3.16.4-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 3.16.4-stable review
---------------------------------
Note: This is a big stable release. Mostly my fault for being on the road last week, combined with an unusually large number of patches being tagged for the stable tree. Anyway, I've caught up with all pending patches before 3.17-rc7, so if you have marked something for the stable tree that I have not applied, or emailed the [email protected] list asking for a patch, that is not here, please let me know.
---------------------------------
This is the start of the stable review cycle for the 3.16.4 release. There are 357 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Oct 5 21:28:42 UTC 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.4-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.16.4-rc1
Stephen Boyd <[email protected]>
clk: qcom: Fix PLL rate configurations
Stephen Boyd <[email protected]>
clk: qcom: mdp_lut_clk is a child of mdp_src
Stephen Boyd <[email protected]>
clk: qcom: Fix MN frequency tables, parent map, and jpegd
Arnd Bergmann <[email protected]>
staging/lustre: disable virtual block device for 64K pages
Theodore Ts'o <[email protected]>
ext4: avoid trying to kfree an ERR_PTR pointer
Theodore Ts'o <[email protected]>
ext4: propagate errors up to ext4_find_entry()'s callers
Gu Zheng <[email protected]>
aio: block exit_aio() until all context requests are completed
Suman Tripathi <[email protected]>
ahci_xgene: Removing NCQ support from the APM X-Gene SoC AHCI SATA Host Controller driver.
Nishanth Menon <[email protected]>
clk: ti: divider: Provide error check for incoming parameters in set_rate
Tero Kristo <[email protected]>
clk: prevent erronous parsing of children during rate change
Nishanth Menon <[email protected]>
clk: ti: dra7-atl: Provide error check for incoming parameters in set_rate
Viresh Kumar <[email protected]>
cpufreq: update 'cpufreq_suspended' after stopping governors
Dan Carpenter <[email protected]>
partitions: aix.c: off by one bug
Andy Shevchenko <[email protected]>
dmaengine: dw: don't perform DMA when dmaengine_submit is called
Andy Shevchenko <[email protected]>
dmaengine: dw: introduce dwc_dostart_first_queued() helper
Ulf Hansson <[email protected]>
mmc: mmci: Reverse IRQ handling for the arm_variant
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: don't update chain with unset counters
Julian Anastasov <[email protected]>
ipvs: fix ipv6 hook registration for local replies
Daniel Borkmann <[email protected]>
netfilter: x_tables: allow to use default cgroup match
Alex Gartrell <[email protected]>
ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding
Eric Dumazet <[email protected]>
netfilter: xt_hashlimit: perform garbage collection from process context
NeilBrown <[email protected]>
md/raid1: intialise start_next_window for READ case to avoid hang
NeilBrown <[email protected]>
md/raid1: fix_read_error should act on all non-faulty devices.
NeilBrown <[email protected]>
md/raid1: count resync requests in nr_pending.
NeilBrown <[email protected]>
md/raid1: update next_resync under resync_lock.
NeilBrown <[email protected]>
md/raid1: Don't use next_resync to determine how far resync has progressed
NeilBrown <[email protected]>
md/raid1: make sure resync waits for conflicting writes to complete.
NeilBrown <[email protected]>
md/raid1: be more cautious where we read-balance during resync.
NeilBrown <[email protected]>
md/raid1: clean up request counts properly in close_sync()
Zhaowei Yuan <[email protected]>
media: vb2: fix plane index sanity check in vb2_plane_cookie()
Hans Verkuil <[email protected]>
media: vb2: fix vb2 state check when start_streaming fails
Hans Verkuil <[email protected]>
media: videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages
Mauro Carvalho Chehab <[email protected]>
media: em28xx: fix VBI handling logic
Hans Verkuil <[email protected]>
media: adv7604: fix inverted condition
Bimow Chen <[email protected]>
media: af9033: update IT9135 tuner inittabs
Hans Verkuil <[email protected]>
media: cx18: fix kernel oops with tda8290 tuner
Antti Palosaari <[email protected]>
media: af9033: feed clock to RF tuner
Malcolm Priestley <[email protected]>
media: af9035: new IDs: add support for PCTV 78e and PCTV 79e
Bimow Chen <[email protected]>
media: it913x: init tuner on attach
Lan Tianyu <[email protected]>
cpufreq: fix cpufreq suspend/resume for intel_pstate
Prarit Bhargava <[email protected]>
cpufreq: release policy->rwsem on error
Bjorn Helgaas <[email protected]>
Revert "PCI: Make sure bus number resources stay within their parents bounds"
Johannes Berg <[email protected]>
nl80211: clear skb cb before passing to netlink
Tom Lendacky <[email protected]>
crypto: ccp - Check for CCP before registering crypto algs
David Hildenbrand <[email protected]>
blk-mq: Avoid race condition with uninitialized requests
Anton Altaparmakov <[email protected]>
Fix nasty 32-bit overflow bug in buffer i/o code.
Alex Deucher <[email protected]>
drm/radeon/px: fix module unload
Alex Deucher <[email protected]>
drm/nouveau/runpm: fix module unload
Alex Deucher <[email protected]>
vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops
Bjorn Helgaas <[email protected]>
Revert "PCI: Don't scan random busses in pci_scan_bridge()"
Bjorn Helgaas <[email protected]>
PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device
Zhiqiang Zhang <[email protected]>
arm: armv7: perf: fix armv7 ref-cycles error
Cong Wang <[email protected]>
perf: Fix a race condition in perf_remove_from_context()
Krzysztof Hałasa <[email protected]>
Fix unbalanced mutex in dma_pool_create().
Qipan Li <[email protected]>
spi: sirf: enable RX_IO_DMA_INT interrupt
Axel Lin <[email protected]>
spi: dw: Don't use devm_kzalloc in master->setup callback
Axel Lin <[email protected]>
spi: fsl: Don't use devm_kzalloc in master->setup callback
Matan Barak <[email protected]>
IB/core: When marshaling uverbs path, clear unused fields
Moni Shoua <[email protected]>
IB/mlx4: Don't duplicate the default RoCE GID
Moni Shoua <[email protected]>
IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
Mike Marciniszyn <[email protected]>
IB/qib: Correct reference counting in debugfs qp_stats
Al Viro <[email protected]>
GFS2: fix d_splice_alias() misuses
Amit Shah <[email protected]>
Revert "hwrng: virtio - ensure reads happen after successful probe"
Amit Shah <[email protected]>
virtio: rng: delay hwrng_register() till driver is ready
Richard Larocque <[email protected]>
alarmtimer: Lock k_itimer during timer callback
Richard Larocque <[email protected]>
alarmtimer: Do not signal SIGEV_NONE timers
Richard Larocque <[email protected]>
alarmtimer: Return relative times in timer_gettime
John David Anglin <[email protected]>
parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
Guy Martin <[email protected]>
parisc: Implement new LWS CAS supporting 64 bit operations.
Al Viro <[email protected]>
don't bugger nd->seq on set_root_rcu() from follow_dotdot_rcu()
Richard Genoud <[email protected]>
tty/serial: at91: BUG: disable interrupts when !UART_ENABLE_MS()
Michael Ellerman <[email protected]>
powerpc: Add smp_mb()s to arch_spin_unlock_wait()
Michael Ellerman <[email protected]>
powerpc: Add smp_mb() to arch_spin_is_locked()
Anton Blanchard <[email protected]>
powerpc/perf: Fix ABIv2 kernel backtraces
Johannes Stezenbach <[email protected]>
ath9k_htc: fix random decryption failure
Arend van Spriel <[email protected]>
brcmfmac: handle IF event for P2P_DEVICE interface
Wanpeng Li <[email protected]>
sched: Fix unreleased llc_shared_mask bit during CPU hotplug
Peter Feiner <[email protected]>
mm: softdirty: keep bit when zapping file pte
Fabian Frederick <[email protected]>
fs/cachefiles: add missing \n to kerror conversions
David Rientjes <[email protected]>
mm, slab: initialize object alignment on cache creation
Joseph Qi <[email protected]>
ocfs2/dlm: do not get resource spinlock if lockres is new
Andreas Rohner <[email protected]>
nilfs2: fix data loss with mmap()
Andrey Vagin <[email protected]>
fs/notify: don't show f_handle if exportfs_encode_inode_fh failed
Andrey Vagin <[email protected]>
fsnotify/fdinfo: use named constants instead of hardcoded values
Rasmus Villemoes <[email protected]>
kcmp: fix standard comparison bug
Nicolas Iooss <[email protected]>
eventpoll: fix uninitialized variable in epoll_ctl
Patrick Palka <[email protected]>
kernel/printk/printk.c: fix faulty logic in the case of recursive printk
Johannes Berg <[email protected]>
Revert "mac80211: disable uAPSD if all ACs are under ACM"
Steven Rostedt (Red Hat) <[email protected]>
ftrace: Update all ftrace_ops for a ftrace_hash_ops update
Steven Rostedt (Red Hat) <[email protected]>
ftrace: Fix function_profiler and function tracer together
Steven Rostedt (Red Hat) <[email protected]>
ftrace: Allow ftrace_ops to use the hashes from other ops
Felipe Balbi <[email protected]>
usb: dwc3: fix TRB completion when multiple TRBs are started
Jens Axboe <[email protected]>
genhd: fix leftover might_sleep() in blk_free_devt()
Trond Myklebust <[email protected]>
lockdep: Revert lockdep check in raw_seqcount_begin()
J. Bruce Fields <[email protected]>
lockd: fix rpcbind crash on lockd startup failure
Larry Finger <[email protected]>
rtlwifi: rtl8192cu: Add new ID
Eliad Peller <[email protected]>
regulatory: add NUL to alpha2
Tejun Heo <[email protected]>
percpu: perform tlb flush after pcpu_map_pages() failure
Tejun Heo <[email protected]>
percpu: fix pcpu_alloc_pages() failure path
Honggang Li <[email protected]>
percpu: free percpu allocation info for uniprocessor system
Jarkko Nikula <[email protected]>
gpio: Fix potential NULL handler data in chained irqchip handler
James Ralston <[email protected]>
ata_piix: Add Device IDs for Intel 9 Series PCH
Robert Coulson <[email protected]>
hwmon: (ds1621) Update zbits after conversion rate change
Hans de Goede <[email protected]>
Input: i8042 - add nomux quirk for Avatar AVIU-145A6
Hans de Goede <[email protected]>
Input: i8042 - add Fujitsu U574 to no_timeout dmi table
Dmitry Torokhov <[email protected]>
Input: atkbd - do not try 'deactivate' keyboard on any LG laptops
Hans de Goede <[email protected]>
Input: elantech - fix detection of touchpad on ASUS s301l
Dmitry Torokhov <[email protected]>
Input: synaptics - add support for ForcePads
John Sung <[email protected]>
Input: serport - add compat handling for SPIOCSTYPE ioctl
Mikulas Patocka <[email protected]>
dm crypt: fix access beyond the end of allocated space
Anssi Hannula <[email protected]>
dm cache: fix race causing dirty blocks to be marked as clean
Keith Busch <[email protected]>
block: Fix dev_t minor allocation lifetime
Thomas Gleixner <[email protected]>
futex: Unlock hb->lock in futex_wait_requeue_pi() error path
Tejun Heo <[email protected]>
workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
Luciano Coelho <[email protected]>
iwlwifi: mvm: set MAC_FILTER_IN_BEACON correctly for STA/P2P client
Eyal Shapira <[email protected]>
iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate
Eliad Peller <[email protected]>
iwlwifi: increase DEFAULT_MAX_TX_POWER
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix endianity issues with Smart Fifo commands
Emmanuel Grumbach <[email protected]>
Revert "iwlwifi: dvm: don't enable CTS to self"
Mike Christie <[email protected]>
SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
Dan Carpenter <[email protected]>
NFC: microread: Potential overflows in microread_target_discovered()
Nicholas Bellinger <[email protected]>
iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
Joern Engel <[email protected]>
iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
Sebastian Herbszt <[email protected]>
target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE
Sagi Grimberg <[email protected]>
Target/iser: Don't put isert_conn inside disconnected handler
Sagi Grimberg <[email protected]>
Target/iser: Get isert_conn reference once got to connected_handler
Ludovic Desroches <[email protected]>
iio: adc: at91: don't use the last converted data register
Subbaraya Sundeep Bhatta <[email protected]>
iio: adc: xilinx-xadc: assign auxiliary channels address correctly
Johannes Pointner <[email protected]>
iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
Denis CIOCCA <[email protected]>
iio:magnetometer: bugfix magnetometers gain values
Srinivas Pandruvada <[email protected]>
iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: st_sensors: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: meter: ade7758: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: inv_mpu6050: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: gyro: itg3200: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: hid_sensor_hub: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: accel: bma180: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio:trigger: modify return value for iio_trigger_get
Steve French <[email protected]>
SMB3: Fix oops when creating symlinks on smb3
Peter Ujfalusi <[email protected]>
ASoC: davinci-mcasp: Correct rx format unit configuration
Miklos Szeredi <[email protected]>
shmem: fix nlink for rename overwrite directory
Kees Cook <[email protected]>
x86/kaslr: Avoid the setup_data area when picking location
Dave Young <[email protected]>
x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
Stefan Bader <[email protected]>
x86/xen: don't copy bogus duplicate entries into kernel page tables
Ross Lagerwall <[email protected]>
xen/manage: Always freeze/thaw processes when suspend/resuming
Christian Borntraeger <[email protected]>
KVM: s390/mm: Fix guest storage key corruption in ptep_set_access_flags
Christian Borntraeger <[email protected]>
KVM: s390/mm: Fix storage key corruption during swapping
Christian Borntraeger <[email protected]>
KVM: s390/mm: try a cow on read only pages for key ops
Christian Borntraeger <[email protected]>
KVM: s390: Fix user triggerable bug in dead code
Zefan Li <[email protected]>
cgroup: fix unbalanced locking
Li Zefan <[email protected]>
cgroup: delay the clearing of cgrp->kn->priv
Alban Crequy <[email protected]>
cgroup: reject cgroup names with '\n'
Mark Brown <[email protected]>
regmap: Don't attempt block writes when syncing cache on single_rw devices
Mark Brown <[email protected]>
regmap: Fix handling of volatile registers for format_write() chips
Lars-Peter Clausen <[email protected]>
regmap: Fix regcache debugfs initialization
Tang Chen <[email protected]>
memblock, memhotplug: fix wrong type in memblock_find_in_range_node().
Catalin Marinas <[email protected]>
arm64: Add brackets around user_stack_pointer()
Aaron Lu <[email protected]>
ACPI / video: disable native backlight for ThinkPad X201s
Mika Westerberg <[email protected]>
ACPI / scan: Correct error return value of create_modalias()
Rafael J. Wysocki <[email protected]>
ACPI / hotplug: Generate online uevents for ACPI containers
Fu Zhonghui <[email protected]>
ACPI / platform / LPSS: disable async suspend/resume of LPSS devices
Srinivas Pandruvada <[email protected]>
gpio / ACPI: Use pin index and bit length
Bob Moore <[email protected]>
ACPICA: Update to GPIO region handler interface.
Markos Chandras <[email protected]>
MIPS: mcount: Adjust stack pointer for static trace in MIPS32
Paul Burton <[email protected]>
MIPS: Fix MFC1 & MFHC1 emulation for 64-bit MIPS systems
Aurelien Jarno <[email protected]>
MIPS: ZBOOT: add missing <linux/string.h> include
Nathan Lynch <[email protected]>
ARM: 8178/1: fix set_tls for !CONFIG_KUSER_HELPERS
Robin Murphy <[email protected]>
ARM: 8165/1: alignment: don't break misaligned NEON load/store
Shawn Guo <[email protected]>
ARM: imx: fix .is_enabled() of shared gate clock
Markus Niebel <[email protected]>
ARM: DT: imx53: fix lvds channel 1 port
Roger Quadros <[email protected]>
ARM: dts: dra7-evm: Fix NAND GPMC timings
Stephen Boyd <[email protected]>
ARM: 8149/1: perf: Don't sleep while atomic when enabling per-cpu interrupts
Nathan Lynch <[email protected]>
ARM: 8148/1: flush TLS and thumbee register state during exec
Sudeep Holla <[email protected]>
ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
Nishanth Menon <[email protected]>
ARM: dts: dra7-evm: Fix spi1 mux documentation
Peter Ujfalusi <[email protected]>
ARM: edma: Fix configuration parsing for SoCs with multiple eDMA3 CC
Nishanth Menon <[email protected]>
ARM: dts: DRA7: fix interrupt-cells for GPIO
Rajendra Nayak <[email protected]>
ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
Fabio Estevam <[email protected]>
ARM: dts: imx53-qsrb: Fix suspend/resume
Mark Rutland <[email protected]>
ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex
Mark Rutland <[email protected]>
ARM: 8128/1: abort: don't clear the exclusive monitors
Andy Shevchenko <[email protected]>
spi: dw-pci: fix bug when regs left uninitialized
Andy Shevchenko <[email protected]>
spi: dw: fix kernel crash due to NULL pointer dereference
Jorge A. Ventura <[email protected]>
spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
Weston Andros Adamson <[email protected]>
nfs: can_coalesce_requests must enforce contiguity
Weston Andros Adamson <[email protected]>
nfs: disallow duplicate pages in pgio page vectors
Weston Andros Adamson <[email protected]>
nfs: don't sleep with inode lock in lock_and_join_requests
Weston Andros Adamson <[email protected]>
nfs: fix error handling in lock_and_join_requests
Weston Andros Adamson <[email protected]>
nfs: use blocking page_group_lock in add_request
Weston Andros Adamson <[email protected]>
nfs: fix nonblocking calls to nfs_page_group_lock
Weston Andros Adamson <[email protected]>
nfs: change nfs_page_group_lock argument
Weston Andros Adamson <[email protected]>
nfs: clear_request_commit while holding i_lock
Weston Andros Adamson <[email protected]>
pnfs: add pnfs_put_lseg_async
Weston Andros Adamson <[email protected]>
nfs: check wait_on_bit_lock err in page_group_lock
Weston Andros Adamson <[email protected]>
nfs: remove pgio_header refcount, related cleanup
Weston Andros Adamson <[email protected]>
nfs: merge nfs_pgio_data into _header
Weston Andros Adamson <[email protected]>
nfs: rename members of nfs_pgio_data
Weston Andros Adamson <[email protected]>
nfs: move nfs_pgio_data and remove nfs_rw_header
J. Bruce Fields <[email protected]>
nfsd4: fix corruption of NFSv4 read data
Trond Myklebust <[email protected]>
NFSv4: Fix another bug in the close/open_downgrade code
Steve Dickson <[email protected]>
NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
Li Zefan <[email protected]>
cgroup: check cgroup liveliness before unbreaking kernfs
J. Bruce Fields <[email protected]>
nfsd4: fix rd_dircount enforcement
Olav Haugan <[email protected]>
iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1
Varun Sethi <[email protected]>
iommu/fsl: Fix warning resulting from adding PCI device twice
Joerg Roedel <[email protected]>
iommu/vt-d: Check return value of acpi_bus_get_device()
Bjørn Mork <[email protected]>
Revert "ACPI / battery: fix wrong value of capacity_now reported when fully charged"
Fu Zhonghui <[email protected]>
ACPI / LPSS: complete PM entries for LPSS power domain
Lee, Chun-Yi <[email protected]>
ACPI / RTC: Fix CMOS RTC opregion handler accesses to wrong addresses
Robert Baldyga <[email protected]>
usb: dwc2/gadget: avoid disabling ep0
Marek Szyprowski <[email protected]>
usb: dwc2/gadget: delay enabling irq once hardware is configured properly
Marek Szyprowski <[email protected]>
usb: dwc2/gadget: do not call disconnect method in pullup
Marek Szyprowski <[email protected]>
usb: dwc2/gadget: break infinite loop in endpoint disable code
Kamil Debski <[email protected]>
usb: dwc2/gadget: fix phy initialization sequence
Kamil Debski <[email protected]>
usb: dwc2/gadget: fix phy disable sequence
Felipe Balbi <[email protected]>
usb: dwc3: omap: fix ordering for runtime pm calls
Felipe Balbi <[email protected]>
usb: dwc3: core: fix ordering for PHY suspend
Felipe Balbi <[email protected]>
usb: dwc3: core: fix order of PM runtime calls
Alan Stern <[email protected]>
USB: EHCI: unlink QHs even after the controller has stopped
Mark <[email protected]>
USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
Mark <[email protected]>
USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
Mark <[email protected]>
USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
Mark <[email protected]>
storage: Add single-LUN quirk for Jaz USB Adapter
Alan Stern <[email protected]>
USB: document the 'u' flag for usb-storage quirks parameter
Joe Lawrence <[email protected]>
usb: hub: take hub->hdev reference when processing from eventlist
Mathias Nyman <[email protected]>
xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
Al Cooper <[email protected]>
usb: xhci: Fix OOPS in xhci error handling code
Mathias Nyman <[email protected]>
xhci: Fix null pointer dereference if xhci initialization fails
Felipe Balbi <[email protected]>
usb: host: xhci: fix compliance mode workaround
Thomas Pugliese <[email protected]>
uwb: init beacon cache entry before registering uwb device
Johan Hovold <[email protected]>
USB: zte_ev: fix removed PIDs
Johan Hovold <[email protected]>
USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
Taylor Braun-Jones <[email protected]>
USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device
Ivan T. Ivanov <[email protected]>
usb: chipidea: msm: Initialize PHY on reset event
Ivan T. Ivanov <[email protected]>
usb: chipidea: msm: Use USB PHY API to control PHY state
Tony Lindgren <[email protected]>
usb: phy: twl4030-usb: Fix regressions to runtime PM on omaps
Tony Lindgren <[email protected]>
usb: phy: twl4030-usb: Fix lost interrupts after ID pin goes down
Thierry Reding <[email protected]>
usb: phy: tegra: Avoid use of sizeof(void)
Bjørn Mork <[email protected]>
USB: sierra: add 1199:68AA device ID
Bjørn Mork <[email protected]>
USB: sierra: avoid CDC class functions on "68A3" devices
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Qualcom PID
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Gobi PID
Johan Hovold <[email protected]>
Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
Brennan Ashton <[email protected]>
USB: option: add VIA Telecom CDS7 chipset device id
Johan Hovold <[email protected]>
USB: option: reduce interrupt-urb logging verbosity
Johan Hovold <[email protected]>
USB: serial: fix potential heap buffer overflow
Stephen Hemminger <[email protected]>
USB: sisusb: add device id for Magic Control USB video
Johan Hovold <[email protected]>
USB: serial: fix potential stack buffer overflow
Greg KH <[email protected]>
USB: serial: pl2303: add device id for ztek device
Andrzej Pietrasiewicz <[email protected]>
usb: gadget: f_rndis: fix interface id for OS descriptors
Alexey Khoroshilov <[email protected]>
ufs: fix deadlocks introduced by sb mutex merge
Jeff Layton <[email protected]>
locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease
Max Filippov <[email protected]>
xtensa: fix a6 and a7 handling in fast_syscall_xtensa
Max Filippov <[email protected]>
xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
Max Filippov <[email protected]>
xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
Alan Douglas <[email protected]>
xtensa: fix address checks in dma_{alloc,free}_coherent
Max Filippov <[email protected]>
xtensa: replace IOCTL code definitions with constants
Alex Deucher <[email protected]>
drm/radeon/cik: use a separate counter for CP init timeout
Alex Deucher <[email protected]>
drm/radeon/dpm: fix resume on mullins
Alex Deucher <[email protected]>
drm/radeon: don't reset dma on r6xx-evergreen init
Alex Deucher <[email protected]>
drm/radeon: don't reset sdma on CIK init
Alex Deucher <[email protected]>
drm/radeon: don't reset dma on NI/SI init
Alex Deucher <[email protected]>
drm/radeon: add connector quirk for fujitsu board
Alex Deucher <[email protected]>
drm/radeon/dpm: set the thermal type properly for special configs
Christian König <[email protected]>
drm/radeon: fix semaphore value init
Alex Deucher <[email protected]>
drm/radeon: handle broken disabled rb mask gracefully (6xx/7xx) (v2)
Alex Deucher <[email protected]>
drm/radeon: fix active_cu mask on SI and CIK after re-init (v3)
Alex Deucher <[email protected]>
drm/radeon: fix active cu count for SI and CIK
Alex Deucher <[email protected]>
drm/radeon: fix pm handling in radeon_gpu_reset
Christian König <[email protected]>
drm/radeon: properly document reloc priority mask
Alex Deucher <[email protected]>
drm/radeon/dpm: select the appropriate vce power state for KV/KB/ML
Oleg Chernovskiy <[email protected]>
drm/radeon: Add missing lines to ci_set_thermal_temperature_range
Pali Rohár <[email protected]>
drm/radeon: Add ability to get and change dpm state when radeon PX card is turned off
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
Russell King <[email protected]>
imx-drm: imx-ldb: fix NULL pointer in imx_ldb_unbind()
Russell King <[email protected]>
imx-drm: ipuv3-plane: fix ipu_plane_dpms()
Y.C. Chen <[email protected]>
drm/ast: AST2000 cannot be detected correctly
Y.C. Chen <[email protected]>
drm/ast: open key before detect chips
Brad Volkin <[email protected]>
drm/i915: Don't leak command parser tables on suspend/resume
Jani Nikula <[email protected]>
drm/i915/hdmi: fix hdmi audio state readout
Ville Syrjälä <[email protected]>
drm/i915: Wait for vblank before enabling the TV encoder
Daniel Vetter <[email protected]>
drm/i915: Fix EIO/wedged handling in gem fault handler
Ville Syrjälä <[email protected]>
drm/i915: Fix lock dropping in intel_tv_detect()
Mathias Krause <[email protected]>
drm/i915: Remove bogus __init annotation from DMI callbacks
Scot Doyle <[email protected]>
drm/i915: Ignore VBT backlight presence check on Acer C720 (4005U)
Paulo Zanoni <[email protected]>
drm/i915: fix plane/cursor handling when runtime suspended
Imre Deak <[email protected]>
drm/i915: don't try to retrain a DP link on an inactive CRTC
Ville Syrjälä <[email protected]>
drm/i915: Fix locking for intel_enable_pipe_a()
Ville Syrjälä <[email protected]>
drm/i915: Skip load detect when intel_crtc->new_enable==true
Filipe Brandenburger <[email protected]>
xattr: fix check for simultaneous glibc header inclusion
Benjamin Tissoires <[email protected]>
HID: logitech-dj: prevent false errors to be shown
Jiri Kosina <[email protected]>
HID: magicmouse: sanity check report size in raw_event() callback
Jiri Kosina <[email protected]>
HID: picolcd: sanity check report size in raw_event() callback
Toshiaki Makita <[email protected]>
cfq-iosched: Fix wrong children_weight calculation
Clemens Ladisch <[email protected]>
ALSA: pcm: fix fifo_size frame calculation
Huacai Chen <[email protected]>
ALSA: hda - Add fixup model name lookup for Lemote A1205
Takashi Iwai <[email protected]>
ALSA: hda - Fix invalid pin powermap without jack detection
Takashi Iwai <[email protected]>
ALSA: hda - Fix COEF setups for ALC1150 codec
Takashi Iwai <[email protected]>
ALSA: hda - Fix digital mic on Acer Aspire 3830TG
Takashi Sakamoto <[email protected]>
ALSA: firewire-lib/dice: add arrangements of PCM pointer and interrupts for Dice quirk
Takashi Sakamoto <[email protected]>
ALSA: dice: fix wrong channel mappping at higher sampling rate
Clemens Ladisch <[email protected]>
ALSA: core: fix buffer overflow in snd_info_get_line()
Will Deacon <[email protected]>
arm64: ptrace: fix compat hardware watchpoint reporting
Josef Bacik <[email protected]>
trace: Fix epoll hang when we race with new entries
Steven Rostedt (Red Hat) <[email protected]>
ftrace: Use current addr when converting to nop in __ftrace_replace_code()
Fan Du <[email protected]>
i2c: ismt: use correct length when copy buffer
addy ke <[email protected]>
i2c: rk3x: fix divisor calculation for SCL frequency
Sergei Shtylyov <[email protected]>
i2c: rcar: fix RCAR_IRQ_ACK_{RECV|SEND}Sergei Shtylyov <[email protected]>
i2c: rcar: fix MNR interrupt handling
Sergei Shtylyov <[email protected]>
Revert "i2c: rcar: remove spinlock"
Simon Lindgren <[email protected]>
i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
Marek Roszko <[email protected]>
i2c: at91: add bound checking on SMBus block length bytes
Chen-Yu Tsai <[email protected]>
i2c: mv64xxx: continue probe when clock-frequency is missing
addy ke <[email protected]>
i2c: rk3x: fix bug that cause transfer fails in master receive mode
Pranavkumar Sawargaonkar <[email protected]>
ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU
Christoffer Dall <[email protected]>
arm/arm64: KVM: Complete WFI/WFE instructions
Sudeep Holla <[email protected]>
arm64: use irq_set_affinity with force=false when migrating irqs
Will Deacon <[email protected]>
arm64: flush TLS registers during exec
Lothar Waßmann <[email protected]>
ARM: dts: i.MX53: fix apparent bug in VPU clks
Bill Pringlemeir <[email protected]>
ARM: dts: vf610-twr: Fix pinctrl_esdhc1 pin definitions.
Shawn Guo <[email protected]>
ARM: imx: fix TLB missing of IOMUXC base address during suspend
Jeff Moyer <[email protected]>
aio: add missing smp_rmb() in read_events_ring
Benjamin LaHaise <[email protected]>
aio: fix reqs_available handling
Anton Blanchard <[email protected]>
ibmveth: Fix endian issues with rx_no_buffer statistic
Geert Uytterhoeven <[email protected]>
pwm: Fix period and polarity in pwm_get() for non-perfect matches
Murali Karicheri <[email protected]>
ahci: add pcid for Marvel 0x9182 controller
James Ralston <[email protected]>
ahci: Add Device IDs for Intel 9 Series PCH
Arjun Sreedharan <[email protected]>
pata_scc: propagate return value of scc_wait_after_reset
Tejun Heo <[email protected]>
libata: widen Crucial M550 blacklist matching
Florian Fainelli <[email protected]>
of/irq: Fix lookup to use 'interrupts-extended' property first
Al Cooper <[email protected]>
of: Allow mem_reserve of memory with a base address of zero
Chris Wilson <[email protected]>
drm/i915: Disable RCS flips on Ivybridge
Jiri Kosina <[email protected]>
drm/i915: read HEAD register back in init_ring_common() to enforce ordering
Rafael Barbalho <[email protected]>
drm/i915: Fix crash when failing to parse MIPI VBT
Alex Deucher <[email protected]>
drm/radeon: tweak ACCEL_WORKING2 query for hawaii
Alex Deucher <[email protected]>
drm/radeon/atom: add new voltage fetch function for hawaii
Christian König <[email protected]>
drm/radeon: set VM base addr using the PFP v2
Alex Deucher <[email protected]>
drm/radeon: load the lm63 driver for an lm64 thermal chip.
Alex Deucher <[email protected]>
drm/radeon: re-enable dpm by default on BTC
Alex Deucher <[email protected]>
drm/radeon: re-enable dpm by default on cayman
Alex Deucher <[email protected]>
drm/radeon/dpm: handle voltage info fetching on hawaii
Tetsuo Handa <[email protected]>
drm/ttm: Pass GFP flags in order to avoid deadlock.
Tetsuo Handa <[email protected]>
drm/ttm: Fix possible stack overflow by recursive shrinker calls.
Tetsuo Handa <[email protected]>
drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
Tetsuo Handa <[email protected]>
drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
Tetsuo Handa <[email protected]>
drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
Christian König <[email protected]>
drm/ttm: fix handling of TTM_PL_FLAG_TOPDOWN v2
Guido Martínez <[email protected]>
drm/tilcdc: fix double kfree
Guido Martínez <[email protected]>
drm/tilcdc: fix release order on exit
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix leak when unloading the module
Guido Martínez <[email protected]>
drm/tilcdc: tfp410: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: slave: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix dangling sysfs connector node
Stephen Warren <[email protected]>
drm/tegra: add MODULE_DEVICE_TABLEs
Ronald Wahl <[email protected]>
carl9170: fix sending URBs with wrong type when using full-speed
Stephen Boyd <[email protected]>
cpufreq: OPP: Avoid sleeping while atomic
Andy Lutomirski <[email protected]>
module: Clean up ro/nx after early module load failures
-------------
Diffstat:
.../bindings/interrupt-controller/interrupts.txt | 12 +- .../devicetree/bindings/staging/imx-drm/ldb.txt | 15 +- Documentation/kernel-parameters.txt | 1 + Makefile | 4 +- arch/arm/boot/dts/dra7-evm.dts | 41 ++- arch/arm/boot/dts/dra7.dtsi | 16 +- arch/arm/boot/dts/imx53-qsrb.dts | 8 + arch/arm/boot/dts/imx53.dtsi | 14 +- arch/arm/boot/dts/vf610-twr.dts | 2 +- arch/arm/common/edma.c | 9 +- arch/arm/include/asm/cacheflush.h | 1 - arch/arm/include/asm/tls.h | 64 +++++ arch/arm/kernel/entry-header.S | 29 ++- arch/arm/kernel/irq.c | 2 +- arch/arm/kernel/perf_event_cpu.c | 14 +- arch/arm/kernel/perf_event_v7.c | 5 + arch/arm/kernel/process.c | 2 + arch/arm/kernel/thumbee.c | 2 +- arch/arm/kernel/traps.c | 17 +- arch/arm/kvm/handle_exit.c | 2 + arch/arm/kvm/init.S | 4 + arch/arm/mach-exynos/mcpm-exynos.c | 1 - arch/arm/mach-imx/clk-gate2.c | 6 +- arch/arm/mach-imx/suspend-imx6.S | 2 + arch/arm/mach-omap2/omap_hwmod.c | 3 + arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 22 +- arch/arm/mm/abort-ev6.S | 6 - arch/arm/mm/abort-ev7.S | 6 - arch/arm/mm/alignment.c | 3 + arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/include/asm/ptrace.h | 2 +- arch/arm64/kernel/irq.c | 12 +- arch/arm64/kernel/process.c | 18 ++ arch/arm64/kernel/ptrace.c | 3 +- arch/arm64/kernel/sys_compat.c | 6 + arch/arm64/kvm/handle_exit.c | 2 + arch/arm64/kvm/hyp-init.S | 4 + arch/mips/boot/compressed/decompress.c | 1 + arch/mips/kernel/mcount.S | 12 + arch/mips/math-emu/cp1emu.c | 6 +- arch/parisc/Makefile | 7 +- arch/parisc/kernel/syscall.S | 233 ++++++++++++++++- arch/powerpc/include/asm/ptrace.h | 7 + arch/powerpc/include/asm/spinlock.h | 1 + arch/powerpc/lib/locks.c | 4 + arch/powerpc/perf/callchain.c | 2 +- arch/s390/include/asm/pgtable.h | 6 +- arch/s390/kvm/kvm-s390.c | 13 - arch/s390/mm/pgtable.c | 10 + arch/x86/boot/compressed/aslr.c | 15 ++ arch/x86/include/asm/fixmap.h | 6 +- arch/x86/include/asm/pgtable_64.h | 1 + arch/x86/kernel/smpboot.c | 3 + arch/x86/xen/mmu.c | 27 +- arch/xtensa/include/asm/pgtable.h | 7 +- arch/xtensa/include/asm/uaccess.h | 5 + arch/xtensa/include/uapi/asm/ioctls.h | 19 +- arch/xtensa/kernel/entry.S | 26 +- arch/xtensa/kernel/pci-dma.c | 12 +- block/blk-mq.c | 4 +- block/cfq-iosched.c | 11 +- block/genhd.c | 26 +- block/partition-generic.c | 2 +- block/partitions/aix.c | 2 +- drivers/acpi/acpi_cmos_rtc.c | 2 +- drivers/acpi/acpi_lpss.c | 11 +- drivers/acpi/acpica/aclocal.h | 1 + drivers/acpi/acpica/acobject.h | 1 + drivers/acpi/acpica/dsfield.c | 2 + drivers/acpi/acpica/evregion.c | 47 ++-- drivers/acpi/acpica/exfield.c | 67 +++++ drivers/acpi/acpica/exprep.c | 2 + drivers/acpi/battery.c | 14 - drivers/acpi/container.c | 8 + drivers/acpi/scan.c | 5 +- drivers/acpi/video.c | 8 + drivers/ata/ahci.c | 10 + drivers/ata/ahci_xgene.c | 4 +- drivers/ata/ata_piix.c | 8 + drivers/ata/libata-core.c | 2 +- drivers/ata/pata_scc.c | 15 +- drivers/base/regmap/internal.h | 3 + drivers/base/regmap/regcache-rbtree.c | 9 +- drivers/base/regmap/regcache.c | 2 +- drivers/base/regmap/regmap-debugfs.c | 3 + drivers/base/regmap/regmap.c | 2 +- drivers/char/hw_random/core.c | 6 - drivers/char/hw_random/virtio-rng.c | 34 ++- drivers/clk/clk.c | 7 +- drivers/clk/qcom/common.c | 39 ++- drivers/clk/qcom/common.h | 6 + drivers/clk/qcom/mmcc-msm8960.c | 84 +++--- drivers/clk/qcom/mmcc-msm8974.c | 10 +- drivers/clk/ti/clk-dra7-atl.c | 6 +- drivers/clk/ti/divider.c | 7 +- drivers/cpufreq/cpufreq.c | 9 +- drivers/cpufreq/cpufreq_opp.c | 2 +- drivers/crypto/ccp/ccp-crypto-main.c | 4 + drivers/crypto/ccp/ccp-dev.c | 14 + drivers/dma/TODO | 1 - drivers/dma/dw/core.c | 38 ++- drivers/gpio/gpiolib-acpi.c | 5 +- drivers/gpio/gpiolib.c | 2 +- drivers/gpu/drm/ast/ast_main.c | 3 +- drivers/gpu/drm/i915/i915_cmd_parser.c | 12 +- drivers/gpu/drm/i915/i915_gem.c | 11 +- drivers/gpu/drm/i915/intel_bios.c | 4 +- drivers/gpu/drm/i915/intel_crt.c | 9 +- drivers/gpu/drm/i915/intel_display.c | 62 +++-- drivers/gpu/drm/i915/intel_dp.c | 3 + drivers/gpu/drm/i915/intel_drv.h | 3 +- drivers/gpu/drm/i915/intel_hdmi.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 + drivers/gpu/drm/i915/intel_tv.c | 21 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 1 + drivers/gpu/drm/nouveau/nouveau_ttm.c | 3 + drivers/gpu/drm/nouveau/nouveau_vga.c | 9 + drivers/gpu/drm/radeon/ci_dpm.c | 16 +- drivers/gpu/drm/radeon/cik.c | 18 +- drivers/gpu/drm/radeon/cik_sdma.c | 7 - drivers/gpu/drm/radeon/kv_dpm.c | 34 ++- drivers/gpu/drm/radeon/ni_dma.c | 6 - drivers/gpu/drm/radeon/r600.c | 26 +- drivers/gpu/drm/radeon/r600_dma.c | 9 - drivers/gpu/drm/radeon/radeon.h | 3 + drivers/gpu/drm/radeon/radeon_atombios.c | 72 +++++- drivers/gpu/drm/radeon/radeon_cs.c | 3 +- drivers/gpu/drm/radeon/radeon_device.c | 29 ++- drivers/gpu/drm/radeon/radeon_drv.c | 1 + drivers/gpu/drm/radeon/radeon_kms.c | 9 +- drivers/gpu/drm/radeon/radeon_pm.c | 24 +- drivers/gpu/drm/radeon/radeon_semaphore.c | 2 +- drivers/gpu/drm/radeon/rv770.c | 23 +- drivers/gpu/drm/radeon/si.c | 11 +- drivers/gpu/drm/tegra/dc.c | 1 + drivers/gpu/drm/tegra/dpaux.c | 1 + drivers/gpu/drm/tegra/dsi.c | 1 + drivers/gpu/drm/tegra/gr2d.c | 1 + drivers/gpu/drm/tegra/gr3d.c | 1 + drivers/gpu/drm/tegra/hdmi.c | 1 + drivers/gpu/drm/tegra/sor.c | 1 + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 7 +- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 5 +- drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 + drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 + drivers/gpu/drm/ttm/ttm_bo.c | 6 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 3 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 29 ++- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 34 +-- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 1 + drivers/gpu/vga/vga_switcheroo.c | 6 + drivers/hid/hid-logitech-dj.c | 43 ++-- drivers/hid/hid-logitech-dj.h | 1 + drivers/hid/hid-magicmouse.c | 10 + drivers/hid/hid-picolcd_core.c | 6 + drivers/hwmon/ds1621.c | 1 + drivers/i2c/busses/i2c-at91.c | 32 ++- drivers/i2c/busses/i2c-ismt.c | 4 +- drivers/i2c/busses/i2c-mv64xxx.c | 3 +- drivers/i2c/busses/i2c-rcar.c | 41 ++- drivers/i2c/busses/i2c-rk3x.c | 15 +- drivers/iio/accel/bma180.c | 2 +- drivers/iio/adc/ad_sigma_delta.c | 2 +- drivers/iio/adc/at91_adc.c | 12 +- drivers/iio/adc/xilinx-xadc-core.c | 2 +- .../iio/common/hid-sensors/hid-sensor-trigger.c | 3 +- drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +- drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/magnetometer/st_magn_core.c | 52 ++-- drivers/infiniband/core/uverbs_marshall.c | 4 + drivers/infiniband/hw/mlx4/main.c | 53 ++-- drivers/infiniband/hw/qib/qib_debugfs.c | 3 +- drivers/infiniband/hw/qib/qib_qp.c | 8 - drivers/infiniband/ulp/isert/ib_isert.c | 7 +- drivers/input/keyboard/atkbd.c | 8 - drivers/input/mouse/elantech.c | 7 + drivers/input/mouse/synaptics.c | 68 +++-- drivers/input/mouse/synaptics.h | 11 + drivers/input/serio/i8042-x86ia64io.h | 15 ++ drivers/input/serio/serport.c | 45 +++- drivers/iommu/arm-smmu.c | 7 +- drivers/iommu/dmar.c | 3 +- drivers/iommu/fsl_pamu_domain.c | 10 +- drivers/md/dm-cache-target.c | 4 +- drivers/md/dm-crypt.c | 20 +- drivers/md/raid1.c | 40 +-- drivers/media/dvb-core/dvb-usb-ids.h | 2 + drivers/media/dvb-frontends/af9033.c | 13 + drivers/media/dvb-frontends/af9033_priv.h | 20 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/pci/cx18/cx18-driver.c | 1 + drivers/media/tuners/tuner_it913x.c | 6 + drivers/media/usb/dvb-usb-v2/af9035.c | 4 + drivers/media/usb/em28xx/em28xx-video.c | 2 +- drivers/media/v4l2-core/videobuf2-core.c | 19 +- drivers/media/v4l2-core/videobuf2-dma-sg.c | 2 +- drivers/mmc/host/mmci.c | 12 +- drivers/net/ethernet/ibm/ibmveth.c | 18 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- drivers/net/wireless/ath/carl9170/carl9170.h | 1 + drivers/net/wireless/ath/carl9170/usb.c | 31 ++- drivers/net/wireless/brcm80211/brcmfmac/fweh.c | 12 +- drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 2 + drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 + drivers/net/wireless/iwlwifi/iwl-config.h | 2 + drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 4 +- drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 +- drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 10 +- drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 8 +- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + drivers/nfc/microread/microread.c | 16 +- drivers/of/fdt.c | 2 +- drivers/of/irq.c | 17 +- drivers/pci/hotplug/acpiphp_glue.c | 16 +- drivers/pci/hotplug/pciehp_hpc.c | 12 + drivers/pci/probe.c | 20 +- drivers/phy/phy-twl4030-usb.c | 121 +++++---- drivers/pwm/core.c | 8 +- drivers/scsi/libiscsi.c | 10 + drivers/spi/spi-dw-pci.c | 2 + drivers/spi/spi-dw.c | 14 +- drivers/spi/spi-fsl-espi.c | 15 +- drivers/spi/spi-fsl-spi.c | 10 +- drivers/spi/spi-omap2-mcspi.c | 3 +- drivers/spi/spi-sirf.c | 3 +- drivers/staging/iio/meter/ade7758_trigger.c | 2 +- drivers/staging/imx-drm/imx-ldb.c | 3 + drivers/staging/imx-drm/ipuv3-plane.c | 3 +- drivers/staging/lustre/lustre/Kconfig | 1 + drivers/target/iscsi/iscsi_target.c | 4 +- drivers/target/iscsi/iscsi_target_parameters.c | 2 +- drivers/target/target_core_configfs.c | 2 +- drivers/tty/serial/atmel_serial.c | 43 +++- drivers/usb/chipidea/ci_hdrc_msm.c | 7 +- drivers/usb/core/hub.c | 4 +- drivers/usb/dwc2/gadget.c | 52 ++-- drivers/usb/dwc3/core.c | 13 +- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/gadget/f_rndis.c | 4 + drivers/usb/host/ehci-hcd.c | 2 - drivers/usb/host/xhci-hub.c | 8 +- drivers/usb/host/xhci-mem.c | 3 +- drivers/usb/host/xhci.c | 12 +- drivers/usb/misc/sisusbvga/sisusb.c | 1 + drivers/usb/phy/phy-tegra-usb.c | 4 +- drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 12 + drivers/usb/serial/option.c | 31 ++- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/sierra.c | 9 +- drivers/usb/serial/usb-serial.c | 37 ++- drivers/usb/serial/zte_ev.c | 24 +- drivers/usb/storage/unusual_devs.h | 38 +++ drivers/uwb/lc-dev.c | 13 +- drivers/xen/manage.c | 7 - fs/aio.c | 91 ++++++- fs/buffer.c | 6 +- fs/cachefiles/bind.c | 8 +- fs/cachefiles/daemon.c | 30 +-- fs/cachefiles/internal.h | 2 +- fs/cachefiles/main.c | 2 +- fs/cachefiles/namei.c | 14 +- fs/cachefiles/xattr.c | 10 +- fs/cifs/link.c | 8 +- fs/eventpoll.c | 3 +- fs/ext4/ext4.h | 2 +- fs/ext4/namei.c | 37 ++- fs/ext4/resize.c | 2 + fs/gfs2/inode.c | 5 +- fs/lockd/svc.c | 4 +- fs/locks.c | 2 +- fs/namei.c | 33 +-- fs/nfs/blocklayout/blocklayout.c | 99 ++++--- fs/nfs/direct.c | 8 +- fs/nfs/filelayout/filelayout.c | 175 ++++++------- fs/nfs/internal.h | 10 +- fs/nfs/nfs3proc.c | 21 +- fs/nfs/nfs4_fs.h | 6 +- fs/nfs/nfs4client.c | 38 +-- fs/nfs/nfs4proc.c | 135 +++++----- fs/nfs/nfs4trace.h | 28 +- fs/nfs/objlayout/objio_osd.c | 24 +- fs/nfs/objlayout/objlayout.c | 81 +++--- fs/nfs/objlayout/objlayout.h | 8 +- fs/nfs/pagelist.c | 284 ++++++++++----------- fs/nfs/pnfs.c | 119 ++++----- fs/nfs/pnfs.h | 17 +- fs/nfs/proc.c | 27 +- fs/nfs/read.c | 48 ++-- fs/nfs/write.c | 99 +++---- fs/nfsd/nfs4xdr.c | 17 +- fs/nilfs2/inode.c | 7 +- fs/notify/fdinfo.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 18 +- fs/ufs/inode.c | 7 +- fs/ufs/namei.c | 14 +- include/acpi/acpi_bus.h | 1 + include/drm/ttm/ttm_bo_driver.h | 2 + include/linux/ccp.h | 12 + include/linux/ftrace.h | 13 +- include/linux/iio/trigger.h | 4 +- include/linux/nfs_page.h | 16 +- include/linux/nfs_xdr.h | 32 +-- include/linux/pci.h | 6 + include/linux/seqlock.h | 2 - include/linux/vga_switcheroo.h | 2 + include/linux/workqueue.h | 2 +- include/net/regulatory.h | 2 +- include/uapi/drm/radeon_drm.h | 1 + include/uapi/linux/xattr.h | 2 +- kernel/cgroup.c | 35 ++- kernel/events/core.c | 10 + kernel/futex.c | 1 + kernel/kcmp.c | 7 +- kernel/module.c | 5 + kernel/printk/printk.c | 6 +- kernel/time/alarmtimer.c | 34 ++- kernel/trace/ftrace.c | 190 +++++++++----- kernel/trace/ring_buffer.c | 16 +- mm/dmapool.c | 2 +- mm/memblock.c | 3 +- mm/memory.c | 2 +- mm/percpu-vm.c | 22 +- mm/percpu.c | 2 + mm/shmem.c | 4 +- mm/slab.c | 11 +- net/mac80211/mlme.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_tables_api.c | 3 + net/netfilter/xt_cgroup.c | 2 +- net/netfilter/xt_hashlimit.c | 31 +-- net/wireless/nl80211.c | 6 + sound/core/info.c | 4 +- sound/core/pcm_lib.c | 8 +- sound/firewire/amdtp.c | 11 +- sound/firewire/amdtp.h | 1 + sound/firewire/dice.c | 29 ++- sound/pci/hda/patch_conexant.c | 10 +- sound/pci/hda/patch_realtek.c | 2 + sound/pci/hda/patch_sigmatel.c | 17 +- sound/soc/davinci/davinci-mcasp.c | 11 +- 349 files changed, 3486 insertions(+), 1896 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/357 module: Clean up ro/nx after early module load failures
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit ff7e0055bb5ddbbb320cdd8dfd3e18672bddd2ad upstream.
The commit
4982223e51e8 module: set nx before marking module MODULE_STATE_COMING.
introduced a regression: if a module fails to parse its arguments or if mod_sysfs_setup fails, then the module's memory will be freed while still read-only. Anything that reuses that memory will crash as soon as it tries to write to it.
--- kernel/module.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/module.c +5 -0
@@ -3308,6 +3308,11 @@ static int load_module(struct load_infomutex_lock (&module_mutex);module_bug_cleanup (mod);mutex_unlock (&module_mutex); + +/* we can't deallocate the module until we clear memory protection */ +unset_module_init_ro_nx (mod); +unset_module_core_ro_nx (mod); + ddebug_cleanup:dynamic_debug_remove (info->debug);synchronize_sched ();
Greg Kroah-Hartman
maintainerPATCH 2/357 cpufreq: OPP: Avoid sleeping while atomic
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit 3c5445ce3a0c6d6935911212b735772af5115517 upstream.
We allocate the cpufreq table after calling rcu_read_lock(), which disables preemption. This causes scheduling while atomic warnings. Use GFP_ATOMIC instead of GFP_KERNEL and update for kcalloc while we're here.
BUG: sleeping function called from invalid context at mm/slub.c:1246
in_atomic(): 0, irqs_disabled(): 0, pid: 80, name: modprobe
5 locks held by modprobe/80:
#0: (&dev->mutex){......}, at: [<c050d484>] __driver_attach+0x48/0x98
#1: (&dev->mutex){......}, at: [<c050d494>] __driver_attach+0x58/0x98
#2: (subsys mutex#5){+.+.+.}, at: [<c050c114>] subsys_interface_register+0x38/0xc8
#3: (cpufreq_rwsem){.+.+.+}, at: [<c05a9c8c>] __cpufreq_add_dev.isra.22+0x84/0x92c
#4: (rcu_read_lock){......}, at: [<c05ab24c>] dev_pm_opp_init_cpufreq_table+0x18/0x10cPreemption disabled at:[< (null)>] (null)
CPU: 2 PID: 80 Comm: modprobe Not tainted 3.16.0-rc3-next-20140701-00035-g286857f216aa-dirty #217 [<c0214da8>] (unwind_backtrace) from [<c02123f8>] (show_stack+0x10/0x14) [<c02123f8>] (show_stack) from [<c070141c>] (dump_stack+0x70/0xbc) [<c070141c>] (dump_stack) from [<c02f4cb0>] (__kmalloc+0x124/0x250) [<c02f4cb0>] (__kmalloc) from [<c05ab270>] (dev_pm_opp_init_cpufreq_table+0x3c/0x10c) [<c05ab270>] (dev_pm_opp_init_cpufreq_table) from [<bf000508>] (cpufreq_init+0x48/0x378 [cpufreq_generic]) [<bf000508>] (cpufreq_init [cpufreq_generic]) from [<c05a9e08>] (__cpufreq_add_dev.isra.22+0x200/0x92c) [<c05a9e08>] (__cpufreq_add_dev.isra.22) from [<c050c160>] (subsys_interface_register+0x84/0xc8) [<c050c160>] (subsys_interface_register) from [<c05a9494>] (cpufreq_register_driver+0x108/0x2d8) [<c05a9494>] (cpufreq_register_driver) from [<bf000888>] (generic_cpufreq_probe+0x50/0x74 [cpufreq_generic]) [<bf000888>] (generic_cpufreq_probe [cpufreq_generic]) from [<c050e994>] (platform_drv_probe+0x18/0x48) [<c050e994>] (platform_drv_probe) from [<c050d1f4>] (driver_probe_device+0x128/0x370) [<c050d1f4>] (driver_probe_device) from [<c050d4d0>] (__driver_attach+0x94/0x98) [<c050d4d0>] (__driver_attach) from [<c050b778>] (bus_for_each_dev+0x54/0x88) [<c050b778>] (bus_for_each_dev) from [<c050c894>] (bus_add_driver+0xe8/0x204) [<c050c894>] (bus_add_driver) from [<c050dd48>] (driver_register+0x78/0xf4) [<c050dd48>] (driver_register) from [<c0208870>] (do_one_initcall+0xac/0x1d8) [<c0208870>] (do_one_initcall) from [<c028b6b4>] (load_module+0x190c/0x21e8) [<c028b6b4>] (load_module) from [<c028c034>] (SyS_init_module+0xa4/0x110) [<c028c034>] (SyS_init_module) from [<c020f0c0>] (ret_fast_syscall+0x0/0x48)
--- drivers/cpufreq/cpufreq_opp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cpufreq_opp.c +1 -1
@@ -60,7 +60,7 @@ int dev_pm_opp_init_cpufreq_table(struct goto out; } - freq_table =kzalloc (sizeof (*freq_table) * (max_opps +1 ),GFP_KERNEL ); + freq_table =kcalloc (sizeof (*freq_table), (max_opps +1 ),GFP_ATOMIC );if (!freq_table) { ret = -ENOMEM ; goto out;
Greg Kroah-Hartman
maintainerPATCH 3/357 carl9170: fix sending URBs with wrong type when using full-speed
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
The driver assumes that endpoint 4 is always an interrupt endpoint. Unfortunately the type differs between high-speed and full-speed configurations while in the former case it is indeed an interrupt endpoint this is not true for the latter case - here it is a bulk endpoint. When sending URBs with the wrong type the kernel will generate a warning message including backtrace. In this specific case there will be a huge amount of warnings which can bring the system to freeze.
To fix this we are now sending URBs to endpoint 4 using the type found in the endpoint descriptor.
A side note: The carl9170 firmware currently specifies endpoint 4 as interrupt endpoint even in the full-speed configuration but this has no relevance because before this firmware is loaded the endpoint type is as described above and after the firmware is running the stick is not reenumerated and so the old descriptor is used.
--- drivers/net/wireless/ath/carl9170/carl9170.h | 1 drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/carl9170/carl9170.h +1 -0
@@ -256,6 +256,7 @@ struct ar9170 {atomic_t rx_work_urbs;atomic_t rx_pool_urbs;kernel_ulong_t features; +bool usb_ep_cmd_is_bulk;/* firmware settings */ struct completion fw_load_wait;
drivers/net/wireless/ath/carl9170/usb.c +27 -4
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a goto err_free; } -usb_fill_int_urb (urb, ar->udev,usb_sndintpipe (ar->udev, -AR9170_USB_EP_CMD ), cmd, cmd->hdr.len +4 , - carl9170_usb_cmd_complete, ar,1 ); +if (ar->usb_ep_cmd_is_bulk) +usb_fill_bulk_urb (urb, ar->udev, +usb_sndbulkpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar); +else +usb_fill_int_urb (urb, ar->udev, +usb_sndintpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar,1 );if (free_buf) urb->transfer_flags |=URB_FREE_BUFFER ;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(static int carl9170_usb_probe (struct usb_interface *intf,const struct usb_device_id *id) { +struct usb_endpoint_descriptor *ep;struct ar9170 *ar;struct usb_device *udev; -int err; +int i, err; err =usb_reset_device (interface_to_usbdev (intf));if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb ar->intf = intf; ar->features = id->driver_info; +/* We need to remember the type of endpoint 4 because it differs +* between high- and full-speed configuration. The high-speed +* configuration specifies it as interrupt and the full-speed +* configuration as bulk endpoint. This information is required +* later when sending urbs to that endpoint. +*/ +for (i =0 ; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) { + ep = &intf->cur_altsetting->endpoint[i].desc; + +if (usb_endpoint_num (ep) ==AR9170_USB_EP_CMD && +usb_endpoint_dir_out (ep) && +usb_endpoint_type (ep) ==USB_ENDPOINT_XFER_BULK ) + ar->usb_ep_cmd_is_bulk = true; + } +usb_set_intfdata (intf, ar);SET_IEEE80211_DEV (ar->hw, &intf->dev);
Greg Kroah-Hartman
maintainerPATCH 4/357 drm/tegra: add MODULE_DEVICE_TABLEs
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <[email protected]>
commit ef70728c7a6571a1a7115031e932b811f1740b2e upstream.
When tegra-drm.ko is built as a module, these MODULE_DEVICE_TABLEs allow the module to be auto-loaded since the module will match the devices instantiated from device tree.
(Notes for stable: in 3.14+, just git rm any conflicting file, since they are added in later kernels. For 3.13 and below, manual merging will be needed)
--- drivers/gpu/drm/tegra/dc.c | 1 + drivers/gpu/drm/tegra/dpaux.c | 1 + drivers/gpu/drm/tegra/dsi.c | 1 + drivers/gpu/drm/tegra/gr2d.c | 1 + drivers/gpu/drm/tegra/gr3d.c | 1 + drivers/gpu/drm/tegra/hdmi.c | 1 + drivers/gpu/drm/tegra/sor.c | 1 + 7 files changed, 7 insertions(+)
drivers/gpu/drm/tegra/dc.c +1 -0
@@ -1303,6 +1303,7 @@ static const struct of_device_id tegra_d/* sentinel */ } }; +MODULE_DEVICE_TABLE (of, tegra_dc_of_match);static int tegra_dc_parse_dt (struct tegra_dc *dc) {
drivers/gpu/drm/tegra/dpaux.c +1 -0
@@ -382,6 +382,7 @@ static const struct of_device_id tegra_d { .compatible = "nvidia,tegra124-dpaux", }, { }, }; +MODULE_DEVICE_TABLE (of, tegra_dpaux_of_match);struct platform_driver tegra_dpaux_driver = { .driver = {
drivers/gpu/drm/tegra/dsi.c +1 -0
@@ -982,6 +982,7 @@ static const struct of_device_id tegra_d { .compatible = "nvidia,tegra114-dsi", }, { }, }; +MODULE_DEVICE_TABLE (of, tegra_dsi_of_match);struct platform_driver tegra_dsi_driver = { .driver = {
drivers/gpu/drm/tegra/gr2d.c +1 -0
@@ -121,6 +121,7 @@ static const struct of_device_id gr2d_ma { .compatible = "nvidia,tegra20-gr2d" }, { }, }; +MODULE_DEVICE_TABLE (of, gr2d_match);static const u32 gr2d_addr_regs[] = {GR2D_UA_BASE_ADDR ,
drivers/gpu/drm/tegra/gr3d.c +1 -0
@@ -130,6 +130,7 @@ static const struct of_device_id tegra_g { .compatible = "nvidia,tegra20-gr3d" }, { } }; +MODULE_DEVICE_TABLE (of, tegra_gr3d_match);static const u32 gr3d_addr_regs[] = {GR3D_IDX_ATTRIBUTE (0 ),
drivers/gpu/drm/tegra/hdmi.c +1 -0
@@ -1450,6 +1450,7 @@ static const struct of_device_id tegra_h { .compatible = "nvidia,tegra20-hdmi", .data = &tegra20_hdmi_config }, { }, }; +MODULE_DEVICE_TABLE (of, tegra_hdmi_of_match);static int tegra_hdmi_probe (struct platform_device *pdev) {
drivers/gpu/drm/tegra/sor.c +1 -0
@@ -1455,6 +1455,7 @@ static const struct of_device_id tegra_s { .compatible = "nvidia,tegra124-sor", }, { }, }; +MODULE_DEVICE_TABLE (of, tegra_sor_of_match);struct platform_driver tegra_sor_driver = { .driver = {
Greg Kroah-Hartman
maintainerPATCH 12/357 drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
list_empty(&_manager->pools) being false before taking _manager->lock does not guarantee that _manager->npools != 0 after taking _manager->lock because _manager->npools is updated under _manager->lock.
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -0
@@ -1015,6 +1015,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerreturn SHRINK_STOP ;mutex_lock (&_manager->lock); +if (!_manager->npools) + goto out; pool_offset = pool_offset % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
@@ -1034,6 +1036,7 @@ ttm_dma_pool_shrink_scan(struct shrinker p->pool->dev_name, p->pool->name, current->pid, nr_free, shrink_pages); } +out:mutex_unlock (&_manager->lock);return freed; }
Greg Kroah-Hartman
maintainerPATCH 13/357 drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
We can use "unsigned int" instead of "atomic_t" by updating start_pool variable under _manager->lock. This patch will make it possible to avoid skipping when choosing a pool to shrink in round-robin style, after next patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -3
@@ -1004,9 +1004,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);static unsigned long ttm_dma_pool_shrink_scan (struct shrinker *shrink,struct shrink_control *sc) { -static atomic_t start_pool =ATOMIC_INIT (0 ); +static unsigned start_pool;unsigned idx =0 ; -unsigned pool_offset =atomic_add_return (1 , &start_pool); +unsigned pool_offset;unsigned shrink_pages = sc->nr_to_scan;struct device_pools *p;unsigned long freed =0 ;
@@ -1017,7 +1017,7 @@ ttm_dma_pool_shrink_scan(struct shrinkermutex_lock (&_manager->lock);if (!_manager->npools) goto out; - pool_offset = pool_offset % _manager->npools; + pool_offset = ++start_pool % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
Greg Kroah-Hartman
maintainerPATCH 14/357 drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 22e71691fd54c637800d10816bbeba9cf132d218 upstream.
I can observe that RHEL7 environment stalls with 100% CPU usage when a certain type of memory pressure is given. While the shrinker functions are called by shrink_slab() before the OOM killer is triggered, the stall lasts for many minutes.
One of reasons of this stall is that ttm_dma_pool_shrink_count()/ttm_dma_pool_shrink_scan() are called and are blocked at mutex_lock(&_manager->lock). GFP_KERNEL allocation with _manager->lock held causes someone (including kswapd) to deadlock when these functions are called due to memory pressure. This patch changes "mutex_lock();" to "if (!mutex_trylock()) return ...;" in order to avoid deadlock.
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +4 -2
@@ -1014,7 +1014,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerif (list_empty (&_manager->pools))return SHRINK_STOP ; -mutex_lock (&_manager->lock); +if (!mutex_trylock (&_manager->lock)) +return SHRINK_STOP ;if (!_manager->npools) goto out; pool_offset = ++start_pool % _manager->npools;
@@ -1047,7 +1048,8 @@ ttm_dma_pool_shrink_count(struct shrinkestruct device_pools *p;unsigned long count =0 ; -mutex_lock (&_manager->lock); +if (!mutex_trylock (&_manager->lock)) +return 0 ;list_for_each_entry (p, &_manager->pools, pools) count += p->pool->npages_free;mutex_unlock (&_manager->lock);
Greg Kroah-Hartman
maintainerPATCH 15/357 drm/ttm: Fix possible stack overflow by recursive shrinker calls.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 71336e011d1d2312bcbcaa8fcec7365024f3a95d upstream.
While ttm_dma_pool_shrink_scan() tries to take mutex before doing GFP_KERNEL allocation, ttm_pool_shrink_scan() does not do it. This can result in stack overflow if kmalloc() in ttm_page_pool_free() triggered recursion due to memory pressure.
shrink_slab()
=> ttm_pool_shrink_scan()
=> ttm_page_pool_free()
=> kmalloc(GFP_KERNEL)
=> shrink_slab()
=> ttm_pool_shrink_scan()
=> ttm_page_pool_free()
=> kmalloc(GFP_KERNEL)Change ttm_pool_shrink_scan() to do like ttm_dma_pool_shrink_scan() does.
--- drivers/gpu/drm/ttm/ttm_page_alloc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc.c +7 -3
@@ -391,14 +391,17 @@ out:static unsigned long ttm_pool_shrink_scan (struct shrinker *shrink,struct shrink_control *sc) { -static atomic_t start_pool =ATOMIC_INIT (0 ); +static DEFINE_MUTEX (lock); +static unsigned start_pool;unsigned i; -unsigned pool_offset =atomic_add_return (1 , &start_pool); +unsigned pool_offset;struct ttm_page_pool *pool;int shrink_pages = sc->nr_to_scan;unsigned long freed =0 ; - pool_offset = pool_offset %NUM_POOLS ; +if (!mutex_trylock (&lock)) +return SHRINK_STOP ; + pool_offset = ++start_pool %NUM_POOLS ;/* select start pool in round robin fashion */ for (i =0 ; i <NUM_POOLS ; ++i) {unsigned nr_free = shrink_pages;
@@ -408,6 +411,7 @@ ttm_pool_shrink_scan(struct shrinker *sh shrink_pages =ttm_page_pool_free (pool, nr_free); freed += nr_free - shrink_pages; } +mutex_unlock (&lock);return freed; }
Greg Kroah-Hartman
maintainerPATCH 16/357 drm/ttm: Pass GFP flags in order to avoid deadlock.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit a91576d7916f6cce76d30303e60e1ac47cf4a76d upstream.
Commit 7dc19d5a "drivers: convert shrinkers to new count/scan API" added deadlock warnings that ttm_page_pool_free() and ttm_dma_page_pool_free() are currently doing GFP_KERNEL allocation.
But these functions did not get updated to receive gfp_t argument. This patch explicitly passes sc->gfp_mask or GFP_KERNEL to these functions, and removes the deadlock warning.
--- drivers/gpu/drm/ttm/ttm_page_alloc.c | 19 ++++++++++--------- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 19 +++++++++---------- 2 files changed, 19 insertions(+), 19 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc.c +10 -9
@@ -297,8 +297,10 @@ static void ttm_pool_update_free_locked(* * @pool: to free the pages from * @free_all: If set to true will free all pages in pool +* @gfp: GFP flags. **/ -static int ttm_page_pool_free (struct ttm_page_pool *pool,unsigned nr_free) +static int ttm_page_pool_free (struct ttm_page_pool *pool,unsigned nr_free, +gfp_t gfp) {unsigned long irq_flags;struct page *p;
@@ -309,8 +311,7 @@ static int ttm_page_pool_free(struct ttmif (NUM_PAGES_TO_ALLOC < nr_free) npages_to_free =NUM_PAGES_TO_ALLOC ; - pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), -GFP_KERNEL ); + pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), gfp);if (!pages_to_free) {pr_err ("Failed to allocate memory for pool free operation\n" );return 0 ;
@@ -382,9 +383,7 @@ out:* * XXX: (dchinner) Deadlock warning! * -* ttm_page_pool_free() does memory allocation using GFP_KERNEL. that means -* this can deadlock when called a sc->gfp_mask that is not equal to -* GFP_KERNEL. +* We need to pass sc->gfp_mask to ttm_page_pool_free(). * * This code is crying out for a shrinker per pool.... */
@@ -408,7 +407,8 @@ ttm_pool_shrink_scan(struct shrinker *shif (shrink_pages ==0 )break ; pool = &_manager->pools[(i + pool_offset)%NUM_POOLS ]; - shrink_pages =ttm_page_pool_free (pool, nr_free); + shrink_pages =ttm_page_pool_free (pool, nr_free, + sc->gfp_mask); freed += nr_free - shrink_pages; }mutex_unlock (&lock);
@@ -710,7 +710,7 @@ static void ttm_put_pages(struct page ** }spin_unlock_irqrestore (&pool->lock, irq_flags);if (npages) -ttm_page_pool_free (pool, npages); +ttm_page_pool_free (pool, npages,GFP_KERNEL ); }/*
@@ -850,7 +850,8 @@ void ttm_page_alloc_fini(void)ttm_pool_mm_shrink_fini (_manager);for (i =0 ; i <NUM_POOLS ; ++i) -ttm_page_pool_free (&_manager->pools[i],FREE_ALL_PAGES ); +ttm_page_pool_free (&_manager->pools[i],FREE_ALL_PAGES , +GFP_KERNEL );kobject_put (&_manager->kobj); _manager =NULL ;
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +9 -10
@@ -411,8 +411,10 @@ static void ttm_dma_page_put(struct dma_* * @pool: to free the pages from * @nr_free: If set to true will free all pages in pool +* @gfp: GFP flags. **/ -static unsigned ttm_dma_page_pool_free (struct dma_pool *pool,unsigned nr_free) +static unsigned ttm_dma_page_pool_free (struct dma_pool *pool,unsigned nr_free, +gfp_t gfp) {unsigned long irq_flags;struct dma_page *dma_p, *tmp;
@@ -430,8 +432,7 @@ static unsigned ttm_dma_page_pool_free(s npages_to_free, nr_free); }#endif - pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), -GFP_KERNEL ); + pages_to_free =kmalloc (npages_to_free *sizeof (struct page *), gfp);if (!pages_to_free) { pr_err("%s: Failed to allocate memory for pool free operation\n",
@@ -530,7 +531,7 @@ static void ttm_dma_free_pool(struct devif (pool->type != type)continue ;/* Takes a spinlock.. */ -ttm_dma_page_pool_free (pool,FREE_ALL_PAGES ); +ttm_dma_page_pool_free (pool,FREE_ALL_PAGES ,GFP_KERNEL );WARN_ON (((pool->npages_in_use + pool->npages_free) !=0 ));/* This code path is called after _all_ references to the * struct device has been dropped - so nobody should be
@@ -983,7 +984,7 @@ void ttm_dma_unpopulate(struct ttm_dma_t/* shrink pool if necessary (only on !is_cached pools)*/ if (npages) -ttm_dma_page_pool_free (pool, npages); +ttm_dma_page_pool_free (pool, npages,GFP_KERNEL ); ttm->state = tt_unpopulated; }EXPORT_SYMBOL_GPL (ttm_dma_unpopulate);
@@ -993,10 +994,7 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);* * XXX: (dchinner) Deadlock warning! * -* ttm_dma_page_pool_free() does GFP_KERNEL memory allocation, and so attention -* needs to be paid to sc->gfp_mask to determine if this can be done or not. -* GFP_KERNEL memory allocation in a GFP_ATOMIC reclaim context woul dbe really -* bad. +* We need to pass sc->gfp_mask to ttm_dma_page_pool_free(). * * I'm getting sadder as I hear more pathetical whimpers about needing per-pool * shrinkers
@@ -1030,7 +1028,8 @@ ttm_dma_pool_shrink_scan(struct shrinkerif (++idx < pool_offset)continue ; nr_free = shrink_pages; - shrink_pages =ttm_dma_page_pool_free (p->pool, nr_free); + shrink_pages =ttm_dma_page_pool_free (p->pool, nr_free, + sc->gfp_mask); freed += nr_free - shrink_pages; pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
Greg Kroah-Hartman
maintainerPATCH 17/357 drm/radeon/dpm: handle voltage info fetching on hawaii
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 6b57f20cb5b708415fbab63847f8f8429b051af8 upstream.
Some hawaii cards use a different method to fetch the voltage info from the vbios.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=74250
--- drivers/gpu/drm/radeon/ci_dpm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/ci_dpm.c +12 -1
@@ -940,7 +940,18 @@ static void ci_get_leakage_voltages(stru pi->vddc_leakage.count =0 ; pi->vddci_leakage.count =0 ; -if (radeon_atom_get_leakage_id_from_vbios (rdev, &leakage_id) ==0 ) { +if (rdev->pm.dpm.platform_caps &ATOM_PP_PLATFORM_CAP_EVV ) { +for (i =0 ; i <CISLANDS_MAX_LEAKAGE_COUNT ; i++) { + virtual_voltage_id =ATOM_VIRTUAL_VOLTAGE_ID0 + i; +if (radeon_atom_get_voltage_evv (rdev, virtual_voltage_id, &vddc) !=0 ) +continue ; +if (vddc !=0 && vddc != virtual_voltage_id) { + pi->vddc_leakage.actual_voltage[pi->vddc_leakage.count] = vddc; + pi->vddc_leakage.leakage_id[pi->vddc_leakage.count] = virtual_voltage_id; + pi->vddc_leakage.count++; + } + } + }else if (radeon_atom_get_leakage_id_from_vbios (rdev, &leakage_id) ==0 ) {for (i =0 ; i <CISLANDS_MAX_LEAKAGE_COUNT ; i++) { virtual_voltage_id =ATOM_VIRTUAL_VOLTAGE_ID0 + i; if (radeon_atom_get_leakage_vddc_based_on_leakage_params(rdev, &vddc, &vddci,
Greg Kroah-Hartman
maintainerPATCH 18/357 drm/radeon: re-enable dpm by default on cayman
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8f500af4efe347d1a8ac674d115220e8caa84559 upstream.
This patch depends on:b0880e87c1fd038b84498944f52e52c3e86ebe59
(drm/radeon/dpm: fix vddci setup typo on cayman)
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=69723
--- drivers/gpu/drm/radeon/radeon_pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_pm.c +1 -1
@@ -1306,7 +1306,6 @@ int radeon_pm_init(struct radeon_devicecase CHIP_BARTS :case CHIP_TURKS :case CHIP_CAICOS : -case CHIP_CAYMAN :/* DPM requires the RLC, RV770+ dGPU requires SMC */ if (!rdev->rlc_fw) rdev->pm.pm_method =PM_METHOD_PROFILE ;
@@ -1330,6 +1329,7 @@ int radeon_pm_init(struct radeon_devicecase CHIP_PALM :case CHIP_SUMO :case CHIP_SUMO2 : +case CHIP_CAYMAN :case CHIP_ARUBA :case CHIP_TAHITI :case CHIP_PITCAIRN :
Greg Kroah-Hartman
maintainerPATCH 19/357 drm/radeon: re-enable dpm by default on BTC
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c08abf11900e19b14dd3a0cc3d105bd74519cd18 upstream.
This patch depends on:e07929810f0a19ddd756558290c7d72827cbfcd9 (drm/radeon/dpm: fix typo in vddci setup for eg/btc)
bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=73053
https://bugzilla.kernel.org/show_bug.cgi?id=68571
--- drivers/gpu/drm/radeon/radeon_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/radeon_pm.c +3 -3
@@ -1303,9 +1303,6 @@ int radeon_pm_init(struct radeon_devicecase CHIP_RS780 :case CHIP_RS880 :case CHIP_RV770 : -case CHIP_BARTS : -case CHIP_TURKS : -case CHIP_CAICOS :/* DPM requires the RLC, RV770+ dGPU requires SMC */ if (!rdev->rlc_fw) rdev->pm.pm_method =PM_METHOD_PROFILE ;
@@ -1329,6 +1326,9 @@ int radeon_pm_init(struct radeon_devicecase CHIP_PALM :case CHIP_SUMO :case CHIP_SUMO2 : +case CHIP_BARTS : +case CHIP_TURKS : +case CHIP_CAICOS :case CHIP_CAYMAN :case CHIP_ARUBA :case CHIP_TAHITI :
Greg Kroah-Hartman
maintainerPATCH 20/357 drm/radeon: load the lm63 driver for an lm64 thermal chip.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
Looks like the lm63 driver supports the lm64 as well.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +2 -2
@@ -1963,7 +1963,7 @@ static const char *thermal_controller_na"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" , "asc7xxx", };
@@ -1974,7 +1974,7 @@ static const char *pp_lib_thermal_contro"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" ,"RV6xx" , "RV770",
Greg Kroah-Hartman
maintainerPATCH 22/357 drm/radeon/atom: add new voltage fetch function for hawaii
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e9f274b2a1bd4ecc569b823b1e7942e9bf92593e upstream.
Some hawaii boards use a different method for fetching the voltage information from the vbios.
--- drivers/gpu/drm/radeon/radeon.h | 3 ++ drivers/gpu/drm/radeon/radeon_atombios.c | 35 +++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+)
drivers/gpu/drm/radeon/radeon.h +3 -0
@@ -304,6 +304,9 @@ int radeon_atom_get_leakage_vddc_based_o u16 *vddc, u16 *vddci, u16 virtual_voltage_id, u16 vbios_voltage_id); +int radeon_atom_get_voltage_evv (struct radeon_device *rdev, +u16 virtual_voltage_id, +u16 *voltage); int radeon_atom_round_to_true_voltage(struct radeon_device *rdev, u8 voltage_type, u16 nominal_voltage,
drivers/gpu/drm/radeon/radeon_atombios.c +35 -0
@@ -3236,6 +3236,41 @@ int radeon_atom_get_leakage_vddc_based_oreturn 0 ; } +union get_voltage_info { +struct _GET_VOLTAGE_INFO_INPUT_PARAMETER_V1_2 in; +struct _GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 evv_out; +}; + +int radeon_atom_get_voltage_evv (struct radeon_device *rdev, +u16 virtual_voltage_id, +u16 *voltage) +{ +int index =GetIndexIntoMasterTable (COMMAND , GetVoltageInfo); +u32 entry_id; +u32 count = rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.count; +union get_voltage_info args; + +for (entry_id =0 ; entry_id < count; entry_id++) { +if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].v == + virtual_voltage_id) +break ; + } + +if (entry_id >= count) +return -EINVAL ; + + args.in.ucVoltageType =VOLTAGE_TYPE_VDDC ; + args.in.ucVoltageMode =ATOM_GET_VOLTAGE_EVV_VOLTAGE ; + args.in.ulSCLKFreq = +cpu_to_le32 (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk); + +atom_execute_table (rdev->mode_info.atom_context, index, (uint32_t *)&args); + + *voltage =le16_to_cpu (args.evv_out.usVoltageLevel); + +return 0 ; +} +int radeon_atom_get_voltage_gpio_settings (struct radeon_device *rdev,u16 voltage_level,u8 voltage_type,u32 *gpio_value,u32 *gpio_mask)
Greg Kroah-Hartman
maintainerPATCH 23/357 drm/radeon: tweak ACCEL_WORKING2 query for hawaii
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 3c64bd26f7e9bd589ebe0d1ebec69ef2f784c12d upstream.
Return 2 so we can be sure the kernel has the necessary changes for acceleration to work.
Note: This patch depends on these two commits:
- drm/radeon: fix cut and paste issue for hawaii.
- drm/radeon: use packet2 for nop on hawaii with old firmware
--- drivers/gpu/drm/radeon/radeon_kms.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_kms.c +8 -1
@@ -254,7 +254,14 @@ static int radeon_info_ioctl(struct drm_ }break ;case RADEON_INFO_ACCEL_WORKING2 : - *value = rdev->accel_working; +if (rdev->family ==CHIP_HAWAII ) { +if (rdev->accel_working) + *value =2 ; +else + *value =0 ; + }else { + *value = rdev->accel_working; + }break ;case RADEON_INFO_TILING_CONFIG :if (rdev->family >=CHIP_BONAIRE )
Greg Kroah-Hartman
maintainerPATCH 24/357 drm/i915: Fix crash when failing to parse MIPI VBT
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Barbalho <[email protected]>
commit ed3b6679936801fa2dab47e7a6ef74e383400ed9 upstream.
This particular nasty presented itself while trying to register the intelfb device (intel_fbdev.c). During the process of registering the device the driver will disable the crtc via i9xx_crtc_disable. These will also disable the panel using the generic mipi panel functions in dsi_mod_vbt_generic.c. The stale MIPI generic data sequence pointers would cause a crash within those functions. However, all of this is happening while console_lock is held from do_register_framebuffer inside fbcon.c. Which means that you got kernel log and just the device appearing to reboot/hang for no apparent reason.
The fault started from the FB_EVENT_FB_REGISTERED event using the fb_notifier_call_chain call in fbcon.c.
This regression has been introduced in
commit d3b542fcfc72d7724585e3fd2c5e75351bc3df47
Author: Shobhit Kumar <[email protected]> Date: Mon Apr 14 11:00:34 2014 +0530
drm/i915: Add parsing support for new MIPI blocks in VBT
--- drivers/gpu/drm/i915/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_bios.c +1 -1
@@ -877,7 +877,7 @@ err:/* error during parsing so set all pointers to null * because of partial parsing */ -memset (dev_priv->vbt.dsi.sequence,0 ,MIPI_SEQ_MAX ); +memset (dev_priv->vbt.dsi.sequence,0 ,sizeof (dev_priv->vbt.dsi.sequence)); } static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
Greg Kroah-Hartman
maintainerPATCH 25/357 drm/i915: read HEAD register back in init_ring_common() to enforce ordering
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit ece4a17d237a79f63fbfaf3f724a12b6d500555c upstream.
Withtout this, ring initialization fails reliabily during resume with
[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head ffffff8804 tail 00000000 start 000e4000
This is not a complete fix, but it is verified to make the ring initialization failures during resume much less likely.
We were not able to root-cause this bug (likely HW-specific to Gen4 chips) yet. This is therefore used as a ducttape before problem is fully understood and proper fix created, so that people don't suffer from completely unusable systems in the meantime.
The discussion and debugging is happening at
https://bugs.freedesktop.org/show_bug.cgi?id=76554
--- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/i915/intel_ringbuffer.c +3 -0
@@ -517,6 +517,9 @@ static int init_ring_common(struct intelelse ring_setup_phys_status_page (ring); +/* Enforce ordering by reading HEAD register back */ +I915_READ_HEAD (ring); +/* Initialize the ring. This must happen _after_ we've cleared the ring * registers with the above sequence (the readback of the HEAD registers * also enforces ordering), otherwise the hw might lose the new ring
Greg Kroah-Hartman
maintainerPATCH 26/357 drm/i915: Disable RCS flips on Ivybridge
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 2a92d5bca1999b69c78f3c3e97b5484985b094b9 upstream.
We currently see random GPU hangs when using RCS flips with multiple pipes on Ivybridge. Now that we have mmio flips, we can fairly cheaply fallback to using CPU driven flips instead.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77104
--- drivers/gpu/drm/i915/intel_display.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/i915/intel_display.c +2 -0
@@ -9294,6 +9294,8 @@ static int intel_crtc_page_flip(struct dif (IS_VALLEYVIEW (dev)) { ring = &dev_priv->ring[BCS ]; + }else if (IS_IVYBRIDGE (dev)) { + ring = &dev_priv->ring[BCS ]; }else if (INTEL_INFO (dev)->gen >=7 ) { ring = obj->ring;if (ring ==NULL || ring->id !=RCS )
Greg Kroah-Hartman
maintainerPATCH 27/357 of: Allow mem_reserve of memory with a base address of zero
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Cooper <[email protected]>
commit b5f2a8c02697c3685ccbbb66495465742ffa0dc1 upstream.
__reserved_mem_reserve_reg() won't reserve memory if the base address is zero. This change removes the check for a base address of zero and allows it to be reserved.
Allowing the first 4K of memory to be reserved will help solve a problem on some ARM systems where the the first 16K of memory is unused and becomes allocable memory. This will prevent this memory from being used for DMA by drivers like the USB OHCI driver which consider a physical address of zero to be illegal.
--- drivers/of/fdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/fdt.c +1 -1
@@ -453,7 +453,7 @@ static int __init __reserved_mem_reserve base =dt_mem_next_cell (dt_root_addr_cells, &prop); size =dt_mem_next_cell (dt_root_size_cells, &prop); -if (base && size && +if (size &&early_init_dt_reserve_memory_arch (base, size, nomap) ==0 )pr_debug ("Reserved memory: reserved region for node '%s': base %pa, size %ld MiB\n" , uname, &base, (unsigned long )size /SZ_1M );
Greg Kroah-Hartman
maintainerPATCH 28/357 of/irq: Fix lookup to use interrupts-extended property first
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit a9ecdc0fdc54aa499604dbd43132988effcac9b4 upstream.
In case the Device Tree blob passed by the boot agent supplies both an 'interrupts-extended' and an 'interrupts' property in order to allow for older kernels to be usable, prefer the new-style 'interrupts-extended' property which conveys a lot more information.
This allows us to have bootloaders willingly maintaining backwards compatibility with older kernels without entirely deprecating the 'interrupts' property.
Update the bindings documentation to describe a situation where both the 'interrupts-extended' and the 'interrupts' property are present, and which one takes precedence over the other.
--- Documentation/devicetree/bindings/interrupt-controller/interrupts.txt | 12 ++++--- drivers/of/irq.c | 17 +++++----- 2 files changed, 16 insertions(+), 13 deletions(-)
Documentation/devicetree/bindings/interrupt-controller/interrupts.txt +7 -5
@@ -4,11 +4,13 @@ Specifying interrupt information for dev 1) Interrupt client nodes ------------------------- -Nodes that describe devices which generate interrupts must contain an either an -"interrupts" property or an "interrupts-extended" property. These properties -contain a list of interrupt specifiers, one per output interrupt. The format of -the interrupt specifier is determined by the interrupt controller to which the -interrupts are routed; see section 2 below for details. +Nodes that describe devices which generate interrupts must contain an +"interrupts" property, an "interrupts-extended" property, or both. If both are +present, the latter should take precedence; the former may be provided simply +for compatibility with software that does not recognize the latter. These +properties contain a list of interrupt specifiers, one per output interrupt. The +format of the interrupt specifier is determined by the interrupt controller to +which the interrupts are routed; see section 2 below for details. Example: interrupt-parent = <&intc1>;
drivers/of/irq.c +9 -8
@@ -301,16 +301,17 @@ int of_irq_parse_one(struct device_node/* Get the reg property (if any) */ addr =of_get_property (device,"reg" ,NULL ); +/* Try the new-style interrupts-extended first */ + res =of_parse_phandle_with_args (device,"interrupts-extended" , +"#interrupt-cells" , index, out_irq); +if (!res) +return of_irq_parse_raw (addr, out_irq); +/* Get the interrupts property */ intspec =of_get_property (device,"interrupts" , &intlen); -if (intspec ==NULL ) { -/* Try the new-style interrupts-extended */ - res =of_parse_phandle_with_args (device,"interrupts-extended" , -"#interrupt-cells" , index, out_irq); -if (res) -return -EINVAL ; -return of_irq_parse_raw (addr, out_irq); - } +if (intspec ==NULL ) +return -EINVAL ; + intlen /=sizeof (*intspec);pr_debug (" intspec=%d intlen=%d\n" ,be32_to_cpup (intspec), intlen);
Greg Kroah-Hartman
maintainerPATCH 29/357 libata: widen Crucial M550 blacklist matching
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 2a13772a144d2956a7fedd18685921d0a9b8b783 upstream.
Crucial M550 may cause data corruption on queued trims and is blacklisted. The pattern used for it fails to match 1TB one as the capacity section will be four chars instead of three. Widen the pattern.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81071
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -4227,7 +4227,7 @@ static const struct ata_blacklist_entry { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },/* * Some WD SATA-I drives spin up and down erratically when the link
Greg Kroah-Hartman
maintainerPATCH 30/357 pata_scc: propagate return value of scc_wait_after_reset
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arjun Sreedharan <[email protected]>
commit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.
scc_bus_softreset not necessarily should return zero. Propagate the error code.
--- drivers/ata/pata_scc.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/ata/pata_scc.c +7 -8
@@ -585,7 +585,7 @@ static int scc_wait_after_reset(struct a* Note: Original code is ata_bus_softreset(). */ -static unsigned int scc_bus_softreset (struct ata_port *ap,unsigned int devmask, +static int scc_bus_softreset (struct ata_port *ap,unsigned int devmask,unsigned long deadline) {struct ata_ioports *ioaddr = &ap->ioaddr;
@@ -599,9 +599,7 @@ static unsigned int scc_bus_softreset(studelay (20 );out_be32 (ioaddr->ctl_addr, ap->ctl); -scc_wait_after_reset (&ap->link, devmask, deadline); - -return 0 ; +return scc_wait_after_reset (&ap->link, devmask, deadline); }/**
@@ -618,7 +616,8 @@ static int scc_softreset(struct ata_link {struct ata_port *ap = link->ap;unsigned int slave_possible = ap->flags &ATA_FLAG_SLAVE_POSS ; -unsigned int devmask =0 , err_mask; +unsigned int devmask =0 ; +int rc;u8 err;DPRINTK ("ENTER\n" );
@@ -634,9 +633,9 @@ static int scc_softreset(struct ata_link/* issue bus reset */ DPRINTK ("about to softreset, devmask=%x\n" , devmask); - err_mask =scc_bus_softreset (ap, devmask, deadline); -if (err_mask) { -ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , err_mask); + rc =scc_bus_softreset (ap, devmask, deadline); +if (rc) { +ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , rc);return -EIO ; }
Greg Kroah-Hartman
maintainerPATCH 31/357 ahci: Add Device IDs for Intel 9 Series PCH
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <[email protected]>
commit 1b071a0947dbce5c184c12262e02540fbc493457 upstream.
This patch adds the AHCI mode SATA Device IDs for the Intel 9 Series PCH.
--- drivers/ata/ahci.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ahci.c +8 -0
@@ -305,6 +305,14 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID *//* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
Greg Kroah-Hartman
maintainerPATCH 32/357 ahci: add pcid for Marvel 0x9182 controller
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murali Karicheri <[email protected]>
commit c5edfff9db6f4d2c35c802acb4abe0df178becee upstream.
Keystone K2E EVM uses Marvel 0x9182 controller. This requires support for the ID in the ahci driver.
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -450,6 +450,8 @@ static const struct pci_device_id ahci_p { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172), + .driver_data = board_ahci_yes_fbs }, /* 88se9182 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
Greg Kroah-Hartman
maintainerPATCH 33/357 pwm: Fix period and polarity in pwm_get() for non-perfect matches
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit d717ea73e36dd5659640fae82605ad85c4117f4d upstream.
If pwm_get() finds a look-up entry with a perfect match (both dev_id and con_id match), the loop is aborted, and "p" still points to the correct struct pwm_lookup.
If only an entry with a matching dev_id or con_id is found, the loop terminates after traversing the whole list, and "p" now points to arbitrary memory, not part of the pwm_lookup list.
Then pwm_set_period() and pwm_set_polarity() will set random values for period resp. polarity.
To fix this, save period and polarity when finding a new best match, just like is done for chip (for the provider) and index.
This fixes the LCD backlight on r8a7740/armadillo-legacy, which was fed period 0 and polarity -1068821144 instead of 33333 resp. 1.
--- drivers/pwm/core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pwm/core.c +6 -2
@@ -606,6 +606,8 @@ struct pwm_device *pwm_get(struct deviceunsigned int best =0 ;struct pwm_lookup *p;unsigned int match; +unsigned int period; +enum pwm_polarity polarity;/* look up via DT first */ if (IS_ENABLED (CONFIG_OF ) && dev && dev->of_node)
@@ -653,6 +655,8 @@ struct pwm_device *pwm_get(struct deviceif (match > best) { chip =pwmchip_find_by_name (p->provider); index = p->index; + period = p->period; + polarity = p->polarity;if (match !=3 ) best = match;
@@ -668,8 +672,8 @@ struct pwm_device *pwm_get(struct deviceif (IS_ERR (pwm))return pwm; -pwm_set_period (pwm, p->period); -pwm_set_polarity (pwm, p->polarity); +pwm_set_period (pwm, period); +pwm_set_polarity (pwm, polarity);return pwm;
Greg Kroah-Hartman
maintainerPATCH 34/357 ibmveth: Fix endian issues with rx_no_buffer statistic
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.
Hidden away in the last 8 bytes of the buffer_list page is a solitary statistic. It needs to be byte swapped or else ethtool -S will produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a comment explaining what is going on.
--- drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +14 -4
@@ -292,6 +292,18 @@ failure:atomic_add (buffers_added, &(pool->available)); } +/* +* The final 8 bytes of the buffer list is a counter of frames dropped +* because there was not a buffer in the buffer list capable of holding +* the frame. +*/ +static void ibmveth_update_rx_no_buffer (struct ibmveth_adapter *adapter) +{ +__be64 *p = adapter->buffer_list_addr +4096 -8 ; + + adapter->rx_no_buffer =be64_to_cpup (p); +} +/* replenish routine */ static void ibmveth_replenish_task (struct ibmveth_adapter *adapter) {
@@ -307,8 +319,7 @@ static void ibmveth_replenish_task(strucibmveth_replenish_buffer_pool (adapter, pool); } - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter); }/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -698,8 +709,7 @@ static int ibmveth_close(struct net_devifree_irq (netdev->irq, netdev); - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter);ibmveth_cleanup (adapter);
Greg Kroah-Hartman
maintainerPATCH 35/357 aio: fix reqs_available handling
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin LaHaise <[email protected]>
commit d856f32a86b2b015ab180ab7a55e455ed8d3ccc5 upstream.
As reported by Dan Aloni, commit f8567a3845ac ("aio: fix aio request leak when events are reaped by userspace") introduces a regression when user code attempts to perform io_submit() with more events than are available in the ring buffer. Reverting that commit would reintroduce a regression when user space event reaping is used.
Fixing this bug is a bit more involved than the previous attempts to fix this regression. Since we do not have a single point at which we can count events as being reaped by user space and io_getevents(), we have to track event completion by looking at the number of events left in the event ring. So long as there are as many events in the ring buffer as there have been completion events generate, we cannot call put_reqs_available(). The code to check for this is now placed in refill_reqs_available().
A test program from Dan and modified by me for verifying this bug is available at http://www.kvack.org/~bcrl/20140824-aio_bug.c .
--- fs/aio.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 4 deletions(-)
fs/aio.c +73 -4
@@ -141,6 +141,7 @@ struct kioctx {struct {unsigned tail; +unsigned completed_events;spinlock_t completion_lock; }____cacheline_aligned_in_smp ;
@@ -880,6 +881,68 @@ out:return ret; } +/* refill_reqs_available +* Updates the reqs_available reference counts used for tracking the +* number of free slots in the completion ring. This can be called +* from aio_complete() (to optimistically update reqs_available) or +* from aio_get_req() (the we're out of events case). It must be +* called holding ctx->completion_lock. +*/ +static void refill_reqs_available (struct kioctx *ctx,unsigned head, +unsigned tail) +{ +unsigned events_in_ring, completed; + +/* Clamp head since userland can write to it. */ + head %= ctx->nr_events; +if (head <= tail) + events_in_ring = tail - head; +else + events_in_ring = ctx->nr_events - (head - tail); + + completed = ctx->completed_events; +if (events_in_ring < completed) + completed -= events_in_ring; +else + completed =0 ; + +if (!completed) +return ; + + ctx->completed_events -= completed; +put_reqs_available (ctx, completed); +} + +/* user_refill_reqs_available +* Called to refill reqs_available when aio_get_req() encounters an +* out of space in the completion ring. +*/ +static void user_refill_reqs_available (struct kioctx *ctx) +{ +spin_lock_irq (&ctx->completion_lock); +if (ctx->completed_events) { +struct aio_ring *ring; +unsigned head; + +/* Access of ring->head may race with aio_read_events_ring() +* here, but that's okay since whether we read the old version +* or the new version, and either will be valid. The important +* part is that head cannot pass tail since we prevent +* aio_complete() from updating tail by holding +* ctx->completion_lock. Even if head is invalid, the check +* against ctx->completed_events below will make sure we do the +* safe/right thing. +*/ + ring =kmap_atomic (ctx->ring_pages[0 ]); + head = ring->head; +kunmap_atomic (ring); + +refill_reqs_available (ctx, head, ctx->tail); + } + +spin_unlock_irq (&ctx->completion_lock); +} +/* aio_get_req * Allocate a slot for an aio request. * Returns NULL if no requests are free.
@@ -888,8 +951,11 @@ static inline struct kiocb *aio_get_req( {struct kiocb *req; -if (!get_reqs_available (ctx)) -return NULL ; +if (!get_reqs_available (ctx)) { +user_refill_reqs_available (ctx); +if (!get_reqs_available (ctx)) +return NULL ; + } req =kmem_cache_alloc (kiocb_cachep,GFP_KERNEL |__GFP_ZERO);if (unlikely (!req))
@@ -948,8 +1014,8 @@ void aio_complete(struct kiocb *iocb, lostruct kioctx *ctx = iocb->ki_ctx;struct aio_ring *ring;struct io_event *ev_page, *event; +unsigned tail, pos, head;unsigned long flags; -unsigned tail, pos;/* * Special case handling for sync iocbs:
@@ -1010,10 +1076,14 @@ void aio_complete(struct kiocb *iocb, lo ctx->tail = tail; ring =kmap_atomic (ctx->ring_pages[0 ]); + head = ring->head; ring->tail = tail;kunmap_atomic (ring);flush_dcache_page (ctx->ring_pages[0 ]); + ctx->completed_events++; +if (ctx->completed_events >1 ) +refill_reqs_available (ctx, head, tail);spin_unlock_irqrestore (&ctx->completion_lock, flags);pr_debug ("added to ring %p at [%u]\n" , iocb, tail);
@@ -1028,7 +1098,6 @@ void aio_complete(struct kiocb *iocb, lo/* everything turned out well, dispose of the aiocb. */ kiocb_free (iocb); -put_reqs_available (ctx,1 );/* * We have to order our ring_info tail store above and test
Greg Kroah-Hartman
maintainerPATCH 36/357 aio: add missing smp_rmb() in read_events_ring
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Moyer <[email protected]>
commit 2ff396be602f10b5eab8e73b24f20348fa2de159 upstream.
We ran into a case on ppc64 running mariadb where io_getevents would return zeroed out I/O events. After adding instrumentation, it became clear that there was some missing synchronization between reading the tail pointer and the events themselves. This small patch fixes the problem in testing.
Thanks to Zach for helping to look into this, and suggesting the fix.
--- fs/aio.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/aio.c +6 -0
@@ -1134,6 +1134,12 @@ static long aio_read_events_ring(struct tail = ring->tail;kunmap_atomic (ring); +/* +* Ensure that once we've read the current tail pointer, that +* we also see the events that were stored up to the tail. +*/ +smp_rmb (); +pr_debug ("h%u t%u m%u\n" , head, tail, ctx->nr_events);if (head == tail)
Greg Kroah-Hartman
maintainerPATCH 37/357 ARM: imx: fix TLB missing of IOMUXC base address during suspend
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <[email protected]>
commit 59d05b518321618177b898a6801503e31b15b25b upstream.
After the suspend routine running in OCRAM puts DDR into self-refresh, it will access IOMUXC block to float DDR IO for power saving. A TLB missing of IOMUXC base address may happen in this case, and triggers an access to DDR, and thus hangs the system.
The failure is discovered by running suspend/resume on a Cubox-i board. Though the issue is not Cubox-i specific, it can be hit the on the board quite easily with the 3.15 or 3.16 kernel.
Fix the issue with a dummy access to IOMUXC block at the beginning of suspend routine, so that the address translation can be filled into TLB before DDR is put into self-refresh.
--- arch/arm/mach-imx/suspend-imx6.S | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-imx/suspend-imx6.S +2 -0
@@ -172,6 +172,8 @@ ENTRY(imx6_suspend) ldr r6, [r11, #0x0] ldr r11, [r0, #PM_INFO_MX6Q_GPC_V_OFFSET] ldr r6, [r11, #0x0] + ldr r11, [r0, #PM_INFO_MX6Q_IOMUXC_V_OFFSET] + ldr r6, [r11, #0x0] /* use r11 to store the IO address */ ldr r11, [r0, #PM_INFO_MX6Q_SRC_V_OFFSET]
Greg Kroah-Hartman
maintainerPATCH 38/357 ARM: dts: vf610-twr: Fix pinctrl_esdhc1 pin definitions.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bill Pringlemeir <[email protected]>
commit 0aa4dcb5b730f5da2540926b94d98636fe7d1cbc upstream.
Previous version had an extra 'fsl' which made the pins not match any entry. The console message,
vf610-pinctrl 40048000.iomuxc: no fsl,pins property in node \
/soc/aips-bus@40000000/iomuxc@40048000/vf610-twr/esdhc1grpis displayed without the fix. The prior version would generally work as u-boot sets the pins properly for sdhc. This change allows Linux sdhc use even if u-boot is built without sdhc support.
--- arch/arm/boot/dts/vf610-twr.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/vf610-twr.dts +1 -1
@@ -168,7 +168,7 @@ }; pinctrl_esdhc1: esdhc1grp { - fsl,fsl,pins = < + fsl,pins = < VF610_PAD_PTA24__ESDHC1_CLK 0x31ef VF610_PAD_PTA25__ESDHC1_CMD 0x31ef VF610_PAD_PTA26__ESDHC1_DAT0 0x31ef
Greg Kroah-Hartman
maintainerPATCH 40/357 arm64: flush TLS registers during exec
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream.
Nathan reports that we leak TLS information from the parent context during an exec, as we don't clear the TLS registers when flushing the thread state.
This patch updates the flushing code so that we:
(1) Unconditionally zero the tpidr_el0 register (since this is fully context switched for native tasks and zeroed for compat tasks)
(2) Zero the tp_value state in thread_info before clearing the tpidrr0_el0 register for compat tasks (since this is only writable by the set_tls compat syscall and therefore not fully switched).
A missing compiler barrier is also added to the compat set_tls syscall.
--- arch/arm64/kernel/process.c | 18 ++++++++++++++++++ arch/arm64/kernel/sys_compat.c | 6 ++++++ 2 files changed, 24 insertions(+)
arch/arm64/kernel/process.c +18 -0
@@ -224,9 +224,27 @@ void exit_thread(void) { } +static void tls_thread_flush (void ) +{ + asm ("msr tpidr_el0, xzr" ); + +if (is_compat_task ()) { + current->thread.tp_value =0 ; + +/* +* We need to ensure ordering between the shadow state and the +* hardware state, so that we don't corrupt the hardware state +* with a stale shadow state during context switch. +*/ +barrier (); + asm ("msr tpidrro_el0, xzr" ); + } +} +void flush_thread (void ) {fpsimd_flush_thread (); +tls_thread_flush ();flush_ptrace_hw_breakpoint (current); }
arch/arm64/kernel/sys_compat.c +6 -0
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *case __ARM_NR_compat_set_tls: current->thread.tp_value = regs->regs[0 ]; + +/* +* Protect against register corruption from context switch. +* See comment in tls_thread_flush. +*/ +barrier (); asm ("msr tpidrro_el0, %0" : :"r" (regs->regs[0 ]));return 0 ;
Greg Kroah-Hartman
maintainerPATCH 41/357 arm64: use irq_set_affinity with force=false when migrating irqs
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit 3d8afe3099ebc602848aa7f09235cce3a9a023ce upstream.
The arm64 interrupt migration code on cpu offline calls irqchip.irq_set_affinity() with the argument force=true. Originally this argument had no effect because it was not used by any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu affinity of interrupts") which made the force argument useful to route interrupts to not yet online cpus without checking the target cpu against the cpu online mask. The following commit ffde1de64012 ("irqchip: gic: Support forced affinity setting") implemented this for the GIC interrupt controller.
As a consequence the cpu offline irq migration fails if CPU0 is offlined, because CPU0 is still set in the affinity mask and the validation against cpu online mask is skipped to the force argument being true. The following first_cpu(mask) selection always selects CPU0 as the target.
Commit 601c942176d8("arm64: use cpu_online_mask when using forced irq_set_affinity") intended to fix the above mentioned issue but introduced another issue where affinity can be migrated to a wrong CPU due to unconditional copy of cpu_online_mask.
As with for arm, solve the issue by calling irq_set_affinity() with force=false from the CPU offline irq migration code so the GIC driver validates the affinity mask against CPU online mask and therefore removes CPU0 from the possible target candidates. Also revert the changes done in the commit 601c942176d8 as it's no longer needed.
Tested on Juno platform.
irq_set_affinity")
--- arch/arm64/kernel/irq.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/arm64/kernel/irq.c +4 -8
@@ -97,19 +97,15 @@ static bool migrate_one_irq(struct irq_dif (irqd_is_per_cpu (d) || !cpumask_test_cpu (smp_processor_id (), affinity))return false; -if (cpumask_any_and (affinity, cpu_online_mask) >= nr_cpu_ids) +if (cpumask_any_and (affinity, cpu_online_mask) >= nr_cpu_ids) { + affinity = cpu_online_mask; ret = true; + } -/* -* when using forced irq_set_affinity we must ensure that the cpu -* being offlined is not present in the affinity mask, it may be -* selected as the target CPU otherwise -*/ - affinity = cpu_online_mask; c =irq_data_get_irq_chip (d);if (!c->irq_set_affinity)pr_debug ("IRQ%u: unable to set affinity\n" , d->irq); -else if (c->irq_set_affinity (d, affinity, true) ==IRQ_SET_MASK_OK && ret) +else if (c->irq_set_affinity (d, affinity, false) ==IRQ_SET_MASK_OK && ret)cpumask_copy (d->affinity, affinity);return ret;
Greg Kroah-Hartman
maintainerPATCH 42/357 arm/arm64: KVM: Complete WFI/WFE instructions
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <[email protected]>
commit 05e0127f9e362b36aa35f17b1a3d52bca9322a3a upstream.
The architecture specifies that when the processor wakes up from a WFE or WFI instruction, the instruction is considered complete, however we currrently return to EL1 (or EL0) at the WFI/WFE instruction itself.
While most guests may not be affected by this because their local exception handler performs an exception returning setting the event bit or with an interrupt pending, some guests like UEFI will get wedged due this little mishap.
Simply skip the instruction when we have completed the emulation.
--- arch/arm/kvm/handle_exit.c | 2 ++ arch/arm64/kvm/handle_exit.c | 2 ++ 2 files changed, 4 insertions(+)
arch/arm/kvm/handle_exit.c +2 -0
@@ -93,6 +93,8 @@ static int kvm_handle_wfx(struct kvm_vcpelse kvm_vcpu_block (vcpu); +kvm_skip_instr (vcpu,kvm_vcpu_trap_il_is32bit (vcpu)); +return 1 ; }
arch/arm64/kvm/handle_exit.c +2 -0
@@ -66,6 +66,8 @@ static int kvm_handle_wfx(struct kvm_vcpelse kvm_vcpu_block (vcpu); +kvm_skip_instr (vcpu,kvm_vcpu_trap_il_is32bit (vcpu)); +return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 43/357 ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranavkumar Sawargaonkar <[email protected]>
commit f6edbbf36da3a27b298b66c7955fc84e1dcca305 upstream.
X-Gene u-boot runs in EL2 mode with MMU enabled hence we might have stale EL2 tlb enteris when we enable EL2 MMU on each host CPU.
This can happen on any ARM/ARM64 board running bootloader in Hyp-mode (or EL2-mode) with MMU enabled.
This patch ensures that we flush all Hyp-mode (or EL2-mode) TLBs on each host CPU before enabling Hyp-mode (or EL2-mode) MMU.
--- arch/arm/kvm/init.S | 4 ++++ arch/arm64/kvm/hyp-init.S | 4 ++++ 2 files changed, 8 insertions(+)
arch/arm/kvm/init.S +4 -0
@@ -98,6 +98,10 @@ __do_hyp_init: mrc p15, 0, r0, c10, c2, 1 mcr p15, 4, r0, c10, c2, 1 + @ Invalidate the stale TLBs from Bootloader + mcr p15, 4, r0, c8, c7, 0 @ TLBIALLH + dsb ish + @ Set the HSCTLR to: @ - ARM/THUMB exceptions: Kernel config (Thumb-2 kernel) @ - Endianness: Kernel config
arch/arm64/kvm/hyp-init.S +4 -0
@@ -80,6 +80,10 @@ __do_hyp_init: msr mair_el2, x4 isb + /* Invalidate the stale TLBs from Bootloader */ + tlbi alle2 + dsb sy + mrs x4, sctlr_el2 and x4, x4, #SCTLR_EL2_EE // preserve endianness of EL2 ldr x5, =SCTLR_EL2_FLAGS
Greg Kroah-Hartman
maintainerPATCH 44/357 i2c: rk3x: fix bug that cause transfer fails in master receive mode
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: addy ke <[email protected]>
commit 5da4309f9e1b4de9c2b69e917912fbb84006d44e upstream.
In rk3x SOC, the I2C controller can receive/transmit up to 32 bytes data in one chunk, so the size of data to be write/read to/from TXDATAx/RXDATAx must be less than or equal 32 bytes at a time.
Tested on rk3288-pinky board, elan receive 158 bytes data.
--- drivers/i2c/busses/i2c-rk3x.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/busses/i2c-rk3x.c +4 -0
@@ -323,6 +323,10 @@ static void rk3x_i2c_handle_read(struct/* ack interrupt */ i2c_writel (i2c,REG_INT_MBRF ,REG_IPD ); +/* Can only handle a maximum of 32 bytes at a time */ +if (len >32 ) + len =32 ; +/* read the data from receive buffer */ for (i =0 ; i < len; ++i) {if (i %4 ==0 )
Greg Kroah-Hartman
maintainerPATCH 45/357 i2c: mv64xxx: continue probe when clock-frequency is missing
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit 0ce4bc1dbdd911ae1763e2d4ff36bd1b214a59f7 upstream.
The "clock-frequency" DT property is listed as optional, However, the current code stores the return value of of_property_read_u32 in the return code of mv64xxx_of_config, but then forgets to clear it after setting the default value of "clock-frequency". It is then passed out to the main probe function, resulting in a probe failure when "clock-frequency" is missing.
This patch checks and then throws away the return value of of_property_read_u32, instead of storing it and having to clear it afterwards.
This issue was discovered after the property was removed from all sunxi DTs.
--- drivers/i2c/busses/i2c-mv64xxx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/i2c/busses/i2c-mv64xxx.c +1 -2
@@ -746,8 +746,7 @@ mv64xxx_of_config(struct mv64xxx_i2c_dat } tclk =clk_get_rate (drv_data->clk); - rc =of_property_read_u32 (np,"clock-frequency" , &bus_freq); -if (rc) +if (of_property_read_u32 (np,"clock-frequency" , &bus_freq)) bus_freq =100000 ;/* 100kHz by default */ if (!mv64xxx_find_baud_factors(bus_freq, tclk,
Greg Kroah-Hartman
maintainerPATCH 46/357 i2c: at91: add bound checking on SMBus block length bytes
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Roszko <[email protected]>
commit 75b81f339c6af43f6f4a1b3eabe0603321dade65 upstream.
The driver was not bound checking the received length byte to ensure it was within the the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up in an infinite loop as the at91_twi_read_next_byte function returned immediately without allowing RHR to be read to clear the RXRDY interrupt.
Tested agaisnt a SMBus compliant battery.
--- drivers/i2c/busses/i2c-at91.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-at91.c +24 -4
@@ -101,6 +101,7 @@ struct at91_twi_dev {unsigned twi_cwgr_reg;struct at91_twi_pdata *pdata;bool use_dma; +bool recv_len_abort;struct at91_twi_dma dma; };
@@ -267,12 +268,24 @@ static void at91_twi_read_next_byte(stru *dev->buf =at91_twi_read (dev,AT91_TWI_RHR ) &0xff ; --dev->buf_len; +/* return if aborting, we only needed to read RHR to clear RXRDY*/ +if (dev->recv_len_abort) +return ; +/* handle I2C_SMBUS_BLOCK_DATA */ if (unlikely (dev->msg->flags &I2C_M_RECV_LEN )) { - dev->msg->flags &= ~I2C_M_RECV_LEN ; - dev->buf_len += *dev->buf; - dev->msg->len = dev->buf_len +1 ; -dev_dbg (dev->dev,"received block length %d\n" , dev->buf_len); +/* ensure length byte is a valid value */ +if (*dev->buf <=I2C_SMBUS_BLOCK_MAX && *dev->buf >0 ) { + dev->msg->flags &= ~I2C_M_RECV_LEN ; + dev->buf_len += *dev->buf; + dev->msg->len = dev->buf_len +1 ; +dev_dbg (dev->dev,"received block length %d\n" , + dev->buf_len); + }else { +/* abort and send the stop by reading one more byte */ + dev->recv_len_abort = true; + dev->buf_len =1 ; + } }/* send stop if second but last byte has been read */
@@ -444,6 +457,12 @@ static int at91_do_twi_transfer(struct a ret = -EIO ; goto error; } +if (dev->recv_len_abort) { +dev_err (dev->dev,"invalid smbus block length recvd\n" ); + ret = -EPROTO ; + goto error; + } +dev_dbg (dev->dev,"transfer complete\n" );return 0 ;
@@ -500,6 +519,7 @@ static int at91_twi_xfer(struct i2c_adap dev->buf_len = m_start->len; dev->buf = m_start->buf; dev->msg = m_start; + dev->recv_len_abort = false; ret =at91_do_twi_transfer (dev);
Greg Kroah-Hartman
maintainerPATCH 47/357 i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Lindgren <[email protected]>
commit 6721f28a26efd6368497abbdef5dcfc59608d899 upstream.
There is a race condition in at91_do_twi_xfer when signals arrive. If a signal is recieved while waiting for a transfer to complete wait_for_completion_interruptible_timeout() will return -ERESTARTSYS. This is not handled correctly resulting in interrupts still being enabled and a transfer being in flight when we return.
Symptoms include a range of oopses and bus lockups. Oopses can happen when the transfer completes because the interrupt handler will corrupt the stack. If a new transfer is started before the interrupt fires the controller will start a new transfer in the middle of the old one, resulting in confused slaves and a locked bus.
To avoid this, use wait_for_completion_io_timeout instead so that we don't have to deal with gracefully shutting down the transfer and disabling the interrupts.
--- drivers/i2c/busses/i2c-at91.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-at91.c +2 -2
@@ -434,8 +434,8 @@ static int at91_do_twi_transfer(struct a } } - ret =wait_for_completion_interruptible_timeout (&dev->cmd_complete, - dev->adapter.timeout); + ret =wait_for_completion_io_timeout (&dev->cmd_complete, + dev->adapter.timeout);if (ret ==0 ) {dev_err (dev->dev,"controller timed out\n" );at91_init_twi_bus (dev);
Greg Kroah-Hartman
maintainerPATCH 48/357 Revert "i2c: rcar: remove spinlock"
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 91bfe2989af02e709ca01ccf518c4fbda3efc70f upstream.
This reverts commit 150b8be3cda54412ad7b54f5392b513b25c0aaa7.
The I2C core's per-adapter locks can't protect from IRQs, so the driver still needs a spinlock to protect the register accesses.
--- drivers/i2c/busses/i2c-rcar.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/i2c/busses/i2c-rcar.c +22 -0
@@ -34,6 +34,7 @@#include <linux/platform_device.h> #include <linux/pm_runtime.h> #include <linux/slab.h> +#include <linux/spinlock.h> /* register offsets */ #define ICSCR 0x00/* slave ctrl */
@@ -95,6 +96,7 @@ struct rcar_i2c_priv {struct i2c_msg *msg;struct clk *clk; +spinlock_t lock;wait_queue_head_t wait;int pos;
@@ -365,6 +367,9 @@ static irqreturn_t rcar_i2c_irq(int irq,struct rcar_i2c_priv *priv = ptr;u32 msr; +/*-------------- spin lock -----------------*/ +spin_lock (&priv->lock); + msr =rcar_i2c_read (priv,ICMSR );/* Arbitration lost */
@@ -400,6 +405,9 @@ out:wake_up (&priv->wait); } +spin_unlock (&priv->lock); +/*-------------- spin unlock -----------------*/ +return IRQ_HANDLED ; }
@@ -409,14 +417,21 @@ static int rcar_i2c_master_xfer(struct i {struct rcar_i2c_priv *priv =i2c_get_adapdata (adap);struct device *dev =rcar_i2c_priv_to_dev (priv); +unsigned long flags;int i, ret, timeout;pm_runtime_get_sync (dev); +/*-------------- spin lock -----------------*/ +spin_lock_irqsave (&priv->lock, flags); +rcar_i2c_init (priv);/* start clock */ rcar_i2c_write (priv,ICCCR , priv->icccr); +spin_unlock_irqrestore (&priv->lock, flags); +/*-------------- spin unlock -----------------*/ + ret =rcar_i2c_bus_barrier (priv);if (ret <0 ) goto out;
@@ -428,6 +443,9 @@ static int rcar_i2c_master_xfer(struct ibreak ; } +/*-------------- spin lock -----------------*/ +spin_lock_irqsave (&priv->lock, flags); +/* init each data */ priv->msg = &msgs[i]; priv->pos =0 ;
@@ -437,6 +455,9 @@ static int rcar_i2c_master_xfer(struct i ret =rcar_i2c_prepare_msg (priv); +spin_unlock_irqrestore (&priv->lock, flags); +/*-------------- spin unlock -----------------*/ +if (ret <0 )break ;
@@ -540,6 +561,7 @@ static int rcar_i2c_probe(struct platfor irq =platform_get_irq (pdev,0 );init_waitqueue_head (&priv->wait); +spin_lock_init (&priv->lock); adap = &priv->adap; adap->nr = pdev->id;
Greg Kroah-Hartman
maintainerPATCH 49/357 i2c: rcar: fix MNR interrupt handling
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit dd318b0df27c582ac0d72a346fd6e693700be23c upstream.
Sometimes the MNR and MST interrupts happen simultaneously (stop automatically follows NACK, according to the manuals) and in such case the ID_NACK flag isn't set since the MST interrupt handling precedes MNR and all interrupts are cleared and disabled then, so that MNR interrupt is never noticed -- this causes NACK'ed transfers to be falsely reported as successful. Exchanging MNR and MST handlers fixes this issue, however the MNR bit somehow gets set again even after being explicitly cleared, so I decided to completely suppress handling of all disabled interrupts (which is a good thing anyway)...
--- drivers/i2c/busses/i2c-rcar.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/i2c/busses/i2c-rcar.c +9 -6
@@ -372,18 +372,15 @@ static irqreturn_t rcar_i2c_irq(int irq, msr =rcar_i2c_read (priv,ICMSR ); +/* Only handle interrupts that are currently enabled */ + msr &=rcar_i2c_read (priv,ICMIER ); +/* Arbitration lost */ if (msr &MAL ) {rcar_i2c_flags_set (priv, (ID_DONE |ID_ARBLOST )); goto out; } -/* Stop */ -if (msr &MST ) { -rcar_i2c_flags_set (priv,ID_DONE ); - goto out; - } -/* Nack */ if (msr &MNR ) {/* go to stop phase */
@@ -393,6 +390,12 @@ static irqreturn_t rcar_i2c_irq(int irq, goto out; } +/* Stop */ +if (msr &MST ) { +rcar_i2c_flags_set (priv,ID_DONE ); + goto out; + } +if (rcar_i2c_is_recv (priv))rcar_i2c_flags_set (priv,rcar_i2c_irq_recv (priv, msr));else
Greg Kroah-Hartman
maintainerPATCH 50/357 i2c: rcar: fix RCAR_IRQ_ACK_{RECV|SEND}
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 938916fbb8e8cb67eacb784f4eda17e2950c16c5 upstream.
Bits 8-31 of all registers reflect the value of bits 0-7 on reads and should be 0 on writes, according to the manuals. RCAR_IRQ_ACK_{RECV|SEND} macros have all 1's in bits 8-31, thus going against the manuals, so fix them.
--- drivers/i2c/busses/i2c-rcar.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-rcar.c +2 -2
@@ -76,8 +76,8 @@#define RCAR_IRQ_RECV (MNR | MAL | MST | MAT | MDR)#define RCAR_IRQ_STOP (MST) -#define RCAR_IRQ_ACK_SEND (~(MAT | MDE)) -#define RCAR_IRQ_ACK_RECV (~(MAT | MDR)) +#define RCAR_IRQ_ACK_SEND (~(MAT | MDE) & 0xFF) +#define RCAR_IRQ_ACK_RECV (~(MAT | MDR) & 0xFF)#define ID_LAST_MSG (1 << 0)#define ID_IOERROR (1 << 1)
Greg Kroah-Hartman
maintainerPATCH 51/357 i2c: rk3x: fix divisor calculation for SCL frequency
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: addy ke <[email protected]>
commit b4a7bd7a386dc6b0bb49cb47614e06e8295d495a upstream.
I2C_CLKDIV register descripted in the previous version of RK3x chip manual is incorrect. Plus 1 is required.
The correct formula:
- T(SCL_HIGH) = T(PCLK) * (CLKDIVH + 1) * 8
- T(SCL_LOW) = T(PCLK) * (CLKDIVL + 1) * 8
- (SCL Divsor) = 8 * ((CLKDIVL + 1) + (CLKDIVH + 1))
- SCL = PCLK / (CLK Divsor)
It will be updated to the latest version of chip manual.
--- drivers/i2c/busses/i2c-rk3x.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/i2c/busses/i2c-rk3x.c +5 -6
@@ -433,12 +433,11 @@ static void rk3x_i2c_set_scl_rate(structunsigned long i2c_rate =clk_get_rate (i2c->clk);unsigned int div; -/* SCL rate = (clk rate) / (8 * DIV) */ - div =DIV_ROUND_UP (i2c_rate, scl_rate *8 ); - -/* The lower and upper half of the CLKDIV reg describe the length of -* SCL low & high periods. */ - div =DIV_ROUND_UP (div,2 ); +/* set DIV = DIVH = DIVL +* SCL rate = (clk rate) / (8 * (DIVH + 1 + DIVL + 1)) +* = (clk rate) / (16 * (DIV + 1)) +*/ + div =DIV_ROUND_UP (i2c_rate, scl_rate *16 ) -1 ;i2c_writel (i2c, (div <<16 ) | (div &0xffff ),REG_CLKDIV ); }
Greg Kroah-Hartman
maintainerPATCH 52/357 i2c: ismt: use correct length when copy buffer
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Du <[email protected]>
commit 979bbf7b7ae75cfc06e09d09eda38009a3bdc4a4 upstream.
In block write mode, when encapsulating dma_buffer, first element is 'command', the rest is data buffer, so only copy actual data buffer starting from block[1] with the size indicating by block[0].
--- drivers/i2c/busses/i2c-ismt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-ismt.c +2 -2
@@ -497,7 +497,7 @@ static int ismt_access(struct i2c_adapte desc->wr_len_cmd = dma_size; desc->control |=ISMT_DESC_BLK ; priv->dma_buffer[0 ] = command; -memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size); +memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size -1 ); }else {/* Block Read */ dev_dbg (dev,"I2C_SMBUS_BLOCK_DATA: READ\n" );
@@ -525,7 +525,7 @@ static int ismt_access(struct i2c_adapte desc->wr_len_cmd = dma_size; desc->control |=ISMT_DESC_I2C ; priv->dma_buffer[0 ] = command; -memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size); +memcpy (&priv->dma_buffer[1 ], &data->block[1 ], dma_size -1 ); }else {/* i2c Block Read */ dev_dbg (dev,"I2C_SMBUS_I2C_BLOCK_DATA: READ\n" );
Greg Kroah-Hartman
maintainerPATCH 53/357 ftrace: Use current addr when converting to nop in __ftrace_replace_code()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 39b5552cd5090d4c210d278cd2732f493075f033 upstream.
In __ftrace_replace_code(), when converting the call to a nop in a function it needs to compare against the "curr" (current) value of the ftrace ops, and not the "new" one. It currently does not affect x86 which is the only arch to do the trampolines with function graph tracer, but when other archs that do depend on this code implement the function graph trampoline, it can crash.
Here's an example when ARM uses the trampolines (in the future):
------------[ cut here ]------------ WARNING: CPU: 0 PID: 9 at kernel/trace/ftrace.c:1716 ftrace_bug+0x17c/0x1f4() Modules linked in: omap_rng rng_core ipv6 CPU: 0 PID: 9 Comm: migration/0 Not tainted 3.16.0-test-10959-gf0094b28f303-dirty #52 [<c02188f4>] (unwind_backtrace) from [<c021343c>] (show_stack+0x20/0x24) [<c021343c>] (show_stack) from [<c095a674>] (dump_stack+0x78/0x94) [<c095a674>] (dump_stack) from [<c02532a0>] (warn_slowpath_common+0x7c/0x9c) [<c02532a0>] (warn_slowpath_common) from [<c02532ec>] (warn_slowpath_null+0x2c/0x34) [<c02532ec>] (warn_slowpath_null) from [<c02cbac4>] (ftrace_bug+0x17c/0x1f4) [<c02cbac4>] (ftrace_bug) from [<c02cc44c>] (ftrace_replace_code+0x80/0x9c) [<c02cc44c>] (ftrace_replace_code) from [<c02cc658>] (ftrace_modify_all_code+0xb8/0x164) [<c02cc658>] (ftrace_modify_all_code) from [<c02cc718>] (__ftrace_modify_code+0x14/0x1c) [<c02cc718>] (__ftrace_modify_code) from [<c02c7244>] (multi_cpu_stop+0xf4/0x134) [<c02c7244>] (multi_cpu_stop) from [<c02c6e90>] (cpu_stopper_thread+0x54/0x130) [<c02c6e90>] (cpu_stopper_thread) from [<c0271cd4>] (smpboot_thread_fn+0x1ac/0x1bc) [<c0271cd4>] (smpboot_thread_fn) from [<c026ddf0>] (kthread+0xe0/0xfc) [<c026ddf0>] (kthread) from [<c020f318>] (ret_from_fork+0x14/0x20) ---[ end trace dc9ce72c5b617d8f ]--- [ 65.047264] ftrace failed to modify [<c0208580>] asm_do_IRQ+0x10/0x1c [ 65.054070] actual: 85:1b:00:eb
--- kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ftrace.c +1 -1
@@ -1809,7 +1809,7 @@ __ftrace_replace_code(struct dyn_ftracereturn ftrace_make_call (rec, ftrace_addr);case FTRACE_UPDATE_MAKE_NOP : -return ftrace_make_nop (NULL , rec, ftrace_addr); +return ftrace_make_nop (NULL , rec, ftrace_old_addr);case FTRACE_UPDATE_MODIFY_CALL :return ftrace_modify_call (rec, ftrace_old_addr, ftrace_addr);
Greg Kroah-Hartman
maintainerPATCH 54/357 trace: Fix epoll hang when we race with new entries
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 4ce97dbf50245227add17c83d87dc838e7ca79d0 upstream.
Epoll on trace_pipe can sometimes hang in a weird case. If the ring buffer is empty when we set waiters_pending but an event shows up exactly at that moment we can miss being woken up by the ring buffers irq work. Since ring_buffer_empty() is inherently racey we will sometimes think that the buffer is not empty. So we don't get woken up and we don't think there are any events even though there were some ready when we added the watch, which makes us hang. This patch fixes this by making sure that we are actually on the wait list before we set waiters_pending, and add a memory barrier to make sure ring_buffer_empty() is going to be correct.
--- kernel/trace/ring_buffer.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +15 -1
@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_bu work = &cpu_buffer->irq_work; } - work->waiters_pending = true;poll_wait (filp, &work->waiters, poll_table); + work->waiters_pending = true; +/* +* There's a tight race between setting the waiters_pending and +* checking if the ring buffer is empty. Once the waiters_pending bit +* is set, the next event will wake the task up, but we can get stuck +* if there's only a single event in. +* +* FIXME: Ideally, we need a memory barrier on the writer side as well, +* but adding a memory barrier to all events will cause too much of a +* performance hit in the fast path. We only need a memory barrier when +* the buffer goes from empty to having content. But as this race is +* extremely small, and it's not a problem if another event comes in, we +* will fix it later. +*/ +smp_mb ();if ((cpu ==RING_BUFFER_ALL_CPUS && !ring_buffer_empty (buffer)) || (cpu !=RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu (buffer, cpu)))
Greg Kroah-Hartman
maintainerPATCH 55/357 arm64: ptrace: fix compat hardware watchpoint reporting
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 27d7ff273c2aad37b28f6ff0cab2cfa35b51e648 upstream.
I'm not sure what I was on when I wrote this, but when iterating over the hardware watchpoint array (hbp_watch_array), our index is off by ARM_MAX_BRP, so we walk off the end of our thread_struct...
... except, a dodgy condition in the loop means that it never executes at all (bp cannot be NULL).
This patch fixes the code so that we remove the bp check and use the correct index for accessing the watchpoint structures.
--- arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/kernel/ptrace.c | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/hw_breakpoint.h +0 -1
@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 r*/ #define ARM_MAX_BRP 16#define ARM_MAX_WRP 16 -#define ARM_MAX_HBP_SLOTS (ARM_MAX_BRP + ARM_MAX_WRP)/* Virtual debug register bases. */ #define AARCH64_DBG_REG_BVR 0
arch/arm64/kernel/ptrace.c +2 -1
@@ -85,7 +85,8 @@ static void ptrace_hbptriggered(struct pbreak ; } } -for (i =ARM_MAX_BRP ; i <ARM_MAX_HBP_SLOTS && !bp; ++i) { + +for (i =0 ; i <ARM_MAX_WRP ; ++i) {if (current->thread.debug.hbp_watch[i] == bp) { info.si_errno = -((i <<1 ) +1 );break ;
Greg Kroah-Hartman
maintainerPATCH 56/357 ALSA: core: fix buffer overflow in snd_info_get_line()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream.
snd_info_get_line() documents that its last parameter must be one less than the buffer size, but this API design guarantees that (literally) every caller gets it wrong.
Just change this parameter to have its obvious meaning.
--- sound/core/info.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/info.c +2 -2
@@ -684,7 +684,7 @@ int snd_info_card_free(struct snd_card ** snd_info_get_line - read one line from the procfs buffer * @buffer: the procfs buffer * @line: the buffer to store -* @len: the max. buffer size - 1 +* @len: the max. buffer size * * Reads one line from the buffer and stores the string. *
@@ -704,7 +704,7 @@ int snd_info_get_line(struct snd_info_bu buffer->stop =1 ;if (c =='\n' )break ; -if (len) { +if (len >1 ) { len--; *line++ = c; }
Greg Kroah-Hartman
maintainerPATCH 57/357 ALSA: dice: fix wrong channel mappping at higher sampling rate
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 1033eb5b5aeeb526c22068e0fb0cef9f3c14231e upstream.
The channel mapping is initialized by amdtp_stream_set_parameters(), however Dice driver set it before calling this function. Furthermore, the setting is wrong because the index is the value of array, and vice versa.
This commit moves codes for channel mapping after the function and set it correctly.
--- sound/firewire/dice.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
sound/firewire/dice.c +9 -5
@@ -579,11 +579,6 @@ static int dice_hw_params(struct snd_pcmreturn err; } -for (i =0 ; i < channels; i++) { - dice->stream.pcm_positions[i *2 ] = i; - dice->stream.pcm_positions[i *2 +1 ] = i + channels; - } - rate /=2 ; channels *=2 ; }
@@ -591,6 +586,15 @@ static int dice_hw_params(struct snd_pcm mode =rate_index_to_mode (rate_index);amdtp_stream_set_parameters (&dice->stream, rate, channels, dice->rx_midi_ports[mode]); +if (rate_index >4 ) { + channels /=2 ; + +for (i =0 ; i < channels; i++) { + dice->stream.pcm_positions[i] = i *2 ; + dice->stream.pcm_positions[i + channels] = i *2 +1 ; + } + } +amdtp_stream_set_pcm_format (&dice->stream,params_format (hw_params));
Greg Kroah-Hartman
maintainerPATCH 58/357 ALSA: firewire-lib/dice: add arrangements of PCM pointer and interrupts for Dice quirk
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 65845f29bec6bc17f80eff25c3bc39bcf3be9bf9 upstream.
In IEC 61883-6, one data block transfers one event. In ALSA, the event equals one PCM frame, hence one data block transfers one PCM frame. But Dice has a quirk at higher sampling rate (176.4/192.0 kHz) that one data block transfers two PCM frames.
Commit 10550bea44a8 ("ALSA: dice/firewire-lib: Keep dualwire mode but obsolete CIP_HI_DUALWIRE") moved some codes related to this quirk into Dice driver. But the commit forgot to add arrangements for PCM period interrupts and DMA pointer updates. As a result, Dice driver cannot work correctly at higher sampling rate.
This commit adds 'double_pcm_frames' parameter to amdtp structure for this quirk. When this parameter is set, PCM period interrupts and DMA pointer updates occur at double speed than in IEC 61883-6.
--- sound/firewire/amdtp.c | 11 ++++++++++- sound/firewire/amdtp.h | 1 + sound/firewire/dice.c | 15 +++++++++++---- 3 files changed, 22 insertions(+), 5 deletions(-)
sound/firewire/amdtp.c +10 -1
@@ -507,7 +507,16 @@ static void amdtp_pull_midi(struct amdtpstatic void update_pcm_pointers (struct amdtp_stream *s,struct snd_pcm_substream *pcm,unsigned int frames) -{unsigned int ptr; +{ +unsigned int ptr; + +/* +* In IEC 61883-6, one data block represents one event. In ALSA, one +* event equals to one PCM frame. But Dice has a quirk to transfer +* two PCM frames in one data block. +*/ +if (s->double_pcm_frames) + frames *=2 ; ptr = s->pcm_buffer_pointer + frames;if (ptr >= pcm->runtime->buffer_size)
sound/firewire/amdtp.h +1 -0
@@ -125,6 +125,7 @@ struct amdtp_stream {unsigned int pcm_buffer_pointer;unsigned int pcm_period_pointer;bool pointer_flush; +bool double_pcm_frames;struct snd_rawmidi_substream *midi[AMDTP_MAX_CHANNELS_FOR_MIDI *8 ];
sound/firewire/dice.c +11 -4
@@ -567,10 +567,14 @@ static int dice_hw_params(struct snd_pcmreturn err;/* -* At rates above 96 kHz, pretend that the stream runs at half the -* actual sample rate with twice the number of channels; two samples -* of a channel are stored consecutively in the packet. Requires -* blocking mode and PCM buffer size should be aligned to SYT_INTERVAL. +* At 176.4/192.0 kHz, Dice has a quirk to transfer two PCM frames in +* one data block of AMDTP packet. Thus sampling transfer frequency is +* a half of PCM sampling frequency, i.e. PCM frames at 192.0 kHz are +* transferred on AMDTP packets at 96 kHz. Two successive samples of a +* channel are stored consecutively in the packet. This quirk is called +* as 'Dual Wire'. +* For this quirk, blocking mode is required and PCM buffer size should +* be aligned to SYT_INTERVAL. */ channels =params_channels (hw_params);if (rate_index >4 ) {
@@ -581,6 +585,9 @@ static int dice_hw_params(struct snd_pcm rate /=2 ; channels *=2 ; + dice->stream.double_pcm_frames = true; + }else { + dice->stream.double_pcm_frames = false; } mode =rate_index_to_mode (rate_index);
Greg Kroah-Hartman
maintainerPATCH 59/357 ALSA: hda - Fix digital mic on Acer Aspire 3830TG
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ff50479ad61069f3ee14863225aebe36d598e93e upstream.
Acer Aspire 3830TG with CX20588 codec has a digital built-in mic that has the same problem like many others, the inverted signal in stereo. Apply the same fixup to this machine, too.
--- sound/pci/hda/patch_conexant.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +8 -1
@@ -2822,6 +2822,7 @@ enum {CXT_FIXUP_HEADPHONE_MIC_PIN ,CXT_FIXUP_HEADPHONE_MIC ,CXT_FIXUP_GPIO1 , +CXT_FIXUP_ASPIRE_DMIC ,CXT_FIXUP_THINKPAD_ACPI ,CXT_FIXUP_OLPC_XO , CXT_FIXUP_CAP_MIX_AMP,
@@ -3269,6 +3270,12 @@ static const struct hda_fixup cxt_fixups { } }, }, + [CXT_FIXUP_ASPIRE_DMIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_stereo_dmic, + .chained = true, + .chain_id = CXT_FIXUP_GPIO1, + }, [CXT_FIXUP_THINKPAD_ACPI] = { .type = HDA_FIXUP_FUNC, .v.func = hda_fixup_thinkpad_acpi,
@@ -3349,7 +3356,7 @@ static const struct hda_model_fixup cxt5static const struct snd_pci_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x1025 ,0x0543 ,"Acer Aspire One 522" ,CXT_FIXUP_STEREO_DMIC ), -SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_GPIO1 ), +SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1043 ,0x138d ,"Asus" ,CXT_FIXUP_HEADPHONE_MIC_PIN ),SND_PCI_QUIRK (0x152d ,0x0833 ,"OLPC XO-1.5" ,CXT_FIXUP_OLPC_XO ),SND_PCI_QUIRK (0x17aa ,0x20f2 ,"Lenovo T400" ,CXT_PINCFG_LENOVO_TP410 ),
Greg Kroah-Hartman
maintainerPATCH 60/357 ALSA: hda - Fix COEF setups for ALC1150 codec
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit acf08081adb5e8fe0519eb97bb49797ef52614d6 upstream.
ALC1150 codec seems to need the COEF- and PLL-setups just like its compatible ALC882 codec. Some machines (e.g. SunMicro X10SAT) show the problem like too low output volumes unless the COEF setup is applied.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -327,6 +327,7 @@ static void alc_auto_init_amp(struct hdacase 0x10ec0885 :case 0x10ec0887 :/*case 0x10ec0889:*/ /* this causes an SPDIF problem */ +case 0x10ec0900 :alc889_coef_init (codec);break ;case 0x10ec0888 :
@@ -2349,6 +2350,7 @@ static int patch_alc882(struct hda_codecswitch (codec->vendor_id) {case 0x10ec0882 :case 0x10ec0885 : +case 0x10ec0900 :break ;default :/* ALC883 and variants */
Greg Kroah-Hartman
maintainerPATCH 61/357 ALSA: hda - Fix invalid pin powermap without jack detection
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7a9744cb455e6faa287e148394b4b422a6f3c5c4 upstream.
When a driver is set up without the jack detection explicitly (either by passing a model option or via a specific fixup), the pin powermap of IDT/STAC codecs is set up wrongly, resulting in the silence output. It's because of a logic failure in stac_init_power_map(). It tries to avoid creating a callback for the pins that have other auto-hp and auto-mic callbacks, but the check is done in a wrong way at a wrong time. The stac_init_power_map() should be called after creating other jack detection ctls, and the jack callback should be created only for jack-detectable widgets.
This patch fixes the check in stac_init_power_map() and its callee at the right place, after snd_hda_gen_build_controls().
--- sound/pci/hda/patch_sigmatel.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/pci/hda/patch_sigmatel.c +12 -5
@@ -565,8 +565,8 @@ static void stac_init_power_map(struct hif (snd_hda_jack_tbl_get (codec, nid))continue ;if (def_conf ==AC_JACK_PORT_COMPLEX && - !(spec->vref_mute_led_nid == nid || -is_jack_detectable (codec, nid))) { + spec->vref_mute_led_nid != nid && +is_jack_detectable (codec, nid)) {snd_hda_jack_detect_enable_callback (codec, nid,STAC_PWR_EVENT , jack_update_power);
@@ -4263,11 +4263,18 @@ static int stac_parse_auto_config(structreturn err; } -stac_init_power_map (codec); -return 0 ; } +static int stac_build_controls (struct hda_codec *codec) +{ +int err =snd_hda_gen_build_controls (codec); + +if (err <0 ) +return err; +stac_init_power_map (codec); +return 0 ; +}static int stac_init (struct hda_codec *codec) {
@@ -4379,7 +4386,7 @@ static int stac_suspend(struct hda_codec#endif /* CONFIG_PM */ static const struct hda_codec_ops stac_patch_ops = { - .build_controls = snd_hda_gen_build_controls, + .build_controls = stac_build_controls, .build_pcms = snd_hda_gen_build_pcms, .init = stac_init, .free = stac_free,
Greg Kroah-Hartman
maintainerPATCH 62/357 ALSA: hda - Add fixup model name lookup for Lemote A1205
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 8245b3634516e6b7eb1c94594c0fd41d233502aa upstream.
Lemote A1004 is already added in commit a2dd933d01f (ALSA: hda - Add fixup name lookup for CX5051 and 5066 codecs), but Lemote A1205 has missing.
--- sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_conexant.c +1 -0
@@ -3382,6 +3382,7 @@ static const struct hda_model_fixup cxt5 { .id = CXT_PINCFG_LENOVO_TP410, .name = "tp410" }, { .id = CXT_FIXUP_THINKPAD_ACPI, .name = "thinkpad" }, { .id = CXT_PINCFG_LEMOTE_A1004, .name = "lemote-a1004" }, + { .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" }, { .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" }, {} };
Greg Kroah-Hartman
maintainerPATCH 63/357 ALSA: pcm: fix fifo_size frame calculation
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit a9960e6a293e6fc3ed414643bb4e4106272e4d0a upstream.
The calculated frame size was wrong because snd_pcm_format_physical_width() actually returns the number of bits, not bytes.
Use snd_pcm_format_size() instead, which not only returns bytes, but also simplifies the calculation.
--- sound/core/pcm_lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/pcm_lib.c +5 -3
@@ -1782,14 +1782,16 @@ static int snd_pcm_lib_ioctl_fifo_size(s {struct snd_pcm_hw_params *params = arg;snd_pcm_format_t format; -int channels, width; +int channels; +ssize_t frame_size; params->fifo_size = substream->runtime->hw.fifo_size;if (!(substream->runtime->hw.info &SNDRV_PCM_INFO_FIFO_IN_FRAMES )) { format =params_format (params); channels =params_channels (params); - width =snd_pcm_format_physical_width (format); - params->fifo_size /= width * channels; + frame_size =snd_pcm_format_size (format, channels); +if (frame_size >0 ) + params->fifo_size /= (unsigned )frame_size; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 64/357 cfq-iosched: Fix wrong children_weight calculation
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshiaki Makita <[email protected]>
commit e15693ef18e13e3e6bffe891fe140f18b8ff6d07 upstream.
cfq_group_service_tree_add() is applying new_weight at the beginning of the function via cfq_update_group_weight().
This actually allows weight to change between adding it to and subtracting it from children_weight, and triggers WARN_ON_ONCE() in cfq_group_service_tree_del(), or even causes oops by divide error during vfr calculation in cfq_group_service_tree_add().
The detailed scenario is as follows:
1. Create blkio cgroups X and Y as a child of X.
Set X's weight to 500 and perform some I/O to apply new_weight. This X's I/O completes before starting Y's I/O.
2. Y starts I/O and cfq_group_service_tree_add() is called with Y.
3. cfq_group_service_tree_add() walks up the tree during children_weight calculation and adds parent X's weight (500) to children_weight of root. children_weight becomes 500.
4. Set X's weight to 1000.
5. X starts I/O and cfq_group_service_tree_add() is called with X.
6. cfq_group_service_tree_add() applies its new_weight (1000).
7. I/O of Y completes and cfq_group_service_tree_del() is called with Y.
8. I/O of X completes and cfq_group_service_tree_del() is called with X.
9. cfq_group_service_tree_del() subtracts X's weight (1000) from children_weight of root. children_weight becomes -500.
This triggers WARN_ON_ONCE().
10. Set X's weight to 500.
11. X starts I/O and cfq_group_service_tree_add() is called with X.
12. cfq_group_service_tree_add() applies its new_weight (500) and adds it to children_weight of root. children_weight becomes 0. Calcularion of vfr triggers oops by divide error.
weight should be updated right before adding it to children_weight.
--- block/cfq-iosched.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
block/cfq-iosched.c +8 -3
@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_static void cfq_update_group_weight (struct cfq_group *cfqg) { -BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -if (cfqg->new_weight) { cfqg->weight = cfqg->new_weight; cfqg->new_weight =0 ; } +} + +static void +cfq_update_group_leaf_weight (struct cfq_group *cfqg) +{ +BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node));if (cfqg->new_leaf_weight) { cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb/* add to the service tree */ BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -cfq_update_group_weight (cfqg); +cfq_update_group_leaf_weight (cfqg);__cfq_group_service_tree_add (st, cfqg);/*
@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb*/ while ((parent =cfqg_parent (pos))) {if (propagate) { +cfq_update_group_weight (pos); propagate = !parent->nr_active++; parent->children_weight += pos->weight; }
Greg Kroah-Hartman
maintainerPATCH 65/357 HID: picolcd: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that raw_data that we hold in picolcd_pending structure are always kept within proper bounds.
--- drivers/hid/hid-picolcd_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-picolcd_core.c +6 -0
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_if (!data)return 1 ; +if (size >64 ) { +hid_warn (hdev,"invalid size value (%d) for picolcd raw event\n" , + size); +return 0 ; + } +if (report->id ==REPORT_KEY_STATE ) {if (data->input_keys) ret =picolcd_raw_keypad (data, report, raw_data+1 , size-1 );
Greg Kroah-Hartman
maintainerPATCH 66/357 HID: magicmouse: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that magicmouse_emit_touch() gets only valid values of raw_id.
--- drivers/hid/hid-magicmouse.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/hid-magicmouse.c +10 -0
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hif (size <4 || ((size -4 ) %9 ) !=0 )return 0 ; npoints = (size -4 ) /9 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for TRACKPAD_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *9 +4 );
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hif (size <6 || ((size -6 ) %8 ) !=0 )return 0 ; npoints = (size -6 ) /8 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for MOUSE_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *8 +6 );
Greg Kroah-Hartman
maintainerPATCH 67/357 HID: logitech-dj: prevent false errors to be shown
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 5abfe85c1d4694d5d4bbd13ecc166262b937adf0 upstream.
Commit "HID: logitech: perform bounds checking on device_id early enough" unfortunately leaks some errors to dmesg which are not real ones:
- if the report is not a DJ one, then there is not point in checking the device_id
- the receiver (index 0) can also receive some notifications which can be safely ignored given the current implementation
Move out the test regarding the report_id and also discards printing errors when the receiver got notified.
--- drivers/hid/hid-logitech-dj.c | 43 ++++++++++++++++++++++++------------------ drivers/hid/hid-logitech-dj.h | 1 2 files changed, 26 insertions(+), 18 deletions(-)
drivers/hid/hid-logitech-dj.c +25 -18
@@ -656,7 +656,6 @@ static int logi_dj_raw_event(struct hid_struct dj_receiver_dev *djrcv_dev =hid_get_drvdata (hdev);struct dj_report *dj_report = (struct dj_report *) data;unsigned long flags; -bool report_processed = false;dbg_hid ("%s, size:%d\n" , __func__, size);
@@ -683,34 +682,42 @@ static int logi_dj_raw_event(struct hid_* device (via hid_input_report() ) and return 1 so hid-core does not do * anything else with it. */ + +/* case 1) */ +if (data[0 ] !=REPORT_ID_DJ_SHORT ) +return false; +if ((dj_report->device_index <DJ_DEVICE_INDEX_MIN ) || (dj_report->device_index >DJ_DEVICE_INDEX_MAX )) { -dev_err (&hdev->dev,"%s: invalid device index:%d\n" , +/* +* Device index is wrong, bail out. +* This driver can ignore safely the receiver notifications, +* so ignore those reports too. +*/ +if (dj_report->device_index !=DJ_RECEIVER_INDEX ) +dev_err (&hdev->dev,"%s: invalid device index:%d\n" , __func__, dj_report->device_index);return false; }spin_lock_irqsave (&djrcv_dev->lock, flags); -if (dj_report->report_id ==REPORT_ID_DJ_SHORT ) { -switch (dj_report->report_type) { -case REPORT_TYPE_NOTIF_DEVICE_PAIRED : -case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : -logi_dj_recv_queue_notification (djrcv_dev, dj_report); -break ; -case REPORT_TYPE_NOTIF_CONNECTION_STATUS : -if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == -STATUS_LINKLOSS ) { -logi_dj_recv_forward_null_report (djrcv_dev, dj_report); - } -break ; -default : -logi_dj_recv_forward_report (djrcv_dev, dj_report); +switch (dj_report->report_type) { +case REPORT_TYPE_NOTIF_DEVICE_PAIRED : +case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : +logi_dj_recv_queue_notification (djrcv_dev, dj_report); +break ; +case REPORT_TYPE_NOTIF_CONNECTION_STATUS : +if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == +STATUS_LINKLOSS ) { +logi_dj_recv_forward_null_report (djrcv_dev, dj_report); } - report_processed = true; +break ; +default : +logi_dj_recv_forward_report (djrcv_dev, dj_report); }spin_unlock_irqrestore (&djrcv_dev->lock, flags); -return report_processed; +return true; } static int logi_dj_probe(struct hid_device *hdev,
drivers/hid/hid-logitech-dj.h +1 -0
@@ -27,6 +27,7 @@#define DJ_MAX_PAIRED_DEVICES 6#define DJ_MAX_NUMBER_NOTIFICATIONS 8 +#define DJ_RECEIVER_INDEX 0#define DJ_DEVICE_INDEX_MIN 1#define DJ_DEVICE_INDEX_MAX 6
Greg Kroah-Hartman
maintainerPATCH 68/357 xattr: fix check for simultaneous glibc header inclusion
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Brandenburger <[email protected]>
commit bfcfd44cce2774f19daeb59fb4e43fc9aa80e7b8 upstream.
The guard was introduced in commit ea1a8217b06b ("xattr: guard against simultaneous glibc header inclusion") but it is using #ifdef to check for a define that is either set to 1 or 0. Fix it to use #if instead.
* Without this patch:
$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
include/uapi/linux/xattr.h:19:0: warning: "XATTR_CREATE" redefined [enabled by default]
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
^
/usr/include/x86_64-linux-gnu/sys/xattr.h:32:0: note: this is the location of the previous definition
#define XATTR_CREATE XATTR_CREATE
^* With this patch:
$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
(no warnings)--- include/uapi/linux/xattr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/xattr.h +1 -1
@@ -13,7 +13,7 @@#ifndef _UAPI_LINUX_XATTR_H#define _UAPI_LINUX_XATTR_H -#ifdef __UAPI_DEF_XATTR +#if __UAPI_DEF_XATTR#define __USE_KERNEL_XATTR_DEFS#define XATTR_CREATE 0x1/* set value, fail if attr already exists */
Greg Kroah-Hartman
maintainerPATCH 73/357 drm/i915: Ignore VBT backlight presence check on Acer C720 (4005U)
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scot Doyle <[email protected]>
commit dfb3d47b2369ad752ab9f7438bbf9949524b46ae upstream.
commit c675949ec58ca50d5a3ae3c757892f1560f6e896
Author: Jani Nikula <[email protected]> Date: Wed Apr 9 11:31:37 2014 +0300
drm/i915: do not setup backlight if not available according to VBT
prevents backlight setup on the Acer C720 (Core i3 4005U CPU), which has a misconfigured VBT. Apply quirk to ignore the VBT backlight presence check during backlight setup.
--- drivers/gpu/drm/i915/intel_display.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/i915/intel_display.c +3 -0
@@ -11690,6 +11690,9 @@ static struct intel_quirk intel_quirks[]/* Acer C720 and C720P Chromebooks (Celeron 2955U) have backlights */ { 0x0a06, 0x1025, 0x0a11, quirk_backlight_present }, +/* Acer C720 Chromebook (Core i3 4005U) */ + { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present }, +/* Toshiba CB35 Chromebook (Celeron 2955U) */ { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
Greg Kroah-Hartman
maintainerPATCH 74/357 drm/i915: Remove bogus __init annotation from DMI callbacks
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit bbe1c2740d3a25aa1dbe5d842d2ff09cddcdde0a upstream.
The __init annotations for the DMI callback functions are wrong as this code can be called even after the module has been initialized, e.g. like this:
# echo 1 > /sys/bus/pci/devices/0000:00:02.0/remove # modprobe i915 # echo 1 > /sys/bus/pci/rescan
The first command will remove the PCI device from the kernel's device list so the second command won't see it right away. But as it registers a PCI driver it'll see it on the third command. If the system happens to match one of the DMI table entries we'll try to call a function in long released memory and generate an Oops, at best.
Fix this by removing the bogus annotation.
Modpost should have caught that one but it ignores section reference mismatches from the .rodata section. :/
--- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_bios.c +1 -1
@@ -1122,7 +1122,7 @@ init_vbt_defaults(struct drm_i915_privat } } -static int __init intel_no_opregion_vbt_callback (const struct dmi_system_id *id) +static int intel_no_opregion_vbt_callback (const struct dmi_system_id *id) { DRM_DEBUG_KMS("Falling back to manually reading VBT from " "VBIOS ROM for %s\n",
drivers/gpu/drm/i915/intel_crt.c +1 -1
@@ -780,7 +780,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_crt_dmi_callback (const struct dmi_system_id *id) +static int intel_no_crt_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping CRT initialization for %s\n" , id->ident);return 1 ;
drivers/gpu/drm/i915/intel_lvds.c +1 -1
@@ -531,7 +531,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_lvds_dmi_callback (const struct dmi_system_id *id) +static int intel_no_lvds_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping LVDS initialization for %s\n" , id->ident);return 1 ;
Greg Kroah-Hartman
maintainerPATCH 76/357 drm/i915: Fix EIO/wedged handling in gem fault handler
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit 2232f0315c6688f5ff6b2067ea88d97542034873 upstream.
In
commit 1f83fee08d625f8d0130f9fe5ef7b17c2e022f3c
Author: Daniel Vetter <[email protected]> Date: Thu Nov 15 17:17:22 2012 +0100
drm/i915: clear up wedged transitions
I've accidentally inverted the EIO/wedged handling in the fault
handler: We want to return the EIO as a SIGBUS only if it's not because of the gpu having died, to prevent userspace from unduly dying.
In my defence the comment right above is completely misleading, so fix both.
v2: Drop the WARN_ON, it's not actually a bug to e.g. receive an -EIO when swap-in fails.
v3: Don't remove too much ... oops.
--- drivers/gpu/drm/i915/i915_gem.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/i915_gem.c +7 -4
@@ -1576,10 +1576,13 @@ unlock: out:switch (ret) {case -EIO : -/* If this -EIO is due to a gpu hang, give the reset code a -* chance to clean up the mess. Otherwise return the proper -* SIGBUS. */ -if (i915_terminally_wedged (&dev_priv->gpu_error)) { +/* +* We eat errors when the gpu is terminally wedged to avoid +* userspace unduly crashing (gl has no provisions for mmaps to +* fail). But any other -EIO isn't ours (e.g. swap in failure) +* and so needs to be reported. +*/ +if (!i915_terminally_wedged (&dev_priv->gpu_error)) { ret =VM_FAULT_SIGBUS ;break ; }
Greg Kroah-Hartman
maintainerPATCH 78/357 drm/i915/hdmi: fix hdmi audio state readout
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
commit c84db77010877da6c5da119868ed54c43d59e726 upstream.
Check the correct bit for audio. Seems like a copy-paste error from the start:
commit 9ed109a7b445e3f073d8ea72f888ec80c0532465
Author: Daniel Vetter <[email protected]> Date: Thu Apr 24 23:54:52 2014 +0200
drm/i915: Track has_audio in the pipe config
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82756
--- drivers/gpu/drm/i915/intel_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_hdmi.c +1 -1
@@ -728,7 +728,7 @@ static void intel_hdmi_get_config(structif (tmp &HDMI_MODE_SELECT_HDMI ) pipe_config->has_hdmi_sink = true; -if (tmp &HDMI_MODE_SELECT_HDMI ) +if (tmp &SDVO_AUDIO_ENABLE ) pipe_config->has_audio = true; pipe_config->adjusted_mode.flags |= flags;
Greg Kroah-Hartman
maintainerPATCH 79/357 drm/i915: Dont leak command parser tables on suspend/resume
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brad Volkin <[email protected]>
commit 22cb99af39b5d4aae075a5bc9da615ba245227cd upstream.
Ring init and cleanup are not balanced because we re-init the rings on resume without having cleaned them up on suspend. This leads to the driver leaking the parser's hash tables with a kmemleak signature such as this:
unreferenced object 0xffff880405960980 (size 32):
comm "systemd-udevd", pid 516, jiffies 4294896961 (age 10202.044s) hex dump (first 32 bytes):
d0 85 46 c0 ff ff ff ff 00 00 00 00 00 00 00 00 ..F.............
98 60 28 04 04 88 ff ff 00 00 00 00 00 00 00 00 .`(.............
backtrace:
[<ffffffff81816f9e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff811fa678>] kmem_cache_alloc_trace+0x168/0x2f0
[<ffffffffc03e20a5>] i915_cmd_parser_init_ring+0x2a5/0x3e0 [i915]
[<ffffffffc04088a2>] intel_init_ring_buffer+0x202/0x470 [i915]
[<ffffffffc040c998>] intel_init_vebox_ring_buffer+0x1e8/0x2b0 [i915]
[<ffffffffc03eff59>] i915_gem_init_hw+0x2f9/0x3a0 [i915]
[<ffffffffc03f0057>] i915_gem_init+0x57/0x1d0 [i915]
[<ffffffffc045e26a>] i915_driver_load+0xc0a/0x10e0 [i915]
[<ffffffffc02e0d5d>] drm_dev_register+0xad/0x100 [drm]
[<ffffffffc02e3b9f>] drm_get_pci_dev+0x8f/0x200 [drm]
[<ffffffffc03c934b>] i915_pci_probe+0x3b/0x60 [i915]
[<ffffffff81436725>] local_pci_probe+0x45/0xa0
[<ffffffff81437a69>] pci_device_probe+0xd9/0x130
[<ffffffff81524f4d>] driver_probe_device+0x12d/0x3e0
[<ffffffff815252d3>] __driver_attach+0x93/0xa0
[<ffffffff81522e1b>] bus_for_each_dev+0x6b/0xb0This patch extends the current convention of checking whether a resource is already allocated before allocating it during ring init. Longer term it might make sense to only init the rings once.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83794
--- drivers/gpu/drm/i915/i915_cmd_parser.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/gpu/drm/i915/i915_cmd_parser.c +7 -5
@@ -706,11 +706,13 @@ int i915_cmd_parser_init_ring(struct intBUG_ON (!validate_cmds_sorted (ring, cmd_tables, cmd_table_count));BUG_ON (!validate_regs_sorted (ring)); - ret =init_hash_table (ring, cmd_tables, cmd_table_count); -if (ret) { -DRM_ERROR ("CMD: cmd_parser_init failed!\n" ); -fini_hash_table (ring); -return ret; +if (hash_empty (ring->cmd_hash)) { + ret =init_hash_table (ring, cmd_tables, cmd_table_count); +if (ret) { +DRM_ERROR ("CMD: cmd_parser_init failed!\n" ); +fini_hash_table (ring); +return ret; + } } ring->needs_cmd_parser = true;
Greg Kroah-Hartman
maintainerPATCH 80/357 drm/ast: open key before detect chips
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Y.C. Chen" <[email protected]>
commit 8f372e250ae5f4a5faf87ca1a629d0ae59db65b6 upstream.
Some config settings like 3rd TX chips will not get correctly if the extended reg is protected
--- drivers/gpu/drm/ast/ast_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/ast/ast_main.c +1 -0
@@ -67,6 +67,7 @@ static int ast_detect_chip(struct drm_de {struct ast_private *ast = dev->dev_private;uint32_t data, jreg; +ast_open_key (ast);if (dev->pdev->device ==PCI_CHIP_AST1180 ) { ast->chip =AST1100 ;
Greg Kroah-Hartman
maintainerPATCH 81/357 drm/ast: AST2000 cannot be detected correctly
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Y.C. Chen" <[email protected]>
commit 83502a5d34386f7c6973bc70e1c423f55f5a2e3a upstream.
Type error and cause AST2000 cannot be detected correctly
--- drivers/gpu/drm/ast/ast_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_main.c +1 -1
@@ -105,7 +105,7 @@ static int ast_detect_chip(struct drm_de } ast->vga2_clone = false; }else { - ast->chip =2000 ; + ast->chip =AST2000 ;DRM_INFO ("AST 2000 detected\n" ); } }
Greg Kroah-Hartman
maintainerPATCH 82/357 imx-drm: ipuv3-plane: fix ipu_plane_dpms()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 3a44a2058747d71385eb69691c7f977cb58cc293 upstream.
When unbinding imx-drm, the following oops was observed:
Unable to handle kernel NULL pointer dereference at virtual address 00000004 pgd = e995c000 [00000004] *pgd=4fea5831 Internal error: Oops: 817 [#1] SMP ARM Modules linked in: bnep rfcomm bluetooth nfsd exportfs hid_cypress brcmfmac brcmutil snd_soc_fsl_ssi snd_soc_fsl_spdif imx_pcm_fiq imx_pcm_dma snd_soc_sgtl5000 imx_sdma imx2_wdt imx_ldb(C) imx_thermal snd_soc_imx_sgtl5000 snd_soc_imx_spdif snd_soc_imx_audmux CPU: 1 PID: 779 Comm: bash Tainted: G C 3.16.0-rc2+ #1230 task: ea9eb180 ti: ea378000 task.ti: ea378000 PC is at ipu_dp_put+0x10/0x18 LR is at ipu_plane_dpms+0x60/0x8c pc : [<c0350d20>] lr : [<c04bd9e8>] psr: 200f0013
sp : ea379d80 ip : ea379d90 fp : ea379d8c
r10: 00100100 r9 : 00000000 r8 : 00200200
r7 : e9ba0264 r6 : e9ba01f8 r5 : 00000000 r4 : ea34b800 r3 : 00000000 r2 : 00000000 r1 : 0000009b r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 3995c04a DAC: 00000015 Process bash (pid: 779, stack limit = 0xea378240)
Stack: (0xea379d80 to 0xea37a000) ... Backtrace: [<c0350d10>] (ipu_dp_put) from [<c04bd9e8>] (ipu_plane_dpms+0x60/0x8c) [<c04bd988>] (ipu_plane_dpms) from [<c04bda40>] (ipu_disable_plane+0x2c/0x60) [<c04bda14>] (ipu_disable_plane) from [<c04bda9c>] (ipu_plane_destroy+0x28/0x60) [<c04bda74>] (ipu_plane_destroy) from [<c033ff84>] (drm_mode_config_cleanup+0x1b8/0x250) [<c033fdcc>] (drm_mode_config_cleanup) from [<c04bc234>] (imx_drm_driver_unload+0x44/0x4c) [<c04bc1f0>] (imx_drm_driver_unload) from [<c03394a4>] (drm_dev_unregister+0x2c/0xa0) [<c0339478>] (drm_dev_unregister) from [<c0339f8c>] (drm_put_dev+0x30/0x6c) [<c0339f5c>] (drm_put_dev) from [<c04bc1cc>] (imx_drm_unbind+0x14/0x18) [<c04bc1b8>] (imx_drm_unbind) from [<c03530b4>] (component_master_del+0xbc/0xd8) ... Code: e1a0c00d e92dd800 e24cb004 e3a03000 (e5c03004)
This is caused by a missing check in ipu_plane_dpms for a NULL pointer.
--- drivers/staging/imx-drm/ipuv3-plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/imx-drm/ipuv3-plane.c +2 -1
@@ -281,7 +281,8 @@ static void ipu_plane_dpms(struct ipu_plipu_idmac_put (ipu_plane->ipu_ch);ipu_dmfc_put (ipu_plane->dmfc); -ipu_dp_put (ipu_plane->dp); +if (ipu_plane->dp) +ipu_dp_put (ipu_plane->dp); } }
Greg Kroah-Hartman
maintainerPATCH 83/357 imx-drm: imx-ldb: fix NULL pointer in imx_ldb_unbind()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit d9fdb9fba7ec08769594abede8f78523ed3f025a upstream.
When trying to unbind imx-drm, the following oops was observed from the imx-ldb driver:
Unable to handle kernel NULL pointer dereference at virtual address 0000001c pgd = de954000 [0000001c] *pgd=2e92c831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] SMP ARM Modules linked in: bnep rfcomm bluetooth nfsd exportfs hid_cypress brcmfmac brcmutil snd_soc_fsl_ssi snd_soc_fsl_spdif imx_pcm_fiq imx_pcm_dma imx_ldb(C) imx_thermal imx_sdma imx2_wdt snd_soc_sgtl5000 snd_soc_imx_sgtl5000 snd_soc_imx_spdif snd_soc_imx_audmux CPU: 1 PID: 1228 Comm: bash Tainted: G C 3.16.0-rc2+ #1229 task: ea378d80 ti: de948000 task.ti: de948000 PC is at imx_ldb_unbind+0x1c/0x58 [imx_ldb] LR is at component_unbind+0x38/0x70 pc : [<bf025068>] lr : [<c0353108>] psr: 200f0013
sp : de949da8 ip : de949dc0 fp : de949dbc
r10: e9a44b0c r9 : 00000000 r8 : de949f78
r7 : 00000012 r6 : e9b3f400 r5 : e9b133b8 r4 : e9b13010 r3 : 00000000 r2 : e9b3f400 r1 : ea9a0210 r0 : e9b13020
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 2e95404a DAC: 00000015 Process bash (pid: 1228, stack limit = 0xde948240)
Stack: (0xde949da8 to 0xde94a000) ... Backtrace: [<bf02504c>] (imx_ldb_unbind [imx_ldb]) from [<c0353108>] (component_unbind+0x38/0x70) [<c03530d0>] (component_unbind) from [<c03531d4>] (component_unbind_all+0x94/0xc8) [<c0353140>] (component_unbind_all) from [<c04bc224>] (imx_drm_driver_unload+0x34/0x4c) [<c04bc1f0>] (imx_drm_driver_unload) from [<c03394a4>] (drm_dev_unregister+0x2c/0xa0) [<c0339478>] (drm_dev_unregister) from [<c0339f8c>] (drm_put_dev+0x30/0x6c) [<c0339f5c>] (drm_put_dev) from [<c04bc1cc>] (imx_drm_unbind+0x14/0x18) [<c04bc1b8>] (imx_drm_unbind) from [<c03530b4>] (component_master_del+0xbc/0xd8) ... Code: e5904058 e2840010 e2845fea e59430a0 (e593301c) ---[ end trace 4f211c6dbbcd4963 ]---
This is caused by only having one channel out of the pair configured in DT; the second channel remains uninitialised, but upon unbind, the driver attempts to clean up both, thereby dereferencing a NULL pointer. Avoid this by checking that the second channel is initialised.
--- drivers/staging/imx-drm/imx-ldb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/imx-drm/imx-ldb.c +3 -0
@@ -574,6 +574,9 @@ static void imx_ldb_unbind(struct devicefor (i =0 ; i <2 ; i++) {struct imx_ldb_channel *channel = &imx_ldb->channel[i]; +if (!channel->connector.funcs) +continue ; + channel->connector.funcs->destroy (&channel->connector); channel->encoder.funcs->destroy (&channel->encoder); }
Greg Kroah-Hartman
maintainerPATCH 84/357 drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit f01ea0c3d9db536c64d47922716d8b3b8f21d850 upstream.
The code waiting for fifo idle was incorrect and could possibly spin forever under certain circumstances.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +2 -1
@@ -180,8 +180,9 @@ void vmw_fifo_release(struct vmw_privatemutex_lock (&dev_priv->hw_mutex); +vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC );while (vmw_read (dev_priv,SVGA_REG_BUSY ) !=0 ) -vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC ); + ; dev_priv->last_read_seqno =ioread32 (fifo_mem +SVGA_FIFO_FENCE );
Greg Kroah-Hartman
maintainerPATCH 86/357 drm/radeon: Add missing lines to ci_set_thermal_temperature_range
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Chernovskiy <[email protected]>
commit 6bce8d9772c1c606921a9c99e566eb14202f6669 upstream.
Properly set the thermal min and max temp on CI. Otherwise, we end up setting the thermal ranges to 0 on resume and end up in the lowest power state.
--- drivers/gpu/drm/radeon/ci_dpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/radeon/ci_dpm.c +3 -0
@@ -869,6 +869,9 @@ static int ci_set_thermal_temperature_raWREG32_SMC (CG_THERMAL_CTRL , tmp);#endif + rdev->pm.dpm.thermal.min_temp = low_temp; + rdev->pm.dpm.thermal.max_temp = high_temp; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 87/357 drm/radeon/dpm: select the appropriate vce power state for KV/KB/ML
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c83dec3bb6c38629398b65c231c80978b3e00e14 upstream.
Compare the clock in the limits table to the requested evclk rather than just taking the first value. Improves vce performance in certain cases.
--- drivers/gpu/drm/radeon/kv_dpm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/kv_dpm.c +3 -3
@@ -1438,14 +1438,14 @@ static int kv_update_uvd_dpm(struct radereturn kv_enable_uvd_dpm (rdev, !gate); } -static u8 kv_get_vce_boot_level (struct radeon_device *rdev) +static u8 kv_get_vce_boot_level (struct radeon_device *rdev,u32 evclk) {u8 i;struct radeon_vce_clock_voltage_dependency_table *table = &rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;for (i =0 ; i < table->count; i++) { -if (table->entries[i].evclk >=0 )/* XXX */ +if (table->entries[i].evclk >= evclk)break ; }
@@ -1468,7 +1468,7 @@ static int kv_update_vce_dpm(struct radeif (pi->caps_stable_p_state) pi->vce_boot_level = table->count -1 ;else - pi->vce_boot_level =kv_get_vce_boot_level (rdev); + pi->vce_boot_level =kv_get_vce_boot_level (rdev, radeon_new_state->evclk); ret = kv_copy_bytes_to_smc(rdev, pi->dpm_table_start +
Greg Kroah-Hartman
maintainerPATCH 92/357 drm/radeon: handle broken disabled rb mask gracefully (6xx/7xx) (v2)
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 0a5f6e9d60e71e4b6dbeabd97bc887d6b2b0f0c8 upstream.
This is a port of cedb655a3a7764c3fd946077944383c9e0e68dd4 to older asics. Fixes a possible divide by 0 if the harvest register is invalid.
v2: drop some additional harvest munging.
--- drivers/gpu/drm/radeon/r600.c | 26 ++++++++------------------ drivers/gpu/drm/radeon/rv770.c | 23 ++++++++--------------- 2 files changed, 16 insertions(+), 33 deletions(-)
drivers/gpu/drm/radeon/r600.c +8 -18
@@ -1813,7 +1813,6 @@ static void r600_gpu_init(struct radeon_ {u32 tiling_config;u32 ramcfg; -u32 cc_rb_backend_disable;u32 cc_gc_shader_pipe_config;u32 tmp;int i, j;
@@ -1940,29 +1939,20 @@ static void r600_gpu_init(struct radeon_ } tiling_config |=BANK_SWAPS (1 ); - cc_rb_backend_disable =RREG32 (CC_RB_BACKEND_DISABLE ) &0x00ff0000 ; - tmp =R6XX_MAX_BACKENDS - -r600_count_pipe_bits ((cc_rb_backend_disable >>16 ) &R6XX_MAX_BACKENDS_MASK ); -if (tmp < rdev->config.r600.max_backends) { - rdev->config.r600.max_backends = tmp; - } - cc_gc_shader_pipe_config =RREG32 (CC_GC_SHADER_PIPE_CONFIG ) &0x00ffff00 ; - tmp =R6XX_MAX_PIPES - -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>8 ) &R6XX_MAX_PIPES_MASK ); -if (tmp < rdev->config.r600.max_pipes) { - rdev->config.r600.max_pipes = tmp; - } - tmp =R6XX_MAX_SIMDS - -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>16 ) &R6XX_MAX_SIMDS_MASK ); -if (tmp < rdev->config.r600.max_simds) { - rdev->config.r600.max_simds = tmp; - } tmp = rdev->config.r600.max_simds -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>16 ) &R6XX_MAX_SIMDS_MASK ); rdev->config.r600.active_simds = tmp; disabled_rb_mask = (RREG32 (CC_RB_BACKEND_DISABLE ) >>16 ) &R6XX_MAX_BACKENDS_MASK ; + tmp =0 ; +for (i =0 ; i < rdev->config.r600.max_backends; i++) + tmp |= (1 << i); +/* if all the backends are disabled, fix it up here */ +if ((disabled_rb_mask & tmp) == tmp) { +for (i =0 ; i < rdev->config.r600.max_backends; i++) + disabled_rb_mask &= ~(1 << i); + } tmp = (tiling_config &PIPE_TILING__MASK ) >>PIPE_TILING__SHIFT ; tmp =r6xx_remap_render_backend (rdev, tmp, rdev->config.r600.max_backends,R6XX_MAX_BACKENDS , disabled_rb_mask);
drivers/gpu/drm/radeon/rv770.c +8 -15
@@ -1178,7 +1178,6 @@ static void rv770_gpu_init(struct radeonu32 hdp_host_path_cntl;u32 sq_dyn_gpr_size_simd_ab_0;u32 gb_tiling_config =0 ; -u32 cc_rb_backend_disable =0 ;u32 cc_gc_shader_pipe_config =0 ;u32 mc_arb_ramcfg;u32 db_debug4, tmp;
@@ -1312,21 +1311,7 @@ static void rv770_gpu_init(struct radeonWREG32 (SPI_CONFIG_CNTL ,0 ); } - cc_rb_backend_disable =RREG32 (CC_RB_BACKEND_DISABLE ) &0x00ff0000 ; - tmp =R7XX_MAX_BACKENDS -r600_count_pipe_bits (cc_rb_backend_disable >>16 ); -if (tmp < rdev->config.rv770.max_backends) { - rdev->config.rv770.max_backends = tmp; - } - cc_gc_shader_pipe_config =RREG32 (CC_GC_SHADER_PIPE_CONFIG ) &0xffffff00 ; - tmp =R7XX_MAX_PIPES -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>8 ) &R7XX_MAX_PIPES_MASK ); -if (tmp < rdev->config.rv770.max_pipes) { - rdev->config.rv770.max_pipes = tmp; - } - tmp =R7XX_MAX_SIMDS -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>16 ) &R7XX_MAX_SIMDS_MASK ); -if (tmp < rdev->config.rv770.max_simds) { - rdev->config.rv770.max_simds = tmp; - } tmp = rdev->config.rv770.max_simds -r600_count_pipe_bits ((cc_gc_shader_pipe_config >>16 ) &R7XX_MAX_SIMDS_MASK ); rdev->config.rv770.active_simds = tmp;
@@ -1349,6 +1334,14 @@ static void rv770_gpu_init(struct radeon rdev->config.rv770.tiling_npipes = rdev->config.rv770.max_tile_pipes; disabled_rb_mask = (RREG32 (CC_RB_BACKEND_DISABLE ) >>16 ) &R7XX_MAX_BACKENDS_MASK ; + tmp =0 ; +for (i =0 ; i < rdev->config.rv770.max_backends; i++) + tmp |= (1 << i); +/* if all the backends are disabled, fix it up here */ +if ((disabled_rb_mask & tmp) == tmp) { +for (i =0 ; i < rdev->config.rv770.max_backends; i++) + disabled_rb_mask &= ~(1 << i); + } tmp = (gb_tiling_config &PIPE_TILING__MASK ) >>PIPE_TILING__SHIFT ; tmp =r6xx_remap_render_backend (rdev, tmp, rdev->config.rv770.max_backends,R7XX_MAX_BACKENDS , disabled_rb_mask);
Greg Kroah-Hartman
maintainerPATCH 94/357 drm/radeon/dpm: set the thermal type properly for special configs
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit ff4377924f7e587c61bcbc704eafecf6c7bd2e00 upstream.
On systems with special thermal configurations make sure we make note of the thermal setup. This is required for proper firmware configuration on these systems.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +19 -7
@@ -2281,19 +2281,31 @@ static void radeon_atombios_add_pplib_th (controller->ucFanParameters & ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); rdev->pm.int_thermal_type =THERMAL_TYPE_KV ; - }else if ((controller->ucType == -ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO ) || - (controller->ucType == -ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL ) || - (controller->ucType == -ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL )) { -DRM_INFO ("Special thermal controller config\n" ); + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO ) { +DRM_INFO ("External GPIO thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EXTERNAL_GPIO ; + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL ) { +DRM_INFO ("ADT7473 with internal thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_ADT7473_WITH_INTERNAL ; + }else if (controller->ucType == +ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL ) { +DRM_INFO ("EMC2103 with internal thermal controller %s fan control\n" , + (controller->ucFanParameters & +ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EMC2103_WITH_INTERNAL ; }else if (controller->ucType <ARRAY_SIZE (pp_lib_thermal_controller_names)) {DRM_INFO ("Possible %s thermal controller at 0x%02x %s fan control\n" , pp_lib_thermal_controller_names[controller->ucType], controller->ucI2cAddress >>1 , (controller->ucFanParameters &ATOM_PP_FANPARAMETERS_NOFAN ) ?"without" :"with" ); + rdev->pm.int_thermal_type =THERMAL_TYPE_EXTERNAL ; i2c_bus =radeon_lookup_i2c_gpio (rdev, controller->ucI2cLine); rdev->pm.i2c_bus =radeon_i2c_lookup (rdev, &i2c_bus);if (rdev->pm.i2c_bus) {
Greg Kroah-Hartman
maintainerPATCH 95/357 drm/radeon: add connector quirk for fujitsu board
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 1952f24d0fa6292d65f886887af87ba8ac79b3ba upstream.
Vbios connector table lists non-existent VGA port.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=83184
--- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/radeon/radeon_atombios.c +7 -0
@@ -447,6 +447,13 @@ static bool radeon_atom_apply_quirks(str } } +/* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ +if ((dev->pdev->device ==0x9805 ) && + (dev->pdev->subsystem_vendor ==0x1734 ) && + (dev->pdev->subsystem_device ==0x11bd )) { +if (*connector_type ==DRM_MODE_CONNECTOR_VGA ) +return false; + }return true; }
Greg Kroah-Hartman
maintainerPATCH 99/357 drm/radeon/dpm: fix resume on mullins
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 39da038479a81a35a7f8af3ab2c90effd5c8eff1 upstream.
Need to properly disable nb dpm on dpm disable.
--- drivers/gpu/drm/radeon/kv_dpm.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/kv_dpm.c +21 -7
@@ -33,6 +33,8 @@#define KV_MINIMUM_ENGINE_CLOCK 800#define SMC_RAM_END 0x40000 +static int kv_enable_nb_dpm (struct radeon_device *rdev, +bool enable);static void kv_init_graphics_levels (struct radeon_device *rdev);static int kv_calculate_ds_divider (struct radeon_device *rdev);static int kv_calculate_nbps_level_settings (struct radeon_device *rdev);
@@ -1295,6 +1297,9 @@ void kv_dpm_disable(struct radeon_device {kv_smc_bapm_enable (rdev, false); +if (rdev->family ==CHIP_MULLINS ) +kv_enable_nb_dpm (rdev, false); +/* powerup blocks */ kv_dpm_powergate_acp (rdev, false);kv_dpm_powergate_samu (rdev, false);
@@ -1769,15 +1774,24 @@ static int kv_update_dfs_bypass_settingsreturn ret; } -static int kv_enable_nb_dpm (struct radeon_device *rdev) +static int kv_enable_nb_dpm (struct radeon_device *rdev, +bool enable) {struct kv_power_info *pi =kv_get_pi (rdev);int ret =0 ; -if (pi->enable_nb_dpm && !pi->nb_dpm_enabled) { - ret =kv_notify_message_to_smu (rdev, PPSMC_MSG_NBDPM_Enable); -if (ret ==0 ) - pi->nb_dpm_enabled = true; +if (enable) { +if (pi->enable_nb_dpm && !pi->nb_dpm_enabled) { + ret =kv_notify_message_to_smu (rdev, PPSMC_MSG_NBDPM_Enable); +if (ret ==0 ) + pi->nb_dpm_enabled = true; + } + }else { +if (pi->enable_nb_dpm && pi->nb_dpm_enabled) { + ret =kv_notify_message_to_smu (rdev, PPSMC_MSG_NBDPM_Disable); +if (ret ==0 ) + pi->nb_dpm_enabled = false; + } }return ret;
@@ -1864,7 +1878,7 @@ int kv_dpm_set_power_state(struct radeon }kv_update_sclk_t (rdev);if (rdev->family ==CHIP_MULLINS ) -kv_enable_nb_dpm (rdev); +kv_enable_nb_dpm (rdev, true); } }else {if (pi->enable_dpm) {
@@ -1889,7 +1903,7 @@ int kv_dpm_set_power_state(struct radeon }kv_update_acp_boot_level (rdev);kv_update_sclk_t (rdev); -kv_enable_nb_dpm (rdev); +kv_enable_nb_dpm (rdev, true); } }
Greg Kroah-Hartman
maintainerPATCH 101/357 xtensa: replace IOCTL code definitions with constants
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.
This fixes userspace code that builds on other architectures but fails on xtensa due to references to structures that other architectures don't refer to. E.g. this fixes the following issue with python-2.7.8:
python-2.7.8/Modules/termios.c:861:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERGETMULTI", TIOCSERGETMULTI},
python-2.7.8/Modules/termios.c:870:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERSETMULTI", TIOCSERSETMULTI},
python-2.7.8/Modules/termios.c:900:24: error: invalid application
of 'sizeof' to incomplete type 'struct tty_struct' {"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},
--- arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/xtensa/include/uapi/asm/ioctls.h +10 -9
@@ -28,17 +28,17 @@#define TCSETSW 0x5403#define TCSETSF 0x5404 -#define TCGETA _IOR('t', 23, struct termio) -#define TCSETA _IOW('t', 24, struct termio) -#define TCSETAW _IOW('t', 25, struct termio) -#define TCSETAF _IOW('t', 28, struct termio) +#define TCGETA 0x80127417/* _IOR('t', 23, struct termio) */ +#define TCSETA 0x40127418/* _IOW('t', 24, struct termio) */ +#define TCSETAW 0x40127419/* _IOW('t', 25, struct termio) */ +#define TCSETAF 0x4012741C/* _IOW('t', 28, struct termio) */ #define TCSBRK _IO('t', 29)#define TCXONC _IO('t', 30)#define TCFLSH _IO('t', 31) -#define TIOCSWINSZ _IOW('t', 103, struct winsize) -#define TIOCGWINSZ _IOR('t', 104, struct winsize) +#define TIOCSWINSZ 0x40087467/* _IOW('t', 103, struct winsize) */ +#define TIOCGWINSZ 0x80087468/* _IOR('t', 104, struct winsize) */ #define TIOCSTART _IO('t', 110)/* start output, like ^Q */ #define TIOCSTOP _IO('t', 111)/* stop output, like ^S */ #define TIOCOUTQ _IOR('t', 115, int)/* output queue size */
@@ -88,7 +88,6 @@#define TIOCSETD _IOW('T', 35, int)#define TIOCGETD _IOR('T', 36, int)#define TCSBRKP _IOW('T', 37, int)/* Needed for POSIX tcsendbreak()*/ -#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct)/* For debugging only*/ #define TIOCSBRK _IO('T', 39)/* BSD compatibility */ #define TIOCCBRK _IO('T', 40)/* BSD compatibility */ #define TIOCGSID _IOR('T', 41, pid_t)/* Return the session ID of FD*/
@@ -114,8 +113,10 @@#define TIOCSERGETLSR _IOR('T', 89, unsigned int)/* Get line status reg. */ /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */ # define TIOCSER_TEMT 0x01/* Transmitter physically empty */ -#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct)/* Get multiport config */ -#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct)/* Set multiport config */ +#define TIOCSERGETMULTI 0x80a8545a/* Get multiport config */ +/* _IOR('T', 90, struct serial_multiport_struct) */ +#define TIOCSERSETMULTI 0x40a8545b/* Set multiport config */ +/* _IOW('T', 91, struct serial_multiport_struct) */ #define TIOCMIWAIT _IO('T', 92)/* wait for a change on serial input line(s) */ #define TIOCGICOUNT 0x545D/* read serial port inline interrupt counts */
Greg Kroah-Hartman
maintainerPATCH 102/357 xtensa: fix address checks in dma_{alloc,free}_coherent
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Douglas <[email protected]>
commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.
Virtual address is translated to the XCHAL_KSEG_CACHED region in the dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE range.
Change check for end of the range from 'addr >= X' to 'addr > X - 1' to handle the case of X == 0.
Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.
--- arch/xtensa/kernel/pci-dma.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/xtensa/kernel/pci-dma.c +6 -6
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si/* We currently don't support coherent memory outside KSEG */ -if (ret <XCHAL_KSEG_CACHED_VADDR - || ret >=XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (ret <XCHAL_KSEG_CACHED_VADDR || + ret >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );if (ret !=0 ) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);void dma_free_coherent (struct device *hwdev,size_t size,void *vaddr,dma_addr_t dma_handle) { -long addr=(long )vaddr+XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; +unsigned long addr = (unsigned long )vaddr + +XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; -if (addr <0 || addr >=XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (addr <XCHAL_KSEG_CACHED_VADDR || + addr >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );free_pages (addr,get_order (size)); }
Greg Kroah-Hartman
maintainerPATCH 103/357 xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.
With SMP and a lot of debug options enabled task_struct::thread gets out of reach of s32i/l32i instructions with base pointing at task_struct, breaking build with the following messages:
arch/xtensa/kernel/entry.S: Assembler messages:
arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048' arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040' arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'
Change base to point to task_struct::thread in such cases. Don't use a10 in _switch_to to save/restore prev pointer as a2 is not clobbered.
--- arch/xtensa/include/asm/uaccess.h | 5 +++++ arch/xtensa/kernel/entry.S | 12 ++++++++---- 2 files changed, 13 insertions(+), 4 deletions(-)
arch/xtensa/include/asm/uaccess.h +5 -0
@@ -52,7 +52,12 @@*/ .macro get_fs ad, sp GET_CURRENT(\ad,\sp) +#if THREAD_CURRENT_DS >1020 + addi \ad, \ad, TASK_THREAD + l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD +#else l32i \ad, \ad, THREAD_CURRENT_DS +#endif .endm/*
arch/xtensa/kernel/entry.S +8 -4
@@ -1820,7 +1820,6 @@ ENTRY(_switch_to) entry a1, 16 - mov a10, a2 # preserve 'prev' (a2) mov a11, a3 # and 'next' (a3) l32i a4, a2, TASK_THREAD_INFO
@@ -1828,8 +1827,14 @@ ENTRY(_switch_to) save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER - s32i a0, a10, THREAD_RA # save return address - s32i a1, a10, THREAD_SP # save stack pointer +#if THREAD_RA > 1020 || THREAD_SP > 1020 + addi a10, a2, TASK_THREAD + s32i a0, a10, THREAD_RA - TASK_THREAD # save return address + s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer +#else + s32i a0, a2, THREAD_RA # save return address + s32i a1, a2, THREAD_SP # save stack pointer +#endif /* Disable ints while we manipulate the stack pointer. */
@@ -1870,7 +1875,6 @@ ENTRY(_switch_to) load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER wsr a14, ps - mov a2, a10 # return 'prev' rsync retw
Greg Kroah-Hartman
maintainerPATCH 104/357 xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.
Current definition of TLBTEMP_BASE_2 is always 32K above the TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER) to determine TLBTEMP region where the fault happened. The size of the TLBTEMP region is also checked incorrectly: not 64K, but twice data cache way size (whicht may as well be less than the instruction cache way size).
Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size. Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or the instruction cache way size, and use it to determine if the second level TLB miss occured in the TLBTEMP region.
Practical occurence of page faults in the TLBTEMP area is extremely rare, this code can be tested by deletion of all w[di]tlb instructions in the tlbtemp_mapping region.
--- arch/xtensa/include/asm/pgtable.h | 7 ++++++- arch/xtensa/kernel/entry.S | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/xtensa/include/asm/pgtable.h +6 -1
@@ -67,7 +67,12 @@#define VMALLOC_START 0xC0000000#define VMALLOC_END 0xC7FEFFFF#define TLBTEMP_BASE_1 0xC7FF0000 -#define TLBTEMP_BASE_2 0xC7FF8000 +#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE) +#if 2 *DCACHE_WAY_SIZE >ICACHE_WAY_SIZE +#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE) +#else +#define TLBTEMP_SIZE ICACHE_WAY_SIZE +#endif /* * For the Xtensa architecture, the PTE layout is as follows:
arch/xtensa/kernel/entry.S +1 -1
@@ -1565,7 +1565,7 @@ ENTRY(fast_second_level_miss) rsr a0, excvaddr bltu a0, a3, 2f - addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT)) + addi a1, a0, -TLBTEMP_SIZE bgeu a1, a3, 2f /* Check if we have to restore an ITLB mapping. */
Greg Kroah-Hartman
maintainerPATCH 105/357 xtensa: fix a6 and a7 handling in fast_syscall_xtensa
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.
Remove restoring a6 on some return paths and instead modify and restore it in a single place, using symbolic name.
Correctly restore a7 from PT_AREG7 in case of illegal a6 value.
--- arch/xtensa/kernel/entry.S | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
arch/xtensa/kernel/entry.S +5 -7
@@ -1001,9 +1001,8 @@ ENTRY(fast_syscall_xtensa) movi a7, 4 # sizeof(unsigned int) access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp - addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1 - _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill - _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp + _bgeui a6, SYS_XTENSA_COUNT, .Lill + _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp /* Fall through for ATOMIC_CMP_SWP. */
@@ -1015,27 +1014,26 @@ TRY s32i a5, a3, 0 # different, modify l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 1 # and return 1 - addi a6, a6, 1 # restore a6 (really necessary?) rfe 1: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 0 # return 0 (note that we cannot set - addi a6, a6, 1 # restore a6 (really necessary?) rfe .Lnswp: /* Atomic set, add, and exg_add. */ TRY l32i a7, a3, 0 # orig + addi a6, a6, -SYS_XTENSA_ATOMIC_SET add a0, a4, a7 # + arg moveqz a0, a4, a6 # set + addi a6, a6, SYS_XTENSA_ATOMIC_SET TRY s32i a0, a3, 0 # write new value mov a0, a2 mov a2, a7 l32i a7, a0, PT_AREG7 # restore a7 l32i a0, a0, PT_AREG0 # restore a0 - addi a6, a6, 1 # restore a6 (really necessary?) rfe CATCH
@@ -1044,7 +1042,7 @@ CATCH movi a2, -EFAULT rfe -.Lill: l32i a7, a2, PT_AREG0 # restore a7 +.Lill: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, -EINVAL rfe
Greg Kroah-Hartman
maintainerPATCH 106/357 locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit e0b760ff71be168d4e623f7c3612e98902ab93e9 upstream.
The argument to locks_unlink_lock can't be just any pointer to a pointer. It must be a pointer to the fl_next field in the previous lock in the list.
--- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/locks.c +1 -1
@@ -1595,7 +1595,7 @@ static int generic_add_lease(struct filesmp_mb (); error =check_conflicting_open (dentry, arg);if (error) -locks_unlink_lock (flp); +locks_unlink_lock (before); out:if (is_deleg)mutex_unlock (&inode->i_mutex);
Greg Kroah-Hartman
maintainerPATCH 107/357 ufs: fix deadlocks introduced by sb mutex merge
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Khoroshilov <[email protected]>
commit 9ef7db7f38d0472dd9c444e42d5c5175ccbe5451 upstream.
Commit 0244756edc4b ("ufs: sb mutex merge + mutex_destroy") introduces deadlocks in ufs_new_inode() and ufs_free_inode().
Most callers of that functions acqure the mutex by themselves and ufs_{new,free}_inode() do that via lock_ufs(),
i.e we have an unavoidable double lock.
The patch proposes to resolve the issue by making sure that ufs_{new,free}_inode() are not called with the mutex held.
Found by Linux Driver Verification project (linuxtesting.org).
--- fs/ufs/inode.c | 7 ++----- fs/ufs/namei.c | 14 ++++++-------- 2 files changed, 8 insertions(+), 13 deletions(-)
fs/ufs/inode.c +2 -5
@@ -902,9 +902,6 @@ void ufs_evict_inode(struct inode * inodinvalidate_inode_buffers (inode);clear_inode (inode); -if (want_delete) { -lock_ufs (inode->i_sb); -ufs_free_inode (inode); -unlock_ufs (inode->i_sb); - } +if (want_delete) +ufs_free_inode (inode); }
fs/ufs/namei.c +6 -8
@@ -126,12 +126,12 @@ static int ufs_symlink (struct inode * dif (l > sb->s_blocksize) goto out_notlocked; -lock_ufs (dir->i_sb); inode =ufs_new_inode (dir,S_IFLNK |S_IRWXUGO ); err =PTR_ERR (inode);if (IS_ERR (inode)) - goto out; + goto out_notlocked; +lock_ufs (dir->i_sb);if (l >UFS_SB (sb)->s_uspi->s_maxsymlinklen) {/* slow symlink */ inode->i_op = &ufs_symlink_inode_operations;
@@ -181,13 +181,9 @@ static int ufs_mkdir(struct inode * dir,struct inode * inode;int err; -lock_ufs (dir->i_sb); -inode_inc_link_count (dir); - inode =ufs_new_inode (dir,S_IFDIR |mode); - err =PTR_ERR (inode);if (IS_ERR (inode)) - goto out_dir; +return PTR_ERR (inode); inode->i_op = &ufs_dir_inode_operations; inode->i_fop = &ufs_dir_operations;
@@ -195,6 +191,9 @@ static int ufs_mkdir(struct inode * dir,inode_inc_link_count (inode); +lock_ufs (dir->i_sb); +inode_inc_link_count (dir); + err =ufs_make_empty (inode, dir);if (err) goto out_fail;
@@ -212,7 +211,6 @@ out_fail:inode_dec_link_count (inode);inode_dec_link_count (inode);iput (inode); -out_dir:inode_dec_link_count (dir);unlock_ufs (dir->i_sb); goto out;
Greg Kroah-Hartman
maintainerPATCH 108/357 usb: gadget: f_rndis: fix interface id for OS descriptors
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Pietrasiewicz <[email protected]>
commit 4546527350c3c508554dff53e9086e9d3de0b97b upstream.
f->os_desc_table[0].if_id is zero by default. If the actual id happens to be different then no Feature Descriptors will be returned to the host for this interface, so assign if_id as soon as it is known.
--- drivers/usb/gadget/f_rndis.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/f_rndis.c +4 -0
@@ -727,6 +727,10 @@ rndis_bind(struct usb_configuration *c, rndis_control_intf.bInterfaceNumber = status; rndis_union_desc.bMasterInterface0 = status; +if (cdev->use_os_string) + f->os_desc_table[0 ].if_id = + rndis_iad_descriptor.bFirstInterface; + status =usb_interface_id (c, f);if (status <0 ) goto fail;
Greg Kroah-Hartman
maintainerPATCH 109/357 USB: serial: pl2303: add device id for ztek device
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <[email protected]>
commit 91fcb1ce420e0a5f8d92d556d7008a78bc6ce1eb upstream.
This adds a new device id to the pl2303 driver for the ZTEK device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -45,6 +45,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -22,6 +22,7 @@#define PL2303_PRODUCT_ID_GPRS 0x0609#define PL2303_PRODUCT_ID_HCR331 0x331a#define PL2303_PRODUCT_ID_MOTOROLA 0x0307 +#define PL2303_PRODUCT_ID_ZTEK 0xe1f1#define ATEN_VENDOR_ID 0x0557#define ATEN_VENDOR_ID2 0x0547
Greg Kroah-Hartman
maintainerPATCH 110/357 USB: serial: fix potential stack buffer overflow
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d979e9f9ecab04c1ecca741370e30a8a498893f5 upstream.
Make sure to verify the maximum number of endpoints per type to avoid writing beyond the end of a stack-allocated array.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of endpoints of a certain type reported by a device did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/usb/serial/usb-serial.c +22 -10
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_bulk_in (endpoint)) {/* we found a bulk in endpoint */ dev_dbg (ddev,"found bulk in on endpoint %d\n" , i); - bulk_in_endpoint[num_bulk_in] = endpoint; - ++num_bulk_in; +if (num_bulk_in <MAX_NUM_PORTS ) { + bulk_in_endpoint[num_bulk_in] = endpoint; + ++num_bulk_in; + } }if (usb_endpoint_is_bulk_out (endpoint)) {/* we found a bulk out endpoint */ dev_dbg (ddev,"found bulk out on endpoint %d\n" , i); - bulk_out_endpoint[num_bulk_out] = endpoint; - ++num_bulk_out; +if (num_bulk_out <MAX_NUM_PORTS ) { + bulk_out_endpoint[num_bulk_out] = endpoint; + ++num_bulk_out; + } }if (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in on endpoint %d\n" , i); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = + endpoint; + ++num_interrupt_in; + } }if (usb_endpoint_is_int_out (endpoint)) {/* we found an interrupt out endpoint */ dev_dbg (ddev,"found interrupt out on endpoint %d\n" , i); - interrupt_out_endpoint[num_interrupt_out] = endpoint; - ++num_interrupt_out; +if (num_interrupt_out <MAX_NUM_PORTS ) { + interrupt_out_endpoint[num_interrupt_out] = + endpoint; + ++num_interrupt_out; + } } }
@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in for Prolific device on separate interface\n" ); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = endpoint; + ++num_interrupt_in; + } } } }
Greg Kroah-Hartman
maintainerPATCH 111/357 USB: sisusb: add device id for Magic Control USB video
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <[email protected]>
commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.
I have a j5 create (JUA210) USB 2 video device and adding it device id to SIS USB video gets it to work.
--- drivers/usb/misc/sisusbvga/sisusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/sisusbvga/sisusb.c +1 -0
@@ -3250,6 +3250,7 @@ static const struct usb_device_id sisusb { USB_DEVICE(0x0711, 0x0918) }, { USB_DEVICE(0x0711, 0x0920) }, { USB_DEVICE(0x0711, 0x0950) }, + { USB_DEVICE(0x0711, 0x5200) }, { USB_DEVICE(0x182d, 0x021c) }, { USB_DEVICE(0x182d, 0x0269) }, { }
Greg Kroah-Hartman
maintainerPATCH 112/357 USB: serial: fix potential heap buffer overflow
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.
Make sure to verify the number of ports requested by subdriver to avoid writing beyond the end of fixed-size array in interface data.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of ports requested by a subdriver (which could have been determined from device descriptors) did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/usb-serial.c +5 -0
@@ -862,6 +862,11 @@ static int usb_serial_probe(struct usb_i num_ports = type->num_ports; } +if (num_ports >MAX_NUM_PORTS ) { +dev_warn (ddev,"too many ports requested: %d\n" , num_ports); + num_ports =MAX_NUM_PORTS ; + } + serial->num_ports = num_ports; serial->num_bulk_in = num_bulk_in; serial->num_bulk_out = num_bulk_out;
Greg Kroah-Hartman
maintainerPATCH 113/357 USB: option: reduce interrupt-urb logging verbosity
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit f0e4cba2534cd88476dff920727c81350130f3c5 upstream.
Do not log normal interrupt-urb shutdowns as errors.
The option driver has always been logging any nonzero interrupt-urb status as an error, including when the urb is killed during normal operation.
Commit 9096f1fbba91 ("USB: usb_wwan: fix potential NULL-deref at resume") moved the interrupt urb submission from port probe and release to open and close, thus potentially increasing the number of these false-positive error messages dramatically.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1916,6 +1916,8 @@ static void option_instat_callback(strucdev_dbg (dev,"%s: type %x req %x\n" , __func__, req_pkt->bRequestType, req_pkt->bRequest); } + }else if (status == -ENOENT || status == -ESHUTDOWN ) { +dev_dbg (dev,"%s: urb stopped: %d\n" , __func__, status); }else dev_err (dev,"%s: error %d\n" , __func__, status);
Greg Kroah-Hartman
maintainerPATCH 114/357 USB: option: add VIA Telecom CDS7 chipset device id
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brennan Ashton <[email protected]>
commit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.
This VIA Telecom baseband processor is used is used by by u-blox in both the FW2770 and FW2760 products and may be used in others as well.
This patch has been tested on both of these modem versions.
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -494,6 +494,10 @@ static void option_instat_callback(struc#define INOVIA_VENDOR_ID 0x20a6#define INOVIA_SEW858 0x1105 +/* VIA Telecom */ +#define VIATELECOM_VENDOR_ID 0x15eb +#define VIATELECOM_PRODUCT_CDS7 0x0001 +/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {OPTION_BLACKLIST_NONE =0 ,
@@ -1724,6 +1728,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 115/357 Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 63a901c06e3c2c45bd601916fe04e870e9ccae1e upstream.
This reverts commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev").
Move the IDs of the devices that were previously driven by the option driver back to that driver.
As several users have reported, the zte_ev driver is causing random disconnects as well as reconnect failures.
A closer analysis of the zte_ev setup code reveals that it consists of standard CDC requests (SET/GET_LINE_CODING and SET_CONTROL_LINE_STATE) but unfortunately fails to get some of those right. In particular, as reported by Liu Lei, it fails to lower DTR/RTS on close. It also appears that the control requests lack the interface argument.
Note that the zte_ev driver is based on code (once) distributed by ZTE that still appears to originally have been reverse-engineered and bolted onto the generic driver.
Since line control is already handled properly by the option driver, and the SET/GET_LINE_CODING requests appears to be redundant (amounts to a SET 9600 8N1), this is a first step in ultimately removing the redundant zte_ev driver.
Note that AC2726 had already been moved back to option, and that some IDs were in the device table of both drivers prior to the commit being reverted.
--- drivers/usb/serial/option.c | 24 +++++++++++++++++++++--- drivers/usb/serial/zte_ev.c | 18 ------------------ 2 files changed, 21 insertions(+), 21 deletions(-)
drivers/usb/serial/option.c +21 -3
@@ -275,8 +275,12 @@ static void option_instat_callback(struc#define ZTE_PRODUCT_MF622 0x0001#define ZTE_PRODUCT_MF628 0x0015#define ZTE_PRODUCT_MF626 0x0031 -#define ZTE_PRODUCT_MC2718 0xffe8#define ZTE_PRODUCT_AC2726 0xfff1 +#define ZTE_PRODUCT_CDMA_TECH 0xfffe +#define ZTE_PRODUCT_AC8710T 0xffff +#define ZTE_PRODUCT_MC2718 0xffe8 +#define ZTE_PRODUCT_AD3812 0xffeb +#define ZTE_PRODUCT_MC2716 0xffed#define BENQ_VENDOR_ID 0x04a5#define BENQ_PRODUCT_H10 0x4068
@@ -531,10 +535,18 @@ static const struct option_blacklist_inf .reserved = BIT(4), }; +static const struct option_blacklist_info zte_ad3812_z_blacklist = { + .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), +}; +static const struct option_blacklist_info zte_mc2718_z_blacklist = { .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ) |BIT (4 ), }; +static const struct option_blacklist_info zte_mc2716_z_blacklist = { + .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct option_blacklist_info huawei_cdc12_blacklist = { .reserved =BIT (1 ) |BIT (2 ), };
@@ -1074,6 +1086,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1548,13 +1561,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, -/* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
drivers/usb/serial/zte_ev.c +0 -18
@@ -272,27 +272,9 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { -/* AC8710, AC8710T */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffff ,0xff ,0xff ,0xff ) }, -/* AC8700 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xfffe ,0xff ,0xff ,0xff ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x19d2 ,0xfffc ) }, - {USB_DEVICE (0x19d2 ,0xfffb ) }, -/* AC8710_V3 */ - {USB_DEVICE (0x19d2 ,0xfff6 ) }, - {USB_DEVICE (0x19d2 ,0xfff7 ) }, - {USB_DEVICE (0x19d2 ,0xfff8 ) }, - {USB_DEVICE (0x19d2 ,0xfff9 ) }, - {USB_DEVICE (0x19d2 ,0xffee ) }, -/* AC2716, MC2716 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffed ,0xff ,0xff ,0xff ) }, -/* AD3812 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffeb ,0xff ,0xff ,0xff ) }, - {USB_DEVICE (0x19d2 ,0xffec ) }, {USB_DEVICE (0x05C6 ,0x3197 ) }, - {USB_DEVICE (0x05C6 ,0x6000 ) }, {USB_DEVICE (0x05C6 ,0x9008 ) }, { }, };
Greg Kroah-Hartman
maintainerPATCH 116/357 USB: zte_ev: remove duplicate Gobi PID
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 95be5739588c56a9327e477aa0ba3c81c5cf8631 upstream.
Remove dublicate Gobi PID 0x9008 which is already handled by the qcserial driver since commit f05932c0caf4 ("USB: qcserial: Add extra device IDs").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -275,7 +275,6 @@ static const struct usb_device_id id_tab/* MG880 */ { USB_DEVICE(0x19d2, 0xfffd) }, { USB_DEVICE(0x05C6, 0x3197) }, - { USB_DEVICE(0x05C6, 0x9008) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 117/357 USB: zte_ev: remove duplicate Qualcom PID
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 754eb21c0bbbbc4b8830a9a864b286323b84225f upstream.
Remove dublicate Qualcom PID 0x3197 which is already handled by the moto-modem driver since commit 6986a978eec7 ("USB: add new moto_modem driver for some Morotola phones").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -274,7 +274,6 @@ static void zte_ev_usb_serial_close(strustatic const struct usb_device_id id_table[] = {/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x05C6 ,0x3197 ) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 120/357 usb: phy: tegra: Avoid use of sizeof(void)
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
commit 9ce9ec95fb9b82e09b55a52f1bb8a362bf8f74d8 upstream.
The PHY configuration is stored in an opaque "config" field, but when allocating the structure, its proper size needs to be known. In the case of UTMI, the proper structure is tegra_utmip_config of which a local variable already exists, so we can use that to obtain the size from.
Fixes the following warning from the sparse checker:
drivers/usb/phy/phy-tegra-usb.c:882:17: warning: expression using sizeof(void)
--- drivers/usb/phy/phy-tegra-usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/phy/phy-tegra-usb.c +2 -2
@@ -881,8 +881,8 @@ static int utmi_phy_probe(struct tegra_ureturn -ENOMEM ; } - tegra_phy->config =devm_kzalloc (&pdev->dev, -sizeof (*tegra_phy->config),GFP_KERNEL ); + tegra_phy->config =devm_kzalloc (&pdev->dev,sizeof (*config), +GFP_KERNEL );if (!tegra_phy->config) {dev_err (&pdev->dev,"unable to allocate memory for USB UTMIP config\n" );
Greg Kroah-Hartman
maintainerPATCH 121/357 usb: phy: twl4030-usb: Fix lost interrupts after ID pin goes down
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 85601b8d81e24ce9ae2d31e93f35468ab7616b18 upstream.
Commit 249751f22380 ("usb: phy: twl4030-usb: poll for ID disconnect") added twl4030_id_workaround_work() to deal with lost interrupts after ID pin goes down. Looks like commit f1ddc24c9e33 ("usb: phy:
twl4030-usb: remove *set_suspend* and *phy_init* ops") changed things around for the generic phy framework, and delayed work no longer got called except initially during boot.
The PHY connect and disconnect interrupts for twl4030-usb are not working after disconnecting a USB-A cable from the board, and the deeper idle states for omap are blocked as the USB controller stays busy.
The issue can be solved by calling delayed work from twl4030_usb_irq() when ID pin is down and the PHY is not asleep like we already do in twl4030_id_workaround_work().
But as both twl4030_usb_irq() and twl4030_id_workaround_work() already do pretty much the same thing, let's call twl4030_usb_irq() from twl4030_id_workaround_work() instead of adding some more duplicate code. We also must call sysfs_notify() only when we have an interrupt and not from the delayed work as notified by Grazvydas Ignotas <[email protected]>.
--- drivers/phy/phy-twl4030-usb.c | 33 ++++++++++----------------------- 1 file changed, 10 insertions(+), 23 deletions(-)
drivers/phy/phy-twl4030-usb.c +10 -23
@@ -560,7 +560,15 @@ static irqreturn_t twl4030_usb_irq(int i*/ omap_musb_mailbox (status); } -sysfs_notify (&twl->dev->kobj,NULL ,"vbus" ); + +/* don't schedule during sleep - irq works right then */ +if (status ==OMAP_MUSB_ID_GROUND && !twl->asleep) { +cancel_delayed_work (&twl->id_workaround_work); +schedule_delayed_work (&twl->id_workaround_work,HZ ); + } + +if (irq) +sysfs_notify (&twl->dev->kobj,NULL ,"vbus" );return IRQ_HANDLED ; }
@@ -569,29 +577,8 @@ static void twl4030_id_workaround_work(s { struct twl4030_usb *twl = container_of(work, struct twl4030_usb, id_workaround_work.work); -enum omap_musb_vbus_id_status status; -bool status_changed = false; - - status =twl4030_usb_linkstat (twl); - -spin_lock_irq (&twl->lock); -if (status >=0 && status != twl->linkstat) { - twl->linkstat = status; - status_changed = true; - } -spin_unlock_irq (&twl->lock); -if (status_changed) { -dev_dbg (twl->dev,"handle missing status change to %d\n" , - status); -omap_musb_mailbox (status); - } - -/* don't schedule during sleep - irq works right then */ -if (status ==OMAP_MUSB_ID_GROUND && !twl->asleep) { -cancel_delayed_work (&twl->id_workaround_work); -schedule_delayed_work (&twl->id_workaround_work,HZ ); - } +twl4030_usb_irq (0 , twl); }static int twl4030_phy_init (struct phy *phy)
Greg Kroah-Hartman
maintainerPATCH 122/357 usb: phy: twl4030-usb: Fix regressions to runtime PM on omaps
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4 upstream.
Commit 30a70b026b4cd ("usb: musb: fix obex in g_nokia.ko causing kernel panic") attempted to fix runtime PM handling for PHYs that are on the I2C bus. Commit 3063a12be2b0 ("usb: musb: fix PHY power on/off") then changed things around to enable of PHYs that rely on runtime PM.
These changes however broke idling of the PHY and causes at least 100 mW extra power consumption on omaps, which is a lot with the idle power consumption being below 10 mW range on many devices.
As calling phy_power_on/off from runtime PM calls in the USB causes complicated issues with I2C connected PHYs, let's just let the PHY do it's own runtime PM as needed. This leaves out the dependency between PHYs and USB controller drivers for runtime PM.
Let's fix the regression for twl4030-usb by adding minimal runtime PM support. This allows idling the PHY on disconnect.
Note that we are changing to use standard runtime PM handling for twl4030_phy_init() as that function just checks the state and does not initialize the PHY. The PHY won't get initialized until in twl4030_phy_power_on().
--- drivers/phy/phy-twl4030-usb.c | 88 ++++++++++++++++++++++++++++++------------ 1 file changed, 63 insertions(+), 25 deletions(-)
drivers/phy/phy-twl4030-usb.c +63 -25
@@ -34,6 +34,7 @@#include <linux/delay.h> #include <linux/usb/otg.h> #include <linux/phy/phy.h> +#include <linux/pm_runtime.h> #include <linux/usb/musb-omap.h> #include <linux/usb/ulpi.h> #include <linux/i2c/twl.h>
@@ -422,37 +423,55 @@ static void twl4030_phy_power(struct twl } } -static int twl4030_phy_power_off (struct phy *phy) +static int twl4030_usb_runtime_suspend (struct device *dev) { -struct twl4030_usb *twl =phy_get_drvdata (phy); +struct twl4030_usb *twl =dev_get_drvdata (dev); +dev_dbg (twl->dev,"%s\n" , __func__);if (twl->asleep)return 0 ;twl4030_phy_power (twl,0 ); twl->asleep =1 ; -dev_dbg (twl->dev,"%s\n" , __func__); +return 0 ; } -static void __twl4030_phy_power_on (struct twl4030_usb *twl) +static int twl4030_usb_runtime_resume (struct device *dev) { +struct twl4030_usb *twl =dev_get_drvdata (dev); + +dev_dbg (twl->dev,"%s\n" , __func__); +if (!twl->asleep) +return 0 ; +twl4030_phy_power (twl,1 ); -twl4030_i2c_access (twl,1 ); -twl4030_usb_set_mode (twl, twl->usb_mode); -if (twl->usb_mode ==T2_USB_MODE_ULPI ) -twl4030_i2c_access (twl,0 ); + twl->asleep =0 ; + +return 0 ; +} + +static int twl4030_phy_power_off (struct phy *phy) +{ +struct twl4030_usb *twl =phy_get_drvdata (phy); + +dev_dbg (twl->dev,"%s\n" , __func__); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); + +return 0 ; }static int twl4030_phy_power_on (struct phy *phy) {struct twl4030_usb *twl =phy_get_drvdata (phy); -if (!twl->asleep) -return 0 ; -__twl4030_phy_power_on (twl); - twl->asleep =0 ;dev_dbg (twl->dev,"%s\n" , __func__); +pm_runtime_get_sync (twl->dev); +twl4030_i2c_access (twl,1 ); +twl4030_usb_set_mode (twl, twl->usb_mode); +if (twl->usb_mode ==T2_USB_MODE_ULPI ) +twl4030_i2c_access (twl,0 );/* * XXX When VBUS gets driven after musb goes to A mode,
@@ -558,6 +577,16 @@ static irqreturn_t twl4030_usb_irq(int i* USB_LINK_VBUS state. musb_hdrc won't care until it * starts to handle softconnect right. */ +if ((status ==OMAP_MUSB_VBUS_VALID ) || + (status ==OMAP_MUSB_ID_GROUND )) { +if (twl->asleep) +pm_runtime_get_sync (twl->dev); + }else { +if (!twl->asleep) { +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); + } + }omap_musb_mailbox (status); }
@@ -586,22 +615,17 @@ static int twl4030_phy_init(struct phy *struct twl4030_usb *twl =phy_get_drvdata (phy);enum omap_musb_vbus_id_status status; -/* -* Start in sleep state, we'll get called through set_suspend() -* callback when musb is runtime resumed and it's time to start. -*/ -__twl4030_phy_power (twl,0 ); - twl->asleep =1 ; - +pm_runtime_get_sync (twl->dev); status =twl4030_usb_linkstat (twl); twl->linkstat = status; -if (status ==OMAP_MUSB_ID_GROUND || status ==OMAP_MUSB_VBUS_VALID ) { +if (status ==OMAP_MUSB_ID_GROUND || status ==OMAP_MUSB_VBUS_VALID )omap_musb_mailbox (twl->linkstat); -twl4030_phy_power_on (phy); - }sysfs_notify (&twl->dev->kobj,NULL ,"vbus" ); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put_autosuspend (twl->dev); +return 0 ; }
@@ -637,6 +661,11 @@ static const struct phy_ops ops = { .owner = THIS_MODULE, }; +static const struct dev_pm_ops twl4030_usb_pm_ops = { +SET_RUNTIME_PM_OPS (twl4030_usb_runtime_suspend, + twl4030_usb_runtime_resume,NULL ) +}; +static int twl4030_usb_probe (struct platform_device *pdev) {struct twl4030_usb_data *pdata =dev_get_platdata (&pdev->dev);
@@ -713,6 +742,11 @@ static int twl4030_usb_probe(struct platATOMIC_INIT_NOTIFIER_HEAD (&twl->phy.notifier); +pm_runtime_use_autosuspend (&pdev->dev); +pm_runtime_set_autosuspend_delay (&pdev->dev,2000 ); +pm_runtime_enable (&pdev->dev); +pm_runtime_get_sync (&pdev->dev); +/* Our job is to use irqs and status from the power module * to keep the transceiver disabled when nothing's connected. *
@@ -731,6 +765,9 @@ static int twl4030_usb_probe(struct platreturn status; } +pm_runtime_mark_last_busy (&pdev->dev); +pm_runtime_put_autosuspend (twl->dev); +dev_info (&pdev->dev,"Initialized TWL4030 USB module\n" );return 0 ; }
@@ -740,6 +777,7 @@ static int twl4030_usb_remove(struct plastruct twl4030_usb *twl =platform_get_drvdata (pdev);int val; +pm_runtime_get_sync (twl->dev);cancel_delayed_work (&twl->id_workaround_work);device_remove_file (twl->dev, &dev_attr_vbus);
@@ -759,9 +797,8 @@ static int twl4030_usb_remove(struct pla/* disable complete OTG block */ twl4030_usb_clear_bits (twl,POWER_CTRL ,POWER_CTRL_OTG_ENAB ); - -if (!twl->asleep) -twl4030_phy_power (twl,0 ); +pm_runtime_mark_last_busy (twl->dev); +pm_runtime_put (twl->dev);return 0 ; }
@@ -779,6 +816,7 @@ static struct platform_driver twl4030_us .remove = twl4030_usb_remove, .driver = { .name = "twl4030_usb", + .pm = &twl4030_usb_pm_ops, .owner = THIS_MODULE, .of_match_table = of_match_ptr(twl4030_usb_id_table), },
Greg Kroah-Hartman
maintainerPATCH 123/357 usb: chipidea: msm: Use USB PHY API to control PHY state
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ivan T. Ivanov" <[email protected]>
commit ea290056d7c46f7781ff13801048ed957b96d1a5 upstream.
PHY drivers keep track of the current state of the hardware, so don't change PHY settings under it.
--- drivers/usb/chipidea/ci_hdrc_msm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/chipidea/ci_hdrc_msm.c +1 -5
@@ -20,7 +20,6 @@static void ci_hdrc_msm_notify_event (struct ci_hdrc *ci,unsigned event) {struct device *dev = ci->gadget.dev.parent; -int val;switch (event) {case CI_HDRC_CONTROLLER_RESET_EVENT :
@@ -34,10 +33,7 @@ static void ci_hdrc_msm_notify_event(str* Put the transceiver in non-driving mode. Otherwise host * may not detect soft-disconnection. */ - val =usb_phy_io_read (ci->transceiver,ULPI_FUNC_CTRL ); - val &= ~ULPI_FUNC_CTRL_OPMODE_MASK ; - val |=ULPI_FUNC_CTRL_OPMODE_NONDRIVING ; -usb_phy_io_write (ci->transceiver, val,ULPI_FUNC_CTRL ); +usb_phy_notify_disconnect (ci->transceiver,USB_SPEED_UNKNOWN );break ;default :dev_dbg (dev,"unknown ci_hdrc event\n" );
Greg Kroah-Hartman
maintainerPATCH 124/357 usb: chipidea: msm: Initialize PHY on reset event
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ivan T. Ivanov" <[email protected]>
commit 233c7daf4eecd1e992dc42591182cd4a892e687c upstream.
Initialize USB PHY after every Link controller reset
--- drivers/usb/chipidea/ci_hdrc_msm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/chipidea/ci_hdrc_msm.c +1 -0
@@ -26,6 +26,7 @@ static void ci_hdrc_msm_notify_event(strdev_dbg (dev,"CI_HDRC_CONTROLLER_RESET_EVENT received\n" );writel (0 ,USB_AHBBURST );writel (0 ,USB_AHBMODE ); +usb_phy_init (ci->transceiver);break ;case CI_HDRC_CONTROLLER_STOPPED_EVENT :dev_dbg (dev,"CI_HDRC_CONTROLLER_STOPPED_EVENT received\n" );
Greg Kroah-Hartman
maintainerPATCH 125/357 USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taylor Braun-Jones <[email protected]>
commit 9c491c372d677b6420e0f8c6361fe422791662cc upstream.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -952,6 +952,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },/* Infineon Devices */ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, +/* GE Healthcare devices */ + { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1385,3 +1385,9 @@* ekey biometric systems GmbH (http://ekey.net/) */ #define FTDI_EKEY_CONV_USB_PID 0xCB08/* Converter USB */ + +/* +* GE Healthcare devices +*/ +#define GE_HEALTHCARE_VID 0x1901 +#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
Greg Kroah-Hartman
maintainerPATCH 126/357 USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ee444609dbae8afee420c3243ce4c5f442efb622 upstream.
Add device id for NOVITUS Bono E thermal printer.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -741,6 +741,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -837,6 +837,12 @@#define TELLDUS_TELLSTICK_PID 0x0C30/* RF control dongle 433 MHz using FT232RL */ /* +* NOVITUS printers +*/ +#define NOVITUS_VID 0x1a28 +#define NOVITUS_BONO_E_PID 0x6010 + +/* * RT Systems programming cables for various ham radios */ #define RTSYSTEMS_VID 0x2100/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 127/357 USB: zte_ev: fix removed PIDs
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3096691011d01cef56b243a5e65431405c07d574 upstream.
Add back some PIDs that were mistakingly remove when reverting commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"), which apparently did more than its commit message claimed in that it not only moved some PIDs from option to zte_ev but also added some new ones.
devices to zte_ev"")
--- drivers/usb/serial/zte_ev.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/zte_ev.c +8 -0
@@ -272,6 +272,14 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { + {USB_DEVICE (0x19d2 ,0xffec ) }, + {USB_DEVICE (0x19d2 ,0xffee ) }, + {USB_DEVICE (0x19d2 ,0xfff6 ) }, + {USB_DEVICE (0x19d2 ,0xfff7 ) }, + {USB_DEVICE (0x19d2 ,0xfff8 ) }, + {USB_DEVICE (0x19d2 ,0xfff9 ) }, + {USB_DEVICE (0x19d2 ,0xfffb ) }, + {USB_DEVICE (0x19d2 ,0xfffc ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, { },
Greg Kroah-Hartman
maintainerPATCH 128/357 uwb: init beacon cache entry before registering uwb device
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Pugliese <[email protected]>
commit 675f0ab2fe5a0f7325208e60b617a5f32b86d72c upstream.
Make sure the uwb_dev->bce entry is set before calling uwb_dev_add in uwbd_dev_onair so that usermode will only see the device after it is properly initialized. This fixes a kernel panic that can occur if usermode tries to access the IEs sysfs attribute of a UWB device before the driver has had a chance to set the beacon cache entry.
--- drivers/uwb/lc-dev.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/uwb/lc-dev.c +9 -4
@@ -431,16 +431,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, s uwb_dev->mac_addr = *bce->mac_addr; uwb_dev->dev_addr = bce->dev_addr;dev_set_name (&uwb_dev->dev,"%s" , macbuf); + +/* plug the beacon cache */ + bce->uwb_dev = uwb_dev; + uwb_dev->bce = bce; +uwb_bce_get (bce);/* released in uwb_dev_sys_release() */ + result =uwb_dev_add (uwb_dev, &rc->uwb_dev.dev, rc);if (result <0 ) {dev_err (dev,"new device %s: cannot instantiate device\n" , macbuf); goto error_dev_add; } -/* plug the beacon cache */ - bce->uwb_dev = uwb_dev; - uwb_dev->bce = bce; -uwb_bce_get (bce);/* released in uwb_dev_sys_release() */ +dev_info (dev,"uwb device (mac %s dev %s) connected to %s %s\n" , macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,dev_name (rc->uwb_dev.dev.parent));
@@ -448,6 +451,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, sreturn ; error_dev_add: + bce->uwb_dev =NULL ; +uwb_bce_put (bce);kfree (uwb_dev);return ; }
Greg Kroah-Hartman
maintainerPATCH 129/357 usb: host: xhci: fix compliance mode workaround
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 96908589a8b2584b1185f834d365f5cc360e8226 upstream.
Commit 71c731a (usb: host: xhci: Fix Compliance Mode on SN65LVP3502CP Hardware) implemented a workaround for a known issue with Texas Instruments' USB 3.0 redriver IC but it left a condition where any xHCI host would be taken out of reset if port was placed in compliance mode and there was no device connected to the port.
That condition would trigger a fake connection to a non-existent device so that usbcore would trigger a warm reset of the port, thus taking the link out of reset.
This has the side-effect of preventing any xHCI host connected to a Linux machine from starting and running the USB 3.0 Electrical Compliance Suite because the port will mysteriously taken out of compliance mode and, thus, xHCI won't step through the necessary compliance patterns for link validation.
This patch fixes the issue by just adding a missing check for XHCI_COMP_MODE_QUIRK inside xhci_hub_report_usb3_link_state() when PORT_CAS isn't set.
This patch should be backported to all kernels containing commit 71c731a.
--- drivers/usb/host/xhci-hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +5 -3
@@ -468,7 +468,8 @@ static void xhci_hub_report_usb2_link_st }/* Updates Link Status for super Speed port */ -static void xhci_hub_report_usb3_link_state (u32 *status,u32 status_reg) +static void xhci_hub_report_usb3_link_state (struct xhci_hcd *xhci, +u32 *status,u32 status_reg) {u32 pls = status_reg &PORT_PLS_MASK ;
@@ -507,7 +508,8 @@ static void xhci_hub_report_usb3_link_st* in which sometimes the port enters compliance mode * caused by a delay on the host-device negotiation. */ -if (pls ==USB_SS_PORT_LS_COMP_MOD ) +if ((xhci->quirks &XHCI_COMP_MODE_QUIRK ) && + (pls ==USB_SS_PORT_LS_COMP_MOD )) pls |=USB_PORT_STAT_CONNECTION ; }
@@ -666,7 +668,7 @@ static u32 xhci_get_port_status(struct u }/* Update Port Link State */ if (hcd->speed ==HCD_USB3 ) { -xhci_hub_report_usb3_link_state (&status, raw_port_status); +xhci_hub_report_usb3_link_state (xhci, &status, raw_port_status);/* * Verify if all USB3 Ports Have entered U0 already. * Delete Compliance Mode Timer if so.
Greg Kroah-Hartman
maintainerPATCH 130/357 xhci: Fix null pointer dereference if xhci initialization fails
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit c207e7c50f31113c24a9f536fcab1e8a256985d7 upstream.
If xhci initialization fails before the roothub bandwidth domains (xhci->rh_bw[i]) are allocated it will oops when trying to access rh_bw members in xhci_mem_cleanup().
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1819,7 +1819,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xxhci_cleanup_command_queue (xhci); num_ports =HCS_MAX_PORTS (xhci->hcs_params1); -for (i =0 ; i < num_ports; i++) { +for (i =0 ; i < num_ports && xhci->rh_bw; i++) {struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;for (j =0 ; j <XHCI_MAX_INTERVAL ; j++) {struct list_head *ep = &bwt->interval_bw[j].endpoints;
Greg Kroah-Hartman
maintainerPATCH 131/357 usb: xhci: Fix OOPS in xhci error handling code
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Cooper <[email protected]>
commit 0eda06c7c17ae48d7db69beef57f6e2b20bc3c72 upstream.
The xhci driver will OOPS on resume from S2/S3 if dma_alloc_coherent() is out of memory. This is a result of two things:
1. xhci_mem_cleanup() in xhci-mem.c free's xhci->lpm_command if it's not NULL, but doesn't set it to NULL after the free.
2. xhci_mem_cleanup() is called twice on resume, once for normal restart and once from xhci_mem_init() if dma_alloc_coherent() fails, resulting in a free of xhci->lpm_command that has already been freed. The fix is to set xhci->lpm_command to NULL after freeing it.
--- drivers/usb/host/xhci-mem.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-mem.c +1 -0
@@ -1812,6 +1812,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xif (xhci->lpm_command)xhci_free_command (xhci, xhci->lpm_command); + xhci->lpm_command =NULL ;if (xhci->cmd_ring)xhci_ring_free (xhci, xhci->cmd_ring); xhci->cmd_ring =NULL ;
Greg Kroah-Hartman
maintainerPATCH 132/357 xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 96044694b8511bc2b04df0776b4ba295cfe005c0 upstream.
Resuming from hibernate (S4) will restart and re-initialize xHC.
The device contexts are freed and will be re-allocated later during device reset.
Usb core will disable link pm in device resume before device reset, which will try to change the max exit latency, accessing the device contexts before they are re-allocated.
There is no need to zero (disable) the max exit latency when disabling hw lpm for a freshly re-initialized xHC. So check that device context exists before doing anything. The max exit latency will be set again after device reset when usb core enables the link pm.
--- drivers/usb/host/xhci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +10 -2
@@ -3982,13 +3982,21 @@ static int __maybe_unused xhci_change_maint ret;spin_lock_irqsave (&xhci->lock, flags); -if (max_exit_latency == xhci->devs[udev->slot_id]->current_mel) { + + virt_dev = xhci->devs[udev->slot_id]; + +/* +* virt_dev might not exists yet if xHC resumed from hibernate (S4) and +* xHC was re-initialized. Exit latency will be set later after +* hub_port_finish_reset() is done and xhci->devs[] are re-allocated +*/ + +if (!virt_dev || max_exit_latency == virt_dev->current_mel) {spin_unlock_irqrestore (&xhci->lock, flags);return 0 ; }/* Attempt to issue an Evaluate Context command to change the MEL. */ - virt_dev = xhci->devs[udev->slot_id]; command = xhci->lpm_command; ctrl_ctx =xhci_get_input_control_ctx (xhci, command->in_ctx);if (!ctrl_ctx) {
Greg Kroah-Hartman
maintainerPATCH 133/357 usb: hub: take hub->hdev reference when processing from eventlist
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <[email protected]>
commit c605f3cdff53a743f6d875b76956b239deca1272 upstream.
During surprise device hotplug removal tests, it was observed that hub_events may try to call usb_lock_device on a device that has already been freed. Protect the usb_device by taking out a reference (under the hub_event_lock) when hub_events pulls it off the list, returning the reference after hub_events is finished using it.
--- drivers/usb/core/hub.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +3 -1
@@ -5008,9 +5008,10 @@ static void hub_events(void) hub = list_entry(tmp, struct usb_hub, event_list);kref_get (&hub->kref); + hdev = hub->hdev; +usb_get_dev (hdev);spin_unlock_irq (&hub_event_lock); - hdev = hub->hdev; hub_dev = hub->intfdev; intf =to_usb_interface (hub_dev); dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
@@ -5123,6 +5124,7 @@ static void hub_events(void)usb_autopm_put_interface (intf); loop_disconnected:usb_unlock_device (hdev); +usb_put_dev (hdev);kref_put (&hub->kref, hub_release); }/* end while (1) */
Greg Kroah-Hartman
maintainerPATCH 134/357 USB: document the u flag for usb-storage quirks parameter
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit b6089f19fe0cec625b5963a851a07c3e412c27c8 upstream.
Commit d24d481b7d36 (usb-storage: Modify and export adjust_quirks so that it can be used by uas) added the 'u' flag to the quirks module parameter for usb-storage, but neglected to update the documentation. This patch adds the documentation.
--- Documentation/kernel-parameters.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/kernel-parameters.txt +1 -0
@@ -3478,6 +3478,7 @@ bytes respectively. Such letter suffixes bogus residue values); s = SINGLE_LUN (the device has only one Logical Unit); + u = IGNORE_UAS (don't bind to the uas driver); w = NO_WP_DETECT (don't test whether the medium is write-protected). Example: quirks=0419:aaf5:rl,0421:0433:rc
Greg Kroah-Hartman
maintainerPATCH 135/357 storage: Add single-LUN quirk for Jaz USB Adapter
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c66f1c62e85927357e7b3f4c701614dcb5c498a2 upstream.
The Iomega Jaz USB Adapter is a SCSI-USB converter cable. The hardware seems to be identical to e.g. the Microtech XpressSCSI, using a Shuttle/ SCM chip set. However its firmware restricts it to only work with Jaz drives.
On connecting the cable a message like this appears four times in the log:
reset full speed USB device number 4 using uhci_hcd
That's non-fatal but the US_FL_SINGLE_LUN quirk fixes it.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -741,6 +741,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_SINGLE_LUN ), +UNUSUAL_DEV (0x059b ,0x0040 ,0x0100 ,0x0100 , +"Iomega" , +"Jaz USB Adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_SINGLE_LUN ), +/* Reported by <[email protected]> */ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, "LaCie",
Greg Kroah-Hartman
maintainerPATCH 136/357 USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit 67d365a57a51fb9dece6a5ceb504aa381cae1e5b upstream.
The Adaptec USBConnect 2000 is another SCSI-USB converter which uses Shuttle Technology/SCM Microsystems chips. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have a USBConnect 2000, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the product uses.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -101,6 +101,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x "PhotoSmart R707", USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY), +UNUSUAL_DEV (0x03f3 ,0x0001 ,0x0000 ,0x9999 , +"Adaptec" , +"USBConnect 2000" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Sebastian Kapfer <[email protected]> * and Olaf Hering <[email protected]> (different bcd's, same vendor/product) * for USB floppies that need the SINGLE_LUN enforcement.
Greg Kroah-Hartman
maintainerPATCH 137/357 USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit b6a3ed677991558ce09046397a7c4d70530d15b3 upstream.
Hi,
The Ariston Technologies iConnect 025 and iConnect 050 (also known as e.g. iSCSI-50) are SCSI-USB converters which use Shuttle Technology/SCM Microsystems chips. Only the connectors differ; both have the same USB ID. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have one of these, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the products use.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -1986,6 +1986,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), +UNUSUAL_DEV (0x1822 ,0x0001 ,0x0000 ,0x9999 , +"Ariston Technologies" , +"iConnect USB to SCSI adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Hans de Goede <[email protected]> * These Appotech controllers are found in Picture Frames, they provide a * (buggy) emulation of a cdrom drive which contains the windows software
Greg Kroah-Hartman
maintainerPATCH 138/357 USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c80b4495c61636edc58fe1ce300f09f24db28e10 upstream.
This patch adds quirks for Entrega Technologies (later Xircom PortGear) USB- SCSI converters. They use Shuttle Technology EUSB-01/EUSB-S1 chips. The US_FL_SCM_MULT_TARG quirk is needed to allow multiple devices on the SCSI chain to be accessed. Without it only the (single) device with SCSI ID 0 can be used.
The standalone converter sold by Entrega had model number U1-SC25. Xircom acquired Entrega and re-branded the product line PortGear. The PortGear USB to SCSI Converter (model PGSCSI) is internally identical to the Entrega product, but later models may use a different USB ID. The Entrega-branded units have USB ID 1645:0007, as does my Xircom PGSCSI, but the Windows and Macintosh drivers also support 085A:0028.
Entrega also sold the "Mac USB Dock", which provides two USB ports, a Mac (8-pin mini-DIN) serial port and a SCSI port. It appears to the computer as a four-port hub, USB-serial, and USB-SCSI converters. The USB-SCSI part may have initially used the same ID as the standalone U1-SC25 (1645:0007), but later production used 085A:0026.
My Xircom PortGear PGSCSI has bcdDevice=0x0100. Units with bcdDevice=0x0133 probably also exist.
This patch adds quirks for 1645:0007, 085A:0026 and 085A:0028. The Windows driver INF file also mentions 085A:0032 "PortStation SCSI Module", but I couldn't find any mention of that actually existing in the wild; perhaps it was cancelled before release?
--- drivers/usb/storage/unusual_devs.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/usb/storage/unusual_devs.h +20 -0
@@ -1125,6 +1125,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), +UNUSUAL_DEV (0x085a ,0x0026 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB-SCSI (Mac USB Dock)" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), + +UNUSUAL_DEV (0x085a ,0x0028 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Submitted by Jan De Luyck <[email protected]> */ UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000, "CITIZEN",
@@ -1964,6 +1976,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), +/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) +* and Mac USB Dock USB-SCSI */ +UNUSUAL_DEV (0x1645 ,0x0007 ,0x0100 ,0x0133 , +"Entrega Technologies" , +"USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Reported by Robert Schedel <[email protected]> * Note: this is a 'super top' device like the above 14cd/6600 device */ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
Greg Kroah-Hartman
maintainerPATCH 139/357 USB: EHCI: unlink QHs even after the controller has stopped
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7312b5ddd47fee2356baa78c5516ef8e04eed452 upstream.
Old code in ehci-hcd tries to expedite disabling endpoints after the controller has stopped, by destroying the endpoint's associated QH without first unlinking the QH. This was necessary back when the driver wasn't so careful about keeping track of the controller's state.
But now we are careful about it, and the driver knows that when the controller isn't running, no unlinking delay is needed. Furthermore, skipping the unlink step will trigger a BUG() in qh_destroy() when the preceding QH is released, because the link pointer will be non-NULL.
Removing the lines that skip the unlinking step and go directly to QH_STATE_IDLE fixes the problem.
--- drivers/usb/host/ehci-hcd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/host/ehci-hcd.c +0 -2
@@ -965,8 +965,6 @@ rescan: } qh->exception =1 ; -if (ehci->rh_state <EHCI_RH_RUNNING ) - qh->qh_state =QH_STATE_IDLE ;switch (qh->qh_state) {case QH_STATE_LINKED :WARN_ON (!list_empty (&qh->qtd_list));
Greg Kroah-Hartman
maintainerPATCH 140/357 usb: dwc3: core: fix order of PM runtime calls
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit fed33afce0eda44a46ae24d93aec1b5198c0bac4 upstream.
Currently, we disable pm_runtime before all register accesses are done, this is dangerous and might lead to abort exceptions due to the driver trying to access a register which is clocked by a clock which was long gated.
Fix that by moving pm_runtime_put_sync() and pm_runtime_disable() as the last thing we do before returning from our ->remove() method.
--- drivers/usb/dwc3/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/dwc3/core.c +3 -3
@@ -791,15 +791,15 @@ static int dwc3_remove(struct platform_dphy_power_off (dwc->usb2_generic_phy);phy_power_off (dwc->usb3_generic_phy); -pm_runtime_put_sync (&pdev->dev); -pm_runtime_disable (&pdev->dev); -dwc3_debugfs_exit (dwc);dwc3_core_exit_mode (dwc);dwc3_event_buffers_cleanup (dwc);dwc3_free_event_buffers (dwc);dwc3_core_exit (dwc); +pm_runtime_put_sync (&pdev->dev); +pm_runtime_disable (&pdev->dev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 141/357 usb: dwc3: core: fix ordering for PHY suspend
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit dc99f16f076559235c92d3eb66d03d1310faea08 upstream.
We can't suspend the PHYs before dwc3_core_exit_mode() has been called, that's because the host and/or device sides might still need to communicate with the far end link partner.
--- drivers/usb/dwc3/core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/dwc3/core.c +5 -4
@@ -786,15 +786,16 @@ static int dwc3_remove(struct platform_d {struct dwc3 *dwc =platform_get_drvdata (pdev); +dwc3_debugfs_exit (dwc); +dwc3_core_exit_mode (dwc); +dwc3_event_buffers_cleanup (dwc); +dwc3_free_event_buffers (dwc); +usb_phy_set_suspend (dwc->usb2_phy,1 );usb_phy_set_suspend (dwc->usb3_phy,1 );phy_power_off (dwc->usb2_generic_phy);phy_power_off (dwc->usb3_generic_phy); -dwc3_debugfs_exit (dwc); -dwc3_core_exit_mode (dwc); -dwc3_event_buffers_cleanup (dwc); -dwc3_free_event_buffers (dwc);dwc3_core_exit (dwc);pm_runtime_put_sync (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 142/357 usb: dwc3: omap: fix ordering for runtime pm calls
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 81a60b7f5c143ab3cdcd9943c9b4b7c63c32fc31 upstream.
we don't to gate clocks until our children are
done with their remove path.
--- drivers/usb/dwc3/dwc3-omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-omap.c +1 -1
@@ -576,9 +576,9 @@ static int dwc3_omap_remove(struct platfif (omap->extcon_id_dev.edev)extcon_unregister_interest (&omap->extcon_id_dev);dwc3_omap_disable_irqs (omap); +device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); -device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 143/357 usb: dwc2/gadget: fix phy disable sequence
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Debski <[email protected]>
commit 0655314be0d9c54ad5f63500219485c6a9d9e5e2 upstream.
When the driver is removed s3c_hsotg_phy_disable is called three times instead of once. This results in decreasing of the phy reference counter below zero and thus consecutive inserts of the module fails.
This patch removes calls to s3c_hsotg_phy_disable from s3c_hsotg_remove and s3c_hsotg_udc_stop.
s3c_hsotg_udc_stop is called from udc-core.c only after usb_gadget_disconnect, which in turn calls s3c_hsotg_pullup, which already calls s3c_hsotg_phy_disable.
s3c_hsotg_remove must be called only after udc_stop, so there is no point in disabling phy once again there.
--- drivers/usb/dwc2/gadget.c | 3 --- 1 file changed, 3 deletions(-)
drivers/usb/dwc2/gadget.c +0 -3
@@ -2898,8 +2898,6 @@ static int s3c_hsotg_udc_stop(struct usbspin_lock_irqsave (&hsotg->lock, flags); -s3c_hsotg_phy_disable (hsotg); -if (!driver) hsotg->driver =NULL ;
@@ -3586,7 +3584,6 @@ static int s3c_hsotg_remove(struct platfusb_gadget_unregister_driver (hsotg->driver); } -s3c_hsotg_phy_disable (hsotg);if (hsotg->phy)phy_exit (hsotg->phy);clk_disable_unprepare (hsotg->clk);
Greg Kroah-Hartman
maintainerPATCH 144/357 usb: dwc2/gadget: fix phy initialization sequence
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Debski <[email protected]>
commit ca2c5ba80f823a38c4aae506e2f03c1afb076b0a upstream.
In the Generic PHY Framework a NULL phy is considered to be a valid phy thus the "if (hsotg->phy)" check does not give us the information whether the Generic PHY Framework is used.
In addition to the above this patch also removes phy_init from probe and phy_exit from remove. This is not necessary when init/exit is done in the s3c_hsotg_phy_enable/disable functions.
--- drivers/usb/dwc2/gadget.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
drivers/usb/dwc2/gadget.c +12 -15
@@ -2748,13 +2748,14 @@ static void s3c_hsotg_phy_enable(structdev_dbg (hsotg->dev,"pdev 0x%p\n" , pdev); -if (hsotg->phy) { -phy_init (hsotg->phy); -phy_power_on (hsotg->phy); - }else if (hsotg->uphy) +if (hsotg->uphy)usb_phy_init (hsotg->uphy); -else if (hsotg->plat->phy_init) +else if (hsotg->plat && hsotg->plat->phy_init) hsotg->plat->phy_init (pdev, hsotg->plat->phy_type); +else { +phy_init (hsotg->phy); +phy_power_on (hsotg->phy); + } }/**
@@ -2768,13 +2769,14 @@ static void s3c_hsotg_phy_disable(struct {struct platform_device *pdev =to_platform_device (hsotg->dev); -if (hsotg->phy) { -phy_power_off (hsotg->phy); -phy_exit (hsotg->phy); - }else if (hsotg->uphy) +if (hsotg->uphy)usb_phy_shutdown (hsotg->uphy); -else if (hsotg->plat->phy_exit) +else if (hsotg->plat && hsotg->plat->phy_exit) hsotg->plat->phy_exit (pdev, hsotg->plat->phy_type); +else { +phy_power_off (hsotg->phy); +phy_exit (hsotg->phy); + } }/**
@@ -3489,9 +3491,6 @@ static int s3c_hsotg_probe(struct platfoif (hsotg->phy && (phy_get_bus_width (phy) ==8 )) hsotg->phyif =GUSBCFG_PHYIF8 ; -if (hsotg->phy) -phy_init (hsotg->phy); -/* usb phy enable */ s3c_hsotg_phy_enable (hsotg);
@@ -3584,8 +3583,6 @@ static int s3c_hsotg_remove(struct platfusb_gadget_unregister_driver (hsotg->driver); } -if (hsotg->phy) -phy_exit (hsotg->phy);clk_disable_unprepare (hsotg->clk);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 145/357 usb: dwc2/gadget: break infinite loop in endpoint disable code
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit e0cbe595db72b037260bbda77106f6811a1ebb1d upstream.
This patch fixes possible freeze caused by infinite loop in interrupt context.
--- drivers/usb/dwc2/gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc2/gadget.c +1 -0
@@ -1650,6 +1650,7 @@ static void s3c_hsotg_txfifo_flush(strucdev_err (hsotg->dev,"%s: timeout flushing fifo (GRSTCTL=%08x)\n" , __func__, val); +break ; }udelay (1 );
Greg Kroah-Hartman
maintainerPATCH 146/357 usb: dwc2/gadget: do not call disconnect method in pullup
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit b510df5a36c066da3a188f4ade3404118b63c6de upstream.
This leads to potential spinlock recursion in composite framework, other udc drivers also don't call it directly from pullup method.
--- drivers/usb/dwc2/gadget.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/dwc2/gadget.c +0 -1
@@ -2943,7 +2943,6 @@ static int s3c_hsotg_pullup(struct usb_gs3c_hsotg_phy_enable (hsotg);s3c_hsotg_core_init (hsotg); }else { -s3c_hsotg_disconnect (hsotg);s3c_hsotg_phy_disable (hsotg); }
Greg Kroah-Hartman
maintainerPATCH 147/357 usb: dwc2/gadget: delay enabling irq once hardware is configured properly
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit eb3c56c5ccdd252940cb0ec0541fcdc94894bd8d upstream.
This patch fixes kernel panic/interrupt storm/etc issues if bootloader left s3c-hsotg module in enabled state. Now interrupt handler is enabled only after proper configuration of hardware registers.
--- drivers/usb/dwc2/gadget.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/usb/dwc2/gadget.c +11 -7
@@ -3444,13 +3444,6 @@ static int s3c_hsotg_probe(struct platfo hsotg->irq = ret; - ret =devm_request_irq (&pdev->dev, hsotg->irq, s3c_hsotg_irq,0 , -dev_name (dev), hsotg); -if (ret <0 ) { -dev_err (dev,"cannot claim IRQ\n" ); - goto err_clk; - } -dev_info (dev,"regs %p, irq %d\n" , hsotg->regs, hsotg->irq); hsotg->gadget.max_speed =USB_SPEED_HIGH ;
@@ -3498,6 +3491,17 @@ static int s3c_hsotg_probe(struct platfos3c_hsotg_init (hsotg);s3c_hsotg_hw_cfg (hsotg); + ret =devm_request_irq (&pdev->dev, hsotg->irq, s3c_hsotg_irq,0 , +dev_name (dev), hsotg); +if (ret <0 ) { +s3c_hsotg_phy_disable (hsotg); +clk_disable_unprepare (hsotg->clk); +regulator_bulk_disable (ARRAY_SIZE (hsotg->supplies), + hsotg->supplies); +dev_err (dev,"cannot claim IRQ\n" ); + goto err_clk; + } +/* hsotg->num_of_eps holds number of EPs other than ep0 */ if (hsotg->num_of_eps ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 148/357 usb: dwc2/gadget: avoid disabling ep0
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Baldyga <[email protected]>
commit 604eac3c0c69e98f2fd0133305f9e777418f1d3b upstream.
Endpoint 0 should not be disabled, so we start loop counter from number 1.
--- drivers/usb/dwc2/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc2/gadget.c +1 -1
@@ -2896,7 +2896,7 @@ static int s3c_hsotg_udc_stop(struct usbreturn -ENODEV ;/* all endpoints should be shutdown */ -for (ep =0 ; ep < hsotg->num_of_eps; ep++) +for (ep =1 ; ep < hsotg->num_of_eps; ep++)s3c_hsotg_ep_disable (&hsotg->eps[ep].ep);spin_lock_irqsave (&hsotg->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 149/357 ACPI / RTC: Fix CMOS RTC opregion handler accesses to wrong addresses
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Lee, Chun-Yi" <[email protected]>
commit 9389f46e9782ea5e56fbd7b2e59ba7c08f3ba86b upstream.
The value64 parameter is an u64 point that used to transfer the value for write to CMOS, or used to return the value that's read from CMOS.
The value64 is an u64 point, so don't need get address again. It causes acpi_cmos_rtc_space_handler always return 0 to reader and didn't write expected value to CMOS.
--- drivers/acpi/acpi_cmos_rtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_cmos_rtc.c +1 -1
@@ -33,7 +33,7 @@ acpi_cmos_rtc_space_handler(u32 function void *handler_context, void *region_context) { int i; -u8 *value = (u8 *)&value64; +u8 *value = (u8 *)value64;if (address >0xff || !value64)return AE_BAD_PARAMETER ;
Greg Kroah-Hartman
maintainerPATCH 150/357 ACPI / LPSS: complete PM entries for LPSS power domain
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fu Zhonghui <[email protected]>
commit f4168b617ac09986c4333accaff5d8ba5a9db7bf upstream.
PM entries of LPSS power domain were not implemented correctly in commit c78b0830667a "ACPI / LPSS: custom power domain for LPSS".
This patch fixes and completes these PM entries.
--- drivers/acpi/acpi_lpss.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/acpi/acpi_lpss.c +5 -5
@@ -583,7 +583,7 @@ static int acpi_lpss_suspend_late(structreturn acpi_dev_suspend_late (dev); } -static int acpi_lpss_restore_early (struct device *dev) +static int acpi_lpss_resume_early (struct device *dev) {int ret =acpi_dev_resume_early (dev);
@@ -623,15 +623,15 @@ static int acpi_lpss_runtime_resume(strustatic struct dev_pm_domain acpi_lpss_pm_domain = { .ops = { #ifdef CONFIG_PM_SLEEP - .suspend_late = acpi_lpss_suspend_late, - .restore_early = acpi_lpss_restore_early, .prepare = acpi_subsys_prepare, .complete = acpi_subsys_complete, .suspend = acpi_subsys_suspend, - .resume_early = acpi_subsys_resume_early, + .suspend_late = acpi_lpss_suspend_late, + .resume_early = acpi_lpss_resume_early, .freeze = acpi_subsys_freeze, .poweroff = acpi_subsys_suspend, - .poweroff_late = acpi_subsys_suspend_late, + .poweroff_late = acpi_lpss_suspend_late, + .restore_early = acpi_lpss_resume_early, #endif #ifdef CONFIG_PM_RUNTIME .runtime_suspend = acpi_lpss_runtime_suspend,
Greg Kroah-Hartman
maintainerPATCH 152/357 iommu/vt-d: Check return value of acpi_bus_get_device()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit c0df975f9045d6b2b13d88746e628ac308ff49ea upstream.
Checking adev == NULL is not sufficient as acpi_bus_get_device() might not touch the value of this parameter in an error case, so check the return value directly.
--- drivers/iommu/dmar.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iommu/dmar.c +1 -2
@@ -677,8 +677,7 @@ static int __init dmar_acpi_dev_scope_in andd->object_name);continue ; } -acpi_bus_get_device (h, &adev); -if (!adev) { +if (acpi_bus_get_device (h, &adev)) {pr_err ("Failed to get device for ACPI object %s\n" , andd->object_name);continue ;
Greg Kroah-Hartman
maintainerPATCH 153/357 iommu/fsl: Fix warning resulting from adding PCI device twice
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varun Sethi <[email protected]>
commit 5a9137a66b521d667236e95c307b92af532fe600 upstream.
iommu_group_get_for_dev determines the iommu group for the PCI device and adds the device to the group.
In the PAMU driver we were again adding the device to the same group without checking if the device already had an iommu group. This resulted in the following warning.
sysfs: cannot create duplicate filename '/devices/ffe200000.pcie/pci0000:00/0000:00:00.0/iommu_group'
------------[ cut here ]------------ WARNING: at fs/sysfs/dir.c:31 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.17.0-rc3-00002-g7505cea-dirty #126 task: c0000001fe0a0000 ti: c0000001fe044000 task.ti: c0000001fe044000 NIP: c00000000018879c LR: c000000000188798 CTR: c00000000001ea50 REGS: c0000001fe047040 TRAP: 0700 Not tainted (3.17.0-rc3-00002-g7505cea-dirty) MSR: 0000000080029000 <CE,EE,ME> CR: 24ad8e22 XER: 20000000
SOFTE: 1
GPR00: c000000000188798 c0000001fe0472c0 c0000000009a52e0 0000000000000065
GPR04: 0000000000000001 0000000000000000 3a30303a00000000 0000000027000000
GPR08: 2f696f6d00000000 c0000000008d3830 c0000000009b3938 c0000000009bb3d0
GPR12: 0000000028ad8e24 c00000000fff4000 c00000000000205c 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 c0000000008a4c70
GPR24: c0000000007e9010 c0000001fe0140a8 ffffffffffffffef 0000000000000001
GPR28: c0000001fe22ebb8 c0000000007e9010 c00000000090bf10 c0000001fe220000 NIP [c00000000018879c] .sysfs_warn_dup+0x74/0xa4
LR [c000000000188798] .sysfs_warn_dup+0x70/0xa4
Call Trace: [c0000001fe0472c0] [c000000000188798] .sysfs_warn_dup+0x70/0xa4 (unreliable) [c0000001fe047350] [c000000000188d34] .sysfs_do_create_link_sd.clone.2+0x168/0x174 [c0000001fe047400] [c0000000004b3cf8] .iommu_group_add_device+0x78/0x244 [c0000001fe0474b0] [c0000000004b6964] .fsl_pamu_add_device+0x88/0x1a8 [c0000001fe047570] [c0000000004b3960] .iommu_bus_notifier+0xdc/0x15c [c0000001fe047600] [c000000000059848] .notifier_call_chain+0x8c/0xe8 [c0000001fe0476a0] [c000000000059d04] .__blocking_notifier_call_chain+0x58/0x84 [c0000001fe047750] [c00000000036619c] .device_add+0x464/0x5c8 [c0000001fe047820] [c000000000300ebc] .pci_device_add+0x14c/0x17c [c0000001fe0478c0] [c000000000300fbc] .pci_scan_single_device+0xd0/0xf4 [c0000001fe047970] [c00000000030104c] .pci_scan_slot+0x6c/0x18c [c0000001fe047a10] [c00000000030226c] .pci_scan_child_bus+0x40/0x114 [c0000001fe047ac0] [c000000000021974] .pcibios_scan_phb+0x240/0x2c8 [c0000001fe047b70] [c00000000085a970] .pcibios_init+0x64/0xc8 [c0000001fe047c00] [c000000000001884] .do_one_initcall+0xbc/0x224 [c0000001fe047d00] [c000000000852d50] .kernel_init_freeable+0x14c/0x21c [c0000001fe047db0] [c000000000002078] .kernel_init+0x1c/0xfa4 [c0000001fe047e30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4
Instruction dump:7c7f1b79 4182001c 7fe4fb78 7f83e378 38a01000 4bffc905 60000000 7c641b78 e87e8008 7fa5eb78 48482ff5 60000000 <0fe00000> 7fe3fb78 4bf7bd39 60000000
--- drivers/iommu/fsl_pamu_domain.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/iommu/fsl_pamu_domain.c +8 -2
@@ -1048,7 +1048,7 @@ static int fsl_pamu_add_device(struct destruct iommu_group *group =ERR_PTR (-ENODEV );struct pci_dev *pdev;const u32 *prop; -int ret, len; +int ret =0 , len;/* * For platform devices we allocate a separate group for
@@ -1071,7 +1071,13 @@ static int fsl_pamu_add_device(struct deif (IS_ERR (group))return PTR_ERR (group); - ret =iommu_group_add_device (group, dev); +/* +* Check if device has already been added to an iommu group. +* Group could have already been created for a PCI device in +* the iommu_group_get_for_dev path. +*/ +if (!dev->iommu_group) + ret =iommu_group_add_device (group, dev);iommu_group_put (group);return ret;
Greg Kroah-Hartman
maintainerPATCH 154/357 iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olav Haugan <[email protected]>
commit 1fc870c7efa364862c3bc792cfbdb38afea26742 upstream.
Stage-1 context banks do not have the SMMU_CBn_TCR[SL0] field since it is only applicable to stage-2 context banks.
This patch ensures that we don't set the reserved TCR bits for stage-1 translations.
--- drivers/iommu/arm-smmu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iommu/arm-smmu.c +5 -2
@@ -830,8 +830,11 @@ static void arm_smmu_init_context_bank(s reg |=TTBCR_EAE | (TTBCR_SH_IS <<TTBCR_SH0_SHIFT ) | (TTBCR_RGN_WBWA <<TTBCR_ORGN0_SHIFT ) | - (TTBCR_RGN_WBWA <<TTBCR_IRGN0_SHIFT ) | - (TTBCR_SL0_LVL_1 <<TTBCR_SL0_SHIFT ); + (TTBCR_RGN_WBWA <<TTBCR_IRGN0_SHIFT ); + +if (!stage1) + reg |= (TTBCR_SL0_LVL_1 <<TTBCR_SL0_SHIFT ); +writel_relaxed (reg, cb_base +ARM_SMMU_CB_TTBCR );/* MAIR0 (stage-1 only) */
Greg Kroah-Hartman
maintainerPATCH 155/357 nfsd4: fix rd_dircount enforcement
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit aee3776441461c14ba6d8ed9e2149933e65abb6e upstream.
Commit 3b299709091b "nfsd4: enforce rd_dircount" totally misunderstood rd_dircount; it refers to total non-attribute bytes returned, not number of directory entries returned.
Bring the code into agreement with RFC 3530 section 14.2.24.
--- fs/nfsd/nfs4xdr.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
fs/nfsd/nfs4xdr.c +13 -1
@@ -2662,6 +2662,7 @@ nfsd4_encode_dirent(void *ccdv, const chstruct xdr_stream *xdr = cd->xdr;int start_offset = xdr->buf->len;int cookie_offset; +u32 name_and_cookie;int entry_bytes;__be32 nfserr = nfserr_toosmall;__be64 wire_offset;
@@ -2723,7 +2724,14 @@ nfsd4_encode_dirent(void *ccdv, const ch cd->rd_maxcount -= entry_bytes;if (!cd->rd_dircount) goto fail; - cd->rd_dircount--; +/* +* RFC 3530 14.2.24 describes rd_dircount as only a "hint", so +* let's always let through the first entry, at least: +*/ + name_and_cookie =4 *XDR_QUADLEN (namlen) +8 ; +if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) + goto fail; + cd->rd_dircount -=min (cd->rd_dircount, name_and_cookie); cd->cookie_offset = cookie_offset; skip_entry: cd->common.err = nfs_ok;
@@ -3333,6 +3341,10 @@ nfsd4_encode_readdir(struct nfsd4_compou } maxcount =min_t (int, maxcount-16 , bytes_left); +/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */ +if (!readdir->rd_dircount) + readdir->rd_dircount =INT_MAX ; + readdir->xdr = xdr; readdir->rd_maxcount = maxcount; readdir->common.err =0 ;
Greg Kroah-Hartman
maintainerPATCH 157/357 NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Dickson <[email protected]>
commit 080af20cc945d110f9912d01cf6b66f94a375b8d upstream.
There is a race between nfs4_state_manager() and nfs_server_remove_lists() that happens during a nfsv3 mount.
The v3 mount notices there is already a supper block so nfs_server_remove_lists() called which uses the nfs_client_lock spin lock to synchronize access to the client list.
At the same time nfs4_state_manager() is running through the client list looking for work to do, using the same lock. When nfs4_state_manager() wins the race to the list, a v3 client pointer is found and not ignored properly which causes the panic.
Moving some protocol checks before the state checking avoids the panic.
--- fs/nfs/nfs4client.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)
fs/nfs/nfs4client.c +20 -18
@@ -482,6 +482,16 @@ int nfs40_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos" */ if (pos->cl_cons_state >NFS_CS_READY ) {
@@ -501,15 +511,6 @@ int nfs40_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (pos->cl_clientid != new->cl_clientid)continue ;
@@ -622,6 +623,16 @@ int nfs41_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos", especially the client * ID and serverowner fields. Wait for CREATE_SESSION
@@ -647,15 +658,6 @@ int nfs41_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (!nfs4_match_clientids (pos, new))continue ;
Greg Kroah-Hartman
maintainerPATCH 158/357 NFSv4: Fix another bug in the close/open_downgrade code
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit cd9288ffaea4359d5cfe2b8d264911506aed26a4 upstream.
James Drew reports another bug whereby the NFS client is now sending an OPEN_DOWNGRADE in a situation where it should really have sent a
CLOSE: the client is opening the file for O_RDWR, but then trying to do a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.
--- fs/nfs/nfs4proc.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
fs/nfs/nfs4proc.c +15 -15
@@ -2599,23 +2599,23 @@ static void nfs4_close_prepare(struct rp is_rdwr =test_bit (NFS_O_RDWR_STATE , &state->flags); is_rdonly =test_bit (NFS_O_RDONLY_STATE , &state->flags); is_wronly =test_bit (NFS_O_WRONLY_STATE , &state->flags); -/* Calculate the current open share mode */ - calldata->arg.fmode =0 ; -if (is_rdonly || is_rdwr) - calldata->arg.fmode |=FMODE_READ ; -if (is_wronly || is_rdwr) - calldata->arg.fmode |=FMODE_WRITE ;/* Calculate the change in open mode */ + calldata->arg.fmode =0 ;if (state->n_rdwr ==0 ) { -if (state->n_rdonly ==0 ) { - call_close |= is_rdonly || is_rdwr; - calldata->arg.fmode &= ~FMODE_READ ; - } -if (state->n_wronly ==0 ) { - call_close |= is_wronly || is_rdwr; - calldata->arg.fmode &= ~FMODE_WRITE ; - } - } +if (state->n_rdonly ==0 ) + call_close |= is_rdonly; +else if (is_rdonly) + calldata->arg.fmode |=FMODE_READ ; +if (state->n_wronly ==0 ) + call_close |= is_wronly; +else if (is_wronly) + calldata->arg.fmode |=FMODE_WRITE ; + }else if (is_rdwr) + calldata->arg.fmode |=FMODE_READ |FMODE_WRITE ; + +if (calldata->arg.fmode ==0 ) + call_close |= is_rdwr; +if (!nfs4_valid_open_stateid (state)) call_close =0 ;spin_unlock (&state->owner->so_lock);
Greg Kroah-Hartman
maintainerPATCH 159/357 nfsd4: fix corruption of NFSv4 read data
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 15b23ef5d348ea51c5e7573e2ef4116fbc7cb099 upstream.
The calculation of page_ptr here is wrong in the case the read doesn't start at an offset that is a multiple of a page.
The result is that nfs4svc_encode_compoundres sets rq_next_page to a value one too small, and then the loop in svc_free_res_pages may incorrectly fail to clear a page pointer in rq_respages[].
Pages left in rq_respages[] are available for the next rpc request to use, so xdr data may be written to that page, which may hold data still waiting to be transmitted to the client or data in the page cache.
The observed result was silent data corruption seen on an NFSv4 client.
We tag this as "fixing" 05638dc73af2 because that commit exposed this bug, though the incorrect calculation predates it.
Particular thanks to Andrea Arcangeli and David Gilbert for analysis and testing.
--- fs/nfsd/nfs4xdr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4xdr.c +2 -1
@@ -3112,7 +3112,8 @@ static __be32 nfsd4_encode_splice_read( buf->page_len = maxcount; buf->len += maxcount; - xdr->page_ptr += (maxcount +PAGE_SIZE -1 ) /PAGE_SIZE ; + xdr->page_ptr += (buf->page_base + maxcount +PAGE_SIZE -1 ) + /PAGE_SIZE ;/* Use rest of head for padding and remaining ops: */ buf->tail[0 ].iov_base = xdr->p;
Greg Kroah-Hartman
maintainerPATCH 160/357 nfs: move nfs_pgio_data and remove nfs_rw_header
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 1e7f3a485922211b6e4a082ebc6bf05810b0b6ea upstream.
nfs_rw_header was used to allocate an nfs_pgio_header along with an nfs_pgio_data, because a _header would need at least one _data.
Now there is only ever one nfs_pgio_data for each nfs_pgio_header -- move it to nfs_pgio_header and get rid of nfs_rw_header.
--- fs/nfs/direct.c | 8 ++-- fs/nfs/internal.h | 6 +-- fs/nfs/pagelist.c | 94 ++++++++++++++--------------------------------- fs/nfs/pnfs.c | 24 +++++------- fs/nfs/read.c | 6 +-- fs/nfs/write.c | 10 ++--- include/linux/nfs_page.h | 4 +- include/linux/nfs_xdr.h | 38 ++++++++----------- 8 files changed, 71 insertions(+), 119 deletions(-)
fs/nfs/direct.c +4 -4
@@ -148,8 +148,8 @@ static void nfs_direct_set_hdr_verf(stru {struct nfs_writeverf *verfp; - verfp =nfs_direct_select_verf (dreq, hdr->data->ds_clp, - hdr->data->ds_idx); + verfp =nfs_direct_select_verf (dreq, hdr->data.ds_clp, + hdr->data.ds_idx);WARN_ON_ONCE (verfp->committed >=0 );memcpy (verfp, &hdr->verf,sizeof (struct nfs_writeverf ));WARN_ON_ONCE (verfp->committed <0 );
@@ -169,8 +169,8 @@ static int nfs_direct_set_or_cmp_hdr_ver {struct nfs_writeverf *verfp; - verfp =nfs_direct_select_verf (dreq, hdr->data->ds_clp, - hdr->data->ds_idx); + verfp =nfs_direct_select_verf (dreq, hdr->data.ds_clp, + hdr->data.ds_idx);if (verfp->committed <0 ) {nfs_direct_set_hdr_verf (dreq, hdr);return 0 ;
fs/nfs/internal.h +3 -3
@@ -238,9 +238,9 @@ void nfs_set_pgio_error(struct nfs_pgio_int nfs_iocounter_wait (struct nfs_io_counter *c);extern const struct nfs_pageio_ops nfs_pgio_rw_ops; -struct nfs_rw_header *nfs_rw_header_alloc (const struct nfs_rw_ops *); -void nfs_rw_header_free (struct nfs_pgio_header *); -void nfs_pgio_data_release (struct nfs_pgio_data *); +struct nfs_pgio_header *nfs_pgio_header_alloc (const struct nfs_rw_ops *); +void nfs_pgio_header_free (struct nfs_pgio_header *); +void nfs_pgio_data_destroy (struct nfs_pgio_data *);int nfs_generic_pgio (struct nfs_pageio_descriptor *,struct nfs_pgio_header *);int nfs_initiate_pgio (struct rpc_clnt *,struct nfs_pgio_data *,const struct rpc_call_ops *,int ,int );
fs/nfs/pagelist.c +28 -66
178 lines not on this page · raw message
fs/nfs/pnfs.c +10 -14
@@ -1546,7 +1546,7 @@ pnfs_write_through_mds(struct nfs_pageionfs_pageio_reset_write_mds (desc); desc->pg_recoalesce =1 ; } -nfs_pgio_data_release (data); +nfs_pgio_data_destroy (data); } static enum pnfs_try_status
@@ -1575,7 +1575,7 @@ static void pnfs_do_write(struct nfs_pageio_descriptor *desc, struct nfs_pgio_header *hdr, int how) { - struct nfs_pgio_data *data = hdr->data; + struct nfs_pgio_data *data = &hdr->data;const struct rpc_call_ops *call_ops = desc->pg_rpc_callops;struct pnfs_layout_segment *lseg = desc->pg_lseg;enum pnfs_try_status trypnfs;
@@ -1590,25 +1590,23 @@ pnfs_do_write(struct nfs_pageio_descriptstatic void pnfs_writehdr_free (struct nfs_pgio_header *hdr) {pnfs_put_lseg (hdr->lseg); -nfs_rw_header_free (hdr); +nfs_pgio_header_free (hdr); }EXPORT_SYMBOL_GPL (pnfs_writehdr_free);int pnfs_generic_pg_writepages (struct nfs_pageio_descriptor *desc) { -struct nfs_rw_header *whdr;struct nfs_pgio_header *hdr;int ret; - whdr =nfs_rw_header_alloc (desc->pg_rw_ops); -if (!whdr) { + hdr =nfs_pgio_header_alloc (desc->pg_rw_ops); +if (!hdr) { desc->pg_completion_ops->error_cleanup (&desc->pg_list);pnfs_put_lseg (desc->pg_lseg); desc->pg_lseg =NULL ;return -ENOMEM ; } - hdr = &whdr->header;nfs_pgheader_init (desc, hdr, pnfs_writehdr_free); hdr->lseg =pnfs_get_lseg (desc->pg_lseg);atomic_inc (&hdr->refcnt);
@@ -1696,7 +1694,7 @@ pnfs_read_through_mds(struct nfs_pageio_nfs_pageio_reset_read_mds (desc); desc->pg_recoalesce =1 ; } -nfs_pgio_data_release (data); +nfs_pgio_data_destroy (data); }/*
@@ -1727,7 +1725,7 @@ pnfs_try_to_read_data(struct nfs_pgio_dastatic void pnfs_do_read (struct nfs_pageio_descriptor *desc,struct nfs_pgio_header *hdr) { -struct nfs_pgio_data *data = hdr->data; +struct nfs_pgio_data *data = &hdr->data;const struct rpc_call_ops *call_ops = desc->pg_rpc_callops;struct pnfs_layout_segment *lseg = desc->pg_lseg;enum pnfs_try_status trypnfs;
@@ -1742,26 +1740,24 @@ pnfs_do_read(struct nfs_pageio_descriptostatic void pnfs_readhdr_free (struct nfs_pgio_header *hdr) {pnfs_put_lseg (hdr->lseg); -nfs_rw_header_free (hdr); +nfs_pgio_header_free (hdr); }EXPORT_SYMBOL_GPL (pnfs_readhdr_free);int pnfs_generic_pg_readpages (struct nfs_pageio_descriptor *desc) { -struct nfs_rw_header *rhdr;struct nfs_pgio_header *hdr;int ret; - rhdr =nfs_rw_header_alloc (desc->pg_rw_ops); -if (!rhdr) { + hdr =nfs_pgio_header_alloc (desc->pg_rw_ops); +if (!hdr) { desc->pg_completion_ops->error_cleanup (&desc->pg_list); ret = -ENOMEM ;pnfs_put_lseg (desc->pg_lseg); desc->pg_lseg =NULL ;return ret; } - hdr = &rhdr->header;nfs_pgheader_init (desc, hdr, pnfs_readhdr_free); hdr->lseg =pnfs_get_lseg (desc->pg_lseg);atomic_inc (&hdr->refcnt);
fs/nfs/read.c +3 -3
@@ -33,12 +33,12 @@ static const struct nfs_rw_ops nfs_rw_restatic struct kmem_cache *nfs_rdata_cachep; -static struct nfs_rw_header *nfs_readhdr_alloc (void ) +static struct nfs_pgio_header *nfs_readhdr_alloc (void ) {return kmem_cache_zalloc (nfs_rdata_cachep,GFP_KERNEL ); } -static void nfs_readhdr_free (struct nfs_rw_header *rhdr) +static void nfs_readhdr_free (struct nfs_pgio_header *rhdr) {kmem_cache_free (nfs_rdata_cachep, rhdr); }
@@ -404,7 +404,7 @@ out:int __init nfs_init_readpagecache (void ) { nfs_rdata_cachep =kmem_cache_create ("nfs_read_data" , -sizeof (struct nfs_rw_header ), +sizeof (struct nfs_pgio_header ),0 ,SLAB_HWCACHE_ALIGN ,NULL );if (nfs_rdata_cachep ==NULL )
fs/nfs/write.c +5 -5
@@ -71,18 +71,18 @@ void nfs_commit_free(struct nfs_commit_d }EXPORT_SYMBOL_GPL (nfs_commit_free); -static struct nfs_rw_header *nfs_writehdr_alloc (void ) +static struct nfs_pgio_header *nfs_writehdr_alloc (void ) { -struct nfs_rw_header *p =mempool_alloc (nfs_wdata_mempool,GFP_NOIO ); +struct nfs_pgio_header *p =mempool_alloc (nfs_wdata_mempool,GFP_NOIO );if (p)memset (p,0 ,sizeof (*p));return p; } -static void nfs_writehdr_free (struct nfs_rw_header *whdr) +static void nfs_writehdr_free (struct nfs_pgio_header *hdr) { -mempool_free (whdr, nfs_wdata_mempool); +mempool_free (hdr, nfs_wdata_mempool); }static void nfs_context_set_write_error (struct nfs_open_context *ctx,int error)
@@ -1884,7 +1884,7 @@ int nfs_migrate_page(struct address_spacint __init nfs_init_writepagecache (void ) { nfs_wdata_cachep =kmem_cache_create ("nfs_write_data" , -sizeof (struct nfs_rw_header ), +sizeof (struct nfs_pgio_header ),0 ,SLAB_HWCACHE_ALIGN ,NULL );if (nfs_wdata_cachep ==NULL )
include/linux/nfs_page.h +2 -2
@@ -62,8 +62,8 @@ struct nfs_pageio_ops {struct nfs_rw_ops {const fmode_t rw_mode; -struct nfs_rw_header *(*rw_alloc_header)(void ); -void (*rw_free_header)(struct nfs_rw_header *); +struct nfs_pgio_header *(*rw_alloc_header)(void ); +void (*rw_free_header)(struct nfs_pgio_header *);void (*rw_release)(struct nfs_pgio_data *);int (*rw_done)(struct rpc_task *,struct nfs_pgio_data *,struct inode *);void (*rw_result)(struct rpc_task *,struct nfs_pgio_data *);
include/linux/nfs_xdr.h +16 -22
@@ -1257,13 +1257,27 @@ enum { NFS_IOHDR_NEED_RESCHED, }; -struct nfs_pgio_data ; +struct nfs_pgio_data { +struct nfs_pgio_header *header; +struct list_head list; +struct rpc_task task; +struct nfs_fattr fattr; +struct nfs_writeverf verf;/* Used for writes */ +struct nfs_pgio_args args;/* argument struct */ +struct nfs_pgio_res res;/* result struct */ +unsigned long timestamp;/* For lease renewal */ +int (*pgio_done_cb)(struct rpc_task *task,struct nfs_pgio_data *data); +__u64 mds_offset;/* Filelayout dense stripe */ +struct nfs_page_array pages; +struct nfs_client *ds_clp;/* pNFS data server */ +int ds_idx;/* ds index if ds_clp is set */ +};struct nfs_pgio_header {struct inode *inode;struct rpc_cred *cred;struct list_head pages; -struct nfs_pgio_data *data; +struct nfs_pgio_data data;atomic_t refcnt;struct nfs_page *req;struct nfs_writeverf verf;/* Used for writes */
@@ -1283,26 +1297,6 @@ struct nfs_pgio_header {unsigned long flags; }; -struct nfs_pgio_data { -struct nfs_pgio_header *header; -struct rpc_task task; -struct nfs_fattr fattr; -struct nfs_writeverf verf;/* Used for writes */ -struct nfs_pgio_args args;/* argument struct */ -struct nfs_pgio_res res;/* result struct */ -unsigned long timestamp;/* For lease renewal */ -int (*pgio_done_cb) (struct rpc_task *task,struct nfs_pgio_data *data); -__u64 mds_offset;/* Filelayout dense stripe */ -struct nfs_page_array pages; -struct nfs_client *ds_clp;/* pNFS data server */ -int ds_idx;/* ds index if ds_clp is set */ -}; - -struct nfs_rw_header { -struct nfs_pgio_header header; -struct nfs_pgio_data rpc_data; -}; -struct nfs_mds_commit_info {atomic_t rpcs_out;unsigned long ncommit;
Greg Kroah-Hartman
maintainerPATCH 161/357 nfs: rename members of nfs_pgio_data
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 823b0c9d9800e712374cda89ac3565bd29f6701b upstream.
Rename "verf" to "writeverf" and "pages" to "page_array" to prepare for merge of nfs_pgio_data and nfs_pgio_header.
--- fs/nfs/blocklayout/blocklayout.c | 17 ++++++++++------- fs/nfs/objlayout/objlayout.c | 4 ++-- fs/nfs/pagelist.c | 12 ++++++------ fs/nfs/write.c | 9 +++++---- include/linux/nfs_xdr.h | 4 ++-- 5 files changed, 25 insertions(+), 21 deletions(-)
fs/nfs/blocklayout/blocklayout.c +10 -7
@@ -258,7 +258,8 @@ bl_read_pagelist(struct nfs_pgio_data *rconst bool is_dio = (header->dreq !=NULL );dprintk ("%s enter nr_pages %u offset %lld count %u\n" , __func__, - rdata->pages.npages, f_offset, (unsigned int )rdata->args.count); + rdata->page_array.npages, f_offset, + (unsigned int )rdata->args.count); par =alloc_parallel (rdata);if (!par)
@@ -268,7 +269,7 @@ bl_read_pagelist(struct nfs_pgio_data *r isect = (sector_t) (f_offset >>SECTOR_SHIFT );/* Code assumes extents are page-aligned */ -for (i = pg_index; i < rdata->pages.npages; i++) { +for (i = pg_index; i < rdata->page_array.npages; i++) {if (!extent_length) {/* We've used up the previous extent */ bl_put_extent (be);
@@ -317,7 +318,8 @@ bl_read_pagelist(struct nfs_pgio_data *rstruct pnfs_block_extent *be_read; be_read = (hole && cow_read) ? cow_read : be; - bio = do_add_page_to_bio(bio, rdata->pages.npages - i, + bio = do_add_page_to_bio(bio, + rdata->page_array.npages - i, READ, isect, pages[i], be_read, bl_end_io_read, par,
@@ -446,7 +448,7 @@ static void bl_end_par_io_write(void *da } wdata->task.tk_status = wdata->header->pnfs_error; - wdata->verf.committed =NFS_FILE_SYNC ; + wdata->writeverf.committed =NFS_FILE_SYNC ;INIT_WORK (&wdata->task.u.tk_work, bl_write_cleanup);schedule_work (&wdata->task.u.tk_work); }
@@ -699,7 +701,7 @@ bl_write_pagelist(struct nfs_pgio_data *dprintk ("pnfsblock nonblock aligned DIO writes. Resend MDS\n" ); goto out_mds; } -/* At this point, wdata->pages is a (sequential) list of nfs_pages. +/* At this point, wdata->page_aray is a (sequential) list of nfs_pages. * We want to write each, and if there is an error set pnfs_error * to have it redone using nfs. */
@@ -791,7 +793,7 @@ next_page:/* Middle pages */ pg_index = wdata->args.pgbase >>PAGE_CACHE_SHIFT ; -for (i = pg_index; i < wdata->pages.npages; i++) { +for (i = pg_index; i < wdata->page_array.npages; i++) {if (!extent_length) {/* We've used up the previous extent */ bl_put_extent (be);
@@ -862,7 +864,8 @@ next_page: } - bio =do_add_page_to_bio (bio, wdata->pages.npages - i,WRITE , + bio =do_add_page_to_bio (bio, wdata->page_array.npages - i, +WRITE , isect, pages[i], be, bl_end_io_write, par, pg_offset, pg_len);
fs/nfs/objlayout/objlayout.c +2 -2
@@ -329,7 +329,7 @@ objlayout_write_done(struct objlayout_io oir->status = wdata->task.tk_status = status;if (status >=0 ) { wdata->res.count = status; - wdata->verf.committed = oir->committed; + wdata->writeverf.committed = oir->committed; }else { wdata->header->pnfs_error = status; }
@@ -337,7 +337,7 @@ objlayout_write_done(struct objlayout_io/* must not use oir after this point */ dprintk ("%s: Return status %zd committed %d sync=%d\n" , __func__, - status, wdata->verf.committed, sync); + status, wdata->writeverf.committed, sync);if (sync)pnfs_ld_write_done (wdata);
fs/nfs/pagelist.c +6 -6
@@ -494,7 +494,7 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free);static bool nfs_pgio_data_init (struct nfs_pgio_header *hdr,unsigned int pagecount) { -if (nfs_pgarray_set (&hdr->data.pages, pagecount)) { +if (nfs_pgarray_set (&hdr->data.page_array, pagecount)) { hdr->data.header = hdr;atomic_inc (&hdr->refcnt);return true;
@@ -511,8 +511,8 @@ void nfs_pgio_data_destroy(struct nfs_pgstruct nfs_pgio_header *hdr = data->header;put_nfs_open_context (data->args.context); -if (data->pages.pagevec != data->pages.page_array) -kfree (data->pages.pagevec); +if (data->page_array.pagevec != data->page_array.page_array) +kfree (data->page_array.pagevec);if (atomic_dec_and_test (&hdr->refcnt)) hdr->completion_ops->completion (hdr); }
@@ -540,7 +540,7 @@ static void nfs_pgio_rpcsetup(struct nfs/* pnfs_set_layoutcommit needs this */ data->mds_offset = data->args.offset; data->args.pgbase = req->wb_pgbase + offset; - data->args.pages = data->pages.pagevec; + data->args.pages = data->page_array.pagevec; data->args.count = count; data->args.context =get_nfs_open_context (req->wb_context); data->args.lock_context = req->wb_lock_context;
@@ -558,7 +558,7 @@ static void nfs_pgio_rpcsetup(struct nfs data->res.fattr = &data->fattr; data->res.count = count; data->res.eof =0 ; - data->res.verf = &data->verf; + data->res.verf = &data->writeverf;nfs_fattr_init (&data->fattr); }
@@ -727,7 +727,7 @@ int nfs_generic_pgio(struct nfs_pageio_d data = &hdr->data;nfs_init_cinfo (&cinfo, desc->pg_inode, desc->pg_dreq); - pages = data->pages.pagevec; + pages = data->page_array.pagevec;while (!list_empty (head)) { req =nfs_list_entry (head->next);nfs_list_remove_request (req);
fs/nfs/write.c +5 -4
@@ -828,9 +828,9 @@ nfs_clear_request_commit(struct nfs_pagestatic inline int nfs_write_need_commit (struct nfs_pgio_data *data) { -if (data->verf.committed ==NFS_DATA_SYNC ) +if (data->writeverf.committed ==NFS_DATA_SYNC )return data->header->lseg ==NULL ; -return data->verf.committed !=NFS_FILE_SYNC ; +return data->writeverf.committed !=NFS_FILE_SYNC ; }#else
@@ -1323,8 +1323,9 @@ static void nfs_writeback_release_commonif (test_bit (NFS_IOHDR_NEED_RESCHED , &hdr->flags)) ;/* Do nothing */ else if (!test_and_set_bit (NFS_IOHDR_NEED_COMMIT , &hdr->flags)) -memcpy (&hdr->verf, &data->verf,sizeof (hdr->verf)); -else if (memcmp (&hdr->verf, &data->verf,sizeof (hdr->verf))) +memcpy (&hdr->verf, &data->writeverf,sizeof (hdr->verf)); +else if (memcmp (&hdr->verf, &data->writeverf, +sizeof (hdr->verf)))set_bit (NFS_IOHDR_NEED_RESCHED , &hdr->flags);spin_unlock (&hdr->lock); }
include/linux/nfs_xdr.h +2 -2
@@ -1262,13 +1262,13 @@ struct nfs_pgio_data {struct list_head list;struct rpc_task task;struct nfs_fattr fattr; -struct nfs_writeverf verf;/* Used for writes */ +struct nfs_writeverf writeverf;/* Used for writes */ struct nfs_pgio_args args;/* argument struct */ struct nfs_pgio_res res;/* result struct */ unsigned long timestamp;/* For lease renewal */ int (*pgio_done_cb)(struct rpc_task *task,struct nfs_pgio_data *data);__u64 mds_offset;/* Filelayout dense stripe */ -struct nfs_page_array pages; +struct nfs_page_array page_array;struct nfs_client *ds_clp;/* pNFS data server */ int ds_idx;/* ds index if ds_clp is set */ };
Greg Kroah-Hartman
maintainerPATCH 162/357 nfs: merge nfs_pgio_data into _header
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit d45f60c67848b9f19160692581d78e5b4757a000 upstream.
struct nfs_pgio_data only exists as a member of nfs_pgio_header, but is passed around everywhere, because there used to be multiple _data structs per _header. Many of these functions then use the _data to find a pointer to the _header. This patch cleans this up by merging the nfs_pgio_data structure into nfs_pgio_header and passing nfs_pgio_header around instead.
--- fs/nfs/blocklayout/blocklayout.c | 98 ++++++++++------------ fs/nfs/direct.c | 8 - fs/nfs/filelayout/filelayout.c | 170 ++++++++++++++++++--------------------- fs/nfs/internal.h | 6 - fs/nfs/nfs3proc.c | 21 ++-- fs/nfs/nfs4_fs.h | 6 - fs/nfs/nfs4proc.c | 105 ++++++++++++------------ fs/nfs/nfs4trace.h | 28 +++--- fs/nfs/objlayout/objio_osd.c | 24 ++--- fs/nfs/objlayout/objlayout.c | 81 ++++++++---------- fs/nfs/objlayout/objlayout.h | 8 - fs/nfs/pagelist.c | 120 +++++++++++++-------------- fs/nfs/pnfs.c | 80 +++++++----------- fs/nfs/pnfs.h | 10 +- fs/nfs/proc.c | 27 +++--- fs/nfs/read.c | 42 +++++---- fs/nfs/write.c | 56 ++++++------ include/linux/nfs_page.h | 9 +- include/linux/nfs_xdr.h | 43 ++++----- 19 files changed, 460 insertions(+), 482 deletions(-)
fs/nfs/blocklayout/blocklayout.c +47 -51
@@ -210,8 +210,7 @@ static void bl_end_io_read(struct bio *bSetPageUptodate (bvec->bv_page);if (err) { -struct nfs_pgio_data *rdata = par->data; -struct nfs_pgio_header *header = rdata->header; +struct nfs_pgio_header *header = par->data;if (!header->pnfs_error) header->pnfs_error = -EIO ;
@@ -224,44 +223,44 @@ static void bl_end_io_read(struct bio *bstatic void bl_read_cleanup (struct work_struct *work) {struct rpc_task *task; -struct nfs_pgio_data *rdata; +struct nfs_pgio_header *hdr;dprintk ("%s enter\n" , __func__); task = container_of(work, struct rpc_task, u.tk_work); - rdata = container_of(task, struct nfs_pgio_data, task); -pnfs_ld_read_done (rdata); + hdr = container_of(task, struct nfs_pgio_header, task); +pnfs_ld_read_done (hdr); }static void bl_end_par_io_read (void *data,int unused) { -struct nfs_pgio_data *rdata = data; +struct nfs_pgio_header *hdr = data; - rdata->task.tk_status = rdata->header->pnfs_error; -INIT_WORK (&rdata->task.u.tk_work, bl_read_cleanup); -schedule_work (&rdata->task.u.tk_work); + hdr->task.tk_status = hdr->pnfs_error; +INIT_WORK (&hdr->task.u.tk_work, bl_read_cleanup); +schedule_work (&hdr->task.u.tk_work); }static enum pnfs_try_status -bl_read_pagelist (struct nfs_pgio_data *rdata) +bl_read_pagelist (struct nfs_pgio_header *hdr) { -struct nfs_pgio_header *header = rdata->header; +struct nfs_pgio_header *header = hdr;int i, hole;struct bio *bio =NULL ;struct pnfs_block_extent *be =NULL , *cow_read =NULL ;sector_t isect, extent_length =0 ;struct parallel_io *par; -loff_t f_offset = rdata->args.offset; -size_t bytes_left = rdata->args.count; +loff_t f_offset = hdr->args.offset; +size_t bytes_left = hdr->args.count;unsigned int pg_offset, pg_len; -struct page **pages = rdata->args.pages; -int pg_index = rdata->args.pgbase >>PAGE_CACHE_SHIFT ; +struct page **pages = hdr->args.pages; +int pg_index = hdr->args.pgbase >>PAGE_CACHE_SHIFT ;const bool is_dio = (header->dreq !=NULL );dprintk ("%s enter nr_pages %u offset %lld count %u\n" , __func__, - rdata->page_array.npages, f_offset, - (unsigned int )rdata->args.count); + hdr->page_array.npages, f_offset, + (unsigned int )hdr->args.count); - par =alloc_parallel (rdata); + par =alloc_parallel (hdr);if (!par) goto use_mds; par->pnfs_callback = bl_end_par_io_read;
@@ -269,7 +268,7 @@ bl_read_pagelist(struct nfs_pgio_data *r isect = (sector_t) (f_offset >>SECTOR_SHIFT );/* Code assumes extents are page-aligned */ -for (i = pg_index; i < rdata->page_array.npages; i++) { +for (i = pg_index; i < hdr->page_array.npages; i++) {if (!extent_length) {/* We've used up the previous extent */ bl_put_extent (be);
@@ -319,7 +318,7 @@ bl_read_pagelist(struct nfs_pgio_data *r be_read = (hole && cow_read) ? cow_read : be; bio = do_add_page_to_bio(bio, - rdata->page_array.npages - i, + hdr->page_array.npages - i, READ, isect, pages[i], be_read, bl_end_io_read, par,
@@ -334,10 +333,10 @@ bl_read_pagelist(struct nfs_pgio_data *r extent_length -=PAGE_CACHE_SECTORS ; }if ((isect <<SECTOR_SHIFT ) >= header->inode->i_size) { - rdata->res.eof =1 ; - rdata->res.count = header->inode->i_size - rdata->args.offset; + hdr->res.eof =1 ; + hdr->res.count = header->inode->i_size - hdr->args.offset; }else { - rdata->res.count = (isect <<SECTOR_SHIFT ) - rdata->args.offset; + hdr->res.count = (isect <<SECTOR_SHIFT ) - hdr->args.offset; } out:bl_put_extent (be);
@@ -392,8 +391,7 @@ static void bl_end_io_write_zero(struct }if (unlikely (err)) { -struct nfs_pgio_data *data = par->data; -struct nfs_pgio_header *header = data->header; +struct nfs_pgio_header *header = par->data;if (!header->pnfs_error) header->pnfs_error = -EIO ;
@@ -407,8 +405,7 @@ static void bl_end_io_write(struct bio * {struct parallel_io *par = bio->bi_private;const int uptodate =test_bit (BIO_UPTODATE , &bio->bi_flags); -struct nfs_pgio_data *data = par->data; -struct nfs_pgio_header *header = data->header; +struct nfs_pgio_header *header = par->data;if (!uptodate) {if (!header->pnfs_error)
@@ -425,32 +422,32 @@ static void bl_end_io_write(struct bio *static void bl_write_cleanup (struct work_struct *work) {struct rpc_task *task; -struct nfs_pgio_data *wdata; +struct nfs_pgio_header *hdr;dprintk ("%s enter\n" , __func__); task = container_of(work, struct rpc_task, u.tk_work); - wdata = container_of(task, struct nfs_pgio_data, task); -if (likely (!wdata->header->pnfs_error)) { + hdr = container_of(task, struct nfs_pgio_header, task); +if (likely (!hdr->pnfs_error)) {/* Marks for LAYOUTCOMMIT */ -mark_extents_written (BLK_LSEG2EXT (wdata->header->lseg), - wdata->args.offset, wdata->args.count); +mark_extents_written (BLK_LSEG2EXT (hdr->lseg), + hdr->args.offset, hdr->args.count); } -pnfs_ld_write_done (wdata); +pnfs_ld_write_done (hdr); }/* Called when last of bios associated with a bl_write_pagelist call finishes */ static void bl_end_par_io_write (void *data,int num_se) { -struct nfs_pgio_data *wdata = data; +struct nfs_pgio_header *hdr = data; -if (unlikely (wdata->header->pnfs_error)) { -bl_free_short_extents (&BLK_LSEG2EXT (wdata->header->lseg)->bl_inval, +if (unlikely (hdr->pnfs_error)) { +bl_free_short_extents (&BLK_LSEG2EXT (hdr->lseg)->bl_inval, num_se); } - wdata->task.tk_status = wdata->header->pnfs_error; - wdata->writeverf.committed =NFS_FILE_SYNC ; -INIT_WORK (&wdata->task.u.tk_work, bl_write_cleanup); -schedule_work (&wdata->task.u.tk_work); + hdr->task.tk_status = hdr->pnfs_error; + hdr->writeverf.committed =NFS_FILE_SYNC ; +INIT_WORK (&hdr->task.u.tk_work, bl_write_cleanup); +schedule_work (&hdr->task.u.tk_work); }/* FIXME STUB - mark intersection of layout and page as bad, so is not
@@ -675,18 +672,17 @@ check_page: }static enum pnfs_try_status -bl_write_pagelist (struct nfs_pgio_data *wdata,int sync) +bl_write_pagelist (struct nfs_pgio_header *header,int sync) { -struct nfs_pgio_header *header = wdata->header;int i, ret, npg_zero, pg_index, last =0 ;struct bio *bio =NULL ;struct pnfs_block_extent *be =NULL , *cow_read =NULL ;sector_t isect, last_isect =0 , extent_length =0 ;struct parallel_io *par =NULL ; -loff_t offset = wdata->args.offset; -size_t count = wdata->args.count; +loff_t offset = header->args.offset; +size_t count = header->args.count;unsigned int pg_offset, pg_len, saved_len; -struct page **pages = wdata->args.pages; +struct page **pages = header->args.pages;struct page *page;pgoff_t index;u64 temp;
@@ -701,11 +697,11 @@ bl_write_pagelist(struct nfs_pgio_data *dprintk ("pnfsblock nonblock aligned DIO writes. Resend MDS\n" ); goto out_mds; } -/* At this point, wdata->page_aray is a (sequential) list of nfs_pages. +/* At this point, header->page_aray is a (sequential) list of nfs_pages. * We want to write each, and if there is an error set pnfs_error * to have it redone using nfs. */ - par =alloc_parallel (wdata); + par =alloc_parallel (header);if (!par) goto out_mds; par->pnfs_callback = bl_end_par_io_write;
@@ -792,8 +788,8 @@ next_page: bio =bl_submit_bio (WRITE , bio);/* Middle pages */ - pg_index = wdata->args.pgbase >>PAGE_CACHE_SHIFT ; -for (i = pg_index; i < wdata->page_array.npages; i++) { + pg_index = header->args.pgbase >>PAGE_CACHE_SHIFT ; +for (i = pg_index; i < header->page_array.npages; i++) {if (!extent_length) {/* We've used up the previous extent */ bl_put_extent (be);
@@ -864,7 +860,7 @@ next_page: } - bio = do_add_page_to_bio(bio, wdata->page_array.npages - i, + bio = do_add_page_to_bio(bio, header->page_array.npages - i, WRITE, isect, pages[i], be, bl_end_io_write, par,
@@ -893,7 +889,7 @@ next_page: } write_done: - wdata->res.count = wdata->args.count; + header->res.count = header->args.count; out:bl_put_extent (be);bl_put_extent (cow_read);
fs/nfs/direct.c +4 -4
@@ -148,8 +148,8 @@ static void nfs_direct_set_hdr_verf(stru {struct nfs_writeverf *verfp; - verfp =nfs_direct_select_verf (dreq, hdr->data.ds_clp, - hdr->data.ds_idx); + verfp =nfs_direct_select_verf (dreq, hdr->ds_clp, + hdr->ds_idx);WARN_ON_ONCE (verfp->committed >=0 );memcpy (verfp, &hdr->verf,sizeof (struct nfs_writeverf ));WARN_ON_ONCE (verfp->committed <0 );
@@ -169,8 +169,8 @@ static int nfs_direct_set_or_cmp_hdr_ver {struct nfs_writeverf *verfp; - verfp =nfs_direct_select_verf (dreq, hdr->data.ds_clp, - hdr->data.ds_idx); + verfp =nfs_direct_select_verf (dreq, hdr->ds_clp, + hdr->ds_idx);if (verfp->committed <0 ) {nfs_direct_set_hdr_verf (dreq, hdr);return 0 ;
fs/nfs/filelayout/filelayout.c +81 -89
362 lines not on this page · raw message
fs/nfs/internal.h +3 -3
@@ -240,9 +240,9 @@ int nfs_iocounter_wait(struct nfs_io_couextern const struct nfs_pageio_ops nfs_pgio_rw_ops;struct nfs_pgio_header *nfs_pgio_header_alloc (const struct nfs_rw_ops *);void nfs_pgio_header_free (struct nfs_pgio_header *); -void nfs_pgio_data_destroy (struct nfs_pgio_data *); +void nfs_pgio_data_destroy (struct nfs_pgio_header *);int nfs_generic_pgio (struct nfs_pageio_descriptor *,struct nfs_pgio_header *); -int nfs_initiate_pgio (struct rpc_clnt *,struct nfs_pgio_data *, +int nfs_initiate_pgio (struct rpc_clnt *,struct nfs_pgio_header *,const struct rpc_call_ops *,int ,int );void nfs_free_request (struct nfs_page *req);
@@ -482,7 +482,7 @@ static inline void nfs_inode_dio_wait(stextern ssize_t nfs_dreq_bytes_left (struct nfs_direct_req *dreq);/* nfs4proc.c */ -extern void __nfs4_read_done_cb (struct nfs_pgio_data *); +extern void __nfs4_read_done_cb (struct nfs_pgio_header *);extern struct nfs_client *nfs4_init_client (struct nfs_client *clp,const struct rpc_timeout *timeparms,const char *ip_addr);
fs/nfs/nfs3proc.c +12 -9
@@ -795,41 +795,44 @@ nfs3_proc_pathconf(struct nfs_server *sereturn status; } -static int nfs3_read_done (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs3_read_done (struct rpc_task *task,struct nfs_pgio_header *hdr) { -struct inode *inode = data->header->inode; +struct inode *inode = hdr->inode;if (nfs3_async_handle_jukebox (task, inode))return -EAGAIN ;nfs_invalidate_atime (inode); -nfs_refresh_inode (inode, &data->fattr); +nfs_refresh_inode (inode, &hdr->fattr);return 0 ; } -static void nfs3_proc_read_setup (struct nfs_pgio_data *data,struct rpc_message *msg) +static void nfs3_proc_read_setup (struct nfs_pgio_header *hdr, +struct rpc_message *msg) { msg->rpc_proc = &nfs3_procedures[NFS3PROC_READ ]; } -static int nfs3_proc_pgio_rpc_prepare (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs3_proc_pgio_rpc_prepare (struct rpc_task *task, +struct nfs_pgio_header *hdr) {rpc_call_start (task);return 0 ; } -static int nfs3_write_done (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs3_write_done (struct rpc_task *task,struct nfs_pgio_header *hdr) { -struct inode *inode = data->header->inode; +struct inode *inode = hdr->inode;if (nfs3_async_handle_jukebox (task, inode))return -EAGAIN ;if (task->tk_status >=0 ) -nfs_post_op_update_inode_force_wcc (inode, data->res.fattr); +nfs_post_op_update_inode_force_wcc (inode, hdr->res.fattr);return 0 ; } -static void nfs3_proc_write_setup (struct nfs_pgio_data *data,struct rpc_message *msg) +static void nfs3_proc_write_setup (struct nfs_pgio_header *hdr, +struct rpc_message *msg) { msg->rpc_proc = &nfs3_procedures[NFS3PROC_WRITE ]; }
fs/nfs/nfs4_fs.h +3 -3
@@ -337,11 +337,11 @@ nfs4_state_protect(struct nfs_client *cl*/ static inline void nfs4_state_protect_write (struct nfs_client *clp,struct rpc_clnt **clntp, -struct rpc_message *msg,struct nfs_pgio_data *wdata) +struct rpc_message *msg,struct nfs_pgio_header *hdr) {if (_nfs4_state_protect (clp,NFS_SP4_MACH_CRED_WRITE , clntp, msg) && !test_bit (NFS_SP4_MACH_CRED_COMMIT , &clp->cl_sp4_flags)) - wdata->args.stable =NFS_FILE_SYNC ; + hdr->args.stable =NFS_FILE_SYNC ; }#else /* CONFIG_NFS_v4_1 */ static inline struct nfs4_session *nfs4_get_session (const struct nfs_server *server)
@@ -369,7 +369,7 @@ nfs4_state_protect(struct nfs_client *clstatic inline void nfs4_state_protect_write (struct nfs_client *clp,struct rpc_clnt **clntp, -struct rpc_message *msg,struct nfs_pgio_data *wdata) +struct rpc_message *msg,struct nfs_pgio_header *hdr) { }#endif /* CONFIG_NFS_V4_1 */
fs/nfs/nfs4proc.c +55 -50
179 lines not on this page · raw message
fs/nfs/nfs4trace.h +14 -14
@@ -932,11 +932,11 @@ DEFINE_NFS4_IDMAP_EVENT(nfs4_map_gid_to_ DECLARE_EVENT_CLASS(nfs4_read_event, TP_PROTO( - const struct nfs_pgio_data *data, + const struct nfs_pgio_header *hdr, int error ), - TP_ARGS(data, error), + TP_ARGS(hdr, error), TP_STRUCT__entry( __field(dev_t, dev)
@@ -948,12 +948,12 @@ DECLARE_EVENT_CLASS(nfs4_read_event, ),TP_fast_assign ( - const struct inode *inode = data->header->inode; + const struct inode *inode = hdr->inode; __entry->dev = inode->i_sb->s_dev; __entry->fileid =NFS_FILEID (inode); __entry->fhandle =nfs_fhandle_hash (NFS_FH (inode)); - __entry->offset = data->args.offset; - __entry->count = data->args.count; + __entry->offset = hdr->args.offset; + __entry->count = hdr->args.count; __entry->error = error; ),
@@ -972,10 +972,10 @@ DECLARE_EVENT_CLASS(nfs4_read_event,#define DEFINE_NFS4_READ_EVENT (name) \ DEFINE_EVENT(nfs4_read_event, name, \ TP_PROTO( \ - const struct nfs_pgio_data *data, \ + const struct nfs_pgio_header *hdr, \ int error \ ), \ - TP_ARGS(data, error)) + TP_ARGS(hdr, error))DEFINE_NFS4_READ_EVENT (nfs4_read);#ifdef CONFIG_NFS_V4_1 DEFINE_NFS4_READ_EVENT (nfs4_pnfs_read);
@@ -983,11 +983,11 @@ DEFINE_NFS4_READ_EVENT(nfs4_pnfs_read); DECLARE_EVENT_CLASS(nfs4_write_event, TP_PROTO( - const struct nfs_pgio_data *data, + const struct nfs_pgio_header *hdr, int error ), - TP_ARGS(data, error), + TP_ARGS(hdr, error), TP_STRUCT__entry( __field(dev_t, dev)
@@ -999,12 +999,12 @@ DECLARE_EVENT_CLASS(nfs4_write_event, ),TP_fast_assign ( - const struct inode *inode = data->header->inode; + const struct inode *inode = hdr->inode; __entry->dev = inode->i_sb->s_dev; __entry->fileid =NFS_FILEID (inode); __entry->fhandle =nfs_fhandle_hash (NFS_FH (inode)); - __entry->offset = data->args.offset; - __entry->count = data->args.count; + __entry->offset = hdr->args.offset; + __entry->count = hdr->args.count; __entry->error = error; ),
@@ -1024,10 +1024,10 @@ DECLARE_EVENT_CLASS(nfs4_write_event,#define DEFINE_NFS4_WRITE_EVENT (name) \ DEFINE_EVENT(nfs4_write_event, name, \ TP_PROTO( \ - const struct nfs_pgio_data *data, \ + const struct nfs_pgio_header *hdr, \ int error \ ), \ - TP_ARGS(data, error)) + TP_ARGS(hdr, error))DEFINE_NFS4_WRITE_EVENT (nfs4_write);#ifdef CONFIG_NFS_V4_1 DEFINE_NFS4_WRITE_EVENT (nfs4_pnfs_write);
fs/nfs/objlayout/objio_osd.c +11 -13
@@ -439,22 +439,21 @@ static void _read_done(struct ore_io_staobjlayout_read_done (&objios->oir, status, objios->sync); } -int objio_read_pagelist (struct nfs_pgio_data *rdata) +int objio_read_pagelist (struct nfs_pgio_header *hdr) { -struct nfs_pgio_header *hdr = rdata->header;struct objio_state *objios;int ret; ret =objio_alloc_io_state (NFS_I (hdr->inode)->layout, true, - hdr->lseg, rdata->args.pages, rdata->args.pgbase, - rdata->args.offset, rdata->args.count, rdata, + hdr->lseg, hdr->args.pages, hdr->args.pgbase, + hdr->args.offset, hdr->args.count, hdr,GFP_KERNEL , &objios);if (unlikely (ret))return ret; objios->ios->done = _read_done;dprintk ("%s: offset=0x%llx length=0x%x\n" , __func__, - rdata->args.offset, rdata->args.count); + hdr->args.offset, hdr->args.count); ret =ore_read (objios->ios);if (unlikely (ret))objio_free_result (&objios->oir);
@@ -487,11 +486,11 @@ static void _write_done(struct ore_io_ststatic struct page *__r4w_get_page (void *priv,u64 offset,bool *uptodate) {struct objio_state *objios = priv; -struct nfs_pgio_data *wdata = objios->oir.rpcdata; -struct address_space *mapping = wdata->header->inode->i_mapping; +struct nfs_pgio_header *hdr = objios->oir.rpcdata; +struct address_space *mapping = hdr->inode->i_mapping;pgoff_t index = offset /PAGE_SIZE ;struct page *page; -loff_t i_size =i_size_read (wdata->header->inode); +loff_t i_size =i_size_read (hdr->inode);if (offset >= i_size) { *uptodate = true;
@@ -531,15 +530,14 @@ static const struct _ore_r4w_op _r4w_op .put_page = &__r4w_put_page, }; -int objio_write_pagelist (struct nfs_pgio_data *wdata,int how) +int objio_write_pagelist (struct nfs_pgio_header *hdr,int how) { -struct nfs_pgio_header *hdr = wdata->header;struct objio_state *objios;int ret; ret =objio_alloc_io_state (NFS_I (hdr->inode)->layout, false, - hdr->lseg, wdata->args.pages, wdata->args.pgbase, - wdata->args.offset, wdata->args.count, wdata,GFP_NOFS , + hdr->lseg, hdr->args.pages, hdr->args.pgbase, + hdr->args.offset, hdr->args.count, hdr,GFP_NOFS , &objios);if (unlikely (ret))return ret;
@@ -551,7 +549,7 @@ int objio_write_pagelist(struct nfs_pgio objios->ios->done = _write_done;dprintk ("%s: offset=0x%llx length=0x%x\n" , __func__, - wdata->args.offset, wdata->args.count); + hdr->args.offset, hdr->args.count); ret =ore_write (objios->ios);if (unlikely (ret)) {objio_free_result (&objios->oir);
fs/nfs/objlayout/objlayout.c +39 -42
165 lines not on this page · raw message
fs/nfs/objlayout/objlayout.h +4 -4
@@ -119,8 +119,8 @@ extern void objio_free_lseg(struct pnfs_*/ extern void objio_free_result (struct objlayout_io_res *oir); -extern int objio_read_pagelist (struct nfs_pgio_data *rdata); -extern int objio_write_pagelist (struct nfs_pgio_data *wdata,int how); +extern int objio_read_pagelist (struct nfs_pgio_header *rdata); +extern int objio_write_pagelist (struct nfs_pgio_header *wdata,int how);/* * callback API
@@ -168,10 +168,10 @@ extern struct pnfs_layout_segment *objlaextern void objlayout_free_lseg (struct pnfs_layout_segment *);extern enum pnfs_try_status objlayout_read_pagelist ( -struct nfs_pgio_data *); +struct nfs_pgio_header *);extern enum pnfs_try_status objlayout_write_pagelist ( -struct nfs_pgio_data *, +struct nfs_pgio_header *,int how); extern void objlayout_encode_layoutcommit(
fs/nfs/pagelist.c +58 -62
245 lines not on this page · raw message
fs/nfs/pnfs.c +32 -48
208 lines not on this page · raw message
fs/nfs/pnfs.h +5 -5
@@ -113,8 +113,8 @@ struct pnfs_layoutdriver_type {* Return PNFS_ATTEMPTED to indicate the layout code has attempted * I/O, else return PNFS_NOT_ATTEMPTED to fall back to normal NFS */ -enum pnfs_try_status (*read_pagelist) (struct nfs_pgio_data *nfs_data); -enum pnfs_try_status (*write_pagelist) (struct nfs_pgio_data *nfs_data,int how); +enum pnfs_try_status (*read_pagelist)(struct nfs_pgio_header *); +enum pnfs_try_status (*write_pagelist)(struct nfs_pgio_header *,int );void (*free_deviceid_node) (struct nfs4_deviceid_node *);
@@ -213,13 +213,13 @@ bool pnfs_roc(struct inode *ino);void pnfs_roc_release (struct inode *ino);void pnfs_roc_set_barrier (struct inode *ino,u32 barrier);bool pnfs_roc_drain (struct inode *ino,u32 *barrier,struct rpc_task *task); -void pnfs_set_layoutcommit (struct nfs_pgio_data *wdata); +void pnfs_set_layoutcommit (struct nfs_pgio_header *);void pnfs_cleanup_layoutcommit (struct nfs4_layoutcommit_data *data);int pnfs_layoutcommit_inode (struct inode *inode,bool sync);int _pnfs_return_layout (struct inode *);int pnfs_commit_and_return_layout (struct inode *); -void pnfs_ld_write_done (struct nfs_pgio_data *); -void pnfs_ld_read_done (struct nfs_pgio_data *); +void pnfs_ld_write_done (struct nfs_pgio_header *); +void pnfs_ld_read_done (struct nfs_pgio_header *); struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino, struct nfs_open_context *ctx, loff_t pos,
fs/nfs/proc.c +15 -12
@@ -578,46 +578,49 @@ nfs_proc_pathconf(struct nfs_server *serreturn 0 ; } -static int nfs_read_done (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs_read_done (struct rpc_task *task,struct nfs_pgio_header *hdr) { -struct inode *inode = data->header->inode; +struct inode *inode = hdr->inode;nfs_invalidate_atime (inode);if (task->tk_status >=0 ) { -nfs_refresh_inode (inode, data->res.fattr); +nfs_refresh_inode (inode, hdr->res.fattr);/* Emulate the eof flag, which isn't normally needed in NFSv2 * as it is guaranteed to always return the file attributes */ -if (data->args.offset + data->res.count >= data->res.fattr->size) - data->res.eof =1 ; +if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size) + hdr->res.eof =1 ; }return 0 ; } -static void nfs_proc_read_setup (struct nfs_pgio_data *data,struct rpc_message *msg) +static void nfs_proc_read_setup (struct nfs_pgio_header *hdr, +struct rpc_message *msg) { msg->rpc_proc = &nfs_procedures[NFSPROC_READ ]; } -static int nfs_proc_pgio_rpc_prepare (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs_proc_pgio_rpc_prepare (struct rpc_task *task, +struct nfs_pgio_header *hdr) {rpc_call_start (task);return 0 ; } -static int nfs_write_done (struct rpc_task *task,struct nfs_pgio_data *data) +static int nfs_write_done (struct rpc_task *task,struct nfs_pgio_header *hdr) { -struct inode *inode = data->header->inode; +struct inode *inode = hdr->inode;if (task->tk_status >=0 ) -nfs_post_op_update_inode_force_wcc (inode, data->res.fattr); +nfs_post_op_update_inode_force_wcc (inode, hdr->res.fattr);return 0 ; } -static void nfs_proc_write_setup (struct nfs_pgio_data *data,struct rpc_message *msg) +static void nfs_proc_write_setup (struct nfs_pgio_header *hdr, +struct rpc_message *msg) {/* Note: NFSv2 ignores @stable and always uses NFS_FILE_SYNC */ - data->args.stable =NFS_FILE_SYNC ; + hdr->args.stable =NFS_FILE_SYNC ; msg->rpc_proc = &nfs_procedures[NFSPROC_WRITE ]; }
fs/nfs/read.c +22 -20
92 lines not on this page · raw message
fs/nfs/write.c +29 -27
140 lines not on this page · raw message
include/linux/nfs_page.h +5 -4
@@ -64,10 +64,11 @@ struct nfs_rw_ops {const fmode_t rw_mode;struct nfs_pgio_header *(*rw_alloc_header)(void );void (*rw_free_header)(struct nfs_pgio_header *); -void (*rw_release)(struct nfs_pgio_data *); -int (*rw_done)(struct rpc_task *,struct nfs_pgio_data *,struct inode *); -void (*rw_result)(struct rpc_task *,struct nfs_pgio_data *); -void (*rw_initiate)(struct nfs_pgio_data *,struct rpc_message *, +void (*rw_release)(struct nfs_pgio_header *); +int (*rw_done)(struct rpc_task *,struct nfs_pgio_header *, +struct inode *); +void (*rw_result)(struct rpc_task *,struct nfs_pgio_header *); +void (*rw_initiate)(struct nfs_pgio_header *,struct rpc_message *,struct rpc_task_setup *,int ); };
include/linux/nfs_xdr.h +21 -22
65 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 163/357 nfs: remove pgio_header refcount, related cleanup
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 4714fb51fd03a14d8c73001438283e7f7b752f1e upstream.
The refcounting on nfs_pgio_header was related to there being (possibly) more than one nfs_pgio_data. Now that nfs_pgio_data has been merged into nfs_pgio_header, there is no reason to do this ref counting. Just call the completion callback on nfs_pgio_release/nfs_pgio_error.
--- fs/nfs/pagelist.c | 36 +++++++++++------------------------- fs/nfs/pnfs.c | 6 ------ include/linux/nfs_xdr.h | 1 - 3 files changed, 11 insertions(+), 32 deletions(-)
fs/nfs/pagelist.c +11 -25
@@ -469,7 +469,6 @@ struct nfs_pgio_header *nfs_pgio_header_if (hdr) {INIT_LIST_HEAD (&hdr->pages);spin_lock_init (&hdr->lock); -atomic_set (&hdr->refcnt,0 ); hdr->rw_ops = ops; }return hdr;
@@ -487,31 +486,18 @@ void nfs_pgio_header_free(struct nfs_pgiEXPORT_SYMBOL_GPL (nfs_pgio_header_free);/** -* nfs_pgio_data_alloc - Allocate pageio data -* @hdr: The header making a request -* @pagecount: Number of pages to create -*/ -static bool nfs_pgio_data_init (struct nfs_pgio_header *hdr, -unsigned int pagecount) -{ -if (nfs_pgarray_set (&hdr->page_array, pagecount)) { -atomic_inc (&hdr->refcnt); -return true; - } -return false; -} - -/** -* nfs_pgio_data_destroy - Properly release pageio data -* @hdr: The header with data to destroy +* nfs_pgio_data_destroy - make @hdr suitable for reuse +* +* Frees memory and releases refs from nfs_generic_pgio, so that it may +* be called again. +* +* @hdr: A header that has had nfs_generic_pgio called */ void nfs_pgio_data_destroy (struct nfs_pgio_header *hdr) {put_nfs_open_context (hdr->args.context);if (hdr->page_array.pagevec != hdr->page_array.page_array)kfree (hdr->page_array.pagevec); -if (atomic_dec_and_test (&hdr->refcnt)) - hdr->completion_ops->completion (hdr); }EXPORT_SYMBOL_GPL (nfs_pgio_data_destroy);
@@ -630,6 +616,7 @@ static int nfs_pgio_error(struct nfs_pag {set_bit (NFS_IOHDR_REDO , &hdr->flags);nfs_pgio_data_destroy (hdr); + hdr->completion_ops->completion (hdr); desc->pg_completion_ops->error_cleanup (&desc->pg_list);return -ENOMEM ; }
@@ -644,6 +631,7 @@ static void nfs_pgio_release(void *calldif (hdr->rw_ops->rw_release) hdr->rw_ops->rw_release (hdr);nfs_pgio_data_destroy (hdr); + hdr->completion_ops->completion (hdr); }/**
@@ -717,9 +705,10 @@ int nfs_generic_pgio(struct nfs_pageio_dstruct page **pages;struct list_head *head = &desc->pg_list;struct nfs_commit_info cinfo; +unsigned int pagecount; -if (!nfs_pgio_data_init (hdr,nfs_page_array_len (desc->pg_base, - desc->pg_count))) + pagecount =nfs_page_array_len (desc->pg_base, desc->pg_count); +if (!nfs_pgarray_set (&hdr->page_array, pagecount))return nfs_pgio_error (desc, hdr);nfs_init_cinfo (&cinfo, desc->pg_inode, desc->pg_dreq);
@@ -753,14 +742,11 @@ static int nfs_generic_pg_pgios(struct nreturn -ENOMEM ; }nfs_pgheader_init (desc, hdr, nfs_pgio_header_free); -atomic_inc (&hdr->refcnt); ret =nfs_generic_pgio (desc, hdr);if (ret ==0 ) ret =nfs_initiate_pgio (NFS_CLIENT (hdr->inode), hdr, desc->pg_rpc_callops, desc->pg_ioflags,0 ); -if (atomic_dec_and_test (&hdr->refcnt)) - hdr->completion_ops->completion (hdr);return ret; }
fs/nfs/pnfs.c +0 -6
@@ -1602,15 +1602,12 @@ pnfs_generic_pg_writepages(struct nfs_pa }nfs_pgheader_init (desc, hdr, pnfs_writehdr_free); hdr->lseg =pnfs_get_lseg (desc->pg_lseg); -atomic_inc (&hdr->refcnt); ret =nfs_generic_pgio (desc, hdr);if (ret !=0 ) {pnfs_put_lseg (desc->pg_lseg); desc->pg_lseg =NULL ; }else pnfs_do_write (desc, hdr, desc->pg_ioflags); -if (atomic_dec_and_test (&hdr->refcnt)) - hdr->completion_ops->completion (hdr);return ret; }EXPORT_SYMBOL_GPL (pnfs_generic_pg_writepages);
@@ -1745,15 +1742,12 @@ pnfs_generic_pg_readpages(struct nfs_pag }nfs_pgheader_init (desc, hdr, pnfs_readhdr_free); hdr->lseg =pnfs_get_lseg (desc->pg_lseg); -atomic_inc (&hdr->refcnt); ret =nfs_generic_pgio (desc, hdr);if (ret !=0 ) {pnfs_put_lseg (desc->pg_lseg); desc->pg_lseg =NULL ; }else pnfs_do_read (desc, hdr); -if (atomic_dec_and_test (&hdr->refcnt)) - hdr->completion_ops->completion (hdr);return ret; }EXPORT_SYMBOL_GPL (pnfs_generic_pg_readpages);
include/linux/nfs_xdr.h +0 -1
@@ -1261,7 +1261,6 @@ struct nfs_pgio_header {struct inode *inode;struct rpc_cred *cred;struct list_head pages; -atomic_t refcnt;struct nfs_page *req;struct nfs_writeverf verf;/* Used for writes */ struct pnfs_layout_segment *lseg;
Greg Kroah-Hartman
maintainerPATCH 164/357 nfs: check wait_on_bit_lock err in page_group_lock
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit e7029206ff43f6cf7d6fcb741adb126f47200516 upstream.
Return errors from wait_on_bit_lock from nfs_page_group_lock.
Add a bool argument @wait to nfs_page_group_lock. If true, loop over wait_on_bit_lock until it returns cleanly. If false, return the error from wait_on_bit_lock.
--- fs/nfs/pagelist.c | 29 +++++++++++++++++++++++------ fs/nfs/write.c | 6 ++++-- include/linux/nfs_page.h | 2 +- 3 files changed, 28 insertions(+), 9 deletions(-)
fs/nfs/pagelist.c +23 -6
@@ -147,17 +147,25 @@ static int nfs_wait_bit_uninterruptible(* @req - request in group that is to be locked * * this lock must be held if modifying the page group list +* +* returns result from wait_on_bit_lock: 0 on success, < 0 on error */ -void -nfs_page_group_lock (struct nfs_page *req) +int +nfs_page_group_lock (struct nfs_page *req,bool wait) {struct nfs_page *head = req->wb_head; +int ret;WARN_ON_ONCE (head != head->wb_head); -wait_on_bit_lock (&head->wb_flags,PG_HEADLOCK , +do { + ret =wait_on_bit_lock (&head->wb_flags,PG_HEADLOCK , nfs_wait_bit_uninterruptible,TASK_UNINTERRUPTIBLE ); + }while (wait && ret !=0 ); + +WARN_ON_ONCE (ret >0 ); +return ret; }/*
@@ -218,7 +226,7 @@ bool nfs_page_group_sync_on_bit(struct n {bool ret; -nfs_page_group_lock (req); +nfs_page_group_lock (req, true); ret =nfs_page_group_sync_on_bit_locked (req, bit);nfs_page_group_unlock (req);
@@ -859,8 +867,13 @@ static int __nfs_pageio_add_request(strustruct nfs_page *subreq;unsigned int bytes_left =0 ;unsigned int offset, pgbase; +int ret; -nfs_page_group_lock (req); + ret =nfs_page_group_lock (req, false); +if (ret <0 ) { + desc->pg_error = ret; +return 0 ; + } subreq = req; bytes_left = subreq->wb_bytes;
@@ -882,7 +895,11 @@ static int __nfs_pageio_add_request(struif (desc->pg_recoalesce)return 0 ;/* retry add_request for this subreq */ -nfs_page_group_lock (req); + ret =nfs_page_group_lock (req, false); +if (ret <0 ) { + desc->pg_error = ret; +return 0 ; + }continue ; }
fs/nfs/write.c +4 -2
@@ -216,7 +216,7 @@ static bool nfs_page_group_covers_page(sunsigned int pos =0 ;unsigned int len =nfs_page_length (req->wb_page); -nfs_page_group_lock (req); +nfs_page_group_lock (req, true); do { tmp = nfs_page_group_search_locked(req->wb_head, pos);
@@ -456,7 +456,9 @@ try_again: }/* lock each request in the page group */ -nfs_page_group_lock (head); + ret =nfs_page_group_lock (head, false); +if (ret <0 ) +return ERR_PTR (ret); subreq = head; do { /*
include/linux/nfs_page.h +1 -1
@@ -120,7 +120,7 @@ extern size_t nfs_generic_pg_test(structextern int nfs_wait_on_request (struct nfs_page *);extern void nfs_unlock_request (struct nfs_page *req);extern void nfs_unlock_and_release_request (struct nfs_page *); -extern void nfs_page_group_lock (struct nfs_page *); +extern int nfs_page_group_lock (struct nfs_page *,bool );extern void nfs_page_group_unlock (struct nfs_page *);extern bool nfs_page_group_sync_on_bit (struct nfs_page *,unsigned int );
Greg Kroah-Hartman
maintainerPATCH 165/357 pnfs: add pnfs_put_lseg_async
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit e6cf82d1830f5e16a10d566f58db70f297ba5da8 upstream.
This is useful when lsegs need to be released while holding locks.
--- fs/nfs/pnfs.c | 17 +++++++++++++++++ fs/nfs/pnfs.h | 7 +++++++ 2 files changed, 24 insertions(+)
fs/nfs/pnfs.c +17 -0
@@ -361,6 +361,23 @@ pnfs_put_lseg(struct pnfs_layout_segment }EXPORT_SYMBOL_GPL (pnfs_put_lseg); +static void pnfs_put_lseg_async_work (struct work_struct *work) +{ +struct pnfs_layout_segment *lseg; + + lseg = container_of(work, struct pnfs_layout_segment, pls_work); + +pnfs_put_lseg (lseg); +} + +void +pnfs_put_lseg_async (struct pnfs_layout_segment *lseg) +{ +INIT_WORK (&lseg->pls_work, pnfs_put_lseg_async_work); +schedule_work (&lseg->pls_work); +} +EXPORT_SYMBOL_GPL (pnfs_put_lseg_async); +static u64 end_offset (u64 start,u64 len) {
fs/nfs/pnfs.h +7 -0
@@ -32,6 +32,7 @@#include <linux/nfs_fs.h> #include <linux/nfs_page.h> +#include <linux/workqueue.h> enum {NFS_LSEG_VALID =0 ,/* cleared when lseg is recalled/returned */
@@ -46,6 +47,7 @@ struct pnfs_layout_segment {atomic_t pls_refcount;unsigned long pls_flags;struct pnfs_layout_hdr *pls_layout; +struct work_struct pls_work; };enum pnfs_try_status {
@@ -179,6 +181,7 @@ extern int nfs4_proc_layoutreturn(struct/* pnfs.c */ void pnfs_get_layout_hdr (struct pnfs_layout_hdr *lo);void pnfs_put_lseg (struct pnfs_layout_segment *lseg); +void pnfs_put_lseg_async (struct pnfs_layout_segment *lseg);void set_pnfs_layoutdriver (struct nfs_server *,const struct nfs_fh *,u32 );void unset_pnfs_layoutdriver (struct nfs_server *);
@@ -410,6 +413,10 @@ static inline void pnfs_put_lseg(struct { } +static inline void pnfs_put_lseg_async (struct pnfs_layout_segment *lseg) +{ +} +static inline int pnfs_return_layout (struct inode *ino) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 166/357 nfs: clear_request_commit while holding i_lock
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 411a99adffb4f993eee29759f744de01487044ac upstream.
--- fs/nfs/filelayout/filelayout.c | 5 ++--- fs/nfs/write.c | 15 ++++----------- 2 files changed, 6 insertions(+), 14 deletions(-)
fs/nfs/filelayout/filelayout.c +2 -3
@@ -1015,6 +1015,7 @@ static u32 select_bucket_index(struct nf/* The generic layer is about to remove the req from the commit list. * If this will make the bucket empty, it will need to put the lseg reference. +* Note this is must be called holding the inode (/cinfo) lock */ static void filelayout_clear_request_commit(struct nfs_page *req,
@@ -1022,7 +1023,6 @@ filelayout_clear_request_commit(struct n {struct pnfs_layout_segment *freeme =NULL ; -spin_lock (cinfo->lock);if (!test_and_clear_bit (PG_COMMIT_TO_DS , &req->wb_flags)) goto out; cinfo->ds->nwritten--;
@@ -1037,8 +1037,7 @@ filelayout_clear_request_commit(struct n } out:nfs_request_remove_commit_list (req, cinfo); -spin_unlock (cinfo->lock); -pnfs_put_lseg (freeme); +pnfs_put_lseg_async (freeme); } static struct list_head *
fs/nfs/write.c +4 -11
@@ -379,8 +379,6 @@ nfs_destroy_unlinked_subrequests(struct subreq->wb_head = subreq; subreq->wb_this_page = subreq; -nfs_clear_request_commit (subreq); -/* subreq is now totally disconnected from page group or any * write / commit lists. last chance to wake any waiters */ nfs_unlock_request (subreq);
@@ -490,7 +488,7 @@ try_again:* Commit list removal accounting is done after locks are dropped */ subreq = head;do { -nfs_list_remove_request (subreq); +nfs_clear_request_commit (subreq); subreq = subreq->wb_this_page; }while (subreq != head);
@@ -520,15 +518,11 @@ try_again:nfs_page_group_unlock (head); -/* drop lock to clear_request_commit the head req and clean up -* requests on destroy list */ +/* drop lock to clean uprequests on destroy list */ spin_unlock (&inode->i_lock);nfs_destroy_unlinked_subrequests (destroy_list, head); -/* clean up commit list state */ -nfs_clear_request_commit (head); -/* still holds ref on head from nfs_page_find_head_request_locked * and still has lock on head from lock loop */ return head;
@@ -810,6 +804,7 @@ nfs_clear_page_commit(struct page *page)dec_bdi_stat (page_file_mapping (page)->backing_dev_info,BDI_RECLAIMABLE ); } +/* Called holding inode (/cinfo) lock */ static void nfs_clear_request_commit (struct nfs_page *req) {
@@ -819,9 +814,7 @@ nfs_clear_request_commit(struct nfs_pagenfs_init_cinfo_from_inode (&cinfo, inode);if (!pnfs_clear_request_commit (req, &cinfo)) { -spin_lock (cinfo.lock);nfs_request_remove_commit_list (req, &cinfo); -spin_unlock (cinfo.lock); }nfs_clear_page_commit (req->wb_page); }
@@ -1040,9 +1033,9 @@ static struct nfs_page *nfs_try_to_updatelse req->wb_bytes = rqend - req->wb_offset; out_unlock: -spin_unlock (&inode->i_lock);if (req)nfs_clear_request_commit (req); +spin_unlock (&inode->i_lock);return req; out_flushme:spin_unlock (&inode->i_lock);
Greg Kroah-Hartman
maintainerPATCH 167/357 nfs: change nfs_page_group_lock argument
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit fd2f3a06d30c85a17cf035ebc60c88c2a13a8ece upstream.
Flip the meaning of the second argument from 'wait' to 'nonblock' to match related functions. Update all five calls to reflect this change.
--- fs/nfs/pagelist.c | 11 ++++++----- fs/nfs/write.c | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-)
fs/nfs/pagelist.c +6 -5
@@ -145,13 +145,14 @@ static int nfs_wait_bit_uninterruptible(/* * nfs_page_group_lock - lock the head of the page group * @req - request in group that is to be locked +* @nonblock - if true don't block waiting for lock * * this lock must be held if modifying the page group list * * returns result from wait_on_bit_lock: 0 on success, < 0 on error */ int -nfs_page_group_lock (struct nfs_page *req,bool wait) +nfs_page_group_lock (struct nfs_page *req,bool nonblock) {struct nfs_page *head = req->wb_head;int ret;
@@ -162,7 +163,7 @@ nfs_page_group_lock(struct nfs_page *req ret =wait_on_bit_lock (&head->wb_flags,PG_HEADLOCK , nfs_wait_bit_uninterruptible,TASK_UNINTERRUPTIBLE ); - }while (wait && ret !=0 ); + }while (!nonblock && ret !=0 );WARN_ON_ONCE (ret >0 );return ret;
@@ -226,7 +227,7 @@ bool nfs_page_group_sync_on_bit(struct n {bool ret; -nfs_page_group_lock (req, true); +nfs_page_group_lock (req, false); ret =nfs_page_group_sync_on_bit_locked (req, bit);nfs_page_group_unlock (req);
@@ -869,7 +870,7 @@ static int __nfs_pageio_add_request(struunsigned int offset, pgbase;int ret; - ret =nfs_page_group_lock (req, false); + ret =nfs_page_group_lock (req, true);if (ret <0 ) { desc->pg_error = ret;return 0 ;
@@ -895,7 +896,7 @@ static int __nfs_pageio_add_request(struif (desc->pg_recoalesce)return 0 ;/* retry add_request for this subreq */ - ret =nfs_page_group_lock (req, false); + ret =nfs_page_group_lock (req, true);if (ret <0 ) { desc->pg_error = ret;return 0 ;
fs/nfs/write.c +2 -2
@@ -216,7 +216,7 @@ static bool nfs_page_group_covers_page(sunsigned int pos =0 ;unsigned int len =nfs_page_length (req->wb_page); -nfs_page_group_lock (req, true); +nfs_page_group_lock (req, false); do { tmp = nfs_page_group_search_locked(req->wb_head, pos);
@@ -454,7 +454,7 @@ try_again: }/* lock each request in the page group */ - ret =nfs_page_group_lock (head, false); + ret =nfs_page_group_lock (head, true);if (ret <0 )return ERR_PTR (ret); subreq = head;
Greg Kroah-Hartman
maintainerPATCH 168/357 nfs: fix nonblocking calls to nfs_page_group_lock
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit bc8a309e88a86205fc3e17f06e42a2e56fc6f807 upstream.
nfs_page_group_lock was calling wait_on_bit_lock even when told not to block. Fix by first trying test_and_set_bit, followed by wait_on_bit_lock if and only if blocking is allowed. Return -EAGAIN if nonblocking and the test_and_set of the bit was already locked.
--- fs/nfs/pagelist.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
fs/nfs/pagelist.c +14 -9
@@ -149,24 +149,29 @@ static int nfs_wait_bit_uninterruptible(* * this lock must be held if modifying the page group list * -* returns result from wait_on_bit_lock: 0 on success, < 0 on error +* return 0 on success, < 0 on error: -EDELAY if nonblocking or the +* result from wait_on_bit_lock +* +* NOTE: calling with nonblock=false should always have set the +* lock bit (see fs/buffer.c and other uses of wait_on_bit_lock +* with TASK_UNINTERRUPTIBLE), so there is no need to check the result. */ int nfs_page_group_lock (struct nfs_page *req,bool nonblock) {struct nfs_page *head = req->wb_head; -int ret;WARN_ON_ONCE (head != head->wb_head); -do { - ret =wait_on_bit_lock (&head->wb_flags,PG_HEADLOCK , - nfs_wait_bit_uninterruptible, -TASK_UNINTERRUPTIBLE ); - }while (!nonblock && ret !=0 ); +if (!test_and_set_bit (PG_HEADLOCK , &head->wb_flags)) +return 0 ; + +if (!nonblock) +return wait_on_bit_lock (&head->wb_flags,PG_HEADLOCK , + nfs_wait_bit_uninterruptible, +TASK_UNINTERRUPTIBLE ); -WARN_ON_ONCE (ret >0 ); -return ret; +return -EAGAIN ; }/*
Greg Kroah-Hartman
maintainerPATCH 169/357 nfs: use blocking page_group_lock in add_request
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit bfd484a5606d6a0379a0a2f04251b1e5c1f8995c upstream.
__nfs_pageio_add_request was calling nfs_page_group_lock nonblocking, but this can return -EAGAIN which would end up passing -EIO to the application.
There is no reason not to block in this path, so change the two calls to do so. Also, there is no need to check the return value of nfs_page_group_lock when nonblock=false, so remove the error handling code.
--- fs/nfs/pagelist.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
fs/nfs/pagelist.c +2 -11
@@ -873,13 +873,8 @@ static int __nfs_pageio_add_request(strustruct nfs_page *subreq;unsigned int bytes_left =0 ;unsigned int offset, pgbase; -int ret; - ret =nfs_page_group_lock (req, true); -if (ret <0 ) { - desc->pg_error = ret; -return 0 ; - } +nfs_page_group_lock (req, false); subreq = req; bytes_left = subreq->wb_bytes;
@@ -901,11 +896,7 @@ static int __nfs_pageio_add_request(struif (desc->pg_recoalesce)return 0 ;/* retry add_request for this subreq */ - ret =nfs_page_group_lock (req, true); -if (ret <0 ) { - desc->pg_error = ret; -return 0 ; - } +nfs_page_group_lock (req, false);continue ; }
Greg Kroah-Hartman
maintainerPATCH 170/357 nfs: fix error handling in lock_and_join_requests
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 94970014c46223cbcdfbfc67b89596a412f9e3dd upstream.
This fixes handling of errors from nfs_page_group_lock in nfs_lock_and_join_requests. It now releases the inode lock and the reference to the head request.
--- fs/nfs/write.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/nfs/write.c +4 -1
@@ -455,8 +455,11 @@ try_again:/* lock each request in the page group */ ret =nfs_page_group_lock (head, true); -if (ret <0 ) +if (ret <0 ) { +spin_unlock (&inode->i_lock); +nfs_release_request (head);return ERR_PTR (ret); + } subreq = head; do { /*
Greg Kroah-Hartman
maintainerPATCH 171/357 nfs: dont sleep with inode lock in lock_and_join_requests
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 7c3af975257383ece54b83c0505d3e0656cb7daf upstream.
This handles the 'nonblock=false' case in nfs_lock_and_join_requests. If the group is already locked and blocking is allowed, drop the inode lock and wait for the group lock to be cleared before trying it all again. This should fix warnings found in peterz's tree (sched/wait branch), where might_sleep() checks are added to wait.[ch].
--- fs/nfs/pagelist.c | 18 ++++++++++++++++++ fs/nfs/write.c | 12 +++++++++++- include/linux/nfs_page.h | 1 + 3 files changed, 30 insertions(+), 1 deletion(-)
fs/nfs/pagelist.c +18 -0
@@ -175,6 +175,24 @@ nfs_page_group_lock(struct nfs_page *req }/* +* nfs_page_group_lock_wait - wait for the lock to clear, but don't grab it +* @req - a request in the group +* +* This is a blocking call to wait for the group lock to be cleared. +*/ +void +nfs_page_group_lock_wait (struct nfs_page *req) +{ +struct nfs_page *head = req->wb_head; + +WARN_ON_ONCE (head != head->wb_head); + +wait_on_bit (&head->wb_flags,PG_HEADLOCK , + nfs_wait_bit_uninterruptible, +TASK_UNINTERRUPTIBLE ); +} + +/* * nfs_page_group_unlock - unlock the head of the page group * @req - request in group that is to be unlocked */
fs/nfs/write.c +11 -1
@@ -453,13 +453,23 @@ try_again:return NULL ; } -/* lock each request in the page group */ +/* holding inode lock, so always make a non-blocking call to try the +* page group lock */ ret =nfs_page_group_lock (head, true);if (ret <0 ) {spin_unlock (&inode->i_lock); + +if (!nonblock && ret == -EAGAIN ) { +nfs_page_group_lock_wait (head); +nfs_release_request (head); + goto try_again; + } +nfs_release_request (head);return ERR_PTR (ret); } + +/* lock each request in the page group */ subreq = head; do { /*
include/linux/nfs_page.h +1 -0
@@ -121,6 +121,7 @@ extern int nfs_wait_on_request(struct nextern void nfs_unlock_request (struct nfs_page *req);extern void nfs_unlock_and_release_request (struct nfs_page *);extern int nfs_page_group_lock (struct nfs_page *,bool ); +extern void nfs_page_group_lock_wait (struct nfs_page *);extern void nfs_page_group_unlock (struct nfs_page *);extern bool nfs_page_group_sync_on_bit (struct nfs_page *,unsigned int );
Greg Kroah-Hartman
maintainerPATCH 174/357 spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jorge A. Ventura" <[email protected]>
commit 3d0763c006f8da1b44a9f5f9a21187f5b8f674f4 upstream.
The spi hangs waiting the completion of omap2_mcspi_rx_callback.
--- drivers/spi/spi-omap2-mcspi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-omap2-mcspi.c +2 -1
@@ -329,7 +329,8 @@ static void omap2_mcspi_set_fifo(const s disable_fifo:if (t->rx_buf !=NULL ) chconf &= ~OMAP2_MCSPI_CHCONF_FFER ; -else + +if (t->tx_buf !=NULL ) chconf &= ~OMAP2_MCSPI_CHCONF_FFET ;mcspi_write_chconf0 (spi, chconf);
Greg Kroah-Hartman
maintainerPATCH 175/357 spi: dw: fix kernel crash due to NULL pointer dereference
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 08a707b87874eaaa0f336ab604ecd6e5e9f286dd upstream.
The obvious fix after the commit d9c73bb8a3a5 "spi: dw: add support for gpio controlled chip select". This patch fixes the issue by using locally defined temporary variable.
--- drivers/spi/spi-dw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-dw.c +1 -1
@@ -271,7 +271,7 @@ static void giveback(struct dw_spi *dws) transfer_list);if (!last_transfer->cs_change) -spi_chip_sel (dws, dws->cur_msg->spi,0 ); +spi_chip_sel (dws, msg->spi,0 );spi_finalize_current_message (dws->master); }
Greg Kroah-Hartman
maintainerPATCH 176/357 spi: dw-pci: fix bug when regs left uninitialized
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit c9d5d6fe168fd45a4dfdd0116affe708789b4702 upstream.
The commit 04f421e7 "spi: dw: use managed resources" changes drivers to use managed functions, but seems wasn't properly tested in PCI case. The regs field of struct dw_spi left uninitialized. Thus, kernel crashes when tries to access to the SPI controller registers. This patch fixes the issue.
--- drivers/spi/spi-dw-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-dw-pci.c +2 -0
@@ -62,6 +62,8 @@ static int spi_pci_probe(struct pci_devif (ret)return ret; + dws->regs =pcim_iomap_table (pdev)[pci_bar]; + dws->bus_num =0 ; dws->num_cs =4 ; dws->irq = pdev->irq;
Greg Kroah-Hartman
maintainerPATCH 177/357 ARM: 8128/1: abort: dont clear the exclusive monitors
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 85868313177700d20644263a782351262d2aff84 upstream.
The ARMv6 and ARMv7 early abort handlers clear the exclusive monitors upon entry to the kernel, but this is redundant:
- We clear the monitors on every exception return since commit 200b812d0084 ("Clear the exclusive monitor when returning from an exception"), so this is not necessary to ensure the monitors are cleared before returning from a fault handler.
- Any dummy STREX will target a temporary scratch area in memory, and may succeed or fail without corrupting useful data. Its status value will not be used.
- Any other STREX in the kernel must be preceded by an LDREX, which will initialise the monitors consistently and will not depend on the earlier state of the monitors.
Therefore we have no reason to care about the initial state of the exclusive monitors when a data abort is taken, and clearing the monitors prior to exception return (as we already do) is sufficient.
This patch removes the redundant clearing of the exclusive monitors from the early abort handlers.
--- arch/arm/mm/abort-ev6.S | 6 ------ arch/arm/mm/abort-ev7.S | 6 ------ 2 files changed, 12 deletions(-)
arch/arm/mm/abort-ev6.S +0 -6
@@ -17,12 +17,6 @@ */ .align 5 ENTRY(v6_early_abort) -#ifdef CONFIG_CPU_V6 - sub r1, sp, #4 @ Get unused stack location - strex r0, r1, [r1] @ Clear the exclusive monitor -#elif defined(CONFIG_CPU_32v6K) - clrex -#endif mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR /*
arch/arm/mm/abort-ev7.S +0 -6
@@ -13,12 +13,6 @@ */ .align 5 ENTRY(v7_early_abort) - /* - * The effect of data aborts on on the exclusive access monitor are - * UNPREDICTABLE. Do a CLREX to clear the state - */ - clrex - mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR
Greg Kroah-Hartman
maintainerPATCH 178/357 ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 2c32c65e3726c773760038910be30cce1b4d4149 upstream.
On revisions of Cortex-A15 prior to r3p3, a CLREX instruction at PL1 may falsely trigger a watchpoint exception, leading to potential data aborts during exception return and/or livelock.
This patch resolves the issue in the following ways:
- Replacing our uses of CLREX with a dummy STREX sequence instead (as we did for v6 CPUs).
- Removing the clrex code from v7_exit_coherency_flush and derivatives, since this only exists as a minor performance improvement when non-cached exclusives are in use (Linux doesn't use these).
Benchmarking on a variety of ARM cores revealed no measurable performance difference with this change applied, so the change is performed unconditionally and no new Kconfig entry is added.
--- arch/arm/include/asm/cacheflush.h | 1 - arch/arm/kernel/entry-header.S | 29 +++++++++++++++-------------- arch/arm/mach-exynos/mcpm-exynos.c | 1 - 3 files changed, 15 insertions(+), 16 deletions(-)
arch/arm/include/asm/cacheflush.h +0 -1
@@ -472,7 +472,6 @@ static inline void __sync_cache_range_r("mcr p15, 0, r0, c1, c0, 0 @ set SCTLR \n\t" \"isb \n\t" \ "bl v7_flush_dcache_"__stringify(level)" \n\t" \ -"clrex \n\t" \"mrc p15, 0, r0, c1, c0, 1 @ get ACTLR \n\t" \"bic r0, r0, #(1 << 6) @ disable local coherency \n\t" \"mcr p15, 0, r0, c1, c0, 1 @ set ACTLR \n\t" \
arch/arm/kernel/entry-header.S +15 -14
@@ -208,26 +208,21 @@ #endif .endif msr spsr_cxsf, \rpsr -#if defined(CONFIG_CPU_V6) - ldr r0, [sp] - strex r1, r2, [sp] @ clear the exclusive monitor - ldmib sp, {r1 - pc}^ @ load r1 - pc, cpsr -#elif defined(CONFIG_CPU_32v6K) - clrex @ clear the exclusive monitor - ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr -#else - ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr +#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K) + @ We must avoid clrex due to Cortex-A15 erratum #830321 + sub r0, sp, #4 @ uninhabited address + strex r1, r2, [r0] @ clear the exclusive monitor #endif + ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr .endm .macro restore_user_regs, fast = 0, offset = 0 ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr ldr lr, [sp, #\offset + S_PC]! @ get pc msr spsr_cxsf, r1 @ save in spsr_svc -#if defined(CONFIG_CPU_V6) +#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K) + @ We must avoid clrex due to Cortex-A15 erratum #830321 strex r1, r2, [sp] @ clear the exclusive monitor -#elif defined(CONFIG_CPU_32v6K) - clrex @ clear the exclusive monitor #endif .if \fast ldmdb sp, {r1 - lr}^ @ get calling r1 - lr
@@ -267,7 +262,10 @@ .endif ldr lr, [sp, #S_SP] @ top of the stack ldrd r0, r1, [sp, #S_LR] @ calling lr and pc - clrex @ clear the exclusive monitor + + @ We must avoid clrex due to Cortex-A15 erratum #830321 + strex r2, r1, [sp, #S_LR] @ clear the exclusive monitor + stmdb lr!, {r0, r1, \rpsr} @ calling lr and rfe context ldmia sp, {r0 - r12} mov sp, lr
@@ -288,13 +286,16 @@ .endm #else /* ifdef CONFIG_CPU_V7M */ .macro restore_user_regs, fast = 0, offset = 0 - clrex @ clear the exclusive monitor mov r2, sp load_user_sp_lr r2, r3, \offset + S_SP @ calling sp, lr ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr ldr lr, [sp, #\offset + S_PC] @ get pc add sp, sp, #\offset + S_SP msr spsr_cxsf, r1 @ save in spsr_svc + + @ We must avoid clrex due to Cortex-A15 erratum #830321 + strex r1, r2, [sp] @ clear the exclusive monitor + .if \fast ldmdb sp, {r1 - r12} @ get calling r1 - r12 .else
arch/arm/mach-exynos/mcpm-exynos.c +0 -1
@@ -39,7 +39,6 @@"mcr p15, 0, r0, c1, c0, 0 @ set SCTLR\n\t" \"isb\n\t" \ "bl v7_flush_dcache_"__stringify(level)"\n\t" \ -"clrex\n\t" \"mrc p15, 0, r0, c1, c0, 1 @ get ACTLR\n\t" \"bic r0, r0, #(1 << 6) @ disable local coherency\n\t" \/* Dummy Load of a device register to avoid Erratum 799270 */ \
Greg Kroah-Hartman
maintainerPATCH 179/357 ARM: dts: imx53-qsrb: Fix suspend/resume
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 090727b880ff3c56e333f267cc24ab076f3bc096 upstream.
The following error is seen after a suspend/resume cycle on a mx53qsb with a MC34708 PMIC:
root@freescale /$ echo mem > /sys/power/state
[ 32.630592] PM: Syncing filesystems ... done. [ 32.643924] Freezing user space processes ... (elapsed 0.001 seconds) done. [ 32.652384] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 32.679156] PM: suspend of devices complete after 13.113 msecs [ 32.685128] PM: suspend devices took 0.030 seconds [ 32.696109] PM: late suspend of devices complete after 6.133 msecs [ 33.313032] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 33.322009] PM: noirq suspend of devices complete after 619.667 msecs [ 33.328544] Disabling non-boot CPUs ... [ 33.335031] PM: noirq resume of devices complete after 2.352 msecs [ 33.842940] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 33.976095] [sched_delayed] sched: RT throttling activated [ 33.984804] PM: early resume of devices complete after 642.642 msecs [ 34.352954] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 34.862910] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 34.996595] PM: resume of devices complete after 1005.367 msecs [ 35.372925] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 35.882911] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 35.955707] PM: resume devices took 1.970 seconds [ 35.960445] Restarting tasks ... done. [ 35.993386] fec 63fec000.ethernet eth0: Link is Down [ 36.392980] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 36.902908] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 36.953036] ata1: SATA link down (SStatus 0 SControl 300) [ 37.412922] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 37.922906] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 37.993379] fec 63fec000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx [ 38.432938] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 38.942920] mc13xxx 0-0008: Failed to read IRQ status: -110 [ 39.452933] mc13xxx 0-0008: Failed to read IRQ status: -110
(flood of this error message continues forever)
Commit 5169df8be0a432ee ("ARM: dts: i.MX53: add support for MCIMX53-START-R") missed to configure the IOMUX for the PMIC IRQ pin.
Configure the PMIC IRQ pin so that the suspend/resume sequence behaves cleanly as expected.
--- arch/arm/boot/dts/imx53-qsrb.dts | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm/boot/dts/imx53-qsrb.dts +8 -0
@@ -28,6 +28,12 @@ MX53_PAD_CSI0_DAT9__I2C1_SCL 0x400001ec >; }; + + pinctrl_pmic: pmicgrp { + fsl,pins = < + MX53_PAD_CSI0_DAT5__GPIO5_23 0x1e4 /* IRQ */ + >; + }; }; };
@@ -38,6 +44,8 @@ pmic: mc34708@8 { compatible = "fsl,mc34708"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_pmic>; reg = <0x08>; interrupt-parent = <&gpio5>; interrupts = <23 0x8>;
Greg Kroah-Hartman
maintainerPATCH 180/357 ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <[email protected]>
commit f7f7a29bf0cf25af23f37e5b5bf1368b85705286 upstream.
To deal with IPs which are specific to dra74x and dra72x, maintain seperate ocp interface lists, while keeping the common list for all common IPs.
Move USB OTG SS4 to dra74x only list since its unavailable in dra72x and is giving an abort during boot. The dra72x only list is empty for now and a placeholder for future hwmod additions which are specific to dra72x.
--- arch/arm/mach-omap2/omap_hwmod.c | 3 +++ arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 22 ++++++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/omap_hwmod.c +3 -0
@@ -3349,6 +3349,9 @@ int __init omap_hwmod_register_links(strif (!ois)return 0 ; +if (ois[0 ] ==NULL )/* Empty list */ +return 0 ; +if (!linkspace) {if (_alloc_linkspace (ois)) {pr_err ("omap_hwmod: could not allocate link space\n" );
arch/arm/mach-omap2/omap_hwmod_7xx_data.c +20 -2
@@ -35,6 +35,7 @@#include "i2c.h" #include "mmc.h" #include "wd_timer.h" +#include "soc.h" /* Base offset for all DRA7XX interrupts external to MPUSS */ #define DRA7XX_IRQ_GIC_START 32
@@ -2705,7 +2706,6 @@ static struct omap_hwmod_ocp_if *dra7xx_ &dra7xx_l4_per3__usb_otg_ss1, &dra7xx_l4_per3__usb_otg_ss2, &dra7xx_l4_per3__usb_otg_ss3, - &dra7xx_l4_per3__usb_otg_ss4, &dra7xx_l3_main_1__vcp1, &dra7xx_l4_per2__vcp1, &dra7xx_l3_main_1__vcp2,
@@ -2714,8 +2714,26 @@ static struct omap_hwmod_ocp_if *dra7xx_ NULL, }; +static struct omap_hwmod_ocp_if *dra74x_hwmod_ocp_ifs[]__initdata = { + &dra7xx_l4_per3__usb_otg_ss4, +NULL , +}; + +static struct omap_hwmod_ocp_if *dra72x_hwmod_ocp_ifs[]__initdata = { +NULL , +}; +int __init dra7xx_hwmod_init (void ) { +int ret; +omap_hwmod_init (); -return omap_hwmod_register_links (dra7xx_hwmod_ocp_ifs); + ret =omap_hwmod_register_links (dra7xx_hwmod_ocp_ifs); + +if (!ret &&soc_is_dra74x ()) +return omap_hwmod_register_links (dra74x_hwmod_ocp_ifs); +else if (!ret &&soc_is_dra72x ()) +return omap_hwmod_register_links (dra72x_hwmod_ocp_ifs); + +return ret; }
Greg Kroah-Hartman
maintainerPATCH 181/357 ARM: dts: DRA7: fix interrupt-cells for GPIO
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
commit e49d519c456f4fb6f4a0473bc04ba30bb805fce5 upstream.
GPIO modules are also interrupt sources. However, they require both the GPIO number and IRQ type to function properly.
By declaring that GPIO uses interrupt-cells=<1>, we essentially do not allow users of the nodes to use the interrupt property appropritely.
With this change, the following now works:
interrupt-parent = <&gpio6>;
interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
--- arch/arm/boot/dts/dra7.dtsi | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm/boot/dts/dra7.dtsi +8 -8
@@ -172,7 +172,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio2: gpio@48055000 {
@@ -183,7 +183,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio3: gpio@48057000 {
@@ -194,7 +194,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio4: gpio@48059000 {
@@ -205,7 +205,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio5: gpio@4805b000 {
@@ -216,7 +216,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio6: gpio@4805d000 {
@@ -227,7 +227,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio7: gpio@48051000 {
@@ -238,7 +238,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; gpio8: gpio@48053000 {
@@ -249,7 +249,7 @@ gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; }; uart1: serial@4806a000 {
Greg Kroah-Hartman
maintainerPATCH 182/357 ARM: edma: Fix configuration parsing for SoCs with multiple eDMA3 CC
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 929a015b1809a30748d487f9d25b16a41434b61a upstream.
The edma_setup_from_hw() should know about the CC number when parsing the CCCFG register - when it reads the register to be precise. The base addresses for CCs stored in an array and we need to provide the correct id to edma_read() in order to read the correct register.
--- arch/arm/common/edma.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm/common/edma.c +5 -4
@@ -1415,14 +1415,14 @@ void edma_clear_event(unsigned channel)EXPORT_SYMBOL (edma_clear_event);static int edma_setup_from_hw (struct device *dev,struct edma_soc_info *pdata, -struct edma *edma_cc) +struct edma *edma_cc,int cc_id) {int i;u32 value, cccfg;s8 (*queue_priority_map)[2 ];/* Decode the eDMA3 configuration from CCCFG register */ - cccfg =edma_read (0 ,EDMA_CCCFG ); + cccfg =edma_read (cc_id,EDMA_CCCFG ); value =GET_NUM_REGN (cccfg); edma_cc->num_region =BIT (value);
@@ -1436,7 +1436,8 @@ static int edma_setup_from_hw(struct dev value =GET_NUM_EVQUE (cccfg); edma_cc->num_tc = value +1 ; -dev_dbg (dev,"eDMA3 HW configuration (cccfg: 0x%08x):\n" , cccfg); +dev_dbg (dev,"eDMA3 CC%d HW configuration (cccfg: 0x%08x):\n" , cc_id, + cccfg);dev_dbg (dev,"num_region: %u\n" , edma_cc->num_region);dev_dbg (dev,"num_channel: %u\n" , edma_cc->num_channels);dev_dbg (dev,"num_slot: %u\n" , edma_cc->num_slots);
@@ -1655,7 +1656,7 @@ static int edma_probe(struct platform_dereturn -ENOMEM ;/* Get eDMA3 configuration from IP */ - ret =edma_setup_from_hw (dev, info[j], edma_cc[j]); + ret =edma_setup_from_hw (dev, info[j], edma_cc[j], j);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 183/357 ARM: dts: dra7-evm: Fix spi1 mux documentation
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
commit 68e4d9e58dbae2fb178e8b74806f521adb16f0d3 upstream.
While auditing the various pin ctrl configurations using the following command:
grep PIN_ arch/arm/boot/dts/dra7-evm.dts|(while read line; do
v=`echo "$line" | sed -e "s/\s\s*/|/g" | cut -d '|' -f1 | cut -d 'x' -f2|tr [a-z] [A-Z]`; HEX=`echo "obase=16;ibase=16;4A003400+$v"| bc`; echo "$HEX ===> $line";
done)
against DRA75x/74x NDA TRM revision S(SPRUHI2S August 2014), documentation errors were found for spi1 pinctrl. Fix the same.
--- arch/arm/boot/dts/dra7-evm.dts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm/boot/dts/dra7-evm.dts +7 -7
@@ -50,13 +50,13 @@ mcspi1_pins: pinmux_mcspi1_pins { pinctrl-single,pins = < - 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi2_clk */ - 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi2_d1 */ - 0x3ac (PIN_INPUT | MUX_MODE0) /* spi2_d0 */ - 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs0 */ - 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs1 */ - 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs2 */ - 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs3 */ + 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi1_sclk */ + 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi1_d1 */ + 0x3ac (PIN_INPUT | MUX_MODE0) /* spi1_d0 */ + 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs0 */ + 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs1 */ + 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs2.hdmi1_hpd */ + 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs3.hdmi1_cec */ >; };
Greg Kroah-Hartman
maintainerPATCH 184/357 ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit a040803a9d6b8c1876d3487a5cb69602ebcbb82c upstream.
Since commit 1dbfa187dad ("ARM: irq migration: force migration off CPU going down") the ARM interrupt migration code on cpu offline calls irqchip.irq_set_affinity() with the argument force=true. At the point of this change the argument had no effect because it was not used by any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu affinity of interrupts") which made the force argument useful to route interrupts to not yet online cpus without checking the target cpu against the cpu online mask. The following commit ffde1de64012 ("irqchip: gic: Support forced affinity setting") implemented this for the GIC interrupt controller.
As a consequence the ARM cpu offline irq migration fails if CPU0 is offlined, because CPU0 is still set in the affinity mask and the validataion against cpu online mask is skipped to the force argument being true. The following first_cpu(mask) selection always selects CPU0 as the target.
Solve the issue by calling irq_set_affinity() with force=false from the CPU offline irq migration code so the GIC driver validates the affinity mask against CPU online mask and therefore removes CPU0 from the possible target candidates.
Tested on TC2 hotpluging CPU0 in and out. Without this patch the system locks up as the IRQs are not migrated away from CPU0.
--- arch/arm/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/irq.c +1 -1
@@ -175,7 +175,7 @@ static bool migrate_one_irq(struct irq_d c =irq_data_get_irq_chip (d);if (!c->irq_set_affinity)pr_debug ("IRQ%u: unable to set affinity\n" , d->irq); -else if (c->irq_set_affinity (d, affinity, true) ==IRQ_SET_MASK_OK && ret) +else if (c->irq_set_affinity (d, affinity, false) ==IRQ_SET_MASK_OK && ret)cpumask_copy (d->affinity, affinity);return ret;
Greg Kroah-Hartman
maintainerPATCH 185/357 ARM: 8148/1: flush TLS and thumbee register state during exec
In reply to Greg Kroah-Hartman3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit fbfb872f5f417cea48760c535e0ff027c88b507a upstream.
The TPIDRURO and TPIDRURW registers need to be flushed during exec; otherwise TLS information is potentially leaked. TPIDRURO in particular needs careful treatment. Since flush_thread basically needs the same code used to set the TLS in arm_syscall, pull that into a common set_tls helper in tls.h and use it in both places.
Similarly, TEEHBR needs to be cleared during exec as well. Clearing its save slot in thread_info isn't right as there is no guarantee that a thread switch will occur before the new program runs. Just setting the register directly is sufficient.
--- arch/arm/include/asm/tls.h | 62 +++++++++++++++++++++++++++++++++++++++++++++ arch/arm/kernel/process.c | 2 + arch/arm/kernel/thumbee.c | 2 - arch/arm/kernel/traps.c | 17 ------------ 4 files changed, 66 insertions(+), 17 deletions(-)
arch/arm/include/asm/tls.h +62 -0
@@ -1,6 +1,9 @@#ifndef __ASMARM_TLS_H#define __ASMARM_TLS_H +#include <linux/compiler.h> +#include <asm/thread_info.h> +#ifdef __ASSEMBLY__#include <asm/asm-offsets.h> .macro switch_tls_none, base, tp, tpuser, tmp1, tmp2
@@ -50,6 +53,47 @@#endif #ifndef __ASSEMBLY__ + +static inline void set_tls (unsigned long val) +{ +struct thread_info *thread; + + thread =current_thread_info (); + + thread->tp_value[0 ] = val; + +/* +* This code runs with preemption enabled and therefore must +* be reentrant with respect to switch_tls. +* +* We need to ensure ordering between the shadow state and the +* hardware state, so that we don't corrupt the hardware state +* with a stale shadow state during context switch. +* +* If we're preempted here, switch_tls will load TPIDRURO from +* thread_info upon resuming execution and the following mcr +* is merely redundant. +*/ +barrier (); + +if (!tls_emu) { +if (has_tls_reg) { + asm("mcr p15, 0, %0, c13, c0, 3" + : :"r" (val)); + }else { +/* +* User space must never try to access this +* directly. Expect your app to break +* eventually if you do so. The user helper +* at 0xffff0fe0 must be used instead. (see +* entry-armv.S for details) +*/ + *((unsigned int *)0xffff0ff0 ) = val; + } + + } +} +static inline unsigned long get_tpuser (void ) {unsigned long reg =0 ;
@@ -59,5 +103,23 @@ static inline unsigned long get_tpuser(vreturn reg; } + +static inline void set_tpuser (unsigned long val) +{ +/* Since TPIDRURW is fully context-switched (unlike TPIDRURO), +* we need not update thread_info. +*/ +if (has_tls_reg && !tls_emu) { + asm("mcr p15, 0, %0, c13, c0, 2" + : :"r" (val)); + } +} + +static inline void flush_tls (void ) +{ +set_tls (0 ); +set_tpuser (0 ); +} +#endif #endif /* __ASMARM_TLS_H */
arch/arm/kernel/process.c +2 -0
@@ -334,6 +334,8 @@ void flush_thread(void)memset (&tsk->thread.debug,0 ,sizeof (struct debug_info ));memset (&thread->fpstate,0 ,sizeof (union fp_state )); +flush_tls (); +thread_notify (THREAD_NOTIFY_FLUSH , thread); }
arch/arm/kernel/thumbee.c +1 -1
@@ -45,7 +45,7 @@ static int thumbee_notifier(struct notifswitch (cmd) {case THREAD_NOTIFY_FLUSH : - thread->thumbee_state =0 ; +teehbr_write (0 );break ;case THREAD_NOTIFY_SWITCH :current_thread_info ()->thumbee_state =teehbr_read ();
arch/arm/kernel/traps.c +1 -16
@@ -579,7 +579,6 @@ do_cache_op(unsigned long start, unsigne#define NR (x) ((__ARM_NR_##x) - __ARM_NR_BASE) asmlinkage int arm_syscall(int no, struct pt_regs *regs) { -struct thread_info *thread =current_thread_info ();siginfo_t info;if ((no >>16 ) != (__ARM_NR_BASE>>16 ))
@@ -630,21 +629,7 @@ asmlinkage int arm_syscall(int no, strucreturn regs->ARM_r0;case NR (set_tls): - thread->tp_value[0 ] = regs->ARM_r0; -if (tls_emu) -return 0 ; -if (has_tls_reg) { - asm ("mcr p15, 0, %0, c13, c0, 3" - : :"r" (regs->ARM_r0)); - }else { -/* -* User space must never try to access this directly. -* Expect your app to break eventually if you do so. -* The user helper at 0xffff0fe0 must be used instead. -* (see entry-armv.S for details) -*/ - *((unsigned int *)0xffff0ff0 ) = regs->ARM_r0; - } +set_tls (regs->ARM_r0);return 0 ;#ifdef CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG