't forget to set softdirty on file mapped fault") where the return value of pte_*mksoft_dirty was being ignored.
To be sure that no other pte/pmd "mk" function return values were being ignored, I annotated the functions in arch/x86/include/asm/pgtable.h with __must_check and rebuilt.
The userspace effect of this bug is that the softdirty mark might be lost if a file mapped pte get zapped.
--- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memory.c +1 -1
@@ -1120,7 +1120,7 @@ again: addr) != page->index) {pte_t ptfile =pgoff_to_pte (page->index);if (pte_soft_dirty (ptent)) -pte_file_mksoft_dirty (ptfile); + ptfile =pte_file_mksoft_dirty (ptfile);set_pte_at (mm, addr, pte, ptfile); }if (PageAnon (page))
Greg Kroah-Hartman
maintainerPATCH 188/238 sched: Fix unreleased llc_shared_mask bit during CPU hotplug
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <[email protected]>
commit 03bd4e1f7265548832a76e7919a81f3137c44fd1 upstream.
The following bug can be triggered by hot adding and removing a large number of xen domain0's vcpus repeatedly:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [..] find_busiest_group PGD 5a9d5067 PUD 13067 PMD 0 Oops: 0000 [#3] SMP [...] Call Trace: load_balance ? _raw_spin_unlock_irqrestore idle_balance __schedule schedule schedule_timeout ? lock_timer_base schedule_timeout_uninterruptible msleep lock_device_hotplug_sysfs online_store dev_attr_store sysfs_write_file vfs_write SyS_write system_call_fastpath
Last level cache shared mask is built during CPU up and the build_sched_domain() routine takes advantage of it to setup the sched domain CPU topology.
However, llc_shared_mask is not released during CPU disable, which leads to an invalid sched domainCPU topology.
This patch fix it by releasing the llc_shared_mask correctly during CPU disable.
Yasuaki also reported that this can happen on real hardware:
https://lkml.org/lkml/2014/7/22/1018
His case is here:
== Here is an example on my system. My system has 4 sockets and each socket has 15 cores and HT is enabled. In this case, each core of sockes is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 Socket#2 | 30-44, 90-104 Socket#3 | 45-59, 105-119 Then llc_shared_mask of CPU#30 has 0x3fff80000001fffc0000000. It means that last level cache of Socket#2 is shared with CPU#30-44 and 90-104. When hot-removing socket#2 and #3, each core of sockets is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 But llc_shared_mask is not cleared. So llc_shared_mask of CPU#30 remains having 0x3fff80000001fffc0000000. After that, when hot-adding socket#2 and #3, each core of sockets is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 Socket#2 | 30-59 Socket#3 | 90-119 Then llc_shared_mask of CPU#30 becomes 0x3fff8000fffffffc0000000. It means that last level cache of Socket#2 is shared with CPU#30-59 and 90-104. So the mask has the wrong value.
--- arch/x86/kernel/smpboot.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/smpboot.c +3 -0
@@ -1287,6 +1287,9 @@ static void remove_siblinginfo(int cpu)for_each_cpu (sibling,cpu_sibling_mask (cpu))cpumask_clear_cpu (cpu,cpu_sibling_mask (sibling)); +for_each_cpu (sibling,cpu_llc_shared_mask (cpu)) +cpumask_clear_cpu (cpu,cpu_llc_shared_mask (sibling)); +cpumask_clear (cpu_llc_shared_mask (cpu));cpumask_clear (cpu_sibling_mask (cpu));cpumask_clear (cpu_core_mask (cpu)); c->phys_proc_id =0 ;
Greg Kroah-Hartman
maintainerPATCH 189/238 brcmfmac: handle IF event for P2P_DEVICE interface
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <[email protected]>
commit 87c4790330810fe5caf0172d9320cf24ef19cebe upstream.
The firmware notifies about interface changes through the IF event which has a NO_IF flag that means host can ignore the event. This behaviour was introduced in the driver by:
commit 2ee8382fc6c763c76396a6aaff77a27089eed3aa
Author: Arend van Spriel <[email protected]>
Date: Sat Aug 10 12:27:24 2013 +0200
brcmfmac: ignore IF event if firmware indicates it
It turns out that the IF event for the P2P_DEVICE also has this flag set, but the event should not be ignored in this scenario. The mentioned commit caused a regression in 3.12 kernel in creation of the P2P_DEVICE interface.
--- drivers/net/wireless/brcm80211/brcmfmac/fweh.c | 12 +++++++++--- drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 2 ++ 2 files changed, 11 insertions(+), 3 deletions(-)
drivers/net/wireless/brcm80211/brcmfmac/fweh.c +9 -3
@@ -185,7 +185,13 @@ static void brcmf_fweh_handle_if_event(s ifevent->action, ifevent->ifidx, ifevent->bssidx, ifevent->flags, ifevent->role); -if (ifevent->flags &BRCMF_E_IF_FLAG_NOIF ) { +/* The P2P Device interface event must not be ignored +* contrary to what firmware tells us. The only way to +* distinguish the P2P Device is by looking at the ifidx +* and bssidx received. +*/ +if (!(ifevent->ifidx ==0 && ifevent->bssidx ==1 ) && + (ifevent->flags &BRCMF_E_IF_FLAG_NOIF )) {brcmf_dbg (EVENT ,"event can be ignored\n" );return ; }
@@ -210,12 +216,12 @@ static void brcmf_fweh_handle_if_event(sreturn ; } -if (ifevent->action ==BRCMF_E_IF_CHANGE ) +if (ifp && ifevent->action ==BRCMF_E_IF_CHANGE )brcmf_fws_reset_interface (ifp); err =brcmf_fweh_call_event_handler (ifp, emsg->event_code, emsg, data); -if (ifevent->action ==BRCMF_E_IF_DEL ) { +if (ifp && ifevent->action ==BRCMF_E_IF_DEL ) {brcmf_fws_del_interface (ifp);brcmf_del_if (drvr, ifevent->bssidx); }
drivers/net/wireless/brcm80211/brcmfmac/fweh.h +2 -0
@@ -167,6 +167,8 @@ enum brcmf_fweh_event_code {#define BRCMF_E_IF_ROLE_STA 0#define BRCMF_E_IF_ROLE_AP 1#define BRCMF_E_IF_ROLE_WDS 2 +#define BRCMF_E_IF_ROLE_P2P_GO 3 +#define BRCMF_E_IF_ROLE_P2P_CLIENT 4/** * definitions for event packet validation.
Greg Kroah-Hartman
maintainerPATCH 190/238 powerpc/perf: Fix ABIv2 kernel backtraces
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 85101af13bb854a6572fa540df7c7201958624b9 upstream.
ABIv2 kernels are failing to backtrace through the kernel. An example:
39.30% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
__GI___libc_readThe problem is in valid_next_sp() where we check that the new stack pointer is at least STACK_FRAME_OVERHEAD below the previous one.
ABIv1 has a minimum stack frame size of 112 bytes consisting of 48 bytes and 64 bytes of parameter save area. ABIv2 changes that to 32 bytes with no paramter save area.
STACK_FRAME_OVERHEAD is in theory the minimum stack frame size, but we over 240 uses of it, some of which assume that it includes space for the parameter area.
We need to work through all our stack defines and rationalise them but let's fix perf now by creating STACK_FRAME_MIN_SIZE and using in valid_next_sp(). This fixes the issue:
30.64% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
pagecache_get_page
generic_file_read_iter
new_sync_read
vfs_read
sys_read
syscall_exit
__GI___libc_read--- arch/powerpc/include/asm/ptrace.h | 7 +++++++ arch/powerpc/perf/callchain.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/ptrace.h +7 -0
@@ -47,6 +47,12 @@ STACK_FRAME_OVERHEAD + KERNEL_REDZONE_SIZE)#define STACK_FRAME_MARKER 12 +#if defined(_CALL_ELF) && _CALL_ELF ==2 +#define STACK_FRAME_MIN_SIZE 32 +#else +#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD +#endif +/* Size of dummy stack frame allocated when calling signal handler. */ #define __SIGNAL_FRAMESIZE 128#define __SIGNAL_FRAMESIZE32 64
@@ -60,6 +66,7 @@#define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773)#define STACK_INT_FRAME_SIZE (sizeof(struct pt_regs) + STACK_FRAME_OVERHEAD)#define STACK_FRAME_MARKER 2 +#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD/* Size of stack frame allocated when calling signal handler. */ #define __SIGNAL_FRAMESIZE 64
arch/powerpc/perf/callchain.c +1 -1
@@ -35,7 +35,7 @@ static int valid_next_sp(unsigned long sreturn 0 ;/* must be 16-byte aligned */ if (!validate_sp (sp, current,STACK_FRAME_OVERHEAD ))return 0 ; -if (sp >= prev_sp +STACK_FRAME_OVERHEAD ) +if (sp >= prev_sp +STACK_FRAME_MIN_SIZE )return 1 ;/* * sp could decrease when we jump off an interrupt stack
Greg Kroah-Hartman
maintainerPATCH 191/238 powerpc: Add smp_mb() to arch_spin_is_locked()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 51d7d5205d3389a32859f9939f1093f267409929 upstream.
The kernel defines the function spin_is_locked(), which can be used to check if a spinlock is currently locked.
Using spin_is_locked() on a lock you don't hold is obviously racy. That is, even though you may observe that the lock is unlocked, it may become locked at any time.
There is (at least) one exception to that, which is if two locks are used as a pair, and the holder of each checks the status of the other before doing any update.
Assuming *A and *B are two locks, and *COUNTER is a shared non-atomic value:
The first CPU does:
spin_lock(*A) if spin_is_locked(*B) # nothing else smp_mb() LOAD r = *COUNTER r++ STORE *COUNTER = r spin_unlock(*A)
And the second CPU does:
spin_lock(*B) if spin_is_locked(*A) # nothing else smp_mb() LOAD r = *COUNTER r++ STORE *COUNTER = r spin_unlock(*B)
Although this is a strange locking construct, it should work.
It seems to be understood, but not documented, that spin_is_locked() is not a memory barrier, so in the examples above and below the caller inserts its own memory barrier before acting on the result of spin_is_locked().
For now we assume spin_is_locked() is implemented as below, and we break it out in our examples:
bool spin_is_locked(*LOCK) {
LOAD l = *LOCK
return l.locked
}Our intuition is that there should be no problem even if the two code sequences run simultaneously such as:
CPU 0 CPU 1 ================================================== spin_lock(*A) spin_lock(*B) LOAD b = *B LOAD a = *A if b.locked # true if a.locked # true # nothing # nothing spin_unlock(*A) spin_unlock(*B)
If one CPU gets the lock before the other then it will do the update and the other CPU will back off:
CPU 0 CPU 1 ================================================== spin_lock(*A) LOAD b = *B spin_lock(*B) if b.locked # false LOAD a = *A else if a.locked # true smp_mb() # nothing LOAD r1 = *COUNTER spin_unlock(*B) r1++ STORE *COUNTER = r1 spin_unlock(*A)
However in reality spin_lock() itself is not indivisible. On powerpc we implement it as a load-and-reserve and store-conditional.
Ignoring the retry logic for the lost reservation case, it boils down to:
spin_lock(*LOCK) {
LOAD l = *LOCK
l.locked = true
STORE *LOCK = l
ACQUIRE_BARRIER
}
The ACQUIRE_BARRIER is required to give spin_lock() ACQUIRE semantics as defined in memory-barriers.txt:
This acts as a one-way permeable barrier. It guarantees that all memory operations after the ACQUIRE operation will appear to happen after the ACQUIRE operation with respect to the other components of the system.
On modern powerpc systems we use lwsync for ACQUIRE_BARRIER. lwsync is also know as "lightweight sync", or "sync 1".
As described in Power ISA v2.07 section B.2.1.1, in this scenario the lwsync is not the barrier itself. It instead causes the LOAD of *LOCK to act as the barrier, preventing any loads or stores in the locked region from occurring prior to the load of *LOCK.
Whether this behaviour is in accordance with the definition of ACQUIRE semantics in memory-barriers.txt is open to discussion, we may switch to a different barrier in future.
What this means in practice is that the following can occur:
CPU 0 CPU 1
==================================================
LOAD a = *A LOAD b = *B
a.locked = true b.locked = true
LOAD b = *B LOAD a = *A
STORE *A = a STORE *B = b
if b.locked # false if a.locked # false
else else
smp_mb() smp_mb()
LOAD r1 = *COUNTER LOAD r2 = *COUNTER
r1++ r2++
STORE *COUNTER = r1
STORE *COUNTER = r2 # Lost update
spin_unlock(*A) spin_unlock(*B)
That is, the load of *B can occur prior to the store that makes *A visibly locked. And similarly for CPU 1. The result is both CPUs hold their lock and believe the other lock is unlocked.
The easiest fix for this is to add a full memory barrier to the start of spin_is_locked(), so adding to our previous definition would give us:
bool spin_is_locked(*LOCK) {
smp_mb()
LOAD l = *LOCK
return l.locked
}The new barrier orders the store to the lock we are locking vs the load of the other lock:
CPU 0 CPU 1
==================================================
LOAD a = *A LOAD b = *B
a.locked = true b.locked = true
STORE *A = a STORE *B = b
smp_mb() smp_mb()
LOAD b = *B LOAD a = *A
if b.locked # true if a.locked # true
# nothing # nothing
spin_unlock(*A) spin_unlock(*B)
Although the above example is theoretical, there is code similar to this example in sem_lock() in ipc/sem.c. This commit in addition to the next commit appears to be a fix for crashes we are seeing in that code where we believe this race happens in practice.
--- arch/powerpc/include/asm/spinlock.h | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/include/asm/spinlock.h +1 -0
@@ -61,6 +61,7 @@ static __always_inline int arch_spin_valstatic inline int arch_spin_is_locked (arch_spinlock_t *lock) { +smp_mb ();return !arch_spin_value_unlocked (*lock); }
Greg Kroah-Hartman
maintainerPATCH 192/238 powerpc: Add smp_mb()s to arch_spin_unlock_wait()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 78e05b1421fa41ae8457701140933baa5e7d9479 upstream.
Similar to the previous commit which described why we need to add a barrier to arch_spin_is_locked(), we have a similar problem with spin_unlock_wait().
We need a barrier on entry to ensure any spinlock we have previously taken is visibly locked prior to the load of lock->slock.
It's also not clear if spin_unlock_wait() is intended to have ACQUIRE semantics. For now be conservative and add a barrier on exit to give it ACQUIRE semantics.
--- arch/powerpc/lib/locks.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/lib/locks.c +4 -0
@@ -70,12 +70,16 @@ void __rw_yield(arch_rwlock_t *rw)void arch_spin_unlock_wait (arch_spinlock_t *lock) { +smp_mb (); +while (lock->slock) {HMT_low ();if (SHARED_PROCESSOR )__spin_yield (lock); }HMT_medium (); + +smp_mb (); }EXPORT_SYMBOL (arch_spin_unlock_wait);
Greg Kroah-Hartman
maintainerPATCH 193/238 dont bugger nd->seq on set_root_rcu() from follow_dotdot_rcu()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 upstream.
return the value instead, and have path_init() do the assignment. Broken by "vfs: Fix absolute RCU path walk failures due to uninitialized seq number", which was Cc-stable with 2.6.38+ as destination. This one should go where it went.
To avoid dummy value returned in case when root is already set (it would do no harm, actually, since the only caller that doesn't ignore the return value is guaranteed to have nd->root *not* set, but it's more obvious that way), lift the check into callers. And do the same to set_root(), to keep them in sync.
--- fs/namei.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-)
fs/namei.c +17 -16
@@ -642,24 +642,22 @@ static int complete_walk(struct nameidat static __always_inline void set_root(struct nameidata *nd) { -if (!nd->root.mnt) -get_fs_root (current->fs, &nd->root); +get_fs_root (current->fs, &nd->root); }static int link_path_walk (const char *,struct nameidata *); -static __always_inline void set_root_rcu(struct nameidata *nd) +static __always_inline unsigned set_root_rcu (struct nameidata *nd) { -if (!nd->root.mnt) { -struct fs_struct *fs = current->fs; -unsigned seq; +struct fs_struct *fs = current->fs; +unsigned seq, res; -do { - seq =read_seqcount_begin (&fs->seq); - nd->root = fs->root; - nd->seq =__read_seqcount_begin (&nd->root.dentry->d_seq); - }while (read_seqcount_retry (&fs->seq, seq)); - } +do { + seq =read_seqcount_begin (&fs->seq); + nd->root = fs->root; + res =__read_seqcount_begin (&nd->root.dentry->d_seq); + }while (read_seqcount_retry (&fs->seq, seq)); +return res; }static void path_put_conditional (struct path *path,struct nameidata *nd)
@@ -859,7 +857,8 @@ follow_link(struct path *link, struct nareturn PTR_ERR (s); }if (*s =='/' ) { -set_root (nd); +if (!nd->root.mnt) +set_root (nd);path_put (&nd->path); nd->path = nd->root;path_get (&nd->root);
@@ -1132,7 +1131,8 @@ static bool __follow_mount_rcu(struct nastatic int follow_dotdot_rcu (struct nameidata *nd) { -set_root_rcu (nd); +if (!nd->root.mnt) +set_root_rcu (nd);while (1 ) { if (nd->path.dentry == nd->root.dentry &&
@@ -1244,7 +1244,8 @@ static void follow_mount(struct path *pastatic void follow_dotdot (struct nameidata *nd) { -set_root (nd); +if (!nd->root.mnt) +set_root (nd);while (1 ) {struct dentry *old = nd->path.dentry;
@@ -1842,7 +1843,7 @@ static int path_init(int dfd, const charif (*name=='/' ) {if (flags &LOOKUP_RCU ) {rcu_read_lock (); -set_root_rcu (nd); + nd->seq =set_root_rcu (nd); }else {set_root (nd);path_get (&nd->root);
Greg Kroah-Hartman
maintainerPATCH 194/238 parisc: Implement new LWS CAS supporting 64 bit operations.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guy Martin <[email protected]>
commit 89206491201cbd1571009b36292af781cef74c1b upstream.
The current LWS cas only works correctly for 32bit. The new LWS allows for CAS operations of variable size.
--- arch/parisc/kernel/syscall.S | 233 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 229 insertions(+), 4 deletions(-)
arch/parisc/kernel/syscall.S +229 -4
@@ -74,7 +74,7 @@ ENTRY(linux_gateway_page) /* ADDRESS 0xb0 to 0xb8, lws uses two insns for entry */ /* Light-weight-syscall entry must always be located at 0xb0 */ /* WARNING: Keep this number updated with table size changes */ -#define __NR_lws_entries (2) +#define __NR_lws_entries (3) lws_entry: gate lws_start, %r0 /* increase privilege */
@@ -502,7 +502,7 @@ lws_exit: /*************************************************** - Implementing CAS as an atomic operation: + Implementing 32bit CAS as an atomic operation: %r26 - Address to examine %r25 - Old value to check (old)
@@ -659,6 +659,230 @@ cas_action: ASM_EXCEPTIONTABLE_ENTRY(2b-linux_gateway_page, 3b-linux_gateway_page) + /*************************************************** + New CAS implementation which uses pointers and variable size + information. The value pointed by old and new MUST NOT change + while performing CAS. The lock only protect the value at %r26. + + %r26 - Address to examine + %r25 - Pointer to the value to check (old) + %r24 - Pointer to the value to set (new) + %r23 - Size of the variable (0/1/2/3 for 8/16/32/64 bit) + %r28 - Return non-zero on failure + %r21 - Kernel error code + + %r21 has the following meanings: + + EAGAIN - CAS is busy, ldcw failed, try again. + EFAULT - Read or write failed. + + Scratch: r20, r22, r28, r29, r1, fr4 (32bit for 64bit CAS only) + + ****************************************************/ + + /* ELF32 Process entry path */ +lws_compare_and_swap_2: +#ifdef CONFIG_64BIT + /* Clip the input registers */ + depdi 0, 31, 32, %r26 + depdi 0, 31, 32, %r25 + depdi 0, 31, 32, %r24 + depdi 0, 31, 32, %r23 +#endif + + /* Check the validity of the size pointer */ + subi,>>= 4, %r23, %r0 + b,n lws_exit_nosys + + /* Jump to the functions which will load the old and new values into + registers depending on the their size */ + shlw %r23, 2, %r29 + blr %r29, %r0 + nop + + /* 8bit load */ +4: ldb 0(%sr3,%r25), %r25 + b cas2_lock_start +5: ldb 0(%sr3,%r24), %r24 + nop + nop + nop + nop + nop + + /* 16bit load */ +6: ldh 0(%sr3,%r25), %r25 + b cas2_lock_start +7: ldh 0(%sr3,%r24), %r24 + nop + nop + nop + nop + nop + + /* 32bit load */ +8: ldw 0(%sr3,%r25), %r25 + b cas2_lock_start +9: ldw 0(%sr3,%r24), %r24 + nop + nop + nop + nop + nop + + /* 64bit load */ +#ifdef CONFIG_64BIT +10: ldd 0(%sr3,%r25), %r25 +11: ldd 0(%sr3,%r24), %r24 +#else + /* Load new value into r22/r23 - high/low */ +10: ldw 0(%sr3,%r25), %r22 +11: ldw 4(%sr3,%r25), %r23 + /* Load new value into fr4 for atomic store later */ +12: flddx 0(%sr3,%r24), %fr4 +#endif + +cas2_lock_start: + /* Load start of lock table */ + ldil L%lws_lock_start, %r20 + ldo R%lws_lock_start(%r20), %r28 + + /* Extract four bits from r26 and hash lock (Bits 4-7) */ + extru %r26, 27, 4, %r20 + + /* Find lock to use, the hash is either one of 0 to + 15, multiplied by 16 (keep it 16-byte aligned) + and add to the lock table offset. */ + shlw %r20, 4, %r20 + add %r20, %r28, %r20 + + rsm PSW_SM_I, %r0 /* Disable interrupts */ + /* COW breaks can cause contention on UP systems */ + LDCW 0(%sr2,%r20), %r28 /* Try to acquire the lock */ + cmpb,<>,n %r0, %r28, cas2_action /* Did we get it? */ +cas2_wouldblock: + ldo 2(%r0), %r28 /* 2nd case */ + ssm PSW_SM_I, %r0 + b lws_exit /* Contended... */ + ldo -EAGAIN(%r0), %r21 /* Spin in userspace */ + + /* + prev = *addr; + if ( prev == old ) + *addr = new; + return prev; + */ + + /* NOTES: + This all works becuse intr_do_signal + and schedule both check the return iasq + and see that we are on the kernel page + so this process is never scheduled off + or is ever sent any signal of any sort, + thus it is wholly atomic from usrspaces + perspective + */ +cas2_action: + /* Jump to the correct function */ + blr %r29, %r0 + /* Set %r28 as non-zero for now */ + ldo 1(%r0),%r28 + + /* 8bit CAS */ +13: ldb,ma 0(%sr3,%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +14: stb,ma %r24, 0(%sr3,%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 16bit CAS */ +15: ldh,ma 0(%sr3,%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +16: sth,ma %r24, 0(%sr3,%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 32bit CAS */ +17: ldw,ma 0(%sr3,%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +18: stw,ma %r24, 0(%sr3,%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 64bit CAS */ +#ifdef CONFIG_64BIT +19: ldd,ma 0(%sr3,%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +20: std,ma %r24, 0(%sr3,%r26) + copy %r0, %r28 +#else + /* Compare first word */ +19: ldw,ma 0(%sr3,%r26), %r29 + sub,= %r29, %r22, %r0 + b,n cas2_end + /* Compare second word */ +20: ldw,ma 4(%sr3,%r26), %r29 + sub,= %r29, %r23, %r0 + b,n cas2_end + /* Perform the store */ +21: fstdx %fr4, 0(%sr3,%r26) + copy %r0, %r28 +#endif + +cas2_end: + /* Free lock */ + stw,ma %r20, 0(%sr2,%r20) + /* Enable interrupts */ + ssm PSW_SM_I, %r0 + /* Return to userspace, set no error */ + b lws_exit + copy %r0, %r21 + +22: + /* Error occurred on load or store */ + /* Free lock */ + stw %r20, 0(%sr2,%r20) + ssm PSW_SM_I, %r0 + ldo 1(%r0),%r28 + b lws_exit + ldo -EFAULT(%r0),%r21 /* set errno */ + nop + nop + nop + + /* Exception table entries, for the load and store, return EFAULT. + Each of the entries must be relocated. */ + ASM_EXCEPTIONTABLE_ENTRY(4b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(5b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(6b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(7b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(8b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(9b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(10b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(11b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(13b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(14b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(15b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(16b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(17b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(18b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(19b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(20b-linux_gateway_page, 22b-linux_gateway_page) +#ifndef CONFIG_64BIT + ASM_EXCEPTIONTABLE_ENTRY(12b-linux_gateway_page, 22b-linux_gateway_page) + ASM_EXCEPTIONTABLE_ENTRY(21b-linux_gateway_page, 22b-linux_gateway_page) +#endif + /* Make sure nothing else is placed on this page */ .align PAGE_SIZE END(linux_gateway_page)
@@ -675,8 +899,9 @@ ENTRY(end_linux_gateway_page) /* Light-weight-syscall table */ /* Start of lws table. */ ENTRY(lws_table) - LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic compare and swap */ - LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic compare and swap */ + LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic 32bit CAS */ + LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic 32bit CAS */ + LWS_ENTRY(compare_and_swap_2) /* 2 - ELF32 Atomic 64bit CAS */ END(lws_table) /* End of lws table */
Greg Kroah-Hartman
maintainerPATCH 195/238 parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit d26a7730b5874a5fa6779c62f4ad7c5065a94723 upstream.
In spite of what the GCC manual says, the -mfast-indirect-calls has never been supported in the 64-bit parisc compiler. Indirect calls have always been done using function descriptors irrespective of the -mfast-indirect-calls option.
Recently, it was noticed that a function descriptor was always requested when the -mfast-indirect-calls option was specified. This caused problems when the option was used in application code and doesn't make any sense because the whole point of the option is to avoid using a function descriptor for indirect calls.
Fixing this broke 64-bit kernel builds.
I will fix GCC but for now we need the attached change. This results in the same kernel code as before.
--- arch/parisc/Makefile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/parisc/Makefile +6 -1
@@ -48,7 +48,12 @@ cflags-y := -pipe # These flags should be implied by an hppa-linux configuration, but they # are not in gcc 3.2. -cflags-y += -mno-space-regs -mfast-indirect-calls +cflags-y += -mno-space-regs + +# -mfast-indirect-calls is only relevant for 32-bit kernels. +ifndef CONFIG_64BIT +cflags-y += -mfast-indirect-calls +endif # Currently we save and restore fpregs on all kernel entry/interruption paths. # If that gets optimized, we might need to disable the use of fpregs in the
Greg Kroah-Hartman
maintainerPATCH 196/238 alarmtimer: Return relative times in timer_gettime
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <[email protected]>
commit e86fea764991e00a03ff1e56409ec9cacdbda4c9 upstream.
Returns the time remaining for an alarm timer, rather than the time at which it is scheduled to expire. If the timer has already expired or it is not currently scheduled, the it_value's members are set to zero.
This new behavior matches that of the other posix-timers and the POSIX specifications.
This is a change in user-visible behavior, and may break existing applications. Hopefully, few users rely on the old incorrect behavior.
--- kernel/time/alarmtimer.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
kernel/time/alarmtimer.c +11 -7
@@ -541,18 +541,22 @@ static int alarm_timer_create(struct k_i* @new_timer: k_itimer pointer * @cur_setting: itimerspec data to fill * -* Copies the itimerspec data out from the k_itimer +* Copies out the current itimerspec data */ static void alarm_timer_get (struct k_itimer *timr,struct itimerspec *cur_setting) { -memset (cur_setting,0 ,sizeof (struct itimerspec )); +ktime_t relative_expiry_time = +alarm_expires_remaining (&(timr->it.alarm.alarmtimer)); - cur_setting->it_interval = -ktime_to_timespec (timr->it.alarm.interval); - cur_setting->it_value = -ktime_to_timespec (timr->it.alarm.alarmtimer.node.expires); -return ; +if (ktime_to_ns (relative_expiry_time) >0 ) { + cur_setting->it_value =ktime_to_timespec (relative_expiry_time); + }else { + cur_setting->it_value.tv_sec =0 ; + cur_setting->it_value.tv_nsec =0 ; + } + + cur_setting->it_interval =ktime_to_timespec (timr->it.alarm.interval); }/**
Greg Kroah-Hartman
maintainerPATCH 197/238 alarmtimer: Do not signal SIGEV_NONE timers
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <[email protected]>
commit 265b81d23a46c39df0a735a3af4238954b41a4c2 upstream.
Avoids sending a signal to alarm timers created with sigev_notify set to SIGEV_NONE by checking for that special case in the timeout callback.
The regular posix timers avoid sending signals to SIGEV_NONE timers by not scheduling any callbacks for them in the first place. Although it would be possible to do something similar for alarm timers, it's simpler to handle this as a special case in the timeout.
Prior to this patch, the alarm timer would ignore the sigev_notify value and try to deliver signals to the process anyway. Even worse, the sanity check for the value of sigev_signo is skipped when SIGEV_NONE was specified, so the signal number could be bogus. If sigev_signo was an unitialized value (as it often would be if SIGEV_NONE is used), then it's hard to predict which signal will be sent.
--- kernel/time/alarmtimer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/time/alarmtimer.c +4 -2
@@ -466,8 +466,10 @@ static enum alarmtimer_restart alarm_han { struct k_itimer *ptr = container_of(alarm, struct k_itimer, it.alarm.alarmtimer); -if (posix_timer_event (ptr,0 ) !=0 ) - ptr->it_overrun++; +if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID ) !=SIGEV_NONE ) { +if (posix_timer_event (ptr,0 ) !=0 ) + ptr->it_overrun++; + }/* Re-add periodic timers */ if (ptr->it.alarm.interval.tv64) {
Greg Kroah-Hartman
maintainerPATCH 198/238 alarmtimer: Lock k_itimer during timer callback
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <[email protected]>
commit 474e941bed9262f5fa2394f9a4a67e24499e5926 upstream.
Locks the k_itimer's it_lock member when handling the alarm timer's expiry callback.
The regular posix timers defined in posix-timers.c have this lock held during timout processing because their callbacks are routed through posix_timer_fn(). The alarm timers follow a different path, so they ought to grab the lock somewhere else.
--- kernel/time/alarmtimer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
kernel/time/alarmtimer.c +8 -2
@@ -464,8 +464,12 @@ static enum alarmtimer_type clock2alarm(static enum alarmtimer_restart alarm_handle_timer (struct alarm *alarm,ktime_t now) { +unsigned long flags; struct k_itimer *ptr = container_of(alarm, struct k_itimer, it.alarm.alarmtimer); +enum alarmtimer_restart result =ALARMTIMER_NORESTART ; + +spin_lock_irqsave (&ptr->it_lock, flags);if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID ) !=SIGEV_NONE ) {if (posix_timer_event (ptr,0 ) !=0 ) ptr->it_overrun++;
@@ -475,9 +479,11 @@ static enum alarmtimer_restart alarm_hanif (ptr->it.alarm.interval.tv64) { ptr->it_overrun +=alarm_forward (alarm, now, ptr->it.alarm.interval); -return ALARMTIMER_RESTART ; + result =ALARMTIMER_RESTART ; } -return ALARMTIMER_NORESTART ; +spin_unlock_irqrestore (&ptr->it_lock, flags); + +return result; }/**